Privacy Policy dduu99 – Your Data in Safe Hands

1. Introduction

Dduu99 respects your privacy. This Privacy Policy clearly and directly explains how the dduu99 platform, available at dduu99.best, collects, uses, stores, protects, and shares the personal data of its users, in full compliance with Brazil's General Data Protection Law (Lei nº 13.709/2018 – LGPD).

By creating an account on dduu99, making a Pix deposit, placing bets on the Brasileirão, playing slots, or accessing any feature of the platform, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein, in cases where consent is the applicable legal basis.

This Policy applies to all dduu99 services, including Sports Betting (football, NBB basketball, MMA/UFC, e-sports), Live Casino games, slots, roulette, crash games, and all other products available on the platform. If you have any questions about any part of this Policy, please contact our team before using the services.

2. Personal Data Controller

For the purposes of the LGPD, the controller responsible for processing personal data collected through the dduu99 platform is the company operating the domain dduu99.best, headquartered in Brazil.

Dduu99's Data Protection Officer (DPO) can be reached at contato@dduu99.best with the subject line "LGPD – DPO". All requests relating to data subjects' rights are handled centrally through this channel.

3. Personal Data We Collect

Dduu99 collects personal data at various points during your interaction with the platform. The categories of data processed are detailed below:

3.1 Data Provided Directly by the User

• Identification data: full name, CPF, date of birth, gender;
• Contact details: email address, mobile number, full residential address with ZIP code;
• Financial data: Pix key, bank details for wire transfers, credit/debit card data (tokenized, never stored as plain text), PicPay or Mercado Pago account details;
• Identity documents: images of national ID, driver's license, or passport submitted for KYC verification;
• Communication data: message history with dduu99 support via chat, email, or WhatsApp.

3.2 Automatically Collected Data

• Access data: IP address, device type, operating system, phone model, browser;
• Usage data: pages visited, games accessed, session duration, access times;
• Transaction data: full history of deposits, withdrawals, bets placed, and winnings;
• Location data: approximate location based on IP address — never precise GPS data.

3.3 Third-party data

In specific situations, dduu99 may receive data from identity verification partners, credit bureaus for fraud prevention, and game providers for security and regulatory compliance purposes.

4. Processing Purposes and Legal Bases

Dduu99 processes personal data on clear legal grounds and for specific, legitimate purposes. We never use data in ways that are incompatible with the purposes originally stated.

4.1 Service Provision (Contract Performance)

The primary purpose of data processing is to enable dduu99 to deliver its services: creating and managing your account, processing deposits via Pix, bank slip, credit/debit card, PicPay, and wire transfer, settling Sports Betting wagers, operating casino games, handling support requests, and sending account-related communications.

4.2 Compliance with Legal Obligations

Dduu99 is subject to Brazilian legal and regulatory obligations that require the processing of certain data, including: mandatory identity verification (KYC) for anti-money laundering compliance under Law No. 9,613/1998; reporting of suspicious transactions to COAF (Financial Activities Control Council); and compliance with court orders and requests from competent authorities.

4.3 Legitimate Interest

Based on legitimate interest, dduu99 processes data to: prevent fraud and protect platform integrity; monitor usage patterns to identify problem gambling behaviors and trigger responsible gaming tools; perform security analysis of access and transactions; and maintain betting history for dispute resolution.

4.4 Consent

When you explicitly consent, dduu99 uses your data to: send marketing communications, promotions, and platform updates (you may opt out at any time); use non-essential analytics and personalization cookies; and send WhatsApp messages about special promotions.

5. Sharing Data with Third Parties

Dduu99 does not sell, rent, or trade users' personal data. Sharing occurs only in the situations listed below, always with appropriate safeguards in place:

5.1 Service Providers (Processors)

We share data with companies that process information on our behalf and under our instructions, including:

• Payment processors: financial institutions participating in the Pix system, card processors for credit/debit transactions, and platforms such as PicPay and Mercado Pago;
• Game providers: Evolution Gaming, Pragmatic Play, Microgaming, Play'n GO, and other casino content providers that require minimum user identification for security and RNG audit purposes;
• Identity verification services: specialized KYC partners to validate documents submitted during registration;
• IT Infrastructure: hosting providers, CDN, and cloud services that store and process data with end-to-end encryption.

All dduu99 service providers sign Data Processing Agreements (DPAs) requiring them to implement security measures equivalent to ours and to use data solely for the authorized purposes.

5.2 Authorities and Regulatory Bodies

Dduu99 may share data with Brazilian government authorities when: (i) required by law or regulation; (ii) ordered by a court; (iii) necessary to report suspicious transactions to COAF; or (iv) requested by competent regulatory bodies in the exercise of their legal duties.

5.3 Corporate Transfers

In the event of a merger, acquisition, or corporate restructuring involving dduu99, user data may be transferred to the successor entity. In such cases, users will be notified with reasonable advance notice, and the new entity will be bound by the same privacy commitments set out here.

