X9game Privacy Policy – Your Data, Protected

1 Who We Are — The Data Controller

For the purposes of the LGPD (Law 13.709/2018), the x9game acts as controller of the personal data processed within this platform. This means we are responsible for all decisions regarding the collection, use, storage, and sharing of your data.

The platform x9game is intended exclusively for the Brazilian market, offering Sports Betting (football, volleyball, basketball, MMA/UFC, e-sports, and over 50 other sports) and online casino games, including slots, live roulette, blackjack, baccarat, and crash games.

For any questions related to privacy or the processing of your personal data, you can reach us directly by email at suporte@x9game.best or via the live chat available 24 hours a day on the platform.

2 Data We Collect

The x9game only collects data strictly necessary to operate the platform securely, meet legal obligations, and provide a suitable experience for Brazilian users. Data is collected at different points and through different means:

Data provided directly by the user during registration:

• Full name;
• CPF (Cadastro de Pessoas Físicas);
• Date of birth;
• Email address;
• Mobile phone number;
• Full residential address (zip code, city, state);
• Pix key registered for withdrawals.

Data collected automatically during platform use:

• IP address and approximate location;
• Browser type and version, and operating system;
• Device used (mobile phone, tablet, computer);
• Pages visited, session duration, and interface interactions;
• Betting history, deposits, and withdrawals;
• Data from cookies and similar technologies (detailed in Section 9).

Data collected during the identity verification (KYC) process:

• Copy of a government-issued ID (national ID card, driver's license, or passport);
• Proof of address;
• Selfie for facial verification, when requested.

3 How We Use Your Data

The data collected by x9game are used solely for the purposes described below. No data is processed for any purpose incompatible with what was disclosed to you at the time of collection:

The x9game does not use your data for automated decision-making that produces significant legal effects or substantially impacts you without the possibility of human review, as required by the LGPD.

4 Legal Basis for Processing

All collection and processing of personal data by the x9game has a defined legal basis under the LGPD. The main legal bases we rely on are:

• Contract performance (Art. 7, V): to create and manage your account, process deposits via Pix, boleto, or credit/debit card, and handle withdrawals;
• Compliance with legal obligation (Art. 7, II): for identity verification (KYC), anti-money laundering compliance (PLD/COAF), and fulfillment of court orders;
• Legitimate interest (Art. 7, IX): for fraud prevention, platform improvement, experience personalization, and customer support — always in respect of your fundamental rights;
• Consent (Art. 7, I): for sending marketing communications, promotions, and news — you can withdraw this consent at any time through your account dashboard or by contacting support.

5 Data Sharing

The x9game does not sell, rent, or otherwise commercialize users' personal data. Period. Sharing only occurs in the situations below, always with the appropriate safeguards in place:

Operational and technology partners: We share data with service providers acting as data operators under our control — such as casino game providers (e.g., Evolution Gaming, Pragmatic Play), Pix payment processors, and identity verification companies. These partners may only use your data for the specific purposes of the service they provide to x9game and are contractually bound to protect it.

Legal and regulatory obligations: We may share data with Brazilian authorities when legally required — including the Receita Federal, Banco Central do Brasil, COAF (Financial Activities Control Council), and judicial authorities, upon formal order. This is a legal obligation, not a choice.

Fraud prevention: When there is substantiated suspicion of fraud, match-fixing, or money laundering, we may share information with other betting platforms or regulatory authorities to protect the integrity of the ecosystem.

What we never do:

• Sell data to marketing companies or advertisers;
• Share data with third parties outside the scope described above;
• Transfer your data for purposes incompatible with what was disclosed to you.

6 Data Storage & Security

The x9game adopts robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• 256-bit SSL encryption on all connections between your browser/mobile device and x9game's servers;
• Encryption at rest for sensitive data stored in the database — including KYC documents, banking details, and identification information;
• Least-privilege access control: each team member has access only to the data required for their specific role;
• Multi-Factor Authentication (MFA) required for access to internal systems;
• Continuous monitoring of unauthorized access attempts, with automatic alerts and an incident response plan;
• Periodic security audits conducted by internal teams and, when necessary, by external specialists;
• Encrypted backups with copies stored in separate geographic locations to ensure continuity in the event of an incident.

