Privacy Policy of 9fum — Your Data, Protected

1. Data Controller

For the purposes of this Privacy Policy and the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018), the controller responsible for processing your personal data is the operating company of the 9fum platform, operating exclusively within the Brazilian Sports Betting and online entertainment market.

9fum's Data Protection Officer (DPO) can be reached at privacidade@9fum.net. All requests relating to personal data — access, correction, deletion, portability, or complaints — must be sent to that address.

This Privacy Policy applies to all users who access or use the 9fum platform, available at 9fum.net and on the mobile apps for smartphones and tablets, regardless of the device or operating system used.

2. Data We Collect

2.1 Data You Provide Directly

At the time of registration and throughout your use of the platform, 9fum collects the following information provided directly by the data subject:

• Personal identification: full legal name as shown on your ID, CPF, date of birth, and gender;
• Contact: active email address, mobile number with a Brazilian area code (DDD);
• Address: ZIP code, street address, number, complement, neighborhood, city, and state;
• Identity documents: National ID (RG), driver's license (CNH), or passport, required during the KYC verification process;
• Financial data: Pix key, credit or debit card details (tokenized and never stored in plain text), bank branch and account number for TED transfers;
• Proof of address: required during advanced verification processes, particularly for withdrawals above R$ 2,000.00.

2.2 Automatically collected data

While you use the platform, 9fum automatically collects certain technical data required for the service to function:

• IP address and approximate location data (country, state, city);
• Device type, operating system, phone model, and app or browser version;
• Pages visited, session duration, clicks, and interactions with the platform;
• Betting history, deposits, withdrawals, and activity in casino games;
• Session cookies, preference cookies, and device identifiers (IDFA/GAID) for mobile app users.

2.3 Third-party data

In some cases, 9fum may receive data from external sources for verification and fraud prevention purposes:

• Queries to credit bureaus and fraud prevention databases for identity validation;
• Information from payment providers to confirm transactions via Pix, boleto bancário, card, PicPay, Mercado Pago, and TED;
• Risk analysis data from anti-fraud partners for user account protection.

3. How We Use Your Data

9fum uses the data it collects exclusively for the following purposes:

• Service provision: create and manage your account, process Sports Betting on football (Brasileirão, Copa do Brasil, Libertadores), volleyball, basketball (NBB), UFC, e-sports, and Live Casino, and calculate and pay out winnings;
• Payment processing: process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers;
• Identity verification (KYC): confirm that you are 18 or older, that you are the legitimate account holder, and that the information you have provided is accurate;
• Fraud prevention and anti-money laundering: detect suspicious activity, multiple accounts, bonus abuse, and other violations of the Terms and Conditions;
• Communication: send registration confirmations, betting notifications, security alerts, and updates about promotions and service changes;
• Personalization: tailor betting recommendations, promotions, and content based on your profile and usage history — always in aggregate form, without exposing individual data;
• Compliance with legal obligations: comply with requests from competent authorities, regulatory reporting requirements in the Sports Betting sector, and tax obligations under Brazilian law;
• Responsible gambling: monitor behavioral patterns that may indicate problematic use and activate the protection tools available on the platform.

4. Legal Basis for Processing

9fum processes your personal data based on the following legal grounds established by the LGPD:

Where processing is based on consent, you have the right to withdraw it at any time, without affecting any processing that was carried out prior to that withdrawal under the same legal basis.

5. Data Sharing

9fum does not sell or transfer your personal data to third parties for commercial or advertising purposes. Information is shared only in the situations listed below, always on a proper legal basis and, where applicable, subject to contractual confidentiality obligations:

• Payment providers: Pix (via the Brazilian banking system), credit/debit card processors, PicPay, Mercado Pago, and partner banks (Nubank, Itaú, Bradesco, Banco do Brasil) — required for processing deposits and withdrawals;
• Identity verification (KYC) partners: specialized companies in document verification and biometrics, used in the user identity confirmation process;
• Anti-fraud partners: risk analysis systems and platforms that help 9fum identify suspicious activity and protect user accounts;
• Technology and infrastructure providers: cloud hosting, CDN, and system monitoring services that process data solely for operational purposes, under contracts with strict data protection clauses;
• Casino game providers: when you use games from third-party providers available on 9fum, minimal session data (anonymous identifier, amount wagered, and outcome) is shared with the provider to operate the game;
• Competent authorities: when required by law, court order, Sports Betting regulation in Brazil, or a request from investigative authorities, 9fum may be compelled to share information with government bodies.

