Pop678 Privacy Policy — Data Protection & LGPD

1Who We Are — Data Controller

Pop678 is the controller of the personal data collected and processed under this Policy. The platform operates exclusively for the Brazilian market, with support in Portuguese and payments in BRL (R$) via domestic methods such as Pix, boleto bancário, credit and debit cards, PicPay, and Mercado Pago.

For questions related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, please contact our Data Protection Officer (DPO) by email at privacidade@pop678.best.

Pop678 is committed to transparency in data processing from the very start of its relationship with users. This Policy is the central document of that commitment and should be read alongside the Terms and Conditions available at /terms-conditions.

2Personal Data We Collect

Pop678 collects the following categories of personal data, always limited to what is necessary for the purposes described in this Policy:

Registration data:

• Full name;
• CPF (Individual Taxpayer Registration with the Federal Revenue Service);
• Date of birth;
• Full residential address (street, number, unit, neighborhood, city, state, ZIP code);
• Email address;
• Mobile phone number;
• Photo of a government-issued ID (for KYC verification).

Financial data:

• Pix key provided for withdrawals;
• Last four digits of the credit or debit card (for card deposits);
• Deposit and withdrawal history (amounts, dates, methods used).

Platform usage data:

• Betting and game history (markets, amounts, results);
• IP address and approximate geolocation data;
• Device type, operating system, and browser used;
• Access logs (date, time, and duration of sessions);
• Game preferences and browsing behavior on the platform.

Communication data:

• History of conversations with pop678 support via chat and email;
• Marketing communication preferences.

3How We Collect Your Data

Pop678 collects personal data in the following ways:

• Directly from you: at the time of registration, when you fill out identity verification forms, when contacting support, when setting up payment methods (Pix, card), and when configuring account preferences;
• Automatically during use: through cookies, server logs, and similar technologies that record your interactions with the pop678 platform — bets placed, games accessed, and session duration;
• From authorized third parties: from payment processors (to confirm transactions via Pix, boleto, or card) and from identity verification bureaus for the KYC process;
• From public sources: when required for eligibility verification or compliance with legal obligations, pop678 may query public databases such as the Federal Revenue Service's Individual Taxpayer Registry (CPF).

Pop678 never purchases third-party data lists for unsolicited contact. All data processed by the platform comes directly from the channels described above.

4Purpose of Data Processing

Pop678 uses your personal data exclusively for the following purposes:

• Account operation: create and maintain your account, authenticate your access, process bets, and manage your balance;
• Payment processing: process deposits via Pix, boleto bancário, credit and debit card, PicPay, and Mercado Pago; process withdrawals to your Nubank, Itaú, Bradesco, Banco do Brasil, or any bank with a Pix key;
• Identity verification (KYC): confirm that you are 18 or older, that your CPF is valid, and that the information provided corresponds to a real person — as required by sector regulations;
• Fraud and money laundering prevention: monitor transactions to identify suspicious activity and meet mandatory reporting obligations to the relevant Brazilian authorities;
• Support interactions: answer your questions and requests via chat and email with full context of your account history;
• Account communications: send transactional notifications about deposits, withdrawals, identity verification, security changes, and other information essential to using the platform;
• Marketing communications: send promotions, bonuses, and pop678 news, exclusively if you have given explicit consent and for as long as that consent has not been revoked;
• Platform improvement: analyze aggregate (non-individualized) usage patterns to improve the experience, fix technical issues, and develop new features;
• Compliance with legal obligations: maintain records required by law, respond to court orders, and cooperate with regulatory authorities.

5Legal Basis for Processing

All personal data processing carried out by pop678 has a specific legal basis in accordance with Art. 7 of the LGPD. The table below summarizes the main processing activities and their respective legal bases:

In cases where processing is based on pop678's legitimate interest, we ensure that this interest does not override your fundamental rights and freedoms as a data subject.

6Data Sharing

Pop678 never sells your personal data to third parties. Sharing occurs only in the following situations, all of which are necessary for the platform to function:

• Payment processors: companies responsible for processing Pix, boleto bancário, and credit and debit card transactions. Data sharing is limited to what is necessary for the specific transaction and is governed by confidentiality agreements and LGPD compliance obligations;
• Identity verification providers: specialized KYC companies that validate your documents during the account verification process. These providers do not retain your data after verification is complete;
• Technology providers: hosting services, cloud infrastructure, and technical analytics that support pop678's operations. These providers process data as sub-processors and have no authority to use it for their own purposes;
• Game providers: to operate Live Casino and slots, minimal session data is shared with game providers (such as Pragmatic Play) to process rounds and results. Personally identifiable information is not shared with these providers;
• Competent authorities: when required by court order, instruction from a Brazilian regulatory authority, or a legal obligation related to the prevention of money laundering and terrorism financing. pop678 will notify the user of such requests to the extent permitted by law.

