X333 Privacy Policy – Data Protection in Brazil

The x333 platform, available at x333.express, is the controller of personal data processed under this Privacy Policy. As controller, x333 determines the purposes and means of processing personal information belonging to registered users and visitors of the platform.

For privacy and data protection matters, the official contact channel is our Portuguese-language support, available 24 hours a day via the platform chat or by email at suporte@x333.express. Requests categorized as "LGPD Rights" have a response deadline of up to 15 business days.

X333 operates in compliance with the Lei Geral de Proteção de Dados Pessoais (LGPD — Law No. 13,709/2018) and with all other applicable rules governing the processing of personal data in Brazil. Use of the platform implies awareness of and agreement with the terms of this policy.

X333 collects personal data in three main contexts: registration and identity verification, platform use, and financial transactions. In each context, we collect only the minimum necessary for the stated purpose.

X333 does not collect biometric data beyond selfies for identity verification, does not access the content of phone calls, and does not track the user's device GPS location.

Every piece of data collected by x333 has a specific, declared purpose. We do not use data for purposes incompatible with those described below without prior notice and, where applicable, renewed consent.

• Account operation: authentication, balance management, betting history, and access to platform services;
• Financial processing: deposits via Pix, bank slip, credit and debit card, PicPay, Mercado Pago, and withdrawals to the registered Pix key;
• Identity verification (KYC): verify the identity of the data subject, prevent fraud, and fulfill regulatory obligations related to anti-money laundering;
• VIP Program: calculate points, levels, and weekly cashback based on betting volume and net losses for the period;
• Security and fraud prevention: detect suspicious behavior, multiple accounts, bot usage or any attempt to manipulate x333's systems;
• Customer support: resolve questions, account issues, and withdrawal requests with the full history available to the support agent;
• Responsible gambling: monitor usage patterns that may indicate problematic behavior and proactively trigger support tools;
• Marketing (with consent): send communications about promotions, bonuses, new games, and sporting events to users who have opted in to receive them;
• Legal compliance: comply with obligations imposed by law, financial regulators, and competent authorities in Brazil.

The LGPD requires that all processing of personal data have a specific legal basis. x333 processes data based on the following legal grounds set out in art. 7 of Lei nº 13.709/2018:

• Contract performance (art. 7, V): processing required to operate your account, handle deposits and withdrawals via Pix and card, calculate the VIP Program, and deliver the services you agreed to when creating your x333 account;
• Compliance with a legal obligation (art. 7, II): KYC verification, anti-money laundering compliance, retention of financial records for the legally required period, and responding to requests from judicial or regulatory authorities;
• Legitimate interest (art. 7, IX): fraud prevention, system security, behavioral analysis for responsible gambling, and platform improvement — always with adequate safeguards for data subjects' rights;
• Consent (art. 7, I): marketing communications, non-essential cookies, and behavioral analysis for experience personalization — all consents are revocable at any time.

Where processing is based on consent, you have the right to withdraw it at any time, without affecting any processing carried out prior to that withdrawal or any processing based on other legal grounds.

X333 does not sell, rent, or transfer personal data of users to third parties for commercial purposes. We share information only in the situations below, with the corresponding safeguards:

• Payment processors: financial institutions and technology providers that operate payments via Pix (integrated with the Banco Central system), boleto bancário, credit and debit cards, PicPay, and Mercado Pago. These partners receive only the data strictly necessary to process each transaction;
• Game providers: companies such as Pragmatic Play, Evolution Gaming, Spribe, and other casino providers receive an anonymized user identifier for game session purposes — they do not receive your name, CPF, or full financial data;
• Identity verification services: KYC platforms that assist with document verification and fraud prevention, operating as data processors under x333's instructions;
• IT Infrastructure: cloud hosting providers, CDN and security services that process data as part of the platform's technical operation, always under appropriate data protection agreements;
• Legal obligation: when required by law, court order, tax authority, financial regulator or any competent authority in Brazil, x333 will share the requested data within the terms and limits determined.