6. Data Retention and Deletion

Dduu99 retains personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by Brazilian law:

• Registration and financial data: retained for a minimum of 5 years after account closure, as required by anti-money laundering legislation and tax obligations;
• Betting and transaction history: retained for 5 years for dispute resolution and audit purposes;
• KYC documents: retained for the period required by regulation, generally 5 years after the last transaction;
• Usage data and analytics cookies: retained for no more than 13 months;
• Support communications: retained for up to 2 years after the support case is closed.

Once the applicable retention periods expire, data is securely deleted or anonymized. Anonymized data — which cannot be used to identify the individual — may be retained indefinitely for statistical purposes and service improvement.

7. Data Security

Dduu99 adopts robust technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, or improper disclosure. The main safeguards in place include:

7.1 Technical Measures

• 256-bit SSL/TLS encryption on all connections between the user and the platform;
• Passwords stored using bcrypt hashing — we never store passwords in plain text;
• Bank and card data tokenized, with tokens processed exclusively by PCI-DSS certified partners;
• Two-factor authentication (2FA) available and recommended for all users;
• Continuous security monitoring with anomaly detection and identification of suspicious access attempts;
• Encrypted backups on geographically distributed servers;
• Penetration testing (pen tests) carried out periodically by specialized external firms.

7.2 Organizational Measures

• Access to personal data is restricted to staff with a genuine need to use it (principle of least privilege);
• Mandatory privacy and security training for all dduu99 team members;
• Security incident response procedure with notification to the ANPD and affected data subjects within the legally required timeframes;
• Data protection impact assessments (DPIAs) for new features involving the processing of sensitive data.

8. Cookies and Similar Technologies

Dduu99 uses cookies and similar technologies (such as tracking pixels and local storage) to ensure the platform works properly, improve the user experience, and carry out statistical usage analysis. Each category is explained below:

Essential cookies cannot be disabled as they are required for the platform's basic functionality — including keeping you logged in as you move between casino games and Sports Betting sections. Optional cookies can be managed at any time in your dduu99 account privacy settings. You can also block cookies through your browser, but this may affect platform functionality.

9. Your Rights as a Data Subject (LGPD)

The General Data Protection Law (LGPD) grants you a set of rights over your personal data processed by dduu99. All rights listed below can be exercised free of charge by submitting a request to contato@dduu99.best with the subject line "LGPD – [right name]".

Dduu99 responds to all data subject requests within 15 business days from the date of receipt. For complex requests, this period may be extended by the same amount of time, with notice to the data subject. All responses are provided free of charge.

10. Minors

Dduu99 services are intended exclusively for individuals aged 18 and over. The platform does not intentionally collect personal data from minors. During registration, users are asked for their CPF and date of birth, which — together with identity verification documents — allow us to confirm the user's age.

If dduu99 determines that data from a minor was inadvertently collected, that information will be deleted immediately and the associated account will be closed. Parents or guardians who suspect that a minor has created a dduu99 account should contact us at contato@dduu99.best so that the appropriate measures can be taken promptly.

11. International Data Transfers

Some dduu99 service providers — particularly casino game providers such as Evolution Gaming and Pragmatic Play — have servers or infrastructure located outside Brazil. In such cases, international data transfers only take place when:

• The recipient country provides an adequate level of data protection, as recognized by the ANPD;
• The service provider is subject to standard contractual data protection clauses equivalent to those required by the LGPD;
• The transfer is necessary for the performance of the service agreement between dduu99 and the user.

Dduu99 ensures that, in any international transfer, the personal data of Brazilian users receives protection equivalent to that provided under the LGPD, regardless of the jurisdiction where the data is processed.

12. Changes to This Privacy Policy

Dduu99 may periodically review and update this Privacy Policy to reflect changes in our services, data processing practices, or applicable law. Material changes will be communicated to users at least 30 days in advance via the registered email address and a prominent notice in the account dashboard.

The current version of this Policy is always the one published on this page, identified by the "Last updated" date at the top of the document. We recommend that you review this Policy periodically. Continued use of the dduu99 platform after the effective date of any changes constitutes tacit acceptance of the new provisions, except where the LGPD requires renewed express consent.

The version history of previous editions of this Policy is available upon request to the dduu99 DPO at contato@dduu99.best.

13. Contact, DPO & Privacy Channels

To exercise your rights as a data subject, clarify questions about this Privacy Policy, report a privacy breach, or request any information related to the processing of your personal data by dduu99, please use the channels below:

• DPO email: contato@dduu99.best · Subject: "LGPD – [request type]"
• Live chat: Available 24 hours a day, 7 days a week, on the dduu99 platform
• WhatsApp: Available Monday through Sunday for urgent matters

Response time for LGPD-related requests: up to 15 business days from receipt, extendable by the same period for complex cases, with notice to the data subject.

For complaints that cannot be resolved internally, you may contact the Autoridade Nacional de Proteção de Dados (ANPD), the federal authority responsible for overseeing compliance with the LGPD in Brazil, through the gov.br/anpd portal.

Privacy in Practice: how dduu99 looks after your data every day