40win Privacy Policy – Your Data, Protected

This Privacy Policy describes how 40win, Sports Betting and online casino platform accessible at 40win.best, collects, stores, uses, and protects the personal data of users residing in Brazil, in the capacity of Controller as defined by the General Data Protection Law (LGPD – Law No. 13.709/2018).

40win operates exclusively within the Brazilian market, with its entire data processing infrastructure aligned with current Brazilian laws and regulations. The Data Protection Officer (DPO) can be reached at suporte@40win.best for any questions related to this policy.

By creating an account and using the 40win platform, you confirm that you have read this Privacy Policy and consent to the processing of your data as described herein. If you disagree with any part of it, you should close your account and stop using the platform.

40win collects only the data necessary to operate the platform safely and lawfully. Collection happens in three ways: data you provide directly, data generated through your use of the platform, and data received from trusted third parties for verification purposes.

40win does not collect sensitive data such as racial or ethnic origin, religious belief, health data, biometrics, or sexual orientation — special categories as defined in Article 11 of the LGPD. The sole exception is when there is a specific judicial or regulatory order.

Each piece of data collected has a specific and legitimate purpose. 40win does not process data for purposes incompatible with those declared at the time of collection. Here are the main purposes:

• Account creation and maintenance: full name, CPF, email, and mobile number are required to uniquely identify the user on the platform, communicate about transactions, and ensure each CPF has only one active account;
• Financial transaction processing: banking and Pix details are used exclusively to process BRL deposits and withdrawals, with no card information stored in plain text;
• Fraud prevention and compliance: IP address, usage patterns, and betting history are analyzed to identify suspicious behavior, multiple accounts, and bonus abuse;
• Identity verification (KYC): documents such as a government-issued ID (RG or CNH) are required for withdrawals above R$ 5,000.00 or whenever the security system flags a need — in compliance with anti-money laundering regulations;
• Customer support: interaction history is retained to provide contextualized support and resolve complaints more efficiently;
• Marketing communications: with your consent, 40win sends emails and push notifications about promotions, bonuses, and platform updates. You can opt out of this type of communication at any time in your account settings;
• Product improvement: aggregated and anonymized usage data is used to understand how players interact with the platform and to prioritize product improvements.

40win never uses your data to make automated decisions that produce legal effects or significant impacts on your life without the possibility of human review.

Every personal data processing operation carried out by 40win has a legal basis provided for under the LGPD. Using different legal bases for each purpose ensures transparency and respect for data subjects' rights. The main bases applied are:

• Contract performance (art. 7, V): processing required to perform the service contract entered into between the user and 40win at the time of registration — includes account creation, deposit and withdrawal processing, and game operation;
• Legal obligation (art. 7, II): processing required to fulfill legal obligations such as identity verification, reporting to the Financial Activities Control Council (COAF), and compliance with Law No. 9.613/1998 (anti-money laundering);
• Legitimate interest (art. 7, IX): fraud analysis, platform security, product improvement using anonymized data, and experience personalization — provided this does not override the data subject's fundamental interests and rights;
• Consent (art. 7, I): marketing communications and use of non-essential cookies — consent may be withdrawn at any time with no impact on your use of the platform.

40win does not sell or share personal data with third parties for commercial purposes. Data sharing occurs only in the following specific and necessary situations:

• Payment processors: to process deposits and withdrawals via Pix, boleto, credit and debit cards, PicPay, Mercado Pago, and TED transfers, 40win shares only the minimum necessary financial data with its partner payment gateways — all bound by contracts with data protection clauses equivalent to those in this policy;
• Game providers: companies such as Pragmatic Play, PG Soft, Hacksaw Gaming, and others receive only an anonymous user identifier to record gaming sessions — with no access to the player's name, CPF, or banking details;
• Identity verification services: for KYC purposes, documents may be processed by partners specialized in identity verification, under the same security standards as 40win;
• IT service providers: cloud infrastructure providers, email services, and customer support tools operate as data processors under contract, with no authorization to use the data independently;
• Legal authorities: when required by court order, request from the Public Prosecutor's Office, COAF, or other competent authorities, 40win provides the requested information within the scope determined by law.

All third parties that receive 40win user data are contractually required to maintain protection standards equivalent to or higher than those set out in this policy, and may not use the data for any purposes other than those established in the contract.

40win uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and — with your consent — personalize content and measure marketing performance. The types of cookies used are:

• Essential cookies: required for basic platform functionality — maintaining logged-in sessions, language preferences, and account settings. They cannot be disabled without impacting platform use;
• Performance cookies: collect information about how users interact with the platform — pages visited, session duration, errors encountered — in aggregated and anonymized form, to improve the product;
• Functionality cookies: allow 40win to remember your personalized preferences, such as your preferred odds format or betting layout;
• Marketing cookies: used only with explicit consent, to measure campaign effectiveness and personalize bonus offers and promotions relevant to your usage profile.

