90wil Privacy Policy – Your Data Protected

1Data We Collect

The 90wil collects personal data at different points during your interaction with the platform. Below are the types of data collected and the circumstances in which this occurs:

Data you provide directly:

• Registration: full name, email address, CPF, date of birth, mobile number, and account password.
• Identity verification (KYC): government-issued photo ID (RG or CNH, front and back), a selfie holding the document, and in some cases, proof of residence issued within the last 90 days.
• Payments: Pix key (CPF, phone number, or email), credit or debit card details (processed with encryption – the 90wil does not store your full card number), bank account details for wire transfers. Transactions via PicPay and Mercado Pago are processed directly on those platforms.
• Communications: messages sent to support via live chat or email, including service history.

Automatically collected data:

• Access data: IP address, browser or app type and version, operating system, device used (phone, tablet, or computer), and access time.
• Behavioral data: pages visited within the platform, games accessed (slots, live casino, blackjack), bets placed, session duration, and clicks on interface elements.
• Cookies and similar technologies: detailed in Section 5 of this policy.

2How We Use Your Data

The 90wil uses the data collected solely for the purposes described below, each with a legal basis under the LGPD:

• Account operation: creation, maintenance and management of your account at 90wil, including access authentication, password recovery and preference management.
• Payment processing: processing deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago and TED, as well as withdrawal processing via Pix to the Pix account linked to your CPF.
• Identity verification (KYC): confirmation that you are who you claim to be, that you are at least 18 years old, and that you are a resident of Brazil, as required by legal and regulatory obligations.
• Fraud prevention: monitoring of suspicious activity, identification of multiple accounts under the same CPF, detection of money laundering, and compliance with KYC/AML obligations.
• Customer support: logging and resolution of requests submitted to support via live chat or email, including interaction history for reference in future support cases.
• Platform improvement: aggregated and anonymized usage behavior analysis to identify improvements to the user experience across Sports Betting, live casino, slots, blackjack and e-sports.
• Operational communications: sending transaction confirmations, security alerts, notifications about changes to terms, and information about active promotions (you can opt out of marketing communications at any time).
• Compliance with legal obligations: compliance with requests from competent Brazilian authorities when required by law, including the Banco Central do Brasil, Receita Federal and judicial authorities.

The 90wil does not use your data to build behavioral profiles for sale to third parties, for targeted advertising on external platforms, or for any purpose not described in this policy.

3Data Sharing

The 90wil does not sell, rent, or share your personal data with third parties for commercial purposes. Sharing is limited to the following situations, all of which are necessary to operate the service:

• Payment processors: when making deposits or withdrawals via Pix, credit/debit card, PicPay, Mercado Pago, or TED, transaction data is shared with the respective payment processors (such as card acquirers and the Banco Central's Pix infrastructure) solely to complete the transaction. These partners are contractually required to use the data only for that purpose.
• Identity verification services: during the KYC process, submitted documents may be processed by providers specialized in identity verification. These providers operate as data processors under the instructions of the 90wil and in accordance with the LGPD.
• Casino game providers: for live casino games and slots provided by third parties, only the minimum necessary data (such as session identifier and available balance) is shared with the game provider to enable gameplay. Full name and CPF are not shared with game providers.
• Legal authorities: the 90wil may disclose personal data when required by law, court order, or request from a competent Brazilian authority, such as the Banco Central do Brasil, Receita Federal, Ministério Público, or the judiciary. In such cases, the 90wil will notify the affected user whenever legally permitted.
• Technology infrastructure: cloud hosting and technology infrastructure providers contracted by the 90wil may have technical access to data as part of server operations. These providers operate under contracts with strict data protection clauses compatible with the LGPD.

4Data Security

The 90wil adopts technical and organizational measures to protect your personal data against unauthorized access, leaks, alteration, or destruction. The main security measures in place include:

• Encryption in transit: all communication between your device and the servers of the 90wil is encrypted with 256-bit TLS/SSL. The connection is always via HTTPS.
• Encryption at rest: sensitive data stored on the servers of the 90wil — such as identity documents and financial information — are encrypted at rest using standards equivalent to AES-256.
• Credential protection: passwords are stored in an irreversible hash format. The 90wil never has access to your password in plain text and never asks for your password through any channel.
• Strong authentication: card payments go through the 3D Secure protocol, which requires additional authentication in the issuing bank's app. Pix withdrawals are processed exclusively to keys registered under the account holder's CPF.
• Internal access controls: only members of the 90wil with a legitimate need have access to users' personal data. Access is controlled by individual credentials and recorded in audit logs.
• Continuous monitoring: intrusion detection systems and suspicious activity monitoring operate continuously on the 90wil.

