Privacy Policy of 555bom – How We Protect Your Data

1. Introduction

This Privacy Policy describes how 555bom — operator of the Sports Betting and online casino platform accessible at 555bom.best — collects, stores, uses, and protects the personal data of its users. It applies to all individuals who create an account, make a deposit, place bets, or use any feature of the platform.

555bom is a platform built specifically for the Brazilian market. This means all of our data processing practices comply with current Brazilian law — in particular the LGPD (General Data Protection Law, Law No. 13.709/2018) and its subsequent regulations issued by the ANPD.

By creating an account on 555bom, you confirm that you have read and understood this Privacy Policy. Continued use of the platform after updates to this policy constitutes acceptance of the new terms. For this reason, we recommend revisiting this page periodically — the date of the last update is always displayed at the top of the document.

This policy should be read together with the Terms and Conditions of 555bom, which contain additional provisions regarding use of the platform, deposits and withdrawals via Pix, and other aspects of the service.

2. Data We Collect

2.1 Data You Provide Directly

When you create an account and use 555bom, you provide us directly with the following categories of personal data:

• Personal identification: full name, date of birth, CPF, RG or driver's license (for identity verification);
• Contact: email address, mobile phone number, and full residential address;
• Financial: banking details for withdrawal processing via Pix (Pix key linked to CPF), and deposit and withdrawal history on the platform;
• Documents: images of identity documents and proof of address submitted during the KYC verification process;
• Account preferences: deposit limits set, communication preferences, and responsible gambling settings.

2.2 Automatically Collected Data

When you access and use the 555bom platform, we automatically collect technical data about your use of the service:

• Device data: device type (mobile, tablet, desktop), operating system, browser version, screen resolution;
• Connection data: IP address, country of origin, internet service provider;
• Usage data: pages visited, games played, session duration, access times, bets placed including amounts and markets;
• Cookies and similar technologies: as described in section 8 of this policy.

2.3 Third-Party Data

In some cases, 555bom may receive data about you from third parties for verification and security purposes:

• Identity verification and fraud prevention services that cross-reference Brazilian public databases to confirm the authenticity of submitted documents;
• Payment processors that notify us of transaction statuses via Pix, boleto, or card;
• Partner game providers that report match and session results for bet settlement and prize calculation.

3. Purpose of Data Processing

555bom uses the data it collects exclusively for the following purposes, each with a defined legal basis under the LGPD:

555bom does not use your personal data for any purpose beyond those listed above. Any new use that becomes necessary will be communicated to you in advance, with the opportunity to object where applicable under the LGPD.

4. Legal Basis for Data Processing (LGPD)

The LGPD requires that all personal data processing have a specific legal basis. 555bom grounds its processing activities in the following bases set out in Art. 7 of Law No. 13,709/2018:

• Contract performance (Art. 7, V): processing is necessary for 555bom to deliver the contracted services — creating your account, processing deposits and withdrawals via Pix and other methods, recording bets, and settling winnings;
• Compliance with a legal or regulatory obligation (Art. 7, II): identity verification, transaction monitoring, and cooperation with relevant authorities are legal obligations to which 555bom is subject in Brazil;
• Legitimate interest (Art. 7, IX): the processing of data for platform security, fraud prevention, responsible gambling, and technical service improvement, provided these interests do not override the fundamental rights of data subjects;
• Consent (Art. 7, I): for sending marketing communications and promotions by email or mobile, which you may withdraw at any time without affecting any other account services.

For sensitive data — should any be collected in the future due to regulatory changes — 555bom will apply the specific legal bases set out in Art. 11 of the LGPD and will notify affected users.

