R2Bet Privacy Policy – Your Data, Protected

1Who We Are and What This Policy Covers

This Privacy Policy describes how the r2bet, operator of the platform available at r2bet.best, collects, uses, stores, and protects the personal information of its Brazilian users. It applies to all interactions with the platform: accessing the site, creating an account, making deposits, Sports Betting, casino games, participating in promotions, using support, and any other service offered by the r2bet.

By creating an account or continuing to use the services of r2bet following the publication of this policy, you confirm that you have read and understood the practices described herein. If you disagree with any point, you may close your account and request deletion of your data through support.

This policy was drafted in compliance with Brazil's General Data Protection Law (Lei nº 13.709/2018 — LGPD), applicable to all data processing operations involving users located in Brazil, regardless of where the data controller is based.

2What Personal Data We Collect

The r2bet collects only the data necessary to deliver services securely, meet legal obligations, and improve the user experience. Data collection is organized into the following categories:

Data provided directly by you:

• Full name, date of birth, CPF, and email address — collected at registration.
• Mobile number — for two-factor authentication and important communications.
• Full residential address — required as part of the identity verification (KYC) process.
• Identity documents (RG, CNH, or passport) and proof of address — submitted during the KYC process.
• Banking or card details — collected solely to process deposits and withdrawals via Pix, boleto, credit or debit card, PicPay, Mercado Pago, or TED.

Data collected automatically during platform use:

• IP address and approximate location — for fraud prevention and geographic eligibility verification.
• Device type, operating system, and browser — used to optimize the experience on mobile and desktop.
• Browsing history within the platform — pages visited, games accessed, and session duration.
• Full history of bets, deposits, withdrawals, and participation in promotions.
• Access logs with the date, time, and duration of sessions.

Data obtained from third parties:

• Identity verification information provided by specialized KYC services when used to streamline the process.
• Financial transaction confirmation data provided by banking institutions (Nubank, Itaú, Bradesco, Banco do Brasil, and others) when processing Pix and TED transfers.
• Fraud prevention information provided by compliance partners when there is reasonable suspicion of irregular activity.

3How We Use Your Personal Data

The r2bet uses the personal data collected for the following purposes, always on an adequate and proportionate legal basis:

The r2bet does not use users' personal data for purposes other than those listed above without prior notice and, where applicable, without obtaining fresh consent. If the purpose of processing changes in a material way, you will be notified by email at least 15 days in advance.

4Legal Basis for Data Processing (LGPD)

The LGPD requires that every personal data processing operation have a legal basis to justify it. The r2bet bases its data processing activities on the following legal grounds set out in Article 7 of Lei nº 13.709/2018:

• Contract performance (art. 7, V): processing required to create and manage your account, handle deposits and withdrawals, record bets, and deliver the services you signed up for at r2bet.
• Compliance with a legal obligation (art. 7, II): identity verification (KYC), anti-money laundering compliance, adherence to Central Bank regulations on Pix, and fulfillment of requests from competent authorities.
• Legitimate interest (art. 7, IX): personalizing your platform experience, security and fraud prevention, behavioral analysis for product improvements, and communications related to contracted services.
• Consent (art. 7, I): sending marketing communications, promotions, and updates by email or phone. You may withdraw this consent at any time through your account dashboard or via the unsubscribe link in any communication you receive.

5Data Sharing with Third Parties

The r2bet does not sell, rent, or trade users' personal data with third parties for any purpose. Data is shared exclusively in the situations listed below, always with appropriate protection and, where possible, under formally executed confidentiality and data protection agreements with partners:

• Payment processors: financial data is shared with the institutions responsible for processing transactions — banks and operators for Pix, boleto, credit or debit cards (such as Nubank, Itaú, Bradesco, and Banco do Brasil), PicPay, and Mercado Pago — solely to enable the requested service.
• KYC providers: identity documents and data may be processed by specialized identity verification partners to streamline and ensure the accuracy of the process.
• Game providers: the minimum data required to record the game session (such as user ID and bet details) is shared with game providers (such as Pragmatic Play, PG Soft, NetEnt, and others) for the technical operation of the games.
• Analytics and security services: usage and browsing data may be shared with analytics and fraud prevention tools to protect the platform and its users.
• Competent authorities: the r2bet may be legally required to share data with judicial authorities, regulatory bodies (such as the Banco Central do Brasil), or the Financial Intelligence Unit (UIF) upon a duly substantiated court order or formal request.

6Cookies and Tracking Technologies

The r2bet uses cookies and similar technologies to ensure the platform functions properly, improve the user experience, and protect session security. Understanding how this works helps you make more informed decisions about your privacy.

Types of cookies used by r2bet:

• Essential cookies: required for the basic operation of the platform. Without them, features such as login, active session maintenance, and bet processing will not work. They cannot be disabled without compromising your use of the services.
• Performance cookies: collect anonymous data on how users navigate the platform — most visited pages, time spent in each section, errors encountered. Used exclusively for technical and product improvements.
• Security cookies: detect anomalous behavior and help prevent unauthorized access, the creation of multiple accounts, and promotional abuse.
• Preference cookies: store your platform settings — language, game preferences, notification configurations — so you don't have to reconfigure them every time you log in.

