Bt29 — Privacy Policy and Data Protection

This Privacy Policy is enforced by the company responsible for the platform bt29, available at https://bt29.best ("bt29", "we", "Company"), acting as personal data controller collected in the context of providing online casino, Sports Betting, Slots, Crash Games, roulette, and other products available on the platform.

For the purposes of the General Personal Data Protection Law (LGPD — Law No. 13.709/2018), bt29 is the responsible party for determining how users' personal data is collected, stored, used, and, where applicable, shared. This policy applies to all registered users and visitors of the platform located in Brazil.

Bt29 collects different categories of personal data depending on how you interact with the platform. The table below details the main categories, specific data points, and when they are collected:

Bt29 does not collect sensitive personal data such as racial origin, religious belief, political opinion, or health information, except where strictly necessary to fulfill legal responsible gambling obligations (for example, self-exclusion reports).

The bt29 uses the personal data collected for the following purposes:

• Account management: create, maintain, and manage your user profile on the platform, including login authentication and password recovery.
• Transaction processing: process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED bank transfers in a secure and auditable manner.
• Service delivery: provide access to all games available on the platform — slots, roulette, Live Casino, crash games, jackpots, and Sports Betting (Brasileirão, Copa do Brasil, Libertadores, MMA/UFC, e-sports, NBB).
• Fraud prevention and security: identify and block fraud attempts, multiple-account abuse, money laundering, and other unlawful behavior.
• Compliance with legal obligations: comply with Brazilian regulatory requirements, including Central Bank rules, anti-money laundering legislation (Law No. 9,613/1998), and the provisions of the LGPD.
• Service communications: send account notifications, transaction confirmations, security alerts, and important platform updates.
• Marketing and promotions (with consent): send offers, promotions, tournaments, and bt29 news to users who have consented to receive such communications.
• Responsible gambling: monitor usage patterns to identify signs of compulsive gambling and, when necessary, trigger protective tools or proactive outreach.
• Platform improvement: analyze aggregated and anonymized platform usage data to improve our products, technical performance, and user experience.

Every personal data processing operation carried out by the bt29 is grounded in one of the legal bases set out in article 7 of the LGPD. The primary bases we rely on are:

• Contract performance (art. 7, V): processing necessary to perform the contracted services when you create an account and use the platform. This includes payment processing, account management, and game delivery.
• Compliance with a legal or regulatory obligation (Art. 7, II): when we are required to collect or retain data by law, such as financial records mandated by anti-money laundering legislation or identity verification for regulatory compliance.
• Consent (art. 7, I): for sending marketing communications, use of non-essential cookies, and other processing activities for which we request your explicit consent. Consent may be withdrawn at any time.
• Legitimate interest (art. 7, IX): for purposes such as fraud prevention, platform security, and product improvement, where such interests do not conflict with your fundamental rights and freedoms.
• Credit protection (art. 7, X): where applicable, for financial risk analysis and default prevention.

The bt29 does not sell your personal data. Any sharing of information with third parties occurs exclusively in the following situations, always with contractual guarantees of protection and confidentiality:

• Payment providers: to process deposits and withdrawals, your financial data is shared with the financial institutions involved in the transaction — such as Pix operators, card processors, Mercado Pago, PicPay, and partner banks (Nubank, Itaú, Bradesco, Banco do Brasil, and others). This data is transmitted in encrypted form and used solely to complete the transaction.
• Game providers: to enable access to games, basic session information is shared with game studios (such as Pragmatic Play, Evolution Gaming, PG Soft, NetEnt), which process data solely for service delivery purposes.
• Technology infrastructure: hosting, database, and security services that support bt29's operations. All vendors are contractually bound to maintain data confidentiality and security.
• Competent authorities: when required by law, court order, or request from Brazilian regulatory or law enforcement authorities, bt29 provides the requested information, without exception.
• Audits and certifications: independent auditors that verify RNG integrity and the platform's regulatory compliance may have access to aggregated or anonymized data.

The bt29 uses cookies and similar technologies to ensure the platform functions correctly and to enhance your experience. The types of cookies we use are:

• Essential cookies: required for the platform's basic operation, such as keeping your session active during login. These cannot be disabled without affecting access to our services.
• Performance cookies: collect anonymized data on how you browse the platform — which pages you visit and how long you spend in each section — to optimize the user experience.
• Functionality cookies: remember your language preferences, game settings, and other customizations so you don't have to reconfigure them on every visit.
• Analytics cookies: allow bt29 to understand aggregate usage patterns in order to improve the platform. Data is anonymized prior to analysis.

