Privacy Policy 4play: your data protected under LGPD

1. Introduction and Controller Identification

The 4play is the controller of the personal data processed under this Policy, as defined by the Lei Geral de Proteção de Dados (Law No. 13,709/2018 — LGPD). This means that 4play is the entity responsible for decisions about what data is collected, why it is collected, and how it is used within the platform.

This Privacy Policy transparently describes all personal data processing practices adopted by 4play regarding platform users — including Sports Betting on Brasileirão Série A, Copa do Brasil, and Libertadores, slots games, Live Casino, Pix deposits and withdrawals, and general use of the site.

To get in touch with 4play for any matter related to the privacy of your data, use the email contato@4play.cash. The Data Protection Officer (DPO) can be reached through the same channel by including "DPO" in the subject line.

2. What Personal Data Is Collected

2.1 Data Provided Directly by the User

During registration and platform use 4play, the following data is collected directly from the user:

• Full name as shown on identity document;
• CPF (Cadastro de Pessoas Físicas);
• Date of birth;
• Email address;
• Mobile number (optional, but recommended for two-factor authentication);
• Full residential address (requested during the KYC verification process);
• Pix key and linked bank account details for withdrawals;
• Identity documents submitted during the KYC process (national ID, driver's license, or passport, front and back).

2.2 Automatically collected data

While using the platform, 4play automatically collects certain technical information required for the operation and security of the service:

• Access IP address;
• Device type and operating system in use;
• Browser and version;
• Pages visited within the platform and session duration;
• Full history of Sports Betting, slots games, and Live Casino;
• Financial transaction history (Pix deposits, withdrawals, bonuses);
• Approximate geolocation data (based on IP address, not GPS).

2.3 Data Not Collected

The 4play not collects passwords in plain text (all are stored with cryptographic hashing), credit card data (the platform uses Pix exclusively for transactions), or sensitive information such as racial origin, religious beliefs, or biometric data, except where facial verification is requested in specific KYC processes.

3. Purpose of Data Processing

The personal data collected by 4play are used exclusively for the following purposes:

• Account management: creation, maintenance, authentication, and closure of the user's account on the platform;
• Transaction processing: instant deposits via Pix, withdrawals in up to 90 seconds to the Pix key linked to the registered CPF, and balance management;
• Identity verification (KYC): age verification, fraud prevention, and compliance with sports betting regulations in Brazil;
• Fraud prevention and security: detection of suspicious access, multiple accounts, use of automation, and other activities prohibited by the Terms and Conditions;
• Responsible gambling: monitoring of behavioral patterns that may indicate risk of problem gambling, in order to activate the available self-control tools;
• Account communications: transactional emails (deposit, withdrawal, and bet confirmations) and security alerts;
• Marketing communications: 4play promotions, bonuses, and updates — only with your consent and with an easy opt-out option;
• Legal compliance: fulfillment of tax, regulatory, and judicial obligations before Brazilian authorities.

4. Legal Basis for Processing

All data processing carried out by 4play is grounded in one of the legal bases set out under the LGPD:

• Contract performance (art. 7, V): processing necessary for account management, bet processing, and Pix transactions;
• Legal obligation (art. 7, II): identity verification, financial records retention, and compliance with obligations imposed by betting legislation and the LGPD;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, responsible gambling monitoring, and continuous service improvement — always respecting the user's rights and reasonable expectations;
• Consent (art. 7, I): sending marketing communications and using non-essential cookies — with the option to withdraw consent at any time.

5. Data Sharing with Third Parties

5.1 Operational Partners

The 4play may share users' personal data with third parties strictly necessary for the operation of the platform, including:

• Game providers: companies such as Evolution Gaming, Pragmatic Play, and other live casino and slots content providers receive anonymized session identifiers for the technical operation of games. These providers receive no personally identifiable data beyond the minimum required;
• Payment processors: the Pix system operates via the Banco Central do Brasil; partner financial institutions receive only the data strictly necessary to process deposits and withdrawals;
• Identity verification services: KYC platforms may process document images to speed up verification — all partners in this category follow LGPD-equivalent standards;
• Cloud infrastructure: servers and hosting services used by 4play are located in Brazil and comply with LGPD security guidelines.

5.2 Data Never Shared

The 4play does not sell, rent, transfer, or make users' personal data available to advertising companies, data brokers, social networks, or any third party for commercial purposes not directly related to the operation of the platform.

5.3 Legal Authorities & Obligations

The 4play may disclose personal data to government, regulatory, or judicial authorities when required by law, court order, or applicable regulation, always limiting disclosure to the minimum necessary to fulfill the request.

6. Data Storage & Security

The 4play adopts appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or improper destruction. Key measures include:

• 256-bit SSL Encryption across all communications between the user's device and the platform's servers;
• Password hashing using modern algorithms — 4play never stores passwords in plain text and has no access to the user's original password;
• Two-Factor Authentication (2FA) available to all users for additional account access protection;
• Role-based access control — only staff with a justified operational need access user data;
• Continuous monitoring of suspicious access attempts and attacks on the platform;
• Encrypted backups performed on a regular basis with separate storage from primary data;
• Periodic security testing carried out by the internal team and, where applicable, by external auditors.