You can manage your cookie preferences through your browser by disabling non-essential categories. On mobile, cookie settings are available in the options of the browser you use (Chrome, Safari, Firefox, or others). Please note that disabling essential cookies may prevent the platform from functioning properly. r2bet.

7Data Security

Protecting users' personal data is an operational priority at r2bet. We implement multiple layers of technical and organizational security to protect your information against unauthorized access, alteration, disclosure, or accidental destruction:

• Encryption in transit: all connections to the platform are protected by SSL/TLS with 256-bit keys — the same standard used by Brazilian banks such as Itaú and Bradesco.
• Encryption at rest: sensitive data stored on our servers — such as identity documents and banking details — is encrypted even when not in transit.
• Two-factor authentication (2FA): available to all users and strongly recommended. 2FA adds a second layer of protection against unauthorized access even if your password is compromised.
• Internal access controls: the employees of the r2bet have access to user data only to the extent necessary to carry out their functions, with access logs monitored and audited on a regular basis.
• Continuous monitoring: automated systems monitor suspicious activity around the clock, identifying unauthorized access attempts, fraud patterns, and anomalous behavior in real time.
• Periodic security testing: the infrastructure of the r2bet undergoes penetration testing and vulnerability assessments carried out by independent specialists on a regular basis.

8Data Retention and Deletion

The r2bet retains personal data for only as long as strictly necessary for the purposes for which it was collected, in compliance with the minimum retention periods required by Brazilian law. After account closure or fulfillment of legal obligations, data is deleted or anonymized.

When closing your account, you may request the deletion of your personal data. The r2bet will process the request in compliance with the legal retention periods above — meaning some data must be kept for a set period even after account closure, due to regulatory obligations. You will be clearly informed of which data will be retained and for how long.

9Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a personal data subject, a set of rights that may be exercised at any time with the r2bet. See all available rights below:

To exercise any of these rights, contact us via live chat or by email at privacidade@r2bet.best. The r2bet will respond within 15 business days as required by the LGPD. In complex cases, this deadline may be extended by an additional 15 days with a justified notice. If you are not satisfied with the response, you may file a complaint with the National Data Protection Authority (ANPD).

10Users Under 18

The services of the r2bet are intended exclusively for users aged 18 and over. The platform does not intentionally collect, store, or process personal data from minors. Registration requires a declaration of legal age, and the CPF provided is verified against the Receita Federal database, which contains the registered date of birth.

If the r2bet identify that a user is under 18 years of age, the account will be immediately closed and any deposited balance will be refunded following verification of the legal guardian's identity. If you suspect that a child or teenager is using the platform, contact support immediately via live chat.

11International Data Transfers

In some cases, the personal data of users of the r2bet may be processed by servers or partners located outside Brazil — for example, international game providers such as Pragmatic Play and NetEnt, which operate servers in multiple countries to ensure low latency and high availability.

In these situations, the r2bet applies the following safeguards to ensure your data receives protection equivalent to that required by the LGPD:

• We only engage partners operating in countries with adequate data protection legislation or those offering equivalent contractual guarantees.
• Inclusion of data protection clauses in all contracts with international partners that process data belonging to Brazilian users.
• Only the minimum data required to deliver the specific service is transferred — session identifiers and bet data, with no unnecessary personal information.

The r2bet does not transfer data to countries that do not offer adequate protection guarantees, in accordance with the criteria established by the ANPD.

12Changes to this Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in the services offered by the r2bet, changes in Brazilian legislation (including new ANPD regulations), or improvements to internal data protection practices.

Whenever relevant changes are made, the r2bet will adopt the following procedures:

• Publication of the updated version on this page with the effective date clearly indicated at the top.
• Email notification to all users with an active account, at least 15 calendar days before any material changes take effect.
• A visible notice on the platform throughout the transition period to ensure no active user is caught off guard.

Changes that introduce a new processing purpose or a new data-sharing arrangement not previously covered will require fresh consent where applicable. Continued use of the platform after the effective date will be interpreted as acceptance of the changes for processing based on contract or legal obligation.

Previous versions of this policy are archived and may be requested from the support team at r2bet for reference. This version came into effect in June 2026.

13Contact, DPO, and How to Exercise Your Rights

The r2bet has appointed a Data Protection Officer (DPO) as required by the LGPD, serving as the point of contact between the platform, its users, and the National Data Protection Authority (ANPD).

You can reach us through whichever channel is most convenient:

• DPO Email: privacidade@r2bet.best — for formal LGPD rights requests, incident reports, and data-related legal matters.
• General email: contato@r2bet.best — for general questions about privacy and data protection.
• Live chat: available 24 hours a day, 7 days a week, with support in Brazilian Portuguese. For data requests, the agent will open a formal ticket and route it to the DPO.

When contacting us to exercise your rights, please have your account information on hand (registered email or CPF) so we can locate your data and process your request promptly. The response period is up to 15 business days, extendable by a further 15 days in complex cases, always with a written explanation.