555com Privacy Policy – LGPD and Data Protection

This Privacy Policy describes how 555com collects, uses, stores, shares, and protects the personal data of users on the platform available at 555com.world. It was drafted in accordance with the General Personal Data Protection Law (LGPD — Law No. 13.709/2018) and other applicable data processing regulations in Brazil.

On the 555com, we believe privacy is not a bureaucratic formality — it is a genuine commitment to every player. You have the right to know exactly what we do with your information, and we have the obligation to explain it clearly, without unnecessary legal jargon.

By creating your account and using the services of 555com, you confirm that you have read and understood this Privacy Policy. If you have any questions, please contact our support team or our Data Protection Officer (DPO) before proceeding.

1Data Controller

The controller responsible for processing your personal data on the platform 555com is the operating company of the website 555com.world, identified as the data controller as defined under the LGPD.

For all privacy-related questions and personal data processing inquiries, the primary point of contact is our Data Protection Officer's email, listed in Section 13 of this Policy. General support via live chat can also guide you on how to exercise your rights.

2Data We Collect

The 555com collects different categories of personal data depending on how you interact with the platform:

Registration and identification data:

• Full name, date of birth, and CPF;
• Email address and mobile phone number;
• Full residential address (street, number, neighborhood, city, state, ZIP code);
• Photo ID documents (RG, CNH, or passport) and proof of address, when requested for KYC verification.

Financial and transaction data:

• Pix key, bank details, and credit/debit card information used for deposits and withdrawals;
• Full history of deposits, withdrawals, and transactions made on the platform;
• Amounts wagered, winnings, and losses across casino games and Sports Betting.

Usage and behavioral data:

• IP address, device type, operating system, and browser used;
• Pages visited, session duration, games accessed, and features used;
• Betting history, game preferences, and behavioral patterns on the platform;
• Access logs, login and logout times, and approximate geographic location.

Communication data:

• Content of conversations with support via live chat and email;
• Communication preferences and notification history.

The 555com does not collect sensitive personal data such as racial origin, religious beliefs, genetic data, or health information, except where strictly necessary to comply with legal responsible gambling obligations.

3Purpose of Processing

Each piece of data collected by the 555com has a specific and legitimate purpose. The table below summarizes the main purposes:

The 555com does not use your data for purposes incompatible with those described above without prior notice and, where applicable, obtaining fresh consent.

4Legal Basis for Processing (LGPD)

All data processing carried out by the 555com relies on at least one of the legal bases set out in Article 7 of the LGPD:

• Contract performance (Art. 7, V): the processing required to deliver the services you signed up for when creating your account — handling Pix deposits, recording bets, crediting winnings, and processing withdrawals;
• Compliance with a legal or regulatory obligation (Art. 7, II): data collected to meet customer identification (KYC), anti-money laundering (AML/CFT), and other obligations required under Brazilian law;
• Legitimate interest (Art. 7, IX): security data, access logs, and behavioral information processed to protect platform integrity, detect fraud, and keep the player's account secure — always in a manner consistent with the rights and reasonable expectations of the data subject;
• Consent (Art. 7, I): sending marketing communications, personalizing content, and using non-essential cookies — you may withdraw your consent at any time without affecting your access to core services.

5Data Sharing with Third Parties

The 555com never sells your personal data to third parties. Sharing only occurs in the situations described below, with appropriate safeguards:

• Payment processors: to process deposits and withdrawals via Pix, credit/debit card, boleto bancário, PicPay, and Mercado Pago. These partners receive only the minimum data required to complete each transaction and are contractually bound to protect it;
• Game providers: providers such as Evolution Gaming, Pragmatic Play, and PG Soft receive minimal technical data (session identifier, amount wagered) to operate the games. They do not receive the player's full identity data;
• Security and anti-fraud providers: fraud detection systems that analyze behavioral patterns to protect the platform and its players. They operate as sub-processors under contracts that include appropriate data protection clauses;
• Public authorities: when required by law, court order, or applicable regulation — for example, reporting obligations to COAF (Financial Activities Control Council) in cases of suspected money laundering;
• Auditors and certification laboratories: for technical compliance verification of games (RNG certification) and financial audits. They receive aggregated and anonymized data whenever possible.

All third parties that receive personal data from players of 555com are subject to contracts with specific data protection clauses compatible with the LGPD.

6Cookies and Tracking Technologies

The 555com uses cookies and similar technologies to ensure the platform works correctly and to improve your experience. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — maintaining login sessions, language preferences, and the betting slip. These cannot be disabled without compromising the services;
• Analytical cookies: collect aggregated data on how players use the platform (most visited pages, session duration, traffic sources) so we can continuously improve the experience. We use analytics tools in an anonymized manner whenever possible;
• Preference cookies: remember your display settings, game preferences, and other customizations so you don't have to reconfigure everything each time you log in;
• Marketing cookies: used only with your consent, to display relevant promotions within the platform. You may decline or revoke consent through the cookie banner or your account settings.

You can manage your cookie preferences at any time through your browser settings or the privacy dashboard available in your account on the 555com. Declining non-essential cookies does not affect your ability to play, deposit, or withdraw.