In the event of a security incident affecting your personal data, the 90wil will notify the National Data Protection Authority (ANPD) and affected users within the timelines and procedures set out in the LGPD. The notification will describe the nature of the incident, the data affected and the measures taken to mitigate it.

Despite all the measures we have in place, no system is 100% immune to threats. We recommend using a strong, unique password for your 90wil, enable two-factor authentication when available, and never share your login credentials with anyone.

5Cookies & Tracking Technologies

The 90wil uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and analyze service usage. See which types of cookies are used:

• Essential cookies: required for the basic functioning of the platform — maintaining your login session, active betting slip, and language and region preferences. Without these cookies, key parts of the 90wil do not function properly without these. They cannot be disabled.
• Performance cookies: collect aggregated, anonymized information about how users interact with the platform — which pages are visited most, average session duration, and technical errors encountered. This data is used solely to improve the platform.
• Functional cookies: allow the 90wil remember your preferences, such as favorite sports for betting, preferred odds format (decimal or fractional), and casino game filters. They make the experience more personalized without collecting any identifiable data.
• Security cookies: used to detect suspicious behavior, prevent fraud, and verify that the session is being used by the legitimate account holder. They cannot be disabled for operational security reasons.

The 90wil does not use third-party advertising cookies or tracking pixels for external ad platforms. There are no Google Ads cookies, Meta Pixel, or similar tools that transmit your data for targeted advertising on external networks.

You can manage your cookie preferences directly in your browser settings or through the privacy preferences panel within the 90wil platform. 90wil. Disabling non-essential cookies does not affect access to core features, but may reduce the personalization of your experience.

6Data Retention

The 90wil retains your personal data for as long as necessary to fulfill the purposes described in this policy, or as required by legal obligations. The general retention periods are:

• Active account data: retained for as long as your account remains active at 90wil. Operational data (betting history, financial transactions) is retained for a minimum of 5 years for audit and regulatory compliance purposes.
• Identity verification data (KYC): identity documents are retained for a minimum of 5 years after account closure, as required by anti-money laundering legislation (Law 9.613/1998).
• Financial transaction data: records of deposits and withdrawals via Pix, boleto, card, and TED are retained for a minimum of 5 years in accordance with the tax and regulatory obligations applicable to the Brazilian financial sector.
• Support communication data: support chat history with 90wil is retained for 2 years after the last interaction for future support reference and dispute resolution purposes.
• Cookie data: session cookies are deleted automatically when you close your browser. Persistent cookies last a maximum of 12 months, except security cookies, which may have a longer duration.
• After a deletion request: when you request the deletion of your data, the 90wil deletes or anonymizes information it is not legally required to retain. Data subject to legal retention obligations is kept only for the required period and used for no other purpose.

After voluntary account closure, the 90wil anonymizes or deletes data not subject to legal retention obligations within 30 days of an account closure request.

7Your Rights under the LGPD

The General Data Protection Law (LGPD – Lei nº 13.709/2018) grants you, as the data subject, the following rights regarding information processed by the 90wil:

To exercise any of these rights, send a request to contato@90wil.best with the subject line "LGPD Rights – [your full name]". The 90wil responds to all requests within 48 hours. In some cases, identity verification may be required before processing a request, to ensure data is delivered to the correct account holder.

If you believe that the 90wil has not adequately handled a request relating to your data, you have the right to file a complaint directly with the National Data Protection Authority (ANPD) through the gov.br portal.

8Contact & Data Protection Officer (DPO)

The 90wil has appointed a Data Protection Officer (DPO), as required by the LGPD, responsible for overseeing the platform's privacy practices and serving as a communication channel between the 90wil, data subjects and the ANPD.

For any questions, requests, or complaints related to privacy and the handling of your personal data on the 90wil, please reach out through the following channels:

• Privacy email: contato@90wil.best (subject: "Privacy" or "LGPD Rights")
• Live chat: available 24 hours a day, 7 days a week, on the 90wil. Support available in Brazilian Portuguese.

The 90wil may update this Privacy Policy periodically to reflect changes in legislation, the services offered, or data processing practices. Material changes will be communicated by email at least 7 days in advance. The date of the version currently in effect is shown at the top of this page. Continued use of the platform after a new version takes effect constitutes acceptance of the changes.

This Privacy Policy is governed by Brazilian law, in particular the LGPD (Law No. 13,709/2018) and the Consumer Protection Code (Law No. 8,078/1990). Any disputes will be submitted to the jurisdiction of the user's place of residence, in accordance with the CDC.