You can manage your cookie preferences through the banner displayed on your first visit or through your browser settings. Disabling non-essential cookies does not affect your access to games or financial transactions.

The bt29 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or destruction. Key measures in place include:

• 256-bit SSL/TLS encryption on all communications between client and server.
• Passwords are stored exclusively as salted hashes (bcrypt or equivalent) — never in plain text.
• Two-factor authentication (2FA) is available to all users in the security settings.
• Continuous monitoring of unauthorized access attempts with automatic blocking after multiple failed tries.
• Internal access control based on the principle of least privilege — only employees with a justified operational need have access to specific personal data.
• Encrypted backups with periodic integrity verification routines.
• Penetration testing and security audits carried out periodically by specialized external teams.

In the event of a security incident that may affect your data, bt29 will notify the National Data Protection Authority (ANPD) and the affected individuals within the timeframe required by the LGPD, providing clear information about what occurred and the measures taken.

The bt29 retains personal data for as long as necessary for each stated purpose, in compliance with mandatory legal retention periods:

• Registration and identity data: kept for as long as the account remains active and for up to 5 years after account closure, as required by anti-money laundering legislation and financial regulations.
• Financial records (deposits and withdrawals via Pix, boleto, card, TED): retained for 5 years after each transaction, in accordance with the Brazilian Civil Code and applicable tax legislation.
• Betting history and gaming sessions: retained for up to 3 years for support, dispute resolution, and regulatory compliance purposes.
• Security logs: retained for 12 months for fraud analysis and investigations.
• Support communications: retained for 2 years for quality assurance and dispute resolution purposes.
• Marketing data: retained for as long as consent remains active and for up to 6 months after revocation, for compliance record-keeping purposes.

Once retention periods expire, data is securely deleted or anonymized so that the original data subject can no longer be identified.

The bt29 ensures the full exercise of the rights set out in articles 17 to 22 of the LGPD. To submit any request regarding your personal data, follow the steps below:

• Send an email to privacidade@bt29.best with the subject line "LGPD Request – [Right Type]" (e.g., "LGPD Request – Data Access" or "LGPD Request – Deletion").
• In the body of the email, identify yourself with your full name, CPF, and the email address registered to your bt29 account.
• Clearly describe what you are requesting.

Bt29 will respond within the legal deadline of 15 business days. For complex cases requiring additional time, you will be notified of the new estimated deadline. We do not charge any fee to handle data subject rights requests.

The services of bt29 are intended exclusively for users aged 18 and over, in accordance with the regulations applicable to the betting and gambling market in Brazil. bt29 does not knowingly collect personal data from anyone under the age of 18.

If we determine that a registered user is a minor, the account will be closed immediately and all associated data will be deleted, except for records required to fulfill legal obligations. Parents or guardians who believe a person under 18 has created an account on the platform should contact support immediately at suporte@bt29.best.

Given the international nature of some of our technology partners and game providers — such as Pragmatic Play, Evolution Gaming, NetEnt, and other certified studios — some data may be processed on servers located outside Brazil.

The bt29 ensures that all international transfers of personal data take place with the appropriate safeguards required by the LGPD, including:

• Data processing agreements with protection clauses equivalent to those required under Brazilian law.
• Data transfers are made only to countries or organizations that provide an adequate level of personal data protection, as assessed by the ANPD.
• Data minimization — only the information strictly necessary to deliver each specific service is shared with international partners.

The bt29 may update this Privacy Policy periodically to reflect changes in our data processing practices, in response to legal or regulatory changes, or as a result of improvements to our internal processes.

When we make significant changes, you will be notified via the email address registered to your account with at least 15 days' notice before the updated version takes effect. A prominent notice will also be displayed on the platform during that period.

The version of this Policy currently in force is the one published at https://bt29.best/privacy-policy, with the last updated date shown at the top of the page. We recommend reviewing this Policy periodically to stay informed about how we protect your data.

For any questions, requests, or complaints relating to the processing of your personal data by bt29, please contact our Data Protection Officer (DPO):

• Privacy email: privacidade@bt29.best
• General support email: suporte@bt29.best
• Live chat: available 24 hours a day, 7 days a week, directly on the bt29 platform

Bt29's DPO is the designated point of contact for communications with the National Data Protection Authority (ANPD) and for handling data subject requests. All privacy and data protection communications are treated as a priority and addressed within the legal deadlines established by the LGPD.