7Data Security

The 555com adopts a robust set of technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or destruction:

• 256-bit SSL Encryption: all connections between your device and the servers of 555com are encrypted using the 256-bit TLS/SSL protocol — the same standard used by Brazilian banks;
• Data encryption at rest: sensitive data stored on our servers, including financial information and identity documents, is encrypted at rest;
• Two-factor authentication (2FA): available to all players in the account settings. We strongly recommend enabling 2FA as an additional layer of protection;
• Real-time monitoring: automated systems monitor access and transactions 24 hours a day, identifying and blocking suspicious patterns before they cause harm;
• Internal access control: the employees of 555com access players' personal data only when necessary for their specific functions, based on the principle of least privilege. All access is recorded in logs;
• Security testing: the infrastructure undergoes regular penetration testing (pentests) and vulnerability assessments carried out by external specialists.

In the event of a security incident that may affect your data, the 555com will follow the notification procedures set out in the LGPD, informing the ANPD (National Data Protection Authority) and the affected data subjects within the legally required timeframes.

8Data Retention & Deletion

The 555com retains your personal data only for as long as strictly necessary to fulfill the purposes described in this Policy, in compliance with applicable legal retention periods:

• Registration and identification data: retained while the account is active and for up to 5 years after closure, in accordance with compliance obligations and anti-money laundering requirements;
• Financial and transaction records: retained for 5 years after each transaction, in compliance with Brazilian Central Bank regulations and tax legislation;
• Security logs: retained for 6 months for incident investigation and platform security purposes;
• Support communication data: retained for 2 years for dispute resolution and continuous improvement of customer support;
• Marketing data and preferences: retained for as long as consent remains active. Once consent is withdrawn, data is deleted within 30 days.

Once applicable retention periods expire, data is securely deleted or irreversibly anonymized. You may request early deletion of your data by exercising the right described in Section 9, noting that data required to fulfill a legal obligation cannot be deleted before the applicable regulatory deadline.

9Your Rights as a Data Subject

The LGPD grants you, as a personal data subject, the following rights regarding the processing carried out by 555com:

• Confirmation and access (Art. 18, I and II): confirm whether we process your data and access a copy of the information we hold about you;
• Correction (Art. 18, III): request the correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion (Art. 18, IV): request that unnecessary data or data processed in violation of the LGPD be anonymized, blocked, or deleted;
• Portability (Art. 18, V): receive your data in a structured, machine-readable format and transfer it to another controller;
• Deletion upon consent withdrawal (Art. 18, VI): request the deletion of data processed solely on the basis of your consent, following its withdrawal;
• Data sharing information (Art. 18, VII): know which public and private entities we share your data with;
• Withdrawal of Consent (Art. 18, IX): withdraw previously given consent at any time, without affecting any processing carried out before the withdrawal;
• Objection (Art. 18, §2): object to processing carried out on the basis of legitimate interest when it is incompatible with your rights.

To exercise any of these rights, please contact our DPO at privacidade@555com.world or through the platform's live chat. We will respond within 15 business days, as required by the LGPD.

10Data of Minors

The services of 555com are intended exclusively for individuals aged 18 and over. The platform does not intentionally collect personal data from minors.

If we detect that an account was created by a minor, it will be immediately closed, all data will be deleted, and any real-money balance deposited will be refunded to the holder of the payment method used. The identity verification carried out during registration and withdrawal, among other purposes, confirms that the player is of legal age.

If you become aware that a minor has created an account on 555com, please contact our support team or DPO immediately so we can act promptly.

11International Data Transfers

In some situations, the personal data of players at 555com may be processed by systems or suppliers located outside Brazil — for example, servers belonging to international game providers such as Evolution Gaming.

The 555com ensures that any international transfer of personal data takes place with appropriate safeguards, which may include:

• Standard data protection contractual clauses approved by the competent authorities;
• Transfer only to countries with an adequate level of protection recognized by the ANPD;
• Specific consent from the data subject, where no other safeguard applies.

Upon request to the DPO, you may obtain information about the countries to which your data may be transferred and the safeguards applied in each case.

12Changes to This Privacy Policy

The 555com may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or the services offered. When that happens:

• The "Last updated" date at the top of this page will be revised;
• Significant changes will be communicated by email to all registered players at least 7 days in advance;
• If changes require new consent, you will be asked to confirm your acceptance before continuing to use the platform;
• Continued use of the 555com after the new terms take effect constitutes acceptance of the updates.

Previous versions of this Policy may be requested from the DPO by email.

13Data Protection Officer (DPO)

In accordance with Art. 41 of the LGPD, the 555com has appointed a Data Protection Officer (DPO) as the communication channel between the platform, data subjects, and the National Data Protection Authority (ANPD).

To exercise your rights as a data subject, ask questions about this Policy, request data deletion, or report any privacy concern, please contact the DPO at 555com:

• DPO Email: privacidade@555com.world
• General support: suporte@555com.world or via live chat on the platform (24/7)
• Response time: up to 15 business days from receipt of the request

If you believe your rights have not been properly addressed, you may also file a complaint directly with the ANPD (National Data Protection Authority) through the authority's official channel.