Boys888 Privacy Policy – Your Data Protected in Brazil

1 Who We Are & Scope of This Policy

This Privacy Policy describes how boys888, a Sports Betting and online casino platform available at boys888.click, collects, uses, stores, shares, and protects the personal data of registered users and site visitors.

Boys888 acts as the controller of personal data collected during use of the platform, in accordance with the General Personal Data Protection Law (LGPD — Law No. 13,709/2018). This policy applies to all services available on boys888, including Sports Betting (Brasileirão, Copa do Brasil, Libertadores, volleyball, UFC, NBB, e-sports), Live Casino, slots, blackjack, the VIP Program, and any current or future features of the platform.

By registering on boys888, using any service on the platform, or simply browsing the site, you confirm that you have read and understood this Privacy Policy. We recommend reading it in full before creating your account.

2 Personal Data We Collect

Boys888 collects different categories of data depending on how you interact with the platform. Below is a transparent breakdown of each category:

3 How We Use Your Data

Boys888 uses the personal data collected solely for the following legitimate purposes:

• Account operation: create, maintain, and manage your boys888 account, including access authentication and experience personalization.
• Transaction processing: process deposits via Pix, boleto, card, Mercado Pago, PicPay, and TED transfer, as well as withdrawals via Pix to the key linked to your CPF.
• Compliance with legal obligations: comply with Brazilian legal requirements, including identity verification (KYC), anti-money laundering obligations, and reporting to regulatory bodies when required by law.
• Fraud prevention: detect, investigate, and prevent fraudulent activity, multiple accounts, and bonus or promotion abuse.
• User support: answer questions, resolve technical issues, and handle requests submitted via chat, email, or other boys888 support channels.
• Relevant communications: send notifications about your account, transactions, VIP Program promotions, and important platform updates (with the option to unsubscribe at any time).
• Platform improvement: analyze aggregated, anonymous usage patterns to improve the user experience, technical stability, and the range of games and betting options.
• Responsible gambling: monitor usage patterns that may indicate at-risk behavior and apply responsible gambling tools when needed, in line with our commitment to user well-being.

Boys888 does not use your data for purposes beyond those listed above without prior notice and, where applicable, a new express consent.

4 Legal Basis for Processing (LGPD)

Every instance of personal data processing carried out by boys888 has a legal basis expressly provided for under the LGPD. The main bases we rely on are:

• Contract performance (Art. 7, V): we process your registration data, transactions, and betting history because they are necessary to fulfill the service agreement entered into when you created your boys888 account.
• Compliance with a legal obligation (Art. 7, II): financial and identification data are processed to meet legally imposed obligations, including anti-money laundering compliance and adherence to court orders or competent authority directives.
• Legitimate interest (Art. 7, IX): we use technical and usage data to ensure platform security, prevent fraud, and