Privacy Policy of 30wil – Protecting Your Data

This Privacy Policy applies to all users who access or use the services of the platform 30wil, available at https://30wil.com and the associated mobile apps for Android and iOS. 30wil acts as controller of personal data processed in connection with its Sports Betting services — including football (Brasileirão, Copa do Brasil, Libertadores), UFC/MMA, basketball (NBB), volleyball, e-sports, and other disciplines — as well as online casino games such as slots, roulette, poker, crash games, and Live Casino.

For the purposes of this Policy, "personal data" means any information that, alone or in combination with other data, can identify or make identifiable a natural person — such as name, CPF, email address, phone number, home address, or financial data. 30wil processes this data in accordance with the General Data Protection Law (Lei nº 13.709/2018 – LGPD) and other applicable Brazilian regulations.

By creating a 30wil account, making a deposit via Pix, boleto or credit card, or simply browsing the platform, you confirm that you have read and understood this Privacy Policy. If you have any questions, please reach out before proceeding at privacidade@30wil.com.

30wil collects only the data strictly necessary to provide its services. The categories of data collected and the situations in which collection occurs are outlined below:

30wil does not collect data in sensitive categories such as racial origin, religious beliefs, political opinions, health data, or sexual orientation. We also do not collect full credit or debit card numbers — that data is processed directly by payment operators in a secure, certified environment.

30wil uses the personal data collected for the following specific purposes:

• Account creation and management: processing registration, verifying user identity, and maintaining secure access to the platform;
• Providing betting and casino services: process Sports Betting on Brasileirão, UFC, NBB, and other sports, as well as crash games, roulette, poker, slots, and live casino;
• Processing financial transactions: receive deposits via Pix, boleto, credit/debit card, PicPay, Mercado Pago and wire transfer, and process withdrawals to the account holder's bank account or Pix key;
• Fraud and money laundering prevention: verify user identities, detect anomalous behavior, and fulfill legal obligations related to the prevention of financial crimes (Lei nº 9.613/1998);
• Customer support: resolve questions, complaints, and requests via live chat and email, in Brazilian Portuguese, 24 hours a day;
• Marketing communications: send promotions, bonuses, and 30wil news only for users who have consented to this type of communication;
• Service improvement: analyze usage patterns, identify bugs and improve platform features based on aggregated, anonymized data;
• Legal compliance: comply with court orders, requests from Brazilian regulatory authorities, and applicable tax obligations.

30wil does not use your data for purposes other than those listed above without prior notice and, where required, obtaining fresh consent. Automated decisions with a significant impact on users — such as account blocking due to suspected fraud — are always reviewed by a member of 30wil's human team before becoming final.

Every personal data processing activity carried out by 30wil is grounded in at least one of the legal bases set out in Article 7 of the LGPD:

• Performance of a contract (art. 7, V): processing is required to provide the services the user contracted when creating a 30wil account — including bet processing, deposits, and withdrawals;
• Compliance with a legal obligation (art. 7, II): identity verification (KYC), anti-money laundering, and other obligations required under current Brazilian law;
• Consent (art. 7, I): sending marketing communications, personalized promotions, and use of non-essential cookies — always with the option to withdraw consent;
• Legitimate interest (art. 7, IX): security analysis, fraud prevention, service improvement, and risk management, provided these activities do not infringe on the fundamental rights and freedoms of the data subject.

When processing is based on consent, you may withdraw it at any time without affecting processing activities carried out prior to the withdrawal. Revoking consent for marketing communications does not affect account access or bet processing on the 30wil platform.

30wil does not sell, rent, or transfer users' personal data to third parties for commercial purposes. Sharing is restricted to the situations listed below, always with appropriate contractual and technical safeguards:

• Payment service providers: financial institutions and payment platforms (such as Pix processors, credit card acquirers, PicPay, and Mercado Pago) receive only the data strictly necessary to process financial transactions. All payment partners hold PCI-DSS certification and are subject to Banco Central do Brasil regulations;
• Technology and games providers: slots, Live Casino, and crash game providers receive anonymized or pseudonymized identifiers to operate the contracted games — never full personal data such as CPF or address;
• Identity verification services: certified KYC platforms that assist with document verification and fraud detection, operating under a data processing agreement with 30wil;
• Competent authorities: data may be shared with government agencies, the Receita Federal, COAF, Polícia Federal, or the Ministério Público upon court order or formal legal request. 30wil has no control over how authorities use the data once it has been provided;
• Auditors and legal advisors: professionals bound by professional secrecy and confidentiality agreements who access data only when necessary to provide their services to 30wil.

Any third party that receives personal data from 30wil users is contractually required to treat that information confidentially, use it solely for the agreed purpose, and implement security measures consistent with those required by the LGPD.

30wil uses cookies and similar technologies to ensure the platform works correctly and to deliver a personalized experience. Cookies are organized into the following categories:

• Essential cookies: required for the platform's core functionality — session authentication, account security, and betting processes. They cannot be disabled without compromising your use of 30wil's services;
• Performance cookies: collect aggregated and anonymized browsing data to identify errors, measure load times, and improve platform performance on mobile and desktop;
• Functionality cookies: store user preferences such as language, preferred odds format, and interface settings to personalize your experience on 30wil;
• Analytics cookies: used to understand how users navigate the platform — which sections are visited most, which games drive the most engagement, and which features are underused. Data is processed in aggregate form.

30wil does not use tracking cookies for third-party behavioral advertising. You can manage your cookie preferences in your browser settings or through the preference center available on the platform. Disabling non-essential cookies may limit some personalization features.

