Privacy Policy of up88: How We Protect Your Data

1Personal Data Controller

The controller responsible for processing your personal data is the company that operates the platform up88, available at https://up88.world. For the purposes of this Privacy Policy, "up88", "we", "our", or "Platform" refer to the entity that makes decisions about the processing of your data.

Up88 acts as a data controller as defined by the General Data Protection Law (LGPD — Law No. 13,709/2018), and is responsible for ensuring that all processing of personal data belonging to Brazilian users is carried out in compliance with applicable legislation.

For direct contact regarding personal data and the exercise of your rights, please use our dedicated channel: suporte@up88.world with the subject line "Privacy – [type of request]".

2Personal Data We Collect

2.1 Data provided directly by you

At registration and during your use of the up88 platform, we collect the following personal data that you provide directly to us:

• Identification: full name, date of birth, CPF, national ID or driver's license (for KYC verification);
• Contact: email address, mobile phone number, full residential address including zip code;
• Financial: bank account details (bank, branch, account number) or Pix key for withdrawal processing; transaction history (deposits, withdrawals, bets);
• Access credentials: password (stored in encrypted hash format — never in plain text), session access history.

2.2 Automatically Collected Data

When you access and use the up88 platform, we automatically collect:

• Device data: device type (mobile, tablet, desktop), operating system, model, device identifiers;
• Access data: IP address, access date and time, pages visited, session duration, browser used;
• Usage data: games accessed, bets placed, platform usage patterns, interface preferences;
• Location data: approximate geographic location derived from IP address, for regulatory compliance purposes (verifying that the user is in Brazil).

2.3 Third-Party Data

In certain situations, we may receive data from third parties for verification and fraud prevention purposes, such as identity confirmations from Brazilian credit bureaus or transaction information provided by payment processors (such as financial institutions that process Pix transactions).

3How We Use Your Data

Up88 uses your personal data solely for the following purposes:

3.1 Service Delivery

• Create and manage your account on the platform;
• Process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED bank transfer;
• Recording and settling Sports Betting wagers on football (Brasileirão, Copa do Brasil, Libertadores), volleyball, basketball (NBB), MMA/UFC, e-sports, and other sports;
• Offer live casino games, slots, crash games, and poker;
• Send notifications about transactions, bets, and important account updates.

3.2 Compliance with Legal Obligations

• Identity and minimum age verification (18 years) as required by regulatory rules;
• Anti-money laundering and counter-terrorism financing (AML/CFT) compliance under Brazilian law;
• Responding to requests from competent authorities (Receita Federal, Ministry of Finance, COAF);
• Maintenance of tax and accounting records for the legally required period.

3.3 Security & Fraud Prevention

• Detect and prevent unauthorized access, multiple account use, and bet manipulation;
• Monitor financial transactions for suspicious patterns;
• Verify the integrity of casino and poker games.

3.4 Marketing communications (with your consent)

With your explicit consent, up88 may use your email and phone number to send communications about promotions, bonuses, new games, and special events. You may withdraw this consent at any time via the unsubscribe link in any communication or through your account settings.

3.5 Platform Improvement

Anonymized or pseudonymized usage data is used for platform performance analysis, interface A/B testing, and new feature development — always in aggregate form, with no individual user identification.

4Legal Bases for Processing (LGPD)

Under the LGPD, all processing of personal data must have a legal basis. up88 grounds its data processing in the following bases, as set out in art. 7 of the LGPD:

• Contract performance (art. 7, V): the primary basis for providing betting services, processing payments, and managing your account — without this data, the contractual relationship cannot be performed;
• Compliance with a legal or regulatory obligation (art. 7, II): identity verification (KYC), anti-money laundering compliance, record-keeping for tax purposes, and responding to public authorities;
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, product improvement, and risk analysis — always balanced against the rights and interests of data subjects;
• Consent (art. 7, I): marketing communications, use of non-essential cookies, and optional behavioral analytics. Consent may be withdrawn at any time without affecting your use of the platform.

5Data Sharing with Third Parties

Up88 does not sell your personal data. Data is only shared in the situations below, always with contractual data protection guarantees:

5.1 Payment processors

To process deposits and withdrawals, we share the necessary financial data with Brazilian financial institutions and payment processors that operate Pix, boleto bancário, cards (Visa, Mastercard, Elo), PicPay, and Mercado Pago. These partners act as data processors and are contractually required to use your data solely for transaction processing purposes.

5.2 Verification service providers

For identity verification (KYC) and fraud prevention, we may share minimal data with credit bureaus and identity verification services operating in Brazil, always under contract terms that ensure your data is protected.

5.3 Game Providers

Live casino, slots, crash games, and poker providers operating within the up88 platform may have access to technical session data (such as an anonymous user identifier and gameplay data) necessary to run the games. They do not receive personally identifiable information beyond what is strictly required for their operation.