7Data Storage and Security

Pop678 user data is stored on servers located in Brazil or in countries with a level of data protection equivalent to that required by the LGPD. pop678 applies the following technical and organizational measures to protect your data:

• Encryption in transit: all communication between the user's device and pop678 servers is encrypted with TLS 1.3 / 256-bit SSL;
• Encryption at rest: sensitive data stored in pop678's databases is encrypted with AES-256;
• Access control: only pop678 employees with a specific access need to perform their duties are permitted to view users' personal data, with mandatory multi-factor authentication;
• Continuous monitoring: automated systems monitor unauthorized access attempts, behavioral anomalies, and potential security breaches in real time;
• Regular audits: pop678 conducts regular security audits, including penetration testing and compliance reviews, to identify and address vulnerabilities;
• Secure backups: data backups are maintained in geographically separate locations, with restricted and encrypted access.

Despite all these measures, no system is 100% immune to risk. In the event of a security incident that compromises your data, pop678 will follow the procedures described in clause 14 of this Policy.

8Data Retention

Pop678 retains your personal data for as long as necessary to fulfill the purposes described in this Policy, in accordance with the following retention periods:

• Registration data and active account: retained for as long as the account is active and for the period required after closure to meet legal obligations;
• Financial transaction records (Pix, boleto, card): retained for a minimum of 5 years after the transaction, in accordance with Brazilian tax legislation and anti-money laundering requirements;
• Identity verification documents (KYC): retained for a minimum of 5 years after account closure;
• Betting and gaming history: retained for a minimum of 3 years, for dispute resolution and audit purposes;
• Access and security logs: retained for a minimum of 6 months in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014);
• Support communications: retained for 2 years after the case is closed;
• Data processed on the basis of consent (e.g., marketing): retained until consent is withdrawn or the account is closed, whichever comes first.

Once the applicable retention period expires, data is securely deleted or anonymized so that the individual can no longer be identified.

9Cookies and Tracking Technologies

Pop678 uses cookies and similar technologies to improve the user experience, ensure the platform runs correctly, and analyze usage patterns. The types of cookies used are:

• Essential cookies: required for the platform's core functionality — session authentication, bet slip management, and language preferences. These cannot be disabled without affecting how pop678 operates;
• Performance cookies: collect information about how users interact with the platform (most-visited pages, load times, technical errors) in aggregated, anonymous form, for technical improvement purposes;
• Functionality cookies: remember your personalized preferences on pop678, such as odds display type and betting settings;
• Analytics cookies: used to understand platform usage behavior and improve the experience. Data is processed in aggregate form and does not allow individual identification.

You can configure your browser to block or alert you about cookies. However, disabling essential cookies may prevent pop678 from functioning properly, including account access and bet processing.

10International Data Transfer

Pop678 prioritizes storing and processing data in Brazil. Where the use of global technology providers (cloud infrastructure, security tools) requires transferring data outside Brazilian territory, pop678 ensures that:

• The transfer occurs only to countries or organizations with an adequate level of data protection, as recognized by the National Data Protection Authority (ANPD);
• When the recipient country lacks formal adequacy recognition, the transfer is covered by specific contractual clauses that ensure a level of protection equivalent to that required by the LGPD;
• The volume of data transferred internationally is the minimum necessary for the specific technical purpose;
• Detailed financial data and KYC documents are processed preferentially on infrastructure located in Brazil.

To learn more about specific international data transfers carried out by pop678, please contact our DPO at privacidade@pop678.best.

11Marketing Communications

Pop678 may send marketing communications — such as bonus promotions, updates on Sports Betting for the Brasileirão, Libertadores, Copa do Brasil, and casino offers — only to users who have given explicit consent to receive this type of communication.

Consent for marketing communications is collected separately and clearly during registration, and is not bundled with other consents required to use the platform. You can give or withdraw this consent at any time:

• Via the account dashboard: go to "Settings" and turn off the marketing communications options;
• By email: send a request to privacidade@pop678.best with the subject line "Unsubscribe from marketing communications";
• Via the unsubscribe link: every marketing email from pop678 includes an unsubscribe link that processes the request immediately.