You can manage your cookie preferences directly in your browser settings or through the privacy preference panel available on the 40win platform. Disabling essential cookies may affect the normal functioning of your account.

40win implements a robust set of technical and organizational measures to protect users' personal data against unauthorized access, accidental loss, destruction, or improper disclosure. The key measures include:

• AES-256 encryption for all data stored at rest, and TLS 1.3 for data in transit between your device and 40win's servers;
• Financial data tokenization — Pix and card details are never stored in plain text; they are replaced by cryptographic tokens for recurring transactions;
• Multi-factor authentication (MFA) available to all users and mandatory for internal administrative access to the platform;
• 24/7 security monitoring with intrusion detection systems (IDS) and automated responses to suspicious access attempts;
• Role-based access control (RBAC) — each 40win team member accesses only the data required for their specific role, with all access recorded in an immutable log;
• Periodic penetration testing conducted by independent security firms to identify and remediate vulnerabilities before they can be exploited;
• Incident response plan documented and regularly tested, with clear procedures for containment, investigation, and notification in the event of a data breach.

Despite all these measures, no security system is impenetrable. 40win cannot guarantee absolute security, but commits to acting with reasonable diligence and notifying affected users of any significant incident within the legal timeframes.

40win retains personal data only for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum and maximum retention periods established by applicable Brazilian law:

• Active account data: kept while the account is active. After voluntary closure, data is anonymized or deleted within 90 days, except in the cases below;
• Financial records (deposits and withdrawals): retained for a minimum of 5 years after the transaction, as required by anti-money laundering legislation (Law No. 9.613/1998) and COAF regulations;
• KYC data (identity documents): retained for up to 5 years after account closure, for audit and regulatory compliance purposes;
• Access and security logs: retained for up to 6 months, as required by the Brazilian Internet Civil Framework (Law No. 12,965/2014);
• Betting history: retained while the account is active and for up to 5 years after closure, for responsible gambling and contractual dispute purposes;
• Support communications: kept for up to 2 years to ensure service continuity and resolution of late complaints.

After the retention periods above have elapsed, data is permanently deleted or irreversibly anonymized. Anonymized data is no longer considered personal data under the LGPD and may be retained for statistical purposes without any time limitation.

The General Data Protection Law grants eight fundamental rights to every personal data subject. 40win is committed to honoring each of them within the legally required timeframes. To exercise any of the rights below, send an email to suporte@40win.best with the subject line "Privacy – LGPD" and the right you wish to exercise. The response time is up to 15 calendar days.

Some of 40win's technology partners — such as cloud infrastructure providers and security analytics firms — may be located outside Brazil. When this occurs, 40win ensures that any cross-border transfer of personal data meets at least one of the following conditions:

• The destination country provides a level of personal data protection adequate to that required under the LGPD, as assessed by the ANPD;
• The transfer is carried out under specific contractual clauses that guarantee the data subject the same rights provided for under Brazilian law;
• The transfer is necessary to perform the contract between the user and 40win (for example, processing a transaction via a global payment provider).

40win prioritizes partners with internationally recognized security certifications (ISO 27001, SOC 2 Type II) and maintains data processing agreements that include liability clauses equivalent to those required by the LGPD.

The 40win platform is strictly intended for individuals who are 18 years of age or older. 40win does not intentionally collect, store, or process personal data from individuals under 18 years of age, and takes the following measures to prevent this:

• Mandatory date-of-birth verification during registration, with automatic blocking for dates of birth resulting in an age below 18;
• CPF verification against external databases to confirm the holder is of legal age;
• Manual review of identity documents during the KYC process for withdrawals, with immediate account closure if the document reveals the holder was a minor at the time of registration.

If you are the guardian of a minor and suspect they have created an account on 40win, please contact support immediately at suporte@40win.best. 40win will close the account, delete the minor's data, and process the refund of any deposited funds to the legal guardian.

40win may update this Privacy Policy periodically to reflect changes in data processing practices, new legal or regulatory requirements, or improvements in the transparency of information provided to users.

When material changes occur — ones that in any way reduce user rights or expand the scope of data processing — 40win will notify active users by email at least 15 days in advance before the new version takes effect. The last updated date at the top of this page will always be refreshed to reflect the current version.

Changes required by urgent legal or regulatory determination may take effect immediately, with simultaneous notice to users. Continued use of the platform after the effective date of the new policy constitutes tacit acceptance of the new terms. If you do not agree, you may close your account before the effective date.

For any questions related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, you can contact 40win's Data Protection Officer (DPO) through the following channels:

• Email: suporte@40win.best — use the subject line "Privacy – LGPD" for priority handling;
• Live chat: available 24 hours a day on the 40win platform, in Brazilian Portuguese;
• Response time: up to 15 calendar days for requests related to data subject rights.

For complaints not resolved by 40win, the data subject may also contact the National Data Protection Authority (ANPD), the federal body responsible for enforcing the LGPD in Brazil.