Some service providers used by x333 — such as cloud hosting platforms and international game providers — may process data on servers located outside Brazil. When such transfers occur, x333 takes the measures required by the LGPD to ensure a level of protection equivalent to that established under Brazilian law:

• Contracts with standard data protection clauses;
• Transfers only to countries with an adequate level of protection recognized by the ANPD (Autoridade Nacional de Proteção de Dados), or with specific guarantees negotiated in advance;
• Data minimization in transfers — only the information strictly necessary for the specific service is transferred.

You may request information about specific international transfers involving your data through x333's support channel.

X333 retains personal data for as long as necessary to fulfill each stated purpose, in compliance with the minimum retention periods required by law:

Once the retention period ends, data is securely deleted or anonymized so that it can no longer be linked to a specific individual. Data that has already been anonymized is no longer considered personal data and may be retained longer for statistical purposes.

X333 implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, loss, destruction, alteration, or improper disclosure. Key measures include:

• 256-bit SSL encryption across all communications between the user's browser/app and x333's servers;
• Encryption at rest for sensitive financial data stored in the platform's databases;
• Tokenization of credit and debit card data — full card numbers are never stored on x333's servers;
• Role-based access control — each team member can only access the data required for their specific role;
• 24/7 security monitoring with intrusion detection and incident response;
• Security audits periodic audits conducted by independent third parties;
• Multi-factor authentication available for user accounts that want an extra layer of protection at login.

X333 uses cookies and similar technologies (such as pixels and local storage) for a variety of purposes. Cookies are small text files stored on your device when you access the platform.

Categories of cookies used by x333:

• Essential cookies: required for the platform's basic operation — authentication, session management, security and language preferences. They cannot be disabled without affecting platform functionality;
• Performance cookies: collect information about how users interact with the platform (most visited pages, errors encountered, loading times) in an aggregated, anonymous form. Used to improve the overall experience;
• Functional cookies: remember user preferences, such as favorite games, language, and display settings. They improve the experience without collecting identifiable data;
• Marketing cookies (with consent): used to display personalized communications about promotions and bonuses within the platform. They require explicit consent and can be disabled in the account settings.

You can manage your cookie preferences in the account settings or your browser settings. Disabling essential cookies may prevent access to some platform features.

The x333 platform is intended exclusively for users aged 18 and over. x333 does not knowingly collect personal data from minors and does not allow minors to create accounts or use any of the platform's services.

If we determine that an account was created by someone under 18, the account will be blocked immediately, all associated data will be deleted as soon as possible within applicable legal obligations, and any existing balance will be returned in accordance with our account closure procedures.

Mandatory identity verification (KYC) is the primary safeguard for protecting minors — no account is cleared for withdrawals without age confirmation via an official photo ID.

To exercise any right provided under the LGPD regarding your personal data at x333, use one of the channels below:

• Support chat: available 24 hours a day in Portuguese, accessible after logging into the platform. Please label your message "LGPD Request" for priority routing;
• Email: send to suporte@x333.express with the subject line "LGPD Rights – [request type]";

To verify the identity of the requester, x333 may ask you to confirm your registered details before processing requests for access, portability, or deletion. This step ensures that data is only provided to the legitimate account holder.

Deadlines:

• Confirmation of receipt: within 2 business days;
• Full response to the request: up to 15 business days (maximum period established by the LGPD);
• In complex cases requiring an extension of the deadline, you will be notified with an explanation before the 15-day period expires.

If you believe your rights as a data subject have not been properly addressed by x333, you may file a complaint with the ANPD (National Data Protection Authority), which is the federal body responsible for enforcing the LGPD in Brazil.

X333 may update this Privacy Policy periodically to reflect changes in data processing practices, new legal requirements, or improvements to the services offered. Any material change will be communicated with a minimum advance notice of 7 days before taking effect, through:

• Email notification to the address registered on the account;
• Notice on the account dashboard upon login;
• Updating the "last reviewed" date at the top of this document.

Continued use of the platform after the notice period constitutes acceptance of the changes. If you do not agree with the changes, you may close your account before the effective date — any available real balance will be returned via Pix in accordance with standard account closure procedures.

X333 keeps an archive of previous versions of this policy, available upon request through support, so you can review the changes made over time.