Privacy Policy of 1010com – How We Protect Your Data

For the purposes of the General Data Protection Law (LGPD – Law No. 13,709/2018), the controller of your personal data is 1010com, operator of the sports betting and online casino platform accessible at https://1010com.best and via mobile apps for Android and iOS.

The controller is the entity that makes decisions about the processing of personal data — that is, it determines why data is collected, how it is used, how long it is retained, and who can access it. In practice, this means that the 1010com is the legal entity responsible for processing your information and the sole point of contact for exercising your rights as a data subject.

We have appointed a Data Protection Officer (DPO) as required by the LGPD. To contact the DPO, please refer to Section 14 of this Policy.

The 1010com collects only the data necessary to operate the platform and deliver the contracted services. Collection takes place at different points during your interaction with the website or app:

Data provided directly by you

• Registration: full name, CPF, date of birth, gender, full residential address (street, number, neighborhood, city, state, ZIP code), and email address;
• Identity verification (KYC): a photo ID (RG, CNH, or Passport), proof of address, and a selfie with the document;
• Payments: Pix key, credit/debit card details (tokenized — we never store the full card number), bank account details for wire transfers;
• Support communications: live chat conversation history, emails sent, and support interaction records.

Automatically Collected Data

• Browsing data: IP address, device type, operating system, browser, pages visited, session duration, and actions taken on the platform;
• Location data: approximate location derived from IP address, to verify access from Brazil;
• Cookies and similar technologies: session identifiers, saved preferences, and usage analytics data (see section 7 for details);
• Betting and gaming data: complete history of bets, deposits, withdrawals, bonuses used, and casino game activity.

The 1010com uses your personal data solely for the purposes described below. Any use beyond these purposes requires your explicit additional consent:

• Account creation and management: identify the user, personalize the experience, and maintain secure access to the platform;
• Financial transaction processing: receive deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago; process withdrawals via Pix; issue transaction receipts and financial history;
• Identity verification and compliance: fulfill legal KYC obligations, anti-money laundering requirements, and regulatory compliance for the betting sector in Brazil;
• Fraud prevention and security: detect suspicious activity, multiple accounts, bonus abuse, and behavior that violates the Terms and Conditions;
• Customer support: answer questions, resolve technical issues, and maintain a history of support interactions;
• Account communications: betting notifications, results, deposits, withdrawals, security alerts, and important Terms updates;
• Marketing and promotions (with consent): sending emails with offers, bonuses, and platform news — only when you give your consent, with an unsubscribe option in every email;
• Continuous platform improvement: aggregated and anonymized analysis of user behavior to improve the experience, fix bugs, and develop new features;
• Responsible gambling: monitor usage patterns to identify signs of compulsive behavior and offer the appropriate responsible gambling tools.

The LGPD requires that every data processing operation have a legal basis set out in art. 7 of the Law. The 1010com processes your data on the following legal bases, according to the purpose:

• Contract performance (art. 7, V): processing necessary to perform the service agreement entered into when you register on the platform — includes account management, payment processing via Pix and Boleto, identity verification, and support;
• Compliance with a legal obligation (art. 7, II): processing required by Brazilian law — includes KYC, retention of financial records in accordance with tax obligations, and disclosures to competent authorities when required by law;
• Legitimate interest (art. 7, IX): processing for platform security, fraud prevention, service improvement, and usage analysis — always in compliance with your rights and legitimate expectations;
• Consent (art. 7, I): marketing communications and promotional offers – you may withdraw this consent at any time without affecting your account.

The 1010com does not sell, rent, or transfer your personal data to third parties for commercial purposes. Sharing is strictly limited to the situations below, all with a legitimate purpose and defined legal basis:

Service providers (data operators)

We share data with companies that provide services on our behalf, always under a data protection agreement that prohibits them from using your data for their own purposes. This includes:

• Payment processors for transactions via Pix, credit card, PicPay, and Mercado Pago;
• Cloud infrastructure providers for platform hosting;
• Anti-fraud software and identity verification (KYC) providers;
• Usage analytics platforms (anonymized and aggregated data, with no personal identification);
• Casino game providers (internal account identifier only — no full personal data).

Authorities and legal obligations

The 1010com may share data with Brazilian public authorities (Receita Federal, COAF, Federal Police, Public Prosecutor's Office, Judiciary) when required by law, court order, or regulatory investigation. Any such sharing is documented internally.

Corporate transactions

In the event of a merger, acquisition, or corporate restructuring, your data may be transferred to the new controller, which will assume the same obligations under this Policy. You will be notified in advance of any significant change in the controller.

The 1010com adopts robust technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, improper disclosure, or destruction. The main security measures include:

• 256-bit SSL/TLS Encryption across all connections to the platform – the same standard used by Brazil's largest banks, including Itaú, Bradesco, and Banco do Brasil;
• Encrypted storage of passwords using irreversible hashing (bcrypt with salt) – 1010com never stores passwords in plain text and has no access to your password;
• Card data tokenization – your full credit or debit card number is never stored on 1010com's servers. Only a token provided by the payment processor is retained;
• Least-privilege access control – each team member has access only to the data required for their specific role;
• Two-factor authentication (2FA) available to all users and mandatory for internal administrative access;
• Continuous monitoring of suspicious access attempts, with automated alerts and 24-hour incident response;
• Encrypted backups performed daily, stored in a separate location with restricted access controls.

Data is stored on servers located in Brazil or in countries with a level of protection equivalent to that required by the LGPD. See section 11 for more details on international transfers.