In the event of a security incident that may affect your personal data, the x9game will notify affected data subjects and the National Data Protection Authority (ANPD) within the deadlines established by the LGPD.

7 Data Retention — How Long We Keep Your Data

The x9game retains your personal data only for as long as necessary for the purposes it was collected, in accordance with mandatory legal retention periods:

• Active account data: retained for the full duration of the contractual relationship;
• Financial and transaction records (Pix deposits, withdrawals, bets): minimum of 5 years after account closure, as required by Brazilian tax and AML legislation;
• KYC Documents (government-issued ID, driver's license, proof of address): minimum of 5 years after account closure;
• Access and security logs: 12 months, extendable if an investigation is ongoing;
• Marketing communications data: until consent is withdrawn by the data subject;
• Data from accounts closed due to inactivity: the user is notified before account closure; data is retained only for the minimum legally required period after closure.

After the retention period, data is securely deleted or anonymized so it can no longer be linked to a specific individual.

8 Your Rights as a Data Subject

The LGPD grants you a robust set of rights over your personal data. The x9game respects and supports the exercise of all of them:

9 Cookies and Similar Technologies

The x9game uses cookies and similar technologies to ensure the platform functions correctly, remember your preferences, and improve your overall experience. You can manage cookie preferences in your browser settings — but disabling essential cookies may affect platform functionality.

The x9game does not use third-party cookies to track you on other websites outside the platform. Cookies from payment partners (such as Pix via a partner bank) are governed by those partners' own privacy policies and are used solely to process transactions.

10 Minors

The x9game is a platform exclusively intended for users aged 18 and over. We do not intentionally collect personal data from minors. Registration requires age confirmation and CPF verification, which in itself prevents minors from signing up.

If we identify that an account was created by a minor — whether through a false declaration or a failure in the verification process — the account will be immediately closed, all collected data will be securely deleted (except data required to fulfill a legal obligation), and any deposits will be returned to the responsible legal guardian.

11 International Data Transfers

Some of the service providers used by the x9game — such as Live Casino game providers and cloud infrastructure services — may process data on servers located outside Brazil. When this occurs, x9game ensures that:

• Data is only transferred to countries or organizations that offer an adequate level of protection in line with LGPD standards;
• Data Processing Agreements (DPAs) are in place with all international partners;
• Internationally recognized standard contractual clauses are used as a safeguard;
• No sensitive data is transferred to jurisdictions without adequate protection without your explicit consent or a clear legal basis under the LGPD.

The x9game prioritizes partners with recognized security certifications (ISO 27001, SOC 2) for processing data of Brazilian users.

12 Changes to This Privacy Policy

The x9game may periodically update this Privacy Policy to reflect changes in data processing practices, regulatory updates, or platform improvements. When that happens:

• The "last updated" date at the top of this page will be revised;
• Material changes will be communicated by email at least 7 days in advance;
• For changes that require new consent, you will be explicitly asked to agree before continuing to use the platform;
• The previous version of the policy will be archived and made available upon request.

We recommend reviewing this policy periodically. Continued use of the platform after non-material changes are published constitutes acceptance of the updated terms. For changes that significantly expand the scope of data processing, explicit consent will always be requested.

13 Contact, DPO & Reporting Channel

To exercise your rights as a data subject, ask questions about this policy, or report any privacy-related concern, please use the channels below:

• Live chat: available 24/7 directly on the x9game platform — the fastest option for urgent matters;
• DPO Email: suporte@x9game.best with the subject line "LGPD – Data Subject Request";
• Help Center: Frequently Asked Questions — quick answers to the most common questions about privacy and data security.

If you believe that the x9game did not handle your request properly or that your rights have been violated, you have the right to file a complaint with the National Data Protection Authority (ANPD), pursuant to Art. 18, §1 of the LGPD.