Privacy Policy bu777 — Your Data Protected by the LGPD

Introduction and Scope

This Privacy Policy describes how bu777 collects, uses, stores, and protects the personal data of users who access or use any service available on the platform — including Sports Betting on football (Brasileirão Série A, Copa do Brasil, Libertadores), MMA and UFC, e-sports, slots, Live Casino, crash games, and all other available categories.

Bu777 acts as the controller of the personal data it collects and processes, in accordance with the definitions set out in the LGPD. By creating an account and using the platform, you confirm that you have read and accepted this Privacy Policy in full. If you disagree with any provision, we recommend that you do not use bu777's services and contact support to clarify any questions before creating your account.

This policy applies to all interactions with bu777: accessing the website, using the mobile app (Android and iPhone), contacting customer support, and any other communication channels maintained by the platform.

Data We Collect

Bu777 collects only the data necessary to deliver its services securely, meet legal obligations, and continuously improve the user experience. The data collected falls into three categories:

Data provided directly by you:

• Full name, CPF, date of birth, and email address — collected at registration
• Full residential address and zip code — required for eligibility verification and compliance
• Mobile number — for two-factor authentication (2FA) and security communications
• Identity documents (RG, CNH) and proof of address — requested during the KYC verification process
• Financial details such as Pix key, bank branch, and account number — used solely for processing deposits and withdrawals
• Information provided to support during interactions — for ticket resolution and service improvement

Automatically collected data:

• IP address and approximate geographic location — for eligibility verification and fraud prevention
• Device type, operating system, and browser used
• Pages visited, time spent, and browsing sequence within the platform
• Betting history, gaming sessions, and financial transactions carried out on bu777
• Cookies and similar technologies — detailed in section 08 of this policy

Data received from third parties:

• Payment confirmations from providers such as Pix, Mercado Pago, and PicPay — for deposit and withdrawal validation
• Information from identity verification bureaus — used during the KYC process when required
• Responsible gambling restriction list data — to comply with regulatory obligations

How We Use Your Data

Bu777 uses collected data exclusively for the purposes described below. Each purpose is tied to a specific legal basis, detailed in section 04.

Bu777 does not use your data to make automated decisions with significant legal effects — such as account suspension — without human review. Automated fraud detection systems may trigger alerts, but any final action taken on an account is always reviewed by the compliance team.

Legal Basis for Processing

The LGPD requires that every personal data processing operation be grounded in one of the legal bases set out in Art. 7 of Law No. 13,709/2018. bu777 processes your data based on the following grounds:

• Contract performance (Art. 7, V): processing of registration data, financial data, and betting history is necessary to perform the services you contracted when creating an account on bu777.
• Compliance with a legal obligation (Art. 7, II): data used for KYC verification, anti-money laundering compliance, and financial record retention is processed to fulfill legal obligations imposed by Brazilian regulations.
• Legitimate interest (Art. 7, IX): data collected automatically for usage analysis, platform improvement, and fraud prevention is processed on the basis of bu777's legitimate interests, provided these do not override your fundamental rights and freedoms.
• Consent (Art. 7, I): marketing communications and the use of non-essential cookies are carried out solely on the basis of your express consent, which may be withdrawn at any time.

Data Sharing

Bu777 does not sell, rent, or transfer your personal data to third parties for marketing or advertising purposes. Data sharing occurs exclusively in the following situations and with the categories of partners described below:

• Payment providers: the minimum data required to process deposits and withdrawals is shared with payment providers operating in Brazil, such as those responsible for processing Pix, boleto bancário, Mercado Pago, and PicPay. These providers act as data processors under contract and may not use the information for any other purpose.
• Game providers: when accessing a live casino game from Evolution Gaming, Pragmatic Play, NetEnt, or PG Soft, session data such as user identifier and session history is transmitted to the provider to enable the game to function. These providers also act as operators under contract.
• Regulatory and judicial authorities: bu777 may share data with Brazilian governmental, judicial, or regulatory authorities when required by law, court order, or directive from a competent authority. In such cases, bu777 shares only the minimum information necessary to fulfill the obligation.
• Identity verification services: during the KYC process, data such as CPF and identity documents may be verified with credit bureaus or identity validation services authorized to operate in Brazil.
• Technology service providers: cloud infrastructure, security, and analytics providers that process data on behalf of bu777 under data processing agreements that include confidentiality and use-limitation clauses.

In all cases of data sharing with third parties, bu777 contractually requires those partners to handle personal data in accordance with the LGPD and this Privacy Policy.

Data Retention and Deletion

Bu777 retains your personal data for as long as necessary to fulfill the purposes described in this policy or to comply with applicable legal obligations. The general retention periods are:

• Registration and account data: retained for the entire duration of the active account at bu777. After account closure, data is kept for up to 5 years for compliance purposes and potential dispute resolution.
• Financial records (deposits, withdrawals, bets): retained for a minimum of 5 years following the transaction, as required by Brazilian anti-money laundering legislation and financial regulations.
• KYC documents: retained for up to 5 years after account closure or for the period required by applicable regulation, whichever is longer.
• Support and service data: support chat records are kept for up to 2 years for training purposes and dispute resolution.
• Cookie and browsing data: retained for up to 12 months from the date of collection, according to the settings for each cookie type.