The 1010com uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and analyze service usage. Below we explain the types of cookies we use:

Essential cookies

Required for the platform to function properly. These include the session cookie (which keeps you logged in), form security tokens, and language preferences. They cannot be disabled without compromising your use of the platform.

Analytical cookies (with your consent)

Used to understand how users interact with the platform — which pages are visited most, where navigation issues occur, and how to improve the experience. Data is collected in anonymized and aggregated form, with no individual personal identification.

Preference cookies

These store your in-platform preferences, such as favorite sports, preferred odds, and betting settings, to personalize your experience on future visits.

Cookie management

You can manage your cookie preferences through your browser settings at any time. Disabling essential cookies may prevent login and platform security features from working correctly. Analytics and preference cookies can be disabled without affecting core functionality.

The LGPD grants you, as the data subject whose personal data is processed by the 1010com, a set of rights that may be exercised at any time, free of charge, through the channel indicated in Section 14 of this Policy:

• Access (art. 18, II): request confirmation that 1010com processes your data and obtain a copy of all information we hold about you;
• Correction (art. 18, III): request the correction of incomplete, inaccurate, or outdated information in your account;
• Anonymization, blocking, or deletion (art. 18, IV): request that unnecessary data or data processed in violation of the LGPD be anonymized, blocked, or deleted;
• Portability (art. 18, V): request the transfer of your data to another controller, in a structured and commonly used format;
• Deletion following withdrawal of consent (art. 18, VI): withdraw consent for processing based on this legal ground and request the deletion of data processed under it;
• Information on sharing (art. 18, VII): request information about which public and private entities 1010com has shared your data with;
• Right to be informed about the option not to consent (art. 18, VIII): be informed about the consequences of withholding consent for a specific type of data processing;
• Objection (art. 18, § 2): object to processing carried out on the basis of legitimate interest where it has a disproportionate impact on your rights;
• Petition to the ANPD: file a complaint with the National Data Protection Authority (ANPD) if you believe your rights have been violated.

The 1010com responds to all requests within 72 business hours. Some requests may require identity verification before processing, in order to protect your account security.

The 1010com retains your personal data for as long as necessary for the purposes described in this Policy, in accordance with the minimum retention periods required by Brazilian law:

• Active account data: retained for as long as the account remains active and for up to 5 years after closure, in accordance with tax and regulatory requirements;
• Financial records (deposits, withdrawals, bets): retained for 5 years in accordance with the obligations of Law No. 9,613/1998 (anti-money laundering) and tax requirements;
• KYC records (identity documents): retained for 5 years after account closure or last use;
• Customer support communication data: retained for 2 years for quality assurance and service continuity purposes;
• Access log data: retained for 6 months in accordance with the Brazilian Internet Civil Framework (Law No. 12.965/2014), and may be extended if an investigation is ongoing.

Once the applicable retention period ends, data is securely deleted or irreversibly anonymized. You may request early deletion of data not subject to a legal retention obligation by contacting the DPO.

The 1010com does not offer services to individuals under 18 and does not intentionally collect personal data from children or teenagers. Registration requires a valid CPF and date-of-birth verification, and the platform is not directed at anyone under the age of 18.

If we determine that we have collected data from a user under 18, the account will be immediately closed, all data will be deleted without use of any funds deposited through unauthorized means, and the legal guardian will be notified where possible.

If you believe a minor has created an account on 1010com, please contact suporte@1010com.best immediately so we can take the necessary steps.

Some service providers used by the 1010com may process data on servers located outside Brazil. When this occurs, the transfer is carried out with the safeguards required by the LGPD, including:

• Transfer to countries with an adequate level of data protection, as recognized by the ANPD;
• Use of standard data protection contractual clauses approved by the ANPD;
• International information security certifications (ISO 27001, SOC 2) required of all vendors;
• Specific data processing agreements (DPA) with each international vendor.

The core infrastructure of 1010com is hosted in data centers in Brazil. International transfers occur primarily with cloud infrastructure providers and casino game providers, always with the controls above in place.

The 1010com maintains a security incident response plan that establishes clear procedures for the identification, containment, investigation, and notification of events involving personal data.

In the event of a security incident that may pose a relevant risk or harm to data subjects, the 1010com commits to:

• Notify affected users within 72 hours of confirming an incident, with a clear description of what occurred, which data was affected, and what steps were taken;
• Notify the National Data Protection Authority (ANPD) within the applicable regulatory deadline;
• Take immediate action to contain the incident and prevent further damage;
• Provide practical guidance on how affected users can protect themselves.

If you notice any suspicious activity on your account or believe your credentials have been compromised, contact 1010com via live chat or by email at suporte@1010com.best.

The 1010com may update this Privacy Policy at any time to reflect changes in data processing practices, updates to Brazilian law, or improvements to internal data protection processes.

Significant changes – particularly those that expand data collection or modify processing purposes – will be communicated at least 15 days in advance by email and through an in-platform notification. You will have the opportunity to review the changes before they take effect.

The date of the last update is always shown at the top of this page and at the beginning of the document. Previous versions of the Policy are available upon request to the DPO. Continued use of the platform after an updated version takes effect constitutes acceptance of the new terms.

To exercise any of your rights as a data subject, ask questions about this Policy, or report any privacy-related issue, please contact the 1010com through the channels below:

When contacting us to exercise your rights, please provide your full name, CPF, and a clear description of your request. We may require additional identity verification to protect your account security before processing access or data deletion requests.