5. Data Sharing

5.1 Who We Share Data With

555bom may share personal data with third parties only in the situations listed below, each with a defined and proportionate purpose:

• Brazilian payment processors: to process transactions via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED transfer. These partners receive only the data strictly necessary to complete the transaction;
• Partner game providers (such as Pragmatic Play, Evolution Gaming, and others): they receive session identifiers and betting data solely to operate games and settle results correctly on the 555bom platform;
• Identity verification services: KYC companies that consult Brazilian public databases to verify document authenticity — they receive the document image and registration data under a confidentiality agreement;
• Competent authorities: Receita Federal, BACEN, the Federal Police, the Public Prosecutor's Office, and other authorities when required by a judicial, administrative, or regulatory order in Brazil. In such cases, sharing is mandatory and does not require user consent;
• External auditors and consultants: who access anonymized or pseudonymized data for financial and security audit purposes, under strict confidentiality and non-disclosure agreements.

5.2 What We Never Do

555bom never:

• Sells, rents, or transfers users' personal data to third parties for commercial purposes;
• Shares user lists with external advertisers;
• Shares betting behavior data with brokers, insurers, banks, or any other financial institutions for credit scoring or profile analysis purposes;
• Allows partner game providers to use your data for any purpose beyond operating games on the 555bom platform.

6. Data Security

6.1 Technical Measures

555bom implements a robust set of technical measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure:

• Encryption at rest: all data stored on 555bom servers is encrypted with AES-256;
• Encryption in transit: all communication between your device and our servers uses TLS 1.3, the most current security protocol available;
• Access controls: only employees with a verified operational need are granted access to users' personal data, with access tracking and periodic permission reviews;
• Continuous monitoring: automated systems monitor unusual access attempts, brute-force attacks, and anomalous behavior in real time;
• Penetration testing: the platform undergoes regular security audits conducted by specialized external teams;
• Encrypted backups: data backups are performed regularly and stored in geographically separate locations, all encrypted.

6.2 Organizational Measures

In addition to technical measures, 555bom follows organizational data protection practices:

• Mandatory data protection and LGPD training for all staff;
• Strong password policies and multi-factor authentication for internal systems;
• Annual review of all data processing practices;
• Incident response plan with defined procedures for notifying users and the ANPD.

6.3 User Responsibility

Your account security also depends on you. 555bom strongly recommends using a unique, strong password for your account, enabling two-factor authentication when available, and never sharing your login credentials with anyone. If you suspect unauthorized access, contact support immediately via live chat.

7. Your Rights as a Data Subject

The LGPD grants you a set of rights over your personal data that 555bom is fully committed to upholding. See each right and how to exercise it below:

How to Exercise Your Rights

To exercise any of the rights listed above, contact 555bom through the channels below. You will need to verify your identity before any action is taken on your account data:

• Live chat: available 24 hours a day, 7 days a week, directly on the platform;
• Email: suporte@555bom.best, with the subject line "LGPD Request – [Request Type]".

The response time is up to 15 business days from the point your identity is confirmed, as set out in the LGPD. In complex cases requiring additional review, the deadline may be extended with written notice to the data subject.

8. Cookies and Tracking Technologies

8.1 What Are Cookies

Cookies are small text files stored on your device when you access the 555bom platform. They allow the site to "remember" your preferences and session information between visits, making the experience smoother and more personalized.

8.2 Types of Cookies We Use

• Essential cookies: required for the platform's basic operation — keeping you logged in during a session, remembering your selected language, and ensuring bets are recorded correctly. These cookies cannot be disabled without affecting your ability to use 555bom;
• Analytical cookies: collect aggregated and anonymized data on how users navigate the platform — which pages are accessed most, average session duration, and exit points. Used to improve the platform, never to identify individual users;
• Security cookies: help identify abnormal behavior, fraud attempts, and unauthorized access. They are essential for protecting your account;
• Preference cookies: store your personalized settings — such as favorited games and interface preferences — so you don't have to reconfigure them every time you log in.

8.3 Cookie Management

You can manage and delete cookies in your browser settings — Chrome, Firefox, Safari, or any other. Keep in mind that disabling essential cookies may prevent the platform from working properly, including login and bet recording. 555bom does not use cookies for third-party advertising or cross-site tracking.