In the event of a security incident affecting personal data, the 4play will notify affected users and the ANPD within the timeframes and conditions established by the LGPD.

7. Data Retention and Deletion

The 4play retains personal data for as long as necessary for the purposes for which it was collected, in accordance with the minimum retention periods required by Brazilian law:

• Registration data (full name, CPF, date of birth): retained for the duration of the account and for 5 years after closure, in accordance with tax and regulatory obligations;
• Financial transaction history (deposits and withdrawals via Pix): 5 years after each transaction, in accordance with Brazilian tax legislation;
• Betting and gaming history: 5 years, for dispute resolution and regulatory audit purposes;
• KYC documents: 5 years after account closure;
• Access logs (IP logs): 12 months, as required by the Brazilian Internet Civil Framework (Law No. 12.965/2014);
• Non-essential cookie data: in accordance with each cookie's specific timeframe, always subject to the consent provided.

Once mandatory retention periods have been met, data is securely and irreversibly deleted from the systems of the 4play. You may request early deletion of data not subject to mandatory retention by emailing contato@4play.cash.

8. Cookies and Tracking Technologies

8.1 What are cookies

Cookies are small text files stored on your device when you access the platform. 4play. They allow the site to "remember" information about your session, preferences, and browsing behavior.

8.2 Types of Cookies Used by 4play

• Essential cookies: required for the basic operation of the platform — login, session management, and bet processing. These cannot be disabled without impairing use of the site;
• Performance cookies: collect aggregated, anonymous information about how users interact with the platform (most visited pages, errors encountered). They help improve the overall experience;
• Preference cookies: store settings such as language, preferred layout, and recent betting history to personalize your experience;
• Analytics cookies: used by traffic analytics tools to understand user behavior in aggregate. These require your consent.

8.3 How to Manage Cookies

You can manage or disable non-essential cookies in your browser settings (Chrome, Safari, Firefox, or any other). Disabling essential cookies may affect platform functionality. 4play. To withdraw consent given for analytics or preference cookies, go to the privacy settings within your account on the platform.

9. Protection of Minors' Data

The platform 4play is strictly intended for users aged 18 and over. The 4play does not intentionally collect personal data from minors. During registration, the date of birth is verified and users under 18 are prevented from creating an account.

Should the 4play identifies, by any means, that data from a minor was collected without the knowledge or consent of their legal guardians, that data will be deleted immediately and the account will be closed. If you are aware that a minor has used the platform, please contact us at contato@4play.cash so the matter can be handled as a priority.

10. International Data Transfers

The 4play prioritizes the storage and processing of its users' data on servers located in Brazil. Where there is a technical need to transfer data to servers located in other countries — for example, with cloud infrastructure partners — the 4play ensures that recipient countries or organizations provide a level of protection compatible with the LGPD.

Specifically, any international transfer is subject to:

• Recipient country recognized by the ANPD as providing adequate protection; or
• Existence of standard contractual clauses guaranteeing the data subject the same rights provided under the LGPD; or
• Specific and informed consent from the data subject for the transfer.

Financial transaction data via Pix is processed exclusively on infrastructure located in Brazil, in accordance with Banco Central do Brasil regulations.

11. How to Exercise Your Rights as a Data Subject (LGPD)

To exercise any of the rights guaranteed by the LGPD regarding your personal data on 4play, send an email to contato@4play.cash with the subject line "LGPD Rights" and the following information:

• Full name and CPF registered on the account;
• A clear description of the right you wish to exercise (access, correction, deletion, portability, etc.);
• Any additional information that helps identify the request.

The 4play commits to responding to requests within the legal deadline of 15 business days from receipt. In more complex cases, this deadline may be extended by an additional 15 days, with prior notice to the requester.

Some deletion requests may not be fulfilled in full when the data is required to meet a legal or regulatory obligation. In that case, 4play will inform you which data must be retained and for what legal reason, and will delete the rest.

12. Changes to This Privacy Policy

The 4play may update this Privacy Policy periodically to reflect changes in legislation, data processing practices, or the services offered. Any material change will be communicated at least 15 days in advance via the registered email address or an in-platform notification.

The date of the last update is always shown at the top of this page. We recommend reviewing this Policy periodically to stay informed about how your data is handled.

Continued use of the platform 4play after an updated version of this Policy takes effect constitutes acceptance of the new practices described. If you do not agree with the changes, you may close your account and request deletion of your data, as described in section 11 above.

13. Contact, DPO, and Privacy Channel

The 4play has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and serving as the point of contact for data subjects and the ANPD.

To contact the DPO or the privacy team at the 4play:

• Email: contato@4play.cash (include "DPO" or "Privacy" in the subject line);
• Live chat: available within the platform after login, 24 hours a day;
• Response time: up to 15 business days for LGPD rights requests; up to 48 hours for general privacy inquiries.

If you believe your rights have not been adequately upheld by 4play, may lodge a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD), pursuant to art. 18, §1 of the LGPD.