Privacy Policy Q3Bet – Data Protection in Brazil

1. Data Controller

The controller of the personal data processed under this Privacy Policy is Q3Bet, a sports betting and online casino platform operated for the Brazilian market, accessible at q3bet.best. For LGPD purposes, the controller is the entity that makes decisions regarding the purpose and means of processing users' personal data.

Q3Bet's Data Protection Officer (DPO) can be reached at privacidade@q3bet.best. The DPO is the preferred point of contact for rights requests, data-related complaints, and questions about this policy.

2. Data We Collect

Q3Bet collects personal data at various points during your interaction with the platform. Collection follows the data minimization principle — we only ask for what we genuinely need to deliver a quality, secure service.

2.1 Data Provided at Registration

• Full name and date of birth.
• CPF (Cadastro de Pessoa Física) — required for identity verification and regulatory compliance.
• Email address — used for account communications and security notifications.
• Mobile number — for two-factor authentication and urgent account communications.
• Full residential address including ZIP code — required for KYC (Know Your Customer) verification.
• Identity documents (RG, CNH, or passport) — collected during the verification process before the first withdrawal.

2.2 Usage and Browsing Data

• IP address and approximate geolocation information.
• Device type, operating system, and browser used.
• Pages visited, time spent on the platform, and interactions with its features.
• Betting history, casino gameplay, and feature usage.
• Gaming preferences and account settings.

2.3 Financial Data

• History of deposits and withdrawals made via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, or TED.
• Pix key and banking details provided for withdrawal processing — stored with encryption.
• Credit and debit card data is tokenized by the payment processor and is never stored in plain text on Q3Bet's servers.

2.4 Communication Data

All communications with Q3Bet support — via live chat or email — are recorded for quality assurance, dispute resolution, and regulatory compliance purposes. You are notified of this recording at the start of each support interaction.

3. Purpose and Legal Basis for Processing

Every instance of data processing carried out by Q3Bet has a specific purpose and a corresponding legal basis under the LGPD. The table below summarizes the main purposes for which your data is used.

Q3Bet does not use your data for purposes that are incompatible with those listed above. If we need to use data for a new or different purpose, we will notify you in advance and, where required, request fresh consent.

4. Data Sharing

Q3Bet does not sell personal data. Sharing with third parties occurs exclusively in the situations listed below, all with a defined legal basis under the LGPD and with contractual data protection controls in place.

4.1 Service Partners (Operators)

We share data with companies that provide essential services for Q3Bet's operation, always limited to the minimum extent necessary to deliver those services:

• Payment processors: to handle deposits and withdrawals via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED through banks such as Nubank, Itaú, Bradesco, and Banco do Brasil.
• Casino game and slots providers: to enable games to function within the Q3Bet platform — they receive only anonymized session identifiers, with no full personal data.
• IT infrastructure providers: for platform hosting, secure storage, and content delivery.
• Fraud analysis and identity verification (KYC) tools: to meet regulatory anti-money laundering obligations.
• Customer support platforms: used to manage tickets and service history.

All Q3Bet partners are contractually required to handle the personal data they receive with confidentiality and security, and to use it solely for the agreed purposes — with no possibility of secondary use for their own ends.

4.2 Competent Authorities

Q3Bet may share personal data with government, judicial, or regulatory authorities when required by law, court order, or a substantiated request from a competent body. In such cases, sharing is limited to the minimum necessary to fulfill the specific request, and users are informed whenever legally permitted.

5. Data Retention and Deletion

Q3Bet retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by Brazilian law.

5.1 Retention Periods

• Registration and identity data: retained for the lifetime of the account and for up to 5 years after closure, in accordance with anti-money laundering requirements (Law No. 9,613/1998).
• Financial transaction history (deposits and withdrawals): 5 years from the transaction date, in accordance with Brazilian tax and regulatory legislation.
• Support communication records: 2 years after the ticket is closed, for dispute resolution purposes.
• Browsing data and access logs: 6 months, in accordance with the Marco Civil da Internet (Law No. 12,965/2014).
• Consents and communication preferences: for the duration of the consent, until it is withdrawn.

5.2 Data Deletion

Once the applicable retention period expires — or upon a deletion request by the data subject (where no legal retention obligation applies) — data is securely deleted from Q3Bet's systems or irreversibly anonymized. Anonymized data no longer identifies the subject and may be retained for statistical purposes without restriction.

