Privacy Policy – Data Protection at 12qq

1. Introduction and Controller Identification

This Privacy Policy describes how the platform 12qq, accessible at 12qq.best, collects, uses, stores, shares, and protects the personal data of its users. This document is directed at the Brazilian public and drafted in compliance with the Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018 — LGPD).

The 12qq acts as the data controller for its users' personal data, being responsible for decisions regarding the processing of that information. By registering on the platform, making deposits or withdrawals via Pix, boleto bancário, credit card, PicPay, Mercado Pago, or TED, or simply browsing the site, you agree to the practices described in this Privacy Policy.

This policy should be read together with the Terms and Conditions of the platform, which set out the general rules of use for 12qq. If you have any questions about this policy, contact our team at suporte@12qq.best — we respond in Portuguese, 24 hours a day.

2. What Data We Collect

The 12qq collects different categories of data depending on how you interact with the platform. Below are the types of data collected and the context in which each is obtained:

The 12qq does not collect data classified as sensitive under the LGPD — such as racial or ethnic origin, religious belief, political opinion, or health data — unless strictly required to fulfill a specific legal obligation, in which case the user will be notified in advance.

3. How We Use Your Data

Each piece of data collected by 12qq has a specific, declared purpose. We do not process information beyond what is necessary for the purposes listed below:

• Account creation and management: verify your identity, authenticate your sessions, and keep your user profile up to date on the platform;
• Payment processing: process deposits and withdrawals via Pix, boleto bancário, credit card, debit card, Mercado Pago, PicPay, and TED transfers — exclusively in BRL (R$);
• Identity verification (KYC): verify your identity, prevent fraud and money laundering, and comply with the regulatory requirements applicable to the sports betting market in Brazil;
• Platform operations: record bets, process results, calculate winnings, manage bonuses, and ensure the proper functioning of all available services;
• User support: answer questions, resolve technical and account issues, and maintain a support history for reference in future interactions;
• Responsible gambling: monitor usage patterns to identify behaviors that may indicate problem gambling and trigger the available protection tools when needed;
• Security & fraud prevention: detect suspicious access, attempted misuse of the platform, and ensure the integrity of transactions;
• Account communications: send notifications about financial transactions, security updates, changes to terms, and other information relevant to your use of the platform;
• Compliance with legal obligations: respond to requests from regulatory and judicial authorities in accordance with applicable Brazilian law.

4. Legal Basis for Processing (LGPD)

The 12qq processes personal data on the legal bases set out in Article 7 of the LGPD. The applicable basis varies depending on the purpose of the processing:

• Performance of a contract (Art. 7, V): the processing necessary to create your account, handle your bets, execute deposits and withdrawals, and provide the services you agreed to when accepting the Terms and Conditions;
• Compliance with a legal or regulatory obligation (Art. 7, II): data processed to meet identity verification (KYC) requirements, anti-money laundering obligations, and regulatory requirements under Brazilian law;
• Legitimate interest (Art. 7, IX): processing of technical data for platform security, fraud prevention, and continuous service improvement, always respecting users' rights and expectations;
• Consent (Art. 7, I): sending marketing communications and using non-essential cookies — consent may be withdrawn by the user at any time.

The 12qq does not process personal data based on consent obtained through pressure, deception, or by conditioning platform access. Consent for optional communications is always separate and granular — you choose what you agree to receive.

5. Data Sharing with Third Parties

The 12qq does not sell, transfer, or commercially exploit users' personal data. Information is shared with third parties only in the situations described below, for specific purposes and with appropriate safeguards:

• Payment processors: financial data is shared with the institutions responsible for processing Pix, boleto bancário, credit and debit cards, Mercado Pago, PicPay, and TED transfers, exclusively to execute transactions requested by the user;
• Game providers: username and game balance are transmitted to game providers such as Pragmatic Play, Evolution Gaming, Spribe, and SmartSoft to run crash games, slots, and live casino rounds on the platform;
• IT service providers: companies engaged for infrastructure hosting, security analysis, and technical support, operating under confidentiality agreements and data processing terms compatible with the LGPD;
• Competent authorities: data may be shared with regulatory, law enforcement, or judicial authorities when required by law, court order, or valid legal process in Brazil, without the need for prior user consent in those specific situations;
• Fraud prevention companies: technical and behavioral data may be shared with partners specialized in fraud detection to protect the integrity of the platform and its users.

All third parties that receive data from 12qq are contractually required to process such information solely for the agreed purpose, maintaining security standards consistent with those of 12qq and in compliance with the LGPD.