5.4 Competent authorities

Up88 may share data with Brazilian government authorities (Receita Federal, COAF, Banco Central, Ministério Público, Polícia Federal) when required by law, court order, or a legally authorized investigation. In such cases, we provide only the data specifically requested.

5.5 Business transfers

In the event of a merger, acquisition, or sale of up88 assets, user data may be transferred to the new controller, who will assume the same obligations set out in this Policy. Users will be notified before any such transfer takes place.

6Data Retention and Deletion

6.1 Retention Periods

Up88 retains your personal data for as long as necessary for each purpose:

• Registration and identification data: throughout the entire lifetime of the account and for a minimum of 5 years after closure, as required by tax and AML/CFT regulations;
• Financial transaction history: minimum of 5 years after each transaction, as required by tax legislation and Central Bank regulations;
• Betting and gaming data: minimum of 5 years, for audit and regulatory compliance purposes;
• Access data and security logs: 12 months for operational security purposes;
• Support communications: 3 years after the support request is closed;
• Marketing data (consent): until consent is withdrawn or after 2 years of inactivity, whichever comes first.

6.2 Deletion Process

Once the applicable retention period has expired, data is securely deleted or irreversibly anonymized so that the data subject can no longer be identified. Data that must be retained due to a legal obligation is isolated in a restricted repository with controlled access.

7Data Security

Up88 implements technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or improper disclosure:

• Encryption: all data in transit is protected by TLS 1.3 / SSL 256-bit; sensitive data at rest is encrypted with AES-256;
• Access control: internal access to personal data is restricted by the principle of least privilege — each team member accesses only what is necessary for their role, with mandatory multi-factor authentication;
• Continuous monitoring: intrusion detection systems and anomaly monitoring operate 24 hours a day to identify suspicious access;
• Security testing: the up88 platform undergoes periodic penetration testing (pentest) carried out by specialized external firms;
• Passwords: user passwords are stored exclusively as a cryptographic hash (bcrypt) — not even the up88 team has access to your password in plain text;
• Secure backups: backups are encrypted and stored in geographically separate locations, with regular restoration tests.

8Cookies and Tracking Technologies

Up88 uses cookies and similar technologies to ensure the platform runs properly, improve the user experience, and — with your consent — for analytics and personalization.

8.1 Types of cookies used

8.2 Cookie Management

You can manage your cookie preferences through your account's privacy settings panel or through your browser settings. Essential cookies cannot be disabled as they are required for the platform to operate securely. For analytics and marketing cookies, disabling them takes effect immediately and does not affect access to up88's core features.

9Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the data subject, the following rights regarding the processing carried out by up88:

10Minors

The up88 platform is intended exclusively for users aged 18 and over. up88 does not knowingly collect personal data from minors. If we identify that data from a minor has been provided, we will immediately take the following steps:

• Immediate account suspension;
• Deletion of all data collected from the minor;
• Refund of any deposited amounts to the original bank account;
• Notification to competent authorities where applicable.

If you believe a minor has created an account on up88, please contact us immediately via live chat or at suporte@up88.world. We will take the necessary steps with the highest priority.

11International Data Transfers

Up88's technology infrastructure is primarily hosted in data centers located in Brazil. In certain technical scenarios — such as the use of security software providers, fraud analysis, or cloud infrastructure — data may be processed on servers located in other countries.

When this occurs, up88 ensures that international data transfers comply with the safeguards required by the LGPD, including:

• Specific contracts with data protection clauses with international recipients;
• Transfers only to countries with a level of data protection recognized as adequate by the ANPD;
• Adoption of technical and organizational measures to ensure a level of protection equivalent to that required by the LGPD.

Full personal identification data (CPF, documents, banking details) are preferably stored in infrastructure located in Brazil.

12Changes to This Privacy Policy

Up88 may update this Privacy Policy periodically to reflect changes in data processing practices, new platform features, or updates to applicable legislation, particularly the LGPD and ANPD regulations.

Significant changes will be communicated at least 7 days in advance via your registered email or through an in-platform notification, with a clear indication of what changed and the effective date. The last updated date at the top of this page will always be kept current.

For changes required by immediate legal obligations, the effective date may be shorter than usual. Continued use of the up88 platform after notification of changes constitutes acceptance of the updated Policy.

13Contact, DPO & Privacy Channel

Up88 has appointed a Data Protection Officer (DPO), as required by the LGPD for organizations that process data at scale. The DPO serves as the point of contact between up88, data subjects, and the ANPD.

To exercise your rights, request information about how your data is processed, or file a privacy-related complaint, please use the following channels:

• Privacy email: suporte@up88.world — subject line "Privacy – [request type]";
• Live chat: available 24 hours a day, 7 days a week, directly on the platform;
• Response timeframe: up to 15 business days for LGPD rights requests; up to 48 hours for urgent data security matters.

If you are not satisfied with up88's response to your privacy request, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), the federal authority responsible for enforcing the LGPD in Brazil.