Blu666 Privacy Policy – Your Data Protected by the LGPD

The blu666 is a Sports Betting and online casino platform dedicated to Brazilian players. To operate and deliver our services — betting on the Brasileirão, UFC, casino with slots and crash games like Aviator, deposits and withdrawals via Pix, Portuguese-language support — we need to collect and process some personal data from our users.

This Privacy Policy clearly and directly explains what data we collect, why we collect it, how we use it, who we may share it with in specific situations, and — most importantly — what rights you are guaranteed under the General Personal Data Protection Law (LGPD) — Law No. 13,709/2018.

Blu666 follows the principle of data minimization: we collect only what is necessary to provide the service and meet legal obligations. No data is sold to advertisers or third parties for commercial purposes without your explicit consent.

For the purposes of the LGPD, the blu666 acts as Controller of personal data collected on the platform — meaning we are responsible for all decisions regarding how and why your data is processed.

Blu666 has appointed a Data Protection Officer (DPO) as the official point of contact for all matters related to personal data processing and the exercise of your rights as a data subject.

Blu666 handles data subject requests in Brazilian Portuguese, with no need for intermediaries or legal representation for standard access and correction requests.

Blu666 collects data in three main situations: when you create an account, when you use the platform's services, and automatically during browsing. Each category is detailed below:

Data you provide directly during registration:

• Full name as shown on official ID;
• CPF (Individual Taxpayer Registration);
• Date of birth;
• Full residential address including ZIP code;
• Email address;
• Mobile phone number;
• Pix key and banking details for withdrawal processing.

Data collected during platform use:

• Full Sports Betting history (Brasileirão, UFC, e-sports, and other categories);
• Casino session history — slots, crash games, jackpots, and table games;
• Amount of each bet, winnings, and balance per transaction;
• Deposits made via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, or TED;
• Withdrawal requests and history;
• Interactions with customer support, including live chat transcripts;
• Documents submitted for identity verification (KYC).

Automatically collected data:

• Access IP address;
• Browser type and version;
• Operating system and device model (mobile, tablet, or desktop);
• Pages visited and duration of each session;
• Cookie data and similar technologies (detailed in section 10).

Every piece of data collected by blu666 has a specific, documented purpose. We do not process data in a generic manner or for purposes incompatible with the service you signed up for.

Blu666 uses aggregated and anonymized gameplay behavior data to improve the platform, identify technical issues, and develop features that benefit all players — without building individual profiles for targeted advertising without consent.

Brazil's LGPD requires that all personal data processing have a specific legal basis. blu666 processes your data under the following legal grounds set out in Article 7 of Law No. 13,709/2018:

• Contract performance (Art. 7, V): most of the processing takes place because it is necessary to fulfill the service agreement — without your registration details, we cannot create your account, process deposits, or pay out your withdrawals via Pix;
• Compliance with a legal obligation (art. 7, II): identity verification (KYC), anti-money laundering compliance, and reporting to authorities are legal obligations that do not depend on your consent;
• Legitimate interest (Art. 7, IX): platform security, fraud prevention, service improvement, and identification of problematic gambling behavior — always proportionate and in full respect of your rights;
• Consent (Art. 7, I): sending marketing communications by email or phone about promotions, cashback, and platform updates — you can withdraw this consent at any time through your account dashboard or by emailing contato@blu666.net.

Blu666 does not sell your personal data to third parties. Full stop. That said, in specific situations necessary for platform operations, we do need to share certain data with partners and service providers. In those cases, we require those partners to maintain security standards consistent with our own and with the LGPD.

The third parties with whom we may share data, and the respective purposes, are:

• Payment processors (Pix, boleto, card, PicPay, Mercado Pago, TED): financial data and CPF to process deposits and withdrawals — necessary for contract performance;
• Casino game providers (Pragmatic Play, Play'n GO, NetEnt, and others): session data required for gameplay — processed on provider servers in accordance with their own security terms;
• Identity verification companies (KYC): photo ID and proof of address for identity verification — processing required by legal obligation;
• Brazilian regulatory and judicial authorities: any data required by a court, administrative, or regulatory order — blu666 complies with legal determinations without requiring the data subject's consent;
• IT infrastructure and security providers: access data, IP addresses, and logs for security monitoring — processed under strict confidentiality agreements.

Blu666 retains your personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal obligations. The main retention periods are:

• Registration and active account data: for as long as your account remains active on the platform;
• Financial transaction history (deposits and withdrawals via Pix, boleto, and others): minimum of 5 years after account closure, in compliance with tax and anti-money laundering obligations;
• KYC documents (ID and proof of address): minimum of 5 years after account closure;
• Betting and casino session history: minimum of 3 years for audit and player support purposes;
• Customer support transcripts: 2 years after the ticket is closed;
• Browsing data and cookies: based on your browser settings, or up to 13 months for persistent cookies.

Once retention periods have expired and there is no legal obligation requiring continued storage, data is securely deleted or anonymized in a way that makes it impossible to identify the individual.

If you request account closure, data required to fulfill legal obligations will be retained for the periods stated above — all other data will be deleted within 30 days of closure confirmation.

Blu666 implements technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. The main security measures in place are:

• 256-bit SSL Encryption across all communications between your device and blu666's servers — the same standard used by financial institutions such as Nubank, Itaú, and Bradesco;
• Two-factor authentication (2FA) available and recommended for all users — adds an extra layer of protection beyond your password;
• Strict access controls — only employees with a legitimate need can access personal data, with every access tracked;
• Continuous monitoring of unauthorized access attempts, suspicious activity, and potential security breaches;
• Protected servers with firewalls, intrusion detection, and regular encrypted backups;
• Credit/debit card details not stored on blu666 servers — processing handled by PCI-DSS certified gateways.

Despite all the measures we have in place, no digital security system is completely foolproof. We recommend taking your own precautions as well: use a strong, unique password for blu666, enable 2FA, never share your credentials, and contact support immediately if you suspect unauthorized access to your account.

The LGPD grants you, as a data subject, a set of rights that blu666 is fully committed to upholding. You may exercise any of these rights at any time, free of charge and without needing to provide a reason for the more basic ones:

To exercise any of these rights, contact the DPO at contato@blu666.net with the subject line "LGPD Request – [type of right]". blu666 responds within 48 business hours and will fulfill your request within the legal deadlines — no more than 15 calendar days for straightforward requests.

If you believe blu666 has violated your rights as a data subject, you may file a complaint with the National Data Protection Authority (ANPD), as provided under Article 55-A of the LGPD. That said, we recommend reaching out to us first — most issues can be resolved quickly and directly.

Blu666 uses cookies and similar technologies to ensure the platform works properly, improve the user experience, and — with your consent — understand how players interact with the site.

The types of cookies we use:

• Essential cookies: required for the platform's basic functionality — session authentication, login security, and bet slip management. Without these cookies, the platform will not work. No consent required;
• Performance cookies: collect anonymized data on how you use the site — pages visited, session time, errors encountered — to help improve the platform. Enabled only with your consent;
• Functionality cookies: remember your preferences — such as language, betting settings, and favorite games — for a more personalized experience. Enabled only with your consent;
• Marketing cookies: used to deliver relevant communications about blu666 promotions — cashback, free spins, new Sports Betting markets on Brasileirão. Activated only with explicit consent, which can be withdrawn at any time.

You can manage and withdraw cookies at any time through your browser settings or via the blu666 cookie preferences panel. Disabling essential cookies may prevent certain platform features from working.

For more information on how the major browsers handle cookies, visit the privacy settings of Chrome, Firefox, Safari, or whichever browser you use on your phone or computer.