Rrs41 Privacy Policy – Your Data, Our Responsibility

The controller of the personal data processed by this platform is rrs41, operator of the website rrs41.best. As controller, rrs41 is responsible for determining the purposes and means of processing your personal data, in accordance with the Lei Geral de Proteção de Dados (Lei nº 13.709/2018).

To exercise any right provided for in this policy or under the LGPD, or to clarify any questions about the processing of your data, you may contact us directly through the privacy channel available in the support chat or by email at suporte@rrs41.best.

Rrs41 collects personal data at different points during your interaction with the platform. Below is a full overview of what is collected and in which context:

Rrs41 does not collect sensitive data such as racial or ethnic origin, religious beliefs, health data, or sexual orientation. Should any sensitive data be inadvertently provided by a user in support messages, it is discarded and not stored in our systems in a structured manner.

Every piece of data collected by rrs41 has a specific, documented purpose. We do not use data for purposes beyond what is necessary to provide the platform's services. The main purposes are:

• Account creation and management: Identity authentication, password recovery, eligibility verification (18 years of age or older, Brazilian resident with a valid CPF).
• Financial transaction processing: Processing of deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago; processing of withdrawals via Pix and TED to Nubank, Itaú, Bradesco, Banco do Brasil, and other institutions authorized by the Banco Central.
• Provision of sports betting and casino services: Registration and settlement of Sports Betting (Brasileirão, Copa do Brasil, Libertadores, UFC, NBB, e-sports), access to Live Casino games, slots, crash games, and progressive jackpots.
• Compliance with legal obligations: Identity verification (KYC) as required by anti-money laundering regulations; maintenance of financial records in accordance with Brazilian tax and regulatory legislation.
• Fraud prevention and security: Detection of multiple accounts, bonus abuse, unauthorized access, and suspicious activity that may indicate money laundering or match-fixing.
• Platform communications: Sending notifications about bets, results, processed withdrawals, security alerts, and important updates to the Terms and Conditions.
• Marketing communications (with consent): Sending promotions, personalized bonuses, and platform news only to users who have opted in to receive such communications. You can unsubscribe at any time.
• Responsible gambling: Monitoring of usage patterns to identify behaviors that may indicate problem gambling, with proactive offering of control tools in accordance with our responsible gambling policy.

Every data processing activity carried out by rrs41 is grounded in at least one of the legal bases set out in Article 7 of the LGPD. The legal bases rrs41 relies on are listed below:

• Contract performance (art. 7º, V): This is the primary legal basis for processing identity and financial data. When you create an account and make a deposit via Pix, processing your data is necessary to fulfill the service agreement you entered into with rrs41 by accepting the Terms and Conditions.
• Compliance with a legal obligation (art. 7, II): Used for the identity verification process (KYC), as required by anti-money laundering legislation applicable to the sector, and for the retention of financial records for periods established by law.
• Legitimate interest (art. 7, IX): Used for fraud prevention, platform security, and bonus abuse detection. rrs41's legitimate interest in maintaining platform integrity and protecting legitimate players outweighs the interest in not having data analyzed for security purposes.
• Consent (art. 7, I): Used specifically for marketing communications and promotions. Consent is collected clearly during registration and may be withdrawn by the data subject at any time without affecting use of the platform.

Rrs41 does not sell personal data to third parties. Data sharing occurs only in the following situations, all of which are necessary for the operation of our services:

• Payment providers: Financial data is shared with PCI-DSS certified payment processors to enable transactions via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago. These providers act as data processors under rrs41's instruction and are contractually prohibited from using the data for any purpose beyond processing the specific transaction.
• Identity verification providers (KYC): To verify identity documents and proof of address, rrs41 may use third-party services specializing in digital verification. These providers process data exclusively for verification purposes and do not retain it after the process is complete.
• Casino game providers: To offer slots, Live Casino, and other games, rrs41 works with certified providers. Gameplay behavior data may be shared in pseudonymized form for RTP reporting and game integrity auditing purposes.
• Competent authorities: rrs41 may be required by law or court order to share personal data with competent Brazilian authorities, such as the Conselho de Controle de Atividades Financeiras (COAF), the Receita Federal, or the Ministério Público. In such cases, data is shared only to the extent strictly necessary to comply with the legal requirement.

All third parties that receive data from rrs41 are contractually required to process that data solely for the agreed purposes, to implement appropriate security measures, and to comply with the LGPD and all other applicable laws.

Rrs41 uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and — with your consent — personalize content and promotions. The types of cookies used are:

• Essential Cookies: Required for the platform's basic operation — maintaining your logged-in session, bet slip, language preferences, and account security. These cannot be disabled without compromising your use of the platform.
• Functional cookies: These store your preferences, such as favorite games, odds display settings, and preferred payment method. They improve your experience without compromising your privacy.
• Analytical cookies: These collect information about how players use the platform in aggregated, anonymized form to identify areas for improvement in interface and performance. We use analytics tools with enhanced privacy settings.
• Marketing cookies: Used only with your explicit consent to personalize promotions displayed on the platform. These can be disabled in your account settings without affecting the general functionality of rrs41.