30wil retains users' personal data for as long as necessary for the purposes for which it was collected, in compliance with the minimum retention periods established by Brazilian law:

• Active account data: retained for as long as the account is active on the 30wil platform. After account closure, data is anonymized or deleted upon user request, subject to applicable legal retention periods;
• Financial and betting records: retained for a minimum of 5 years after the transaction, as required by Brazilian tax legislation (Law No. 9,613/1998 and Central Bank regulations);
• Identity verification documents (KYC): retained for a minimum of 5 years after account closure, in compliance with legal anti-money laundering obligations;
• Support communication logs: retained for 2 years for dispute resolution and service improvement purposes;
• Analytics cookie data: retained for no longer than 13 months in aggregated form, after which they are automatically discarded.

Once mandatory retention periods expire, data is securely deleted or anonymized so that the individual can no longer be identified. 30wil maintains an internal record of processing operations and the applicable retention period for each data category.

30wil implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, accidental loss, destruction, or improper disclosure. The main security measures include:

• 256-bit SSL/TLS Encryption across all communication between the user's device and 30wil's servers;
• Password storage stored exclusively as a salted hash — even in the event of a technical breach, passwords are never exposed in plain text;
• Two-factor authentication (2FA) available and recommended for all 30wil accounts;
• Continuous monitoring of suspicious access, failed login attempts, and anomalous behavior in real time;
• Role-based access control (RBAC) for internal staff — access is granted only to those who need it, and always with a log entry;
• Penetration testing and security audits conducted periodically by independent specialized firms;
• Incident response plan documented, with notification to the ANPD and affected users within 72 hours in the event of an incident that may cause risk or harm.

Despite 30wil's best efforts, no system is 100% breach-proof. If you suspect unauthorized access to your account, contact support immediately via live chat or at contato@30wil.com. 30wil strongly recommends using unique passwords and enabling 2FA to keep your account secure.

The LGPD grants you, as a data subject, a set of rights that 30wil is committed to respecting and making easy to exercise. You may exercise any of the rights below by submitting a request to privacidade@30wil.com, including your request details and proof of identity:

• Access (Art. 18, II): request confirmation that processing is taking place and obtain a copy of the personal data 30wil holds about you;
• Correction (art. 18, III): request the correction of any incomplete, inaccurate, or outdated information on your account;
• Anonymization or erasure (art. 18, IV): request the anonymization of unnecessary or excessive data, or the deletion of data processed on the basis of consent — subject to mandatory legal retention periods;
• Portability (art. 18, V): request the transfer of your personal data to another controller, in a structured and interoperable format;
• Withdrawal of consent (art. 18, IX): withdraw consent for processing based on that legal basis, such as receiving marketing communications;
• Information on data sharing (art. 18, VII): know which public and private entities 30wil shares your data with;
• Right to object (art. 18, § 2º): object to processing carried out on the basis of legitimate interest, where you believe your fundamental rights take precedence.

30wil responds to rights exercise requests within 15 business days from the date of receipt. In more complex cases, this deadline may be extended by an equal period, with notice to the data subject. If you believe your rights have been violated, you may also file a complaint with the National Data Protection Authority (ANPD) at gov.br/anpd.

30wil services are intended exclusively for individuals of 18 years of age or older. The platform does not intentionally collect personal data from minors. Registration requires a valid CPF, and the identity verification process includes confirmation that the user has reached the legal age of majority.

If 30wil identifies that personal data from a minor was inadvertently collected, the following steps will be taken immediately:

• Account closure and access blocking;
• Deletion of all personal data belonging to the minor from 30wil's systems;
• Refund of any outstanding balance to the original deposit account;
• Notification to the legal guardian, if identified.

If you suspect that someone under 18 has created a 30wil account, contact us immediately at privacidade@30wil.com or via live chat. We take these situations very seriously and act quickly to resolve them.

Some of the technology and service providers 30wil uses — such as cloud server infrastructure, casino game platforms, and security analytics systems — may process data on servers located outside Brazil. When this occurs, 30wil ensures that:

• Data is transferred only to countries or organizations that provide an adequate level of protection in accordance with LGPD and ANPD standards;
• Specific data protection clauses are included in all contracts with vendors that process Brazilian users' data outside the country;
• Only the minimum data required to deliver each specific service is transferred — full personal details such as tax ID numbers and identity documents are never shared with international providers without a proven need and appropriate safeguards.

30wil maintains an up-to-date record of all international data transfers and the applicable protection mechanisms. This record is available upon request to the DPO at privacidade@30wil.com.

30wil may update this Privacy Policy periodically to reflect changes in the services offered, applicable legislation, or data protection practices. Material changes will be communicated with a minimum advance notice of 15 days by:

• Prominent notice on the 30wil platform homepage;
• Email notification to the address registered on the user's account;
• Push notification via the Android or iOS app, if the feature is enabled.

Continued use of the platform after the effective date of any changes constitutes acceptance of the updated version. If you do not agree with the changes, you may close your account and request deletion of your data before they take effect — subject to mandatory legal retention periods. The current version of this Policy is always available at https://30wil.com/privacy-policy, with the date of the last update shown at the top of the document.

To exercise any right outlined in this Policy, clarify questions about how your data is processed, or submit a privacy-related complaint, contact 30wil through the channels below:

• Privacy email (DPO): privacidade@30wil.com — for LGPD rights requests, with a response time of up to 15 business days;
• General email: contato@30wil.com — for general questions about the service;
• Live chat: available 24/7 directly on the 30wil platform, with response times under 3 minutes during peak hours — support in Brazilian Portuguese.

If you believe 30wil has violated your privacy rights and have not received a satisfactory response through the channels above, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), the regulatory body responsible for enforcing the LGPD in Brazil.