Privacy Policy KK678 – LGPD

The KK678 collects personal data at various points during your interaction with the platform. Below is a breakdown of the types of data collected and the context in which they are gathered:

The KK678 collects only the data strictly necessary for each purpose — the data minimization principle established by the LGPD. We do not collect sensitive data such as racial origin, religious beliefs, or health information, except where expressly required by a legal obligation.

The data collected by KK678 are used exclusively for the following purposes:

• Account operation: create, maintain, and manage your account, process bets, deposits, and withdrawals via Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED transfer;
• Identity verification (KYC): confirm that the user is 18 or older, that the CPF is valid, and that the registered information matches the actual account holder — a regulatory requirement for betting platforms;
• Fraud prevention and anti-money laundering (AML): identify suspicious behavior, multiple accounts, use of third-party data, and transactions of illicit origin;
• Communications: send notifications about account activity, promotions, terms updates and security alerts via email and SMS — you may opt out of promotional communications at any time;
• Customer support: address questions, complaints, and requests submitted via live chat or email;
• Personalization: tailor your platform experience based on your usage history — such as suggesting bets on the Brasileirão or e-sports events you regularly follow;
• Legal compliance: fulfill obligations to the Federal Revenue Service, the Central Bank of Brazil, and other competent regulatory authorities;
• Continuous improvement: analyze aggregated and anonymized data to improve platform performance, develop new features and fix issues.

The KK678 does not use your data to build psychological profiles, make automated decisions that affect your rights without human review, or for any purpose beyond those listed above.

The LGPD requires that all personal data processing have a clear legal basis. The KK678 processes your data on the following legal grounds established by Law No. 13,709/2018:

• Contract performance (Art. 7, V): processing is necessary to perform the service agreement between you and kk678 — that is, to allow you to register, place bets, make deposits, and withdraw funds. Without this data, the service simply cannot function;
• Compliance with a legal obligation (art. 7, II): identification data, CPF, financial history, and transaction records are retained to comply with obligations to the Receita Federal, the Banco Central, and anti-money laundering regulations (Lei nº 9.613/98);
• Legitimate interest (art. 7, IX): technical data such as IP address and browsing behavior are used to ensure platform security, detect fraud, and improve the user experience — legitimate interests of KK678 that do not override the rights of the data subject;
• Consent (art. 7, I): for marketing communications and promotional content personalization, processing is based on the consent you provide when opting in to receive these communications at registration. You may withdraw that consent at any time.

The KK678 does not sell, rent, or transfer your personal data to third parties for commercial purposes. Data may be shared only in the following situations and with the following categories of recipients:

• Payment gateways: Pix processors, credit/debit card processors, PicPay, and Mercado Pago receive only the data strictly necessary to process financial transactions. These partners are contractually required to protect your data and may not use it for any other purpose;
• Casino game providers: slots, live casino and crash games are provided by internationally licensed providers. The session identifier and game history may be shared with the provider for audit purposes and RNG (random number generator) certification;
• Identity verification tools (KYC): partners specializing in document verification and fraud prevention may process document images and selfies solely to confirm the user's identity;
• Legal and regulatory authorities: when required by law, court order, or determination by a competent regulatory authority, KK678 shares the necessary information. In such cases, we notify the user whenever legally permitted to do so;
• Auditors and legal advisors: professionals engaged by the KK678 for internal audit, legal counsel, or accounting purposes, subject to confidentiality obligations.

All third parties that receive data from KK678 are assessed for their privacy practices and security standards before being engaged, and are contractually required to process data in accordance with the LGPD and the instructions of the KK678.

