Lua777 Privacy Policy – Data Protection in Brazil

A lua777 is the Sports Betting and online casino platform available at lua777.best, operated by the company responsible for the service, duly registered in accordance with applicable law. For the purposes of this Privacy Policy, lua777 acts as Controller of personal data collected from its users, as defined by the General Data Protection Law (LGPD — Law No. 13,709/2018).

As the Data Controller, lua777 is responsible for determining the purposes and means of personal data processing, always in accordance with the principles of necessity, purpose limitation, adequacy, transparency, security, prevention, non-discrimination, and accountability established by the LGPD.

Lua777's Data Protection Officer (DPO) can be reached at privacidade@lua777.best for any questions related to the processing of your personal data.

A lua777 collects personal data at various points during your interaction with the platform. The table below summarizes the data categories, collection moments, and associated purposes.

We do not collect sensitive personal data beyond what is strictly required to meet legal obligations — such as health data in the context of responsible gambling programs, which is collected only with the user's explicit consent.

Each piece of data collected by lua777 has a specific and defined purpose. We do not use personal data for purposes incompatible with those listed below.

• Provision of contracted services: Creating and managing your account, processing deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago, recording Sports Betting wagers, and Live Casino sessions.
• Identity Verification (KYC): To confirm you are at least 18 years old and that the information provided corresponds to a real person, as required by regulation.
• Fraud and money laundering prevention: Monitoring transactions to detect suspicious behavioral patterns, in compliance with obligations imposed by applicable Brazilian law on the sector.
• Operational communication: To send registration confirmations, deposit and withdrawal notifications, security alerts, Terms and Conditions updates, and important account communications.
• User support: Log and resolve questions, complaints, and requests submitted to our Portuguese-language support team.
• Responsible gambling: Monitoring usage patterns to identify signs of problem gambling behavior and triggering protective measures in accordance with the platform's responsible gambling policy.
• Personalized marketing (with consent): Send offers, promotions, and updates about lua777 by email or SMS — only if you choose to receive them. You can unsubscribe at any time.
• Product improvement: Analyzing aggregated and anonymized usage data to improve the interface, withdrawal speed, and overall platform experience.

All personal data processing carried out by lua777 has an adequate legal basis as set out in Article 7 of the LGPD. The legal bases we rely on are:

• Contract performance (art. 7, V): Processing necessary to provide the services you agreed to when creating your account — handling bets, deposits, and Pix withdrawals, managing bonuses, and maintaining your gaming history.
• Fulfillment of a legal obligation (art. 7, II): Age verification (minimum 18 years), anti-money laundering compliance, and retention of financial records as required by the Federal Revenue Service and the Central Bank of Brazil.
• Legitimate interest (art. 7, IX): Fraud prevention, platform security, monitoring of suspicious activity, and continuous service improvement — always with proportionality analysis and full respect for your rights.
• Consent (art. 7, I): Sending marketing communications by email or SMS, enabling non-essential cookies, and collecting sensitive data in responsible gambling contexts. Consent may be withdrawn at any time.

A lua777 does not sell or rent personal data. Sharing only occurs in the situations below, with contractual guarantees of confidentiality and security.

• Payment processors: Technical partners responsible for processing Pix, bank slip, credit/debit card, PicPay, and Mercado Pago payments. These partners receive only the data necessary to complete each specific transaction.
• Identity verification (KYC) providers: Specialized companies in CPF and identity document validation, operating under the same security standards as lua777.
• Casino game providers: Developers of slots, live Blackjack, and crash games receive anonymous session identifiers — never personally identifiable data such as name or CPF.
• Competent authorities: When required by law, court order, or regulation applicable to the betting and gaming sector in Brazil — including the Receita Federal, Banco Central, Financial Activities Control Council (COAF), and National Data Protection Authority (ANPD).
• Auditors and legal advisors: In internal or external audit processes, subject to contractual confidentiality obligations.

All partners and operators with access to lua777 users' personal data are contractually required to process that information in compliance with the LGPD and the platform's security standards.

A lua777 implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, alteration, improper disclosure, or destruction.

