Privacy Policy t578 – Data Protection and LGPD

1. Who We Are — Controller Identification

For the purposes of the General Personal Data Protection Law (LGPD — Law No. 13.709/2018), the t578, operator of the Sports Betting and online casino platform available at t578.click, is the controller of the personal data processed in this document.

As the data controller, t578 is responsible for defining the purposes and means of processing your personal data, ensuring compliance with this Privacy Policy and the LGPD, and responding to data subject requests within the legally required timeframes.

To exercise any right provided under this policy or the LGPD, please contact us at contato@t578.click with the subject line "Privacy Request – LGPD".

2. Legal Basis for Data Processing

All personal data processing carried out by t578 has a legal basis under the LGPD. The bases we rely on are:

• Contract performance (art. 7, V): processing required to create and operate your account, handle Pix deposits, record bets, and process withdrawals;
• Compliance with legal obligation (art. 7, II): identity verification (KYC), anti-money laundering compliance, and regulatory reporting required by law;
• Legitimate interest (art. 7, IX): platform security, fraud prevention, anomalous behavior analysis, and continuous service improvement;
• Consent (art. 7, I): sending marketing communications, promotional emails, and notifications about promotions — with the option to unsubscribe at any time.

When the legal basis is consent, you may withdraw it at any time without affecting any processing already carried out under other legal grounds.

3. What Data We Collect

T578 collects personal data at different points during your interaction with the platform. Below are the data categories and the circumstances under which they are collected:

3.1. Registration Data

Collected at the time of account registration:

3.2. Identity Verification Data (KYC)

Collected when required by the verification process:

3.3. Financial Data

Collected for processing deposits and withdrawals:

T578 does not store full credit or debit card details. Payment processing is handled by PCI-DSS certified financial intermediaries.

3.4. Platform Usage Data

Collected automatically during use of the website or app:

4. How We Use Your Data

Personal data collected by t578 is used exclusively for the following purposes:

• Account operation: creation, maintenance, and authentication of the user's account on the platform;
• Bet processing: registration, settlement, and full history of all bets placed on football (Brasileirão, Copa do Brasil, Libertadores), MMA/UFC, virtual sports, and other available categories;
• Payments: processing deposits via Pix, bank slip, credit/debit card, PicPay, and Mercado Pago, as well as handling withdrawal requests;
• Identity verification: fulfilling KYC obligations and anti-money laundering requirements under Brazilian law;
• Security and anti-fraud: detection of unauthorized access, suspicious activity, multiple accounts, and the use of prohibited automation tools;
• User support: providing customer support via chat and email, resolving disputes, and managing complaints;
• Responsible gambling: monitoring behavioral patterns to identify signs of problem gambling and proactively offering control tools when needed;
• Platform improvement: analysis of aggregated, anonymized data to identify product improvements, bugs, and opportunities to enhance the user experience;
• Marketing communications: sending emails about promotions, bonuses, new games, and platform updates — only to users who have consented to this type of communication.

5. Sharing Data with Third Parties

T578 does not sell, rent, or share personal data for commercial purposes to no third party. Data sharing occurs only in the situations below, with appropriate safeguards in place:

5.1. Required Operational Partners

Some essential services required for the platform to function are provided by third parties who may have limited access to personal data:

• Payment processors: certified financial intermediaries that process transactions via Pix and other methods — they receive only the data strictly necessary to complete the transaction;
• Identity verification providers (KYC): companies specializing in document verification that assist with the compliance process;
• Game providers: partners such as Pragmatic Play, Evolution Gaming, Spribe, and others that require technical session identifiers to function properly — they do not have access to complete personal data;
• IT infrastructure services: hosting and cloud providers that store data under strict confidentiality agreements and LGPD compliance contracts.

All operational partners sign Data Processing Agreements (DPAs) requiring them to handle information solely for the contracted purposes and at a level of protection equivalent to that required by the LGPD.

5.2. Legal Obligations

T578 may disclose personal data when expressly required by law, court order, or determination of a competent regulatory authority. In such cases, we disclose only the minimum necessary to fulfill the legal obligation and, whenever possible and permitted by law, notify the user of the request.