6. Data Retention and Deletion

9fum retains your personal data for as long as necessary to fulfill the purposes described in this policy and to comply with legal and regulatory obligations. The main retention criteria are:

• Active account: while your 9fum account remains active, your registration and activity data are retained to provide the service;
• After account closure: financial and identification data are retained for up to 5 years after account closure, in compliance with anti-corruption, anti-money laundering, and tax obligations under Brazilian law;
• Betting records: betting history is retained for up to 5 years for audit and regulatory compliance purposes;
• Access and security logs: retained for up to 6 months, as required by the Marco Civil da Internet (Law No. 12.965/2014);
• Marketing data based on consent: deleted within 30 days of consent withdrawal.

After the applicable retention period, data is securely deleted or irreversibly anonymized so that the data subject can no longer be identified.

7. Data Security

9fum implements appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or improper disclosure. The main measures in place include:

• SSL/TLS encryption on all communications between your device and 9fum's servers;
• Password storage with secure hashing (bcrypt or equivalent) — never in plain text;
• Tokenization of credit and debit card data — full card numbers are never stored in 9fum's systems;
• Role-based access control (RBAC), with access to personal data restricted to staff members who require it to perform their duties;
• Continuous monitoring of system access and intrusion attempts;
• Two-factor authentication (2FA) available to all users and mandatory for internal administrative access;
• Periodic security audits and penetration testing carried out by specialized firms.

In the event of a security incident that poses significant risk to data subjects, 9fum will notify the ANPD (Autoridade Nacional de Proteção de Dados) and the affected users within the timeframes established by the LGPD, providing clear information about what occurred, the data involved, and the steps taken to mitigate any harm.

8. Cookies and Tracking Technologies

9fum uses cookies and similar technologies to ensure the platform works correctly, personalize the user experience, and collect aggregated analytics data. See the types of cookies we use:

You can manage your cookie preferences at any time through the platform's settings panel or your browser settings. Disabling essential cookies may affect how 9fum functions.

The 9fum mobile app uses device identifiers (IDFA on iOS and GAID on Android) only when the user grants explicit permission through the mobile operating system settings.

9. Protection of Minors' Data

9fum is a Sports Betting and online casino platform intended exclusively for users aged 18 and over. We do not knowingly collect, process, or store personal data from minors.

The identity verification process — which includes CPF confirmation and date of birth — is designed in part to prevent users under 18 from creating accounts on the platform. Any account identified as belonging to a minor is closed immediately, the balance is frozen, and the data is deleted in accordance with our retention policy.

If you become aware that a minor is using the 9fum platform, please contact our support team immediately at suporte@9fum.net. We treat these situations as a top priority.

10. Your Rights as a Data Subject (LGPD)

Under the LGPD, as the owner of your personal data, you have the following rights, which you may exercise at any time with 9fum:

11. International Data Transfers

Some of 9fum's technology partners — such as cloud infrastructure providers, analytics platforms, and casino game suppliers — may be located outside Brazil. In such cases, 9fum ensures that any international transfer of personal data is carried out in compliance with the LGPD, through:

• Contracts with standard data protection clauses equivalent to the level required by Brazilian law;
• Transfer only to countries or international organizations that the ANPD recognizes as providing an adequate level of personal data protection;
• Specific guarantees of confidentiality and restricted use of the transferred data.

9fum does not transfer the personal data of Brazilian users to jurisdictions that do not offer protection equivalent to the LGPD, unless the appropriate safeguards are in place. If you have questions about specific transfers, please reach out at privacidade@9fum.net.

12. Changes to This Privacy Policy

9fum may update this Privacy Policy periodically to reflect changes in applicable law, our data processing practices, or the services offered by the platform.

Substantial changes — those that significantly affect how we process your data or your rights as a data subject — will be communicated by email to all registered users with an active account, at least 15 days before the new terms take effect.

The date of the last update to this policy is always shown at the top of this document. Continued use of the 9fum platform after the effective date of any changes constitutes acceptance of the new terms. We recommend reviewing this policy periodically.

Previous versions of this Privacy Policy are available upon request at privacidade@9fum.net for reference or comparison purposes.

13. Contact the Data Protection Officer (DPO)

To exercise your rights under the LGPD, ask questions about how your personal data is handled, file a complaint, or learn more about this Privacy Policy, please contact 9fum's Data Protection Officer (DPO):

If you do not receive a satisfactory response from 9fum within the established timeframe, or if you believe your rights as a data subject have not been adequately met, you have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the federal body responsible for enforcing the LGPD in Brazil.

This Privacy Policy was written in Brazilian Portuguese and is governed exclusively by the General Data Protection Law (Law No. 13,709/2018) and other applicable Brazilian legislation.