You can manage your cookie preferences at any time in your account settings or through your browser's privacy settings. Rejecting non-essential cookies does not affect your access to rrs41's core services.

Rrs41 retains personal data only for as long as necessary for the purposes it was collected, or to meet legal obligations. Retention periods are as follows:

• Identity and registration data: Retained for the entire period the account is active and for a minimum of 5 years after closure, in accordance with anti-money laundering requirements (Lei nº 9.613/1998).
• Financial data and transaction history: Retained for a minimum of 5 years, in accordance with Brazilian tax and regulatory legislation applicable to the financial sector.
• Behavioral and betting data: Retained for up to 3 years after account closure for fraud prevention and dispute purposes. After this period, data is anonymized or deleted.
• Support communication data: Retained for 2 years after the last interaction for quality assurance and dispute resolution purposes.
• Cookie and access data: Access logs are retained for 6 months. Cookies expire automatically according to the timeframes configured for each type.

Once retention periods have ended, data is securely deleted or anonymized so that the data subject can no longer be identified. Requests for early deletion are subject to an assessment of whether legal obligations exist that prevent immediate deletion.

The LGPD grants you, as the data subject, a set of rights that rrs41 is committed to respecting and facilitating. See how each right works in practice:

• Right to access: You may request a copy of all personal data rrs41 holds about you, including the purpose for which each piece of data was collected.
• Right to rectification: If any information is incorrect or outdated — such as your email address or mobile number — you can request an immediate correction via support chat or directly in your account settings.
• Right to erasure: You may request deletion of data collected on the basis of consent (such as data used to send promotions) at any time. Data required to fulfill a legal obligation cannot be deleted before the end of the applicable legal retention period.
• Right to data portability: You may request that your personal data be provided in a structured, machine-readable format for transfer to another service, in accordance with the LGPD and ANPD regulations.
• Right to withdraw consent: For processing activities based on consent — such as marketing communications — you may withdraw your consent at any time. Withdrawal does not affect processing carried out prior to it or processing based on other legal grounds.
• Right to object: You may object to processing carried out on the basis of legitimate interest when you believe your interests and fundamental rights outweigh those of rrs41.
• Right to information about sharing: You have the right to know which entities your data has been shared with. This information is summarized in Section 5 of this policy.

To exercise any of these rights, contact us via live chat or send an email to suporte@rrs41.best with the subject line "Direitos LGPD". Responses are provided within up to 15 business days, as required by the LGPD.

Rrs41 implements appropriate technical and organizational measures to protect your data against unauthorized access, disclosure, accidental or unlawful alteration, or destruction. The main measures include:

• 256-bit SSL encryption on all connections and data transmissions;
• Password storage using robust hashing algorithms — passwords are never stored in plain text;
• Role-based access controls, ensuring that only professionals with a legitimate need can access specific data;
• Continuous infrastructure monitoring to detect unauthorized access or anomalous activity;
• Penetration testing and periodic security audits conducted by independent firms;
• Documented procedures for responding to security incidents, including notification to the ANPD and affected data subjects where required by the LGPD.

Rrs41 is an entertainment platform exclusively for users aged 18 and over. rrs41 does not intentionally collect personal data from minors and does not allow minors to create accounts or use any of the platform's services.

During registration, rrs41 requests your date of birth and CPF, and runs verification checks to confirm you are of legal age. Accounts where the holder is identified as a minor are closed immediately and all associated data is deleted, except for the minimum records required to document the closure as required by law.

If you believe a minor has created an account on rrs41, please contact us immediately at suporte@rrs41.best so that we can take the necessary steps.

In certain operational situations — such as the use of cloud infrastructure or casino game processing services provided by international suppliers — personal data may be transferred to servers located outside Brazil.

Rrs41 ensures that such transfers occur only to countries or organizations offering a level of data protection equivalent to that required by the LGPD, or through specific contractual clauses that impose obligations equivalent to Brazilian law on the data recipient. We do not transfer data to jurisdictions without adequate protection absent the necessary contractual safeguards.

You may request information about the specific international transfers involving your data by reaching out through our privacy channel.

This Privacy Policy may be updated periodically to reflect changes in our data processing practices, new platform features, amendments to Brazilian legislation, or determinations by the ANPD.

Significant changes will be communicated by email to all registered players at least 7 days before taking effect. The version currently in force is always the one available on this page, with the last updated date indicated at the beginning of the document.

Continued use of the platform after the effective date of a new version of this policy constitutes acceptance of the changes. If you disagree with the changes, you may close your account before the effective date and request a withdrawal of any available balance.

For any questions regarding this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, you can reach us through the following channels:

• Live chat: Available 24 hours a day, 7 days a week, directly on the rrs41.best platform for urgent matters.
• Privacy email: suporte@rrs41.best — for formal requests to exercise LGPD rights, use the subject line "LGPD Rights – [your CPF]" to ensure faster processing.

The response period for data subject rights requests is up to 15 business days, as per art. 18 of the LGPD. rrs41 strives to respond to most requests within 5 business days.

If you are not satisfied with the response you received, you have the right to file a complaint with the National Data Protection Authority (ANPD), the Brazilian federal authority responsible for overseeing compliance with the LGPD.