5.3. Rights Protection

In cases of suspected fraud, money laundering, match-fixing, or other unlawful activities, t578 may share information with public security authorities or regulatory bodies as required by applicable Brazilian law.

6. Cookies and Tracking Technologies

T578 uses cookies and similar technologies to enhance your experience on the platform. The types of cookies used are:

• Essential cookies: required for core platform functionality — session authentication, language preferences, bet slip. These cannot be disabled without impairing use of the service;
• Performance cookies: collect anonymized data on how users navigate the platform to identify performance issues and improve the experience — for example, which pages load more slowly on certain devices;
• Functionality cookies: remember user preferences such as decimal or fractional odds format, favorite markets, and display settings;
• Analytical cookies: used to understand aggregate usage patterns and support product decision-making — data is always processed in anonymized form.

You can manage your cookie preferences in your browser or device settings. Disabling non-essential cookies does not affect access to the main features of the t578 platform.

7. Payment Data & Financial Security

Payment processing at t578 involves sensitive financial data. Our specific protection practices for this type of data are:

• Full credit and debit card details are never stored on t578's servers — processing is delegated entirely to PCI-DSS certified intermediaries;
• Pix keys are stored with encryption and used solely to process withdrawals requested by the account holder;
• Transaction history is retained in compliance with the retention periods required by Brazilian financial legislation and the LGPD;
• All withdrawal requests go through account ownership verification — withdrawals to third-party accounts are not processed;
• Transactions above certain thresholds trigger additional verification protocols in accordance with anti-money laundering regulations (Law No. 9,613/1998).

8. Data Retention and Deletion

T578 retains your personal data for as long as necessary to fulfill the purposes described in this policy or to meet legal obligations. The main retention periods are:

Data Category	Retention Period	Reason
Registration data	For the duration of the active account + 5 years after closure	Legal obligation (compliance, disputes)
Betting history	5 years after the bet is placed	Tax and regulatory obligations
Financial data (transactions)	10 years (in accordance with Brazilian financial legislation)	Law No. 9,613/1998 and Bacen regulations
KYC Documents	5 years after account closure	Anti-money laundering
Access logs	6 months (extendable by court order)	Brazilian Internet Civil Rights Framework (Law No. 12,965/2014)
Marketing data (consent)	Until consent is withdrawn	Consent as a legal basis

Once retention periods expire, data is securely deleted or anonymized so that the data subject can no longer be identified. Anonymization is an alternative to deletion when the data still has analytical value for service improvement, provided the subject's identity cannot be recovered.

9. Data Security Measures

T578 adopts the following technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure:

9.1. Technical Measures

• 256-bit SSL/TLS encryption on all communications between the user and the platform;
• Passwords stored exclusively as salted hashes (bcrypt or equivalent) — not even t578's technical team has access to your original password;
• Two-factor authentication (2FA) available for all users;
• Intrusion detection systems and anomalous activity monitoring running 24 hours a day;
• Segregation of production, development, and test environments with restricted access based on least privilege;
• Encrypted backups with periodic restoration tests;
• Regular vulnerability scans and penetration testing conducted by specialized teams.

9.2. Organizational Measures

• Access to personal data restricted to employees with a legitimate need (principle of least privilege);
• Regular training for all staff on data protection, the LGPD, and information security best practices;
• Mandatory confidentiality agreements for all employees and service providers with access to personal data;
• Internal incident response policy with clear procedures for containment, investigation, and notification;
• Periodic review of this Privacy Policy and data processing procedures to ensure ongoing compliance with the LGPD.

10. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a personal data subject, a set of rights that t578 is committed to respecting and making easy to exercise. See each right and how to exercise it:

Right	What it means	How to exercise
Access	Obtain confirmation that your data is being processed and receive a copy of the information we hold about you	Email: contato@t578.click with the subject line "LGPD – Access"
Correction	Request the correction of incomplete, inaccurate, or outdated data	Support chat or email with the subject line "LGPD – Correction"
Anonymization or Deletion	Request the anonymization or deletion of data that is unnecessary or processed in violation of the LGPD	Email with subject line "LGPD – Deletion"
Portability	Receive your data in a structured, interoperable format for transfer to another service provider	Email with subject line "LGPD – Portability"
Information on data sharing	Know which public or private entities your data has been shared with	Email with subject line "LGPD – Data Sharing"
Withdrawal of consent	Withdraw consent for processing based on that legal basis (e.g., marketing emails)	Unsubscribe link in the email or via support chat
Objection	Object to processing carried out on the basis of legitimate interest where that interest does not override your rights	Email with subject line "LGPD – Objection"

T578 will respond to all rights requests within 15 business days from the date the request is received, as provided for under the LGPD. In cases requiring more complex review, we will notify you of any extension along with the appropriate justification.