After consent is withdrawn, pop678 will stop sending marketing communications within 5 business days. Essential transactional communications (deposit confirmations, withdrawals, identity verification results) will continue to be sent regardless of your marketing preferences.

Pop678 does not send marketing communications to users who are on a voluntary break, self-exclusion, or who have requested account closure.

12Minors

Pop678 is a platform exclusively for users aged 18 and over. The platform does not knowingly collect personal data from anyone under 18. The identity verification process (KYC) includes date-of-birth verification to ensure only adults can access the platform.

If pop678 identifies that an account was created by a user under 18, the account will be immediately closed, the data will be deleted or anonymized in accordance with the minimum legal retention period, and any remaining balance will be handled in line with the account closure policy and communication with the legal guardian.

13How to Exercise Your Rights as a Data Subject

To exercise any of the rights guaranteed by the LGPD (listed in the previous section of this page), follow the procedure below:

• Step 1: Send an email to privacidade@pop678.best with the subject line corresponding to the right you wish to exercise (e.g., "Data Access Request" or "Data Deletion Request");
• Step 2: In the body of the email, provide your CPF and the email address registered to your pop678 account, the right you wish to exercise, and a brief description of your request;
• Step 3: To confirm the requester's identity and protect your data against fraudulent requests, pop678 may ask for additional verification;
• Step 4: pop678 will respond to your request within 15 business days, informing you of the outcome or the reasons why the request could not be fulfilled in full.

When a data deletion request is submitted, pop678 will delete or anonymize all data not subject to a mandatory legal retention period. Data that must be kept to meet legal requirements (such as financial transaction records) will be retained only for as long as necessary and with restricted access.

If you feel that pop678's response was unsatisfactory, you have the right to file a complaint with the National Data Protection Authority (ANPD), pursuant to Art. 18, § 1 of the LGPD.

14Security Incidents & Data Breaches

In the event of a security incident resulting in unauthorized access, loss, alteration, or improper disclosure of pop678 users' personal data, the platform will take the following steps:

• Immediate containment: identify and block the source of the incident, isolate affected systems, and initiate recovery procedures;
• Impact assessment: determine which data was compromised, how many individuals were affected, and the level of risk posed by the incident;
• ANPD Notification: report the incident to the National Data Protection Authority within the regulatory timeframe, as required by Art. 48 of the LGPD;
• Notification to data subjects: in high-risk cases affecting the rights and freedoms of data subjects, pop678 will notify affected users by email, describing: the nature of the incident, the data involved, the measures taken to address the issue, and recommendations to help users protect themselves from potential consequences;
• Investigation and improvement: conduct a full investigation to identify the root cause and implement improvements to prevent similar incidents.

To report a potential security incident or vulnerability identified on the pop678 platform, please contact seguranca@pop678.best. Good-faith reports are always reviewed as a priority.

15Changes to this Privacy Policy

Pop678 may update this Privacy Policy periodically to reflect changes in Brazilian legislation, the platform's data processing practices, or the launch of new products and features.

Material changes — those that significantly affect your rights or how your data is handled — will be communicated with a minimum advance notice of 15 days before they take effect, via email and through a notification in your pop678 account dashboard.

Non-material changes (such as wording corrections, section reorganization, or clarifications with no practical impact) may take effect immediately, with the update date recorded at the top of this document.

The version history of this Policy is available upon request to pop678's DPO at privacidade@pop678.best. We recommend reviewing this Policy periodically to stay informed about how your data is protected.

16Contact & Data Protection Officer (DPO)

For any questions, requests, or complaints regarding pop678's processing of your personal data, you can reach us through the channels below:

• Data Protection Officer (DPO): privacidade@pop678.best
• General support (account and platform inquiries): suporte@pop678.best
• Live chat: available 24 hours a day, 7 days a week, directly on the pop678 platform

Pop678's DPO is responsible for ensuring LGPD compliance across all data processing activities on the platform and for serving as the point of contact between pop678, data subjects, and the National Data Protection Authority (ANPD).

This Privacy Policy is governed by Brazilian law, in particular the LGPD (Law No. 13,709/2018) and the Internet Civil Framework (Law No. 12,965/2014). In the event of any dispute relating to data processing by pop678, the courts of the District of São Paulo, State of São Paulo, shall have exclusive jurisdiction.