• Encryption in transit: All communication between your device and lua777's servers uses TLS 1.3 protocol with a 256-bit SSL certificate — the banking-grade security standard.
• Encryption at rest: Sensitive data stored on our servers — such as KYC documents and financial information — is encrypted using industry-standard algorithms.
• Access control: Internal access to users' personal data is restricted by role — only team members who need access to specific data to perform their responsibilities are granted that permission.
• Ongoing monitoring: Intrusion detection systems and security monitoring operate around the clock across lua777's environments.
• Two-factor authentication: Available to all users under the account security section — we strongly recommend enabling it.
• Incident response: In the event of a security incident that may affect personal data, lua777 will notify the affected users and the ANPD within the timeframes established by the LGPD.

A lua777 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

• Active account data: Retained for as long as your account is active or while a contractual relationship is in effect.
• Financial and transaction data: Retained for a minimum of 5 years after account closure, as required by Brazilian tax legislation and applicable anti-money laundering regulations.
• KYC documents: Retained for a minimum of 5 years after account closure for regulatory audit purposes.
• Marketing data (with consent): Deleted immediately upon consent withdrawal or deletion request.
• Support history: Retained for 3 years for quality management and dispute resolution purposes.

Once applicable retention periods have expired, data is securely and irreversibly deleted from our systems or anonymized for internal statistical purposes.

To exercise any of the rights guaranteed by the LGPD regarding your personal data processed by lua777, you can:

• Live chat: Access the in-platform support chat, available 24 hours a day, and let the agent know you wish to exercise a data subject right. You will be directed to the appropriate process.
• DPO Email: Send a message to privacidade@lua777.best with the subject line "Exercise of Rights — LGPD", your registered CPF, and a clear description of what you are requesting (access, correction, deletion, portability, etc.).
• Response time: Up to 15 business days for access and portability requests. Up to 30 days for deletion — subject to mandatory legal retention periods.
• Identity verification: To protect you, lua777 may request identity confirmation before processing data deletion or portability requests.

A lua777 uses cookies and similar technologies to ensure the platform works correctly, improve the user experience and, with your consent, personalize content and ads.

• Essential cookies: Required for basic platform functionality — session authentication, security, and language preferences. These cannot be disabled without affecting your use of the platform.
• Analytical cookies: Collect aggregated data on how users navigate lua777 — pages visited, session duration, and traffic source. Used exclusively for product improvement. Activated only with your consent.
• Preference cookies: Store your display preferences — such as your favorite sport or preferred game type — to personalize your experience. Activated only with your consent.
• Marketing cookies (with consent): Used to deliver relevant promotions based on your gaming profile. You can opt out of this type of cookie at any time through the cookie preferences panel.

You can manage your cookie preferences at any time through the cookie banner displayed on your first visit or via the privacy section in your settings panel. Rejecting non-essential cookies does not affect access to lua777's core features.

A lua777 is a platform exclusively for users aged 18 and over. We do not intentionally collect, process, or store personal data belonging to minors.

New user registration is validated by CPF against official Brazilian government databases — which technically prevents anyone under 18 from completing the account creation process. Accounts found to contain data belonging to minors are closed immediately and their data is deleted.

If you are a parent or guardian and believe a minor has created a lua777 account without authorization, please contact us immediately at privacidade@lua777.best or via the support chat. We will handle the case as a priority.

A lua777 may update this Privacy Policy periodically to reflect changes in Brazilian legislation, our data processing practices, or the product.

• Notification of material changes: Changes that significantly affect your rights or the way we process your data will be communicated to your registered email address at least 10 days in advance.
• Effective date: Each version of this Policy clearly states the date of the last update at the top of the document.
• Previous versions: Previous versions of this Policy may be requested by emailing privacidade@lua777.best.
• Continued use: Continued use of the platform after a new version of this Policy takes effect constitutes acceptance of the changes made.

For any questions related to the processing of personal data by lua777, please contact our Data Protection Officer (DPO):

• DPO Email: privacidade@lua777.best
• General support channel: suporte@lua777.best
• Live chat: Available 24 hours a day within the platform for urgent matters
• Response time: Up to 5 business days for privacy inquiries, up to 15 business days for rights exercise requests

Governing law: This Policy is governed by the laws of the Federative Republic of Brazil, in particular the General Data Protection Law (Lei nº 13.709/2018) and any regulations issued by the National Data Protection Authority (ANPD).