Data deletion requests are processed within up to 15 business days. If there is a legal impediment to immediate deletion, Q3Bet will explain the reason and provide an estimated timeline for permanent deletion.

6. Information Security

Q3Bet applies robust technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, or improper disclosure. Security is not an optional feature — it is central to how we build and operate the platform.

6.1 Technical Measures

• 256-bit SSL encryption across all communications between the browser/app and Q3Bet's servers.
• Encryption at rest for sensitive data stored in the database — including banking details and identity documents.
• Two-factor authentication (2FA) is available to all users and mandatory for internal administrative access.
• Continuous monitoring of suspicious activity with a real-time alert system.
• Regular penetration testing (pentest) and security audits conducted by independent firms.
• Access control based on the principle of least privilege: each Q3Bet team member can only access the data required for their role.

6.2 Incident Response

In the event of a security incident that may affect your personal data, Q3Bet will follow its incident response protocol, which includes: immediate containment, investigation, impact assessment, and notification to the National Data Protection Authority (ANPD) within 72 hours where legally required. Affected users will be individually notified by email as quickly as possible, with clear information about what happened and what steps have been taken.

7. Cookies and Tracking Technologies

Q3Bet uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and — with your consent — analyze usage patterns. Below are the types of cookies we use and what each one does.

7.1 How to Manage Cookies

When you first access Q3Bet, a cookie notice will appear allowing you to accept all cookies or customize your preferences. Necessary cookies cannot be disabled, as they are essential for the platform to function. Optional cookies can be turned on or off at any time in your account's privacy settings or in your browser settings.

Disabling analytics and marketing cookies does not affect your access to Q3Bet's features — you can still place bets on the Brasileirão and Libertadores, play in the casino, and make withdrawals as normal.

8. Your Rights as a Data Subject (LGPD)

The LGPD grants data subjects a set of rights that Q3Bet respects and makes easy to exercise. You do not need a lawyer, power of attorney, or any other formality — simply reach out through the designated channel.

Q3Bet responds to all data rights requests within 15 business days. In cases that require more detailed review — such as requests to port large volumes of data — the deadline may be extended, with prior notice to the data subject. If you are not satisfied with our response, you may file a complaint directly with the National Data Protection Authority (ANPD).

9. Data of Minors

Q3Bet is a sports betting and casino platform intended exclusively for users aged 18 and over. We do not intentionally collect, process, or store personal data from anyone under 18.

The registration process includes date-of-birth verification, and identity verification with an official document is required before the first withdrawal. Accounts where risk analysis or a report suggests possible use by a minor are immediately suspended for review, regardless of any other factor.

If you are the legal guardian of a minor and suspect they have created a Q3Bet account, contact us immediately via support or at suporte@q3bet.best. The account will be suspended and all data deleted upon confirmation. No balance deposited by minors is retained.

10. International Data Transfers

Some of Q3Bet's service partners — such as casino game providers and IT infrastructure vendors — may operate outside Brazil. When this occurs, Q3Bet ensures that data transfers are carried out in compliance with the requirements of Article 33 of the LGPD, through:

• Standard contractual data protection clauses providing protections equivalent to those under the LGPD.
• Transfers only to countries or organizations that offer an adequate level of data protection.
• Data transfer minimization: only anonymized session identifiers are passed when the service does not require full personal data.

Primary storage of Brazilian users' data is carried out on servers located in Brazil or on infrastructure that guarantees an equivalent level of protection, in accordance with ANPD guidelines.

11. Changes to This Privacy Policy

Q3Bet may update this Privacy Policy periodically to reflect changes in legislation, our data practices, or the services we offer. All updates are published on this page with the revision date shown at the top.

For material changes — those that significantly affect your rights as a data subject or the way we process your data — Q3Bet will send a notification to your registered email address at least 7 days before the changes take effect. You will have the option to close your account without penalty if you do not agree with the changes.

We recommend reviewing this policy periodically. The most current version will always be available on this page. To access previous versions, contact the DPO at privacidade@q3bet.best.

12. Contact & Data Protection Officer (DPO)

Q3Bet has appointed a Data Protection Officer (DPO) as required by the LGPD. The DPO is the official point of contact for all matters related to the processing of personal data by Q3Bet.

If, after contacting the DPO, you are not satisfied with Q3Bet's response regarding the handling of your personal data, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), the federal body responsible for overseeing LGPD compliance in Brazil.