6. Data Retention and Deletion

The 12qq retains personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with the minimum retention periods established by Brazilian law:

• Active account data: retained for as long as the account is active and for the additional period required after closure to meet legal obligations;
• Financial transaction records: retained for a minimum of 5 years after the transaction, as required by anti-money laundering regulations;
• KYC verification documents: retained for a minimum of 5 years or as required by the regulations applicable at the time of processing;
• Bet and game records: retained for a minimum of 5 years for audit and dispute resolution purposes;
• Support communication data: retained for 2 years after a ticket is closed, for reference in future support interactions.

After account closure, data is anonymized or securely deleted within 90 days, except where retention is required by law. You may request early deletion of data not subject to mandatory retention by emailing suporte@12qq.best — 12qq will respond within 72 business hours.

7. Cookies & Tracking Technologies

The 12qq uses cookies and similar technologies to improve the browsing experience, ensure the platform functions correctly, and — with your consent — personalize content and analyze usage behavior.

The cookies used by 12qq fall into the following categories:

• Essential cookies: required for the basic operation of the platform — session authentication, login security, and bet slip functionality. They cannot be disabled without affecting your ability to use the platform;
• Performance cookies: collect anonymous information about how users navigate the platform to identify errors and areas for improvement. Enabled only with consent;
• Functionality cookies: remember your preferences — such as language, betting settings, and preferred layout — to personalize your experience. Enabled only with your consent;
• Marketing cookies: used to send relevant communications about promotions and platform updates. Enabled only with explicit, revocable consent.

You can manage your cookie preferences at any time through your browser settings or the consent management tool available on the platform. Disabling non-essential cookies does not affect access to the core features of 12qq.

8. Data Security

The 12qq implements multiple layers of technical and organizational security to protect your personal data against unauthorized access, alteration, disclosure, or accidental destruction:

• 256-bit SSL Encryption across all communications between the user's device and the platform's servers;
• Encrypted storage of sensitive data, including banking information and identification documents;
• Two-factor authentication (2FA) available for all accounts — strongly recommended for additional protection of your access;
• Anti-fraud systems that monitor in real time for suspicious access attempts, logins from unrecognized devices, and anomalous behavior patterns;
• Internal access controls with granular permissions — only team members with a specific business need have access to users' personal data, and that access is logged and audited;
• Regular security testing — the platform infrastructure undergoes periodic vulnerability assessments and penetration testing carried out by independent specialists.

In the event of a security incident that may affect users' personal data, 12qq will notify affected users and the National Data Protection Authority (ANPD) within the timeframes set by the LGPD, with clear information about what occurred and the steps taken to address the situation.

9. Your Rights as a Data Subject

The LGPD guarantees you, as the owner of your personal data, a set of rights that 12qq is committed to respecting and facilitating the exercise of these rights. See each right and how to exercise it below:

10. Minors

The 12qq is a platform intended exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. Registration requires confirmation that the user is at least 18 years old, and the KYC verification process detects inconsistencies between the declared date of birth and the documents provided.

If we identify that an account was created by a minor, it will be immediately closed, the collected data will be deleted, and any deposits will be refunded. If you suspect a minor is using the platform with your data or another adult's data, contact us immediately through support — we treat these situations with the highest priority.

Parents or guardians who wish to prevent minors from accessing betting content can use parental control software to restrict access to gambling sites on shared devices.

11. International Data Transfers

Part of the technological infrastructure of the 12qq — including hosting servers and some analytics tools — may be located outside Brazil. When personal data is transferred to other countries, 12qq applies the safeguards required by the LGPD to ensure your data receives protection equivalent to that applied in Brazil:

• Transfers only to countries with an adequate level of data protection recognized by the ANPD, or under specific contractual protection clauses;
• Data processing agreements with all international recipients, imposing obligations compatible with the LGPD;
• Minimization of internationally transferred data — only the information strictly necessary for the specific purpose is shared.

The 12qq prioritizes suppliers and partners with a presence in Brazil or with robust data protection policies, minimizing the need for international transfers of users' personal data.

12. Changes to this Privacy Policy

The 12qq may update this Privacy Policy periodically to reflect changes in its data practices, applicable legislation, or services offered. Material changes — those that directly affect your rights or how your data is handled — will be communicated by email and via an in-platform notification at least 7 days before taking effect.

Minor changes — such as text corrections or contact information updates — may be implemented without prior notice. The last updated date shown at the top of this page always reflects the most recent version of the document.

We recommend reviewing this policy periodically to stay informed about how 12qq protects your information. Continued use of the platform after any changes take effect constitutes acceptance of the updated practices described herein.

13. Contact, DPO & Reporting Channel

For any questions about this Privacy Policy, to exercise your data subject rights, or to report a security incident, please contact the Data Protection Officer (DPO) of 12qq:

If you believe your data protection rights have been violated and do not receive a satisfactory response from 12qq, you have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD), the body responsible for overseeing LGPD compliance in Brazil.