Privacy Policy of only777 — how your data is protected

The only777 is a Sports Betting and online casino platform focused on the Brazilian market. We operate the site only777.best and all related services: football betting (Brasileirão Série A, Copa do Brasil, Libertadores), e-sports (CS2, League of Legends, Valorant, Free Fire), live casino, tips, and promotions.

This Privacy Policy describes how only777 collects, stores, uses, and protects the personal information of users who access and use our platform. It applies to all services offered at only777.best and to anyone who registers, accesses, or uses any feature available on the platform.

By creating an account with only777, you confirm that you have read and understood this Privacy Policy and agree to the processing of your personal data as described herein. This Policy should be read together with our Terms and Conditions and the rules of Responsible Gambling.

Only777 collects personal data at different points during your interaction with the platform. Below are the categories of data and the moments at which they are collected:

At registration:

• Full name, CPF, date of birth, and email address.
• Mobile number for account verification and communications.
• Full residential address (street, number, neighborhood, city, state, and ZIP code).
• Account password — stored exclusively as a cryptographic hash; plaintext recovery is not possible.

While using the platform:

• Betting history, results, amounts wagered, and winnings.
• Records of deposits and withdrawals, including the payment method used (Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago) and registered Pix keys.
• Preferred categories, filters used, and favorite bets.
• Session data: access time, duration, pages visited, and interactions with the system.

Automatically, when you access the platform:

• IP address and approximate geolocation data (city and state).
• Device type, operating system, browser, and version.
• Cookies and session identifiers (detailed in Section 9).
• Performance data and technical error logs for continuous platform improvement.

During identity verification (KYC):

• Official government-issued photo ID (RG, CNH, or passport).
• Proof of address issued within the last 3 months.
• Proof of ownership of the payment method, where applicable.
• Selfie or photo for facial comparison, when required by the regulatory process.

Data collected by only777 is used solely for the purposes listed below. We do not use personal data for purposes incompatible with those that originally justified its collection, except with the data subject's renewed express consent or as required by law.

• Account operation: creation, management, and authentication of your account on the platform.
• Financial processing: deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago, including verification of the payment holder's identity.
• Regulatory compliance: age verification (minimum 18 years), anti-money laundering (AML) compliance, and fulfillment of legal and regulatory obligations applicable to the betting market in Brazil.
• Experience personalization: displaying relevant content based on your betting preferences, such as Brazilian football, e-sports, or live casino.
• Communications: sending bet confirmations, withdrawal notifications, security alerts, and — with your consent — communications about platform promotions and updates.
• Security and fraud prevention: detection of unauthorized access, identification of multiple accounts, and investigation of suspicious activity.
• Continuous improvement: technical performance analysis, error identification, and improvement of the platform's interface and features.
• Responsible gambling: monitoring of betting patterns to identify risk behaviors and offer control tools, in line with the guidelines in the Responsible Gambling.

Only777 does not use your data to build behavioral profiles for third-party advertising, nor to sell or monetize personal information.

The LGPD requires that every personal data processing operation have a legal basis to support it. only777 processes your data based on the following grounds set out in Art. 7 of Law No. 13,709/2018:

• Contract performance (Art. 7, V): processing required to perform the service agreement entered into between you and only777 when you create your account — including the processing of bets, deposits, and withdrawals.
• Compliance with a legal or regulatory obligation (Art. 7, II): processing required to comply with obligations imposed by Brazilian law, including anti-money laundering regulations, age verification, and reporting to competent authorities when required.
• Legitimate interest (Art. 7, IX): processing for platform security, fraud prevention, and continuous service improvement purposes, provided there is no overriding interest or fundamental right of the data subject that requires protection of the personal data.
• Consent (Art. 7, I): for sending promotional and marketing communications, which you can withdraw at any time in your account settings or by emailing our support team.

Only777 does not sell personal data. Sharing only occurs in the situations listed below, always limited to the minimum necessary for each purpose:

• Payment processors: to enable deposits and withdrawals via Pix, bank slip, credit/debit card, PicPay, and Mercado Pago. These partners receive only the data necessary to process the transaction and are subject to contractual confidentiality obligations and LGPD compliance requirements.
• Live casino providers: partners such as Evolution Gaming and Pragmatic Play Live receive a user identifier to enable the gaming experience. We do not share your name, CPF, or financial data with these providers.
• Identity verification (KYC) providers: services used to validate identity documents and proof of address during account verification, operating as data processors under our instructions.
• Technical infrastructure: cloud hosting, database, and performance monitoring providers that host the platform. These providers act as data processors and are subject to processing agreements aligned with the LGPD.
• Competent authorities: when required by law, court order, or request from a Brazilian regulatory authority. only777 will notify the user of such requests whenever legally permitted.