The KK678 retains your personal data only for as long as necessary to fulfill the purposes described in this Policy or to meet legal and regulatory obligations. The criteria used to determine retention periods are:

• Registration and identity data: retained for as long as the account remains active and for up to 5 (five) years after account closure, in accordance with Brazilian anti-money laundering legislation;
• Financial transaction history (deposits and withdrawals in BRL): retained for 5 (five) years for tax purposes and compliance with the Banco Central do Brasil;
• Betting history and casino activity: retained for 2 (two) years after the last login, for responsible gambling purposes and risk behavior analysis;
• Technical records (access logs, IP addresses): retained for 6 (six) months, in accordance with the minimum period required by Brazil's Internet Civil Rights Framework (Lei nº 12.965/2014);
• Support communications: maintained by 2 (two) years for quality assurance and dispute resolution purposes.

Once the applicable retention period has ended, the KK678 securely and irreversibly deletes or anonymizes data in accordance with internal personal data disposal procedures.

The KK678 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. The key security measures in place are:

• SSL/TLS 256-bit Encryption across all communications between the user's browser or app and the servers of KK678;
• Tokenized financial data: credit/debit card data is never stored in readable form on the servers of KK678 — only tokens generated by PCI-DSS certified payment gateways;
• Two-factor authentication (2FA): available as an additional security layer for account access, strongly recommended for all users;
• Continuous access monitoring: automated systems detect suspicious access attempts, block malicious IPs, and alert the security team at KK678 in real time;
• Internal access control: only employees with a legitimate need have access to users' personal data, with audit logs maintained for all internal access;
• Periodic security testing: the infrastructure of the KK678 undergoes regular penetration testing and security audits conducted by specialized firms.

In the event of a security incident that compromises users' personal data, the KK678 will notify the National Data Protection Authority (ANPD) and affected users within the deadlines set by the LGPD, providing details about the nature of the incident and the measures taken to mitigate the damage.

The KK678 uses cookies and similar technologies to ensure the platform operates correctly, personalize your experience and analyze usage. See the types of cookies we use:

You can manage your cookie preferences at any time through the account settings panel or your browser settings. Disabling optional cookies does not affect the core functionality of the platform, but may limit some personalization features of the KK678.

As a data subject, the LGPD grants you the following rights regarding the processing carried out by KK678. All rights can be exercised by emailing suporte@kk678.best:

The services of KK678 are intended exclusively for individuals aged 18 (eighteen) years of age or older. We do not intentionally collect personal data from users under 18, nor do we allow minors to register or use the platform.

The identity verification process at KK678 includes date-of-birth verification via CPF and, where required, a government-issued photo ID. Accounts identified as belonging to minors are closed immediately, the balance is refunded to the legal guardian, and the data is deleted in accordance with LGPD provisions on children's and adolescents' data.

If you are the guardian of a child or teenager and suspect they have created an account on KK678, please contact our team immediately at suporte@kk678.best or via live chat. We will act with the highest priority to close the account and ensure a refund.

The KK678 may update this Privacy Policy periodically to reflect changes in data processing practices, updates to Brazilian legislation — including ANPD regulations — or improvements to our services.

When significant changes occur, the KK678 will notify registered users with a minimum advance notice of 15 days before the changes take effect, via email and a prominent notice on the platform. The date of the most recent update is always displayed at the top of this document.

Continued use of the platform after changes take effect constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you may request account closure before the effective date by following the procedure described in the Terms and Conditions.

The version history of this Policy is available upon request at suporte@kk678.best.

The KK678 has appointed a Data Protection Officer (DPO), as required by the LGPD for controllers that process personal data at scale. The DPO is the primary point of contact for all privacy and personal data protection matters.

To exercise your rights as a data subject, ask questions about this Privacy Policy, or report any concerns related to the processing of your personal data by the KK678, please reach out through the following channels:

• DPO Email: suporte@kk678.best (subject line: "Data Protection – LGPD")
• Live chat: available 24 hours a day, 7 days a week, directly on the kk678.best platform
• Response time: up to 15 business days for all LGPD-related requests

If you believe that the KK678 has not adequately addressed your data privacy requests, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), through the official channels provided by the Brazilian federal government.