1uuu Privacy Policy – How We Protect Your Data

This Privacy Policy applies to the 1uuu, accessible at 1uuu.click, and describes how we handle the personal data of users who register and use our sports betting, live casino, crash games, blackjack, roulette, jackpot, and other platform features.

A 1uuu acts as the data controller for the personal data collected and processed under this policy, as defined by Article 5, Section VI of the General Data Protection Law (LGPD – Law No. 13,709/2018). For any questions related to data processing, users may contact our Data Protection Officer (DPO) directly at privacidade@1uuu.click.

This Policy should be read in conjunction with the Terms and Conditions and with the guidelines of Responsible Gambling of the 1uuu, which form an integral part of the relationship between the platform and the user.

A 1uuu collects only the data necessary to provide its services, comply with legal obligations, and continuously improve the user experience. We collect data across three main categories:

Data provided directly by the user:

• Full legal name;
• CPF (Brazilian Individual Taxpayer Registry);
• Date of birth;
• Email address;
• Mobile phone number;
• Full residential address (zip code, street, city, state);
• Identity documents (national ID, driver's license, or passport) and proof of address, when requested during the KYC verification process;
• Banking and payment data (Pix key, tokenized credit or debit card details — we never store your full card number).

Data collected automatically during platform use:

• IP address and approximate geolocation;
• Device type, operating system, and browser version;
• In-platform browsing history (pages visited, session duration, clicks);
• Complete history of bets, deposits, withdrawals, and casino games;
• Cookies and session identifiers (detailed in Section 6);
• Access logs with date, time, and connection origin.

Data received from third parties:

• Financial transaction confirmations received from payment processors (Pix via Banco Central, card operators, PicPay, Mercado Pago);
• Identity verification data from credit bureaus or authorized document validation services;
• Fraud prevention information from certified security partners.

A 1uuu uses collected personal data exclusively for the following purposes:

A 1uuu does not use users' personal data for purposes incompatible with those described above without prior notice and, where applicable, without obtaining fresh consent.

All personal data processing carried out by 1uuu is grounded in one of the legal bases set out in Article 7 of the LGPD. The main legal bases we rely on are:

• Performance of a contract (art. 7, V): Data processing is necessary to provide the services contracted by the user upon creating an account at 1uuu, including account management, bet processing, and withdrawals via Pix;
• Compliance with a legal or regulatory obligation (art. 7º, II): Identity verification (KYC), anti-money laundering compliance (pursuant to Law No. 9,613/1998), and responsible gambling records are legal requirements that justify the processing of certain data without the need for additional consent;
• Consent (art. 7º, I): For marketing communications, promotions, personalized offers, and non-essential communications, 1uuu requests the user's explicit and separate consent. Consent may be withdrawn at any time;
• Legitimate interest (Art. 7, IX): For aggregated platform usage analysis, user experience improvement, and internal fraud prevention, provided these purposes do not override the fundamental rights of the data subject.

A 1uuu does not sell, rent, or trade users' personal data. Data sharing occurs only in the situations described below and always with appropriate contractual safeguards:

• Payment processors: Financial data is shared with payment providers such as Pix system operators (via Banco Central do Brasil), credit/debit card acquirers, PicPay, and Mercado Pago, solely to process transactions requested by the user. These partners are contractually required not to use the data for any other purpose;
• Technology providers: Cloud infrastructure, CDN, and security monitoring services that support platform operations access data in a controlled manner and under data processing agreements compatible with the LGPD;
• Casino game providers: For the operation of live blackjack, roulette, and baccarat tables, minimal data is shared with licensed studio operators. This data is limited to session identifiers and betting history required for game auditing;
• Regulatory and judicial authorities: 1uuu shares data with competent authorities (Federal Revenue Service, COAF, Central Bank, law enforcement) when required by law, court order, or applicable regulation;
• Anti-fraud services: Behavioral and transaction data are processed by certified fraud prevention tools to protect users' assets and the integrity of the platform.

No personally identifiable data is shared with advertisers, brokers, insurers, or any other entities for commercial purposes unrelated to the direct operation of the 1uuu.

The platform 1uuu uses cookies and similar technologies to ensure the platform works correctly, personalize the user experience, and collect aggregated analytical data. Cookies are small text files stored on your device — computer, phone, or tablet — when you access the platform.

Types of cookies used by 1uuu:

• Essential cookies: Required for the basic operation of the platform — session authentication, bet slip management, and security preferences. They cannot be disabled without compromising service functionality;
• Analytical cookies: Used to understand how users navigate the platform, which sections are most visited, and where difficulties arise. Data is processed in aggregated, anonymized form;
• Functionality cookies: Store user preferences such as selected language, interface settings, and favorite blackjack tables to personalize the experience;
• Performance cookies: They monitor loading times and platform stability, especially during live Sports Betting streams for the Brasileirão and casino tables.

A 1uuu does not use third-party cookies for behavioral advertising or cross-site tracking purposes.

A 1uuu adopts technical and organizational measures in line with the information security standards required by the financial and digital entertainment industries to protect users' personal data against unauthorized access, alteration, disclosure, or destruction.