Once the applicable retention period expires, data is securely deleted or anonymized in a way that makes it impossible to identify the individual. Irreversible anonymization is not considered personal data processing under the LGPD and may be used for statistical purposes and platform improvement with no defined time limit.

Data Security

Bu777 applies technical and organizational measures proportionate to the risk to protect your personal data against unauthorized access, alteration, disclosure, or destruction. The key measures in place are:

• 256-bit SSL encryption: all communication between your device and bu777's servers is encrypted using TLS 1.3, the same standard used by financial institutions such as Nubank, Itaú, and Bradesco.
• Two-factor authentication (2FA): available and strongly recommended for all accounts. 2FA adds a layer of protection that prevents unauthorized access even if your password is compromised.
• Secure password storage: user passwords are stored only as salted hashes — never in plain text — making recovery impossible even for internal staff.
• Internal access controls: user data is accessible only to bu777 employees who need it to perform their duties. Access is logged and regularly audited.
• Threat monitoring: automated systems monitor the infrastructure around the clock for suspicious activity, unauthorized access attempts, and anomalies that may indicate a security incident.
• Penetration testing: platform security is regularly tested by specialized teams that simulate attacks to identify and fix vulnerabilities before they can be exploited.

In the event of a security incident that could significantly affect your personal data, bu777 will notify the affected users and the National Data Protection Authority (ANPD) within the applicable legal timeframe, with details about the nature of the incident, the data involved, and the measures taken.

Cookies and Tracking Technologies

Bu777 uses cookies — small text files stored on your device — and similar technologies to keep the platform running, improve the browsing experience, and understand how users interact with the site. The cookies used fall into three categories:

You can manage your cookie preferences at any time through your browser settings or via the preference panel available in the bu777 footer. Disabling essential cookies may affect platform functionality — including login, bet processing, and financial transactions.

Bu777 does not use cross-site tracking technologies to display advertising on external platforms. Data collected via cookies is used exclusively within the bu777 platform for the purposes described above.

Your Rights Under the LGPD

The General Data Protection Law (Law No. 13,709/2018) grants you a set of rights regarding your personal data processed by bu777. To exercise any of the rights listed below, contact us via the in-platform live chat or by email at suporte@bu777.best.

• Processing confirmation: obtain confirmation of whether bu777 processes your personal data.
• Data access: receive an organized copy of the personal data bu777 holds about you.
• Correction: request the correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion: request the anonymization or deletion of data that is unnecessary, excessive, or processed in violation of the LGPD.
• Portability: receive your data in an interoperable format for transfer to another service provider, where technically feasible.
• Sharing information: obtain information about which public or private entities bu777 has shared your data with.
• Consent withdrawal: withdraw consent given for processing based on that legal ground, without affecting the lawfulness of processing carried out before the withdrawal.
• Objection: object to processing carried out on the basis of legitimate interest where such processing may infringe your rights.
• Review of automated decisions: request human review of decisions made solely on the basis of automated processing that affects your interests.

Bu777 responds to rights exercise requests within 15 business days of receipt. In more complex cases, this deadline may be extended by an equal period, with prior notice to the requester. If your request is not satisfactorily resolved, you have the right to file a complaint with the National Data Protection Authority (ANPD).

Protection of Minors

Bu777 is an entertainment platform exclusively for users aged 18 and over. Registration by minors is strictly prohibited, and bu777 takes active measures to prevent minors from accessing the platform, including age verification at sign-up and a KYC process.

Bu777 does not knowingly collect personal data from individuals under 18 years of age. If we identify that an account was created by a minor, we will close the account immediately, return any existing real deposit balance, and delete the collected personal data as quickly as possible, subject only to legally required retention obligations.

If you believe a bu777 account belongs to a minor — including cases where a minor in your household may have misused your details — contact support immediately via live chat or at suporte@bu777.best. bu777 will handle the matter as a priority and with full confidentiality.

Contact and Data Protection Officer (DPO)

Bu777 has appointed a Data Protection Officer (DPO) responsible for overseeing the platform's privacy practices, handling data subject requests, and maintaining the communication channel with the National Data Protection Authority (ANPD).

To exercise your rights, report a security incident, ask questions about this Privacy Policy, or request any information about how bu777 processes your personal data, use the following channels:

• Live chat: available within the bu777 platform, in Brazilian Portuguese, 7 days a week — the preferred channel for faster responses
• Email: suporte@bu777.best — for formal LGPD rights requests, the response time is up to 15 business days

When contacting us to exercise an LGPD right, include "LGPD Request" in the subject line and provide your full name, CPF registered on bu777, and a detailed description of your request. This helps us route your request faster and meet the response deadline.

Updates to this Privacy Policy

Bu777 may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or the services offered on the platform. When relevant changes are made, you will be notified via your registered email and/or by a prominent notice within the platform at least 7 days in advance.

Changes required by immediate legal obligations, court orders, or ANPD directives may take effect without prior notice. In such cases, bu777 will inform users as soon as possible after the changes are implemented.

The current version of this Privacy Policy will always be available on this page, with the date of the last update shown at the top of the document. We recommend reviewing it periodically to stay informed about how bu777 protects your data.

Continued use of the platform after the effective date of updated terms constitutes acceptance of the revised Privacy Policy. If you disagree with the changes, you may close your account and request data portability or deletion within the limits permitted by applicable law.