If you believe your rights have not been adequately addressed by t578, you may file a complaint with the National Data Protection Authority (ANPD), the public authority responsible for overseeing the enforcement of the LGPD in Brazil.

11. Marketing Communications and Promotional Emails

T578 may send marketing communications — such as emails about new bonuses, Brasileirão football promotions, Live Casino game launches, or VIP Program benefits — only to users who have given explicit consent for this type of communication.

You can opt out of receiving these communications at any time:

• By clicking the "Unsubscribe" link in the footer of any t578 marketing email;
• By accessing the notification settings in your account on the platform;
• Requesting removal via the support chat or by email.

Unsubscribing from marketing communications does not affect the receipt of essential transactional emails, such as bet confirmations, withdrawal notifications, and security alerts — these will continue to be sent as they are necessary for service delivery.

T578 does not make unsolicited phone calls (cold calls) or send marketing SMS messages without prior consent.

12. Protection of Minors

The t578 platform is intended exclusively for individuals who are 18 years of age or older. t578 does not intentionally collect personal data from minors and takes the following preventive measures:

• Date of birth verification at the time of registration;
• CPF request, which enables age verification against public databases;
• KYC process that includes photo-based document verification when required;
• Immediate closure of accounts identified as belonging to minors, with any remaining balance returned subject to compliance review.

If you suspect that an account belonging to a minor is active on the platform, please contact us immediately at contato@t578.click with the subject line "Minor Protection". We will investigate as a priority.

13. International Data Transfers

As a general rule, t578 keeps all users' personal data on servers located in Brazil. In specific situations, international data transfers may be necessary — for example, to use global infrastructure services or to integrate with international game providers whose servers are located outside Brazil.

When this occurs, t578 ensures that:

• The transfer is made only to countries or organizations that provide an adequate level of data protection, as assessed by the ANPD;
• Or, alternatively, appropriate safeguards are applied, such as standard contractual clauses, data processing agreements, and equivalent mechanisms provided for under the LGPD;
• The transfer is limited to the data strictly necessary for the specific purpose that gave rise to it.

T578 keeps an up-to-date record of all international data transfers and the legal bases that support them, available for review by the ANPD upon request.

14. Changes to this Privacy Policy

T578 may update this Privacy Policy periodically to reflect changes in data processing practices, new legal requirements, or platform updates. Changes are communicated as follows:

• Significant changes (changes affecting data subject rights or introducing new processing purposes): communicated by email to all registered users at least 15 calendar days before taking effect;
• Minor changes (corrections, language updates, adjustments to new regulations with no change in substance): implemented by updating the effective date at the top of this policy.

Continued use of the t578 platform after any changes take effect constitutes acceptance of the updated version of this policy. If you do not agree with the changes, you may close your account and request deletion of your data before the new rules come into force.

15. Contact, DPO & Privacy Channel

For any questions related to privacy, data protection, or the exercise of your rights as a data subject, contact t578 through the channels below:

• Privacy email: contato@t578.click — use the subject line "LGPD Request" to ensure priority handling;
• Live chat: available 24 hours a day directly on the t578 platform — average response time under 2 minutes;
• Data Protection Officer (DPO): t578 has a formally designated Data Protection Officer in accordance with Art. 41 of the LGPD, responsible for serving as the communication channel between t578, data subjects, and the ANPD. The DPO can be reached at the same email address above with the subject line "Attention: DPO".

T578 is committed to responding to all privacy requests within the timeframes set by the LGPD and the Consumer Protection Code (Law No. 8.078/1990). Urgent requests related to security incidents or account misuse are treated as the highest priority.

If, after contacting t578, you feel your rights as a data subject have not been properly addressed, you may file a complaint with the National Data Protection Authority (ANPD) through the agency's official portal.