The main security measures in place include:

• 256-bit SSL/TLS Encryption: All communications between the user's device and 1uuu's servers are encrypted in transit, including the submission of registration data, bets, and payment information via Pix, boleto, or card;
• Encrypted storage: Sensitive data stored in 1uuu's databases — such as identity documents and banking details — is encrypted at rest using AES-256 algorithms;
• Two-factor authentication (2FA): Available to all users as an additional layer of account access protection;
• Internal access controls: Access to users' personal data by 1uuu staff is limited to the minimum necessary for each role, with all access recorded in auditable logs;
• Continuous monitoring: Automated intrusion detection and anomalous behavior systems operate 24 hours a day to identify unauthorized access attempts;
• Periodic security testing: The platform undergoes regular penetration testing (pentest) carried out by independent specialized firms.

A 1uuu retains users' personal data for as long as necessary to fulfill the purposes for which it was collected, or to meet legal, regulatory, and contractual obligations. Retention periods vary by data category:

• Registration and active account data: Retained for the entire duration of the user's account on the platform;
• Financial transaction history: Retained for a minimum of 5 years after account closure, as required by Brazilian tax and anti-money laundering legislation;
• Identity verification documents (KYC): Retained for a minimum of 5 years after account closure, as required by COAF and the Central Bank of Brazil;
• Security and access logs: Retained for 2 years for audit purposes and investigation of potential fraud;
• Marketing communications data: Deleted within 30 days of the user withdrawing consent.

Once the applicable retention period ends, data is securely deleted or irreversibly anonymized so that the individual can no longer be identified. Users may request data deletion as described in Section 9 of this policy; however, early deletion is not possible for data kept under a regulatory obligation.

The LGPD grants users a set of rights over their personal data that 1uuu fully respects. You may exercise any of the rights below at any time by emailing privacidade@1uuu.click or through the platform's support chat:

• Confirmation & Access (art. 18, I and II): Request confirmation that your data is being processed and access the data 1uuu holds about you in a readable format;
• Correction (art. 18, III): Request the correction of inaccurate, incomplete, or outdated information in your account;
• Anonymization, Blocking, or Deletion (art. 18, IV): Request the anonymization or deletion of unnecessary data or data processed in violation of the LGPD;
• Data Portability (art. 18, V): Request the portability of your data to another service provider, in accordance with ANPD regulations;
• Deletion following withdrawal of consent (art. 18, VI): After withdrawing consent for processing based on that legal basis, request the deletion of the corresponding data;
• Information on data sharing (art. 18, VII): Obtain information about which public and private entities 1uuu has shared your data with;
• Withdrawal of consent (art. 18, IX): Withdraw consent for non-essential processing, such as marketing, at any time and at no cost;
• Right to Object (art. 18, § 2º): Object to processing based on legitimate interest when it is not in compliance with the LGPD.

If you are unsatisfied with how your request was handled, you have the right to contact the National Data Protection Authority (ANPD) at www.gov.br/anpd, the body responsible for enforcing the LGPD in Brazil.

The services of 1uuu are intended exclusively for users aged 18 and over. The platform does not collect, process, or seek to receive personal data from minors. Registration requires a valid CPF, and date of birth is verified during the account creation process.

Should the 1uuu identifies that personal data from a minor has been inadvertently collected, all such information will be deleted immediately and the corresponding account will be closed. The minor's legal guardian will be notified, and the case may be reported to the relevant authorities as required by law.

Parents or legal guardians who suspect that a minor has created an account with 1uuu should contact us immediately at privacidade@1uuu.click so that the necessary steps can be taken as a matter of urgency.

To operate certain platform services — particularly those related to cloud infrastructure and live casino game providers — data may need to be processed on servers located outside Brazil.

When international data transfers occur, the 1uuu guarantees that:

• The destination country offers a level of personal data protection compatible with the LGPD, as assessed by the ANPD; or
• The recipient is party to data processing agreements that include standard contractual clauses providing a level of protection equivalent to that required under Brazilian law; or
• The transfer is necessary to perform the contract entered into with the user (for example, to process a real-time bet at a live blackjack table hosted on international infrastructure).

In all cases, the 1uuu contractually requires international partners to implement security measures equivalent to those applied internally, and prohibits them from using the received data for any purposes beyond those contractually established.

A 1uuu may update this Privacy Policy periodically to reflect changes in data processing practices, new legal requirements, or improvements to the services offered. The version in force is always the one published on this page, with the date of the last update indicated at the top of the document.

Changes that expand the scope of data processing or modify the applicable legal bases will be communicated to users by email at least 7 days before taking effect. For changes involving consent-based processing, a new consent will be requested before the changes come into force.

Continued use of the platform after the effective date of any changes implies awareness and acceptance of the new terms. If you do not agree with the changes, you may request account closure and withdrawal of your available balance before the effective date.

In accordance with article 41 of the LGPD, the 1uuu has appointed a Data Protection Officer (DPO) responsible for serving as the communication channel between the platform, data subjects, and the National Data Protection Authority (ANPD).

The Data Protection Officer of 1uuu can be reached through the following channels:

• Dedicated email: privacidade@1uuu.click — dedicated exclusively to LGPD-related requests, exercise of data subject rights, and questions about this Policy;
• General support: suporte@1uuu.click or 24-hour live chat on the platform, for general inquiries that may relate to privacy;
• Response time: Up to 15 days for standard requests, extendable by an equal period with justification for complex cases.