9. Data Retention and Deletion

555bom retains personal data for as long as necessary to fulfill each specific purpose, in accordance with the applicable legal timeframes in Brazil:

• Registration and identity data: maintained throughout the entire duration of the active account and for up to 5 years after account closure, in accordance with anti-money laundering requirements (Law No. 9,613/1998) and tax obligations;
• Financial transaction history (Pix, boleto, card): retained for 5 years after each transaction, as required by the Brazilian Federal Revenue Service and the Central Bank;
• Betting history and results: retained for 3 years after each bet, for audit, dispute resolution, and regulatory compliance purposes;
• Access and security logs: retained for 6 months up to 1 year, in accordance with the Brazilian Internet Act (Law No. 12,965/2014);
• Customer support data: retained for 2 years after each interaction ends;
• Analytical cookie data: anonymized after 90 days and deleted within 12 months.

Once the retention periods above have elapsed, data is securely deleted or irreversibly anonymized so that it can no longer be linked to a specific individual. 555bom maintains internal records of deletion processes as part of its LGPD compliance practices.

10. Protection of Minors

555bom is a platform intended exclusively for users aged 18 years old. We do not intentionally collect, store, or process personal data belonging to minors. The registration process includes date-of-birth verification and, as a mandatory step, official document confirmation during KYC.

If 555bom determines that data from a minor was inadvertently collected, the account will be immediately blocked, the data deleted, and the legal guardian notified where identifiable. Legal guardians who discover that a minor has registered on the platform must contact support immediately via live chat so that the appropriate measures can be taken.

Protecting minors is a cornerstone of our responsible gambling commitment — an essential part of how 555bom operates and of our Terms and Conditions.

11. International Data Transfers

To operate the platform, 555bom may use servers and infrastructure services located in other countries. When this occurs, the transfer of personal data outside Brazil takes place only under the following conditions, as set out in Art. 33 of the LGPD:

• The destination country provides a level of data protection equivalent to that required by the LGPD, as assessed by the ANPD;
• The transfer is covered by standard contractual clauses approved by the ANPD, ensuring adequate protection for the data of Brazilian users;
• The transfer is necessary for the performance of the contract with the user — such as when games are processed by certified international providers.

555bom requires all international partners that process data from Brazilian users to implement security measures equivalent to or stronger than those mandated by the LGPD. These partners act exclusively as data processors under 555bom's instructions and are not permitted to use the data for their own purposes.

12. Changes to This Privacy Policy

555bom may update this Privacy Policy periodically for operational, legal, or regulatory reasons. Whenever material changes are made, affected users will be notified at least 7 days in advance through:

• Email sent to the address registered on your account;
• A prominent notice displayed on the platform at login;
• Updating the "last modified" date at the top of this document.

Continued use of the platform after the effective date of any changes constitutes acceptance of the new terms. If you disagree with any change, you may request account closure before the effective date — your available real balance will be returned via Pix in accordance with the platform's standard withdrawal procedures.

Changes that involve new data processing activities or an expansion of existing purposes will be communicated with an explicit request for renewed consent where required by the applicable legal basis.

13. Contact, DPO, and Privacy Channel

555bom has appointed a Data Protection Officer (DPO) responsible for overseeing privacy practices and handling data subject requests as set out in Art. 41 of the LGPD.

For any questions, rights requests, or complaints regarding the processing of your personal data by 555bom, please reach out through the channels below:

• Live chat: available 24/7 on the 555bom.best platform — the fastest option for urgent questions;
• DPO Email: suporte@555bom.best with the subject line "Privacy / LGPD – [Request Type]";
• Response time: within 15 business days of identity verification by the data subject.

If you believe 555bom has not adequately handled your request or that your rights have not been respected, you may file a complaint directly with the ANPD (National Data Protection Authority), through the authority's official channels. 555bom cooperates fully with investigations by the ANPD and any other competent Brazilian regulatory bodies.