Only777 applies a comprehensive set of technical and organizational measures to protect your personal data against unauthorized access, misuse, loss, alteration, or destruction:

• Encryption in transit: all communication between your device and only777's servers is protected by TLS 1.2 or higher.
• Encryption at rest: sensitive data stored in our systems — such as identity documents and financial information — is encrypted at rest.
• Hashed passwords: your login password is never stored in plain text. We use secure hashing algorithms to ensure that not even only777 employees have access to your original password.
• Access control: only employees with a verified operational need have access to users' personal data, and that access is audited and logged.
• Security monitoring: intrusion detection systems and continuous monitoring to identify and respond quickly to security incidents.
• Regular updates: the platform's technical infrastructure is kept up to date with the latest security patches.

In the event of a security incident that may affect your personal data, only777 is committed to notifying you within the timeframe required by the LGPD and taking all necessary corrective action. Relevant incidents will also be reported to the National Data Protection Authority (ANPD) as required by law.

Only777 retains your personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal, regulatory, and contractual obligations:

• Active account data: retained for as long as your account remains active on the platform.
• Financial transaction data: retained for a minimum of 5 years from the transaction date, in accordance with Brazilian tax and anti-money laundering legislation.
• Identity verification documents (KYC): retained for the period required by the regulatory standards applicable to the betting market, generally no less than 5 years.
• Betting data and gaming history: retained for up to 5 years for audit purposes, dispute resolution, and regulatory obligations.
• Security log data: retained for up to 12 months for fraud investigation and platform security purposes.
• After a deletion request: data that is not legally required to be retained will be deleted within 30 calendar days of the request, provided there is no legal obligation to keep it.

When data is no longer needed for any of the intended purposes, it is securely deleted or anonymized so that the data subject can no longer be identified.

The LGPD grants you, as the owner of personal data processed by only777, a robust set of rights. See below what you can request and how to exercise each right:

To exercise any of these rights, send an email to suporte@only777.best with the subject line "LGPD Rights — [your full name]". The only777 DPO will respond within the stated timeframe and may request identity verification to protect your data from unauthorized requests.

If you believe your rights have not been adequately addressed, you may file a complaint with the National Data Protection Authority (ANPD), the government body responsible for overseeing LGPD enforcement in Brazil.

Only777 uses cookies and similar technologies to improve the platform experience, secure sessions, and understand how users interact with the site. The types of cookies we use are listed below:

You can manage or block cookies directly in your browser settings (Chrome, Firefox, Safari, Edge). Blocking essential cookies may affect platform functionality, including login and betting. Similar technologies such as localStorage and sessionStorage are used to store temporary session preferences on your device.

Only777 does not offer any services to individuals under 18. Our platform is strictly intended for adults with full legal capacity to enter into contracts in Brazil.

We do not intentionally collect personal data from users under 18. If we identify that an account was created by a minor, we will immediately close the account and delete all associated data. If you believe a minor has misused the platform, please contact us at suporte@only777.best so we can take the appropriate steps.

Only777 performs age verification during registration and may request supporting documents at any time. Parental control tools are available for parents and guardians who wish to restrict minors' access to betting sites.

Only777 may use technical infrastructure providers that operate servers outside Brazil — such as cloud computing services and some live casino providers. When personal data of Brazilian users is processed abroad, we apply the following safeguards as set out in the LGPD:

• Transfers only to countries or organizations that offer an adequate level of data protection, as determined by ANPD criteria.
• Specific contractual clauses that impose on the recipient obligations equivalent to those required under the LGPD.
• Data protection impact assessments when transfers involve sensitive data or significant volumes.

In no case is complete financial data — such as card numbers or detailed banking information — transferred internationally. Financial processing is handled by certified partners in Brazil or by intermediaries that comply with PCI-DSS standards.

You have the right to be informed about any international transfers involving your data and may request details from the only777 DPO at suporte@only777.best.

Only777 may update this Privacy Policy periodically to reflect changes in our services, applicable legislation, or data protection practices. All changes are communicated to users via their registered email and through a prominent notice on the platform at least 7 days in advance, unless a legal obligation requires immediate implementation.

The effective date of the current version is shown at the top of this page. We recommend reviewing this Policy regularly to stay informed about how only777 handles your data.

If substantial changes are made — particularly regarding the purposes for which data is used or the categories of data collected — we will request your consent again where required by the LGPD.

To exercise your rights as a data subject, clarify any questions about this Privacy Policy, or report concerns about how your data is handled, please get in touch through the channel below:

• Email: suporte@only777.best
• Contact for privacy matters: "LGPD Rights — [your full name]"
• Live chat: available within the platform after login, 24 hours a day

The Data Protection Officer (DPO) of only777 is responsible for ensuring LGPD compliance, handling data subject requests, and serving as the point of contact with the National Data Protection Authority (ANPD). You can reach the DPO directly at the email address above, with the subject line "DPO — only777".

The standard response time for LGPD-related matters is up to 15 calendar days, as provided by law. For urgent account security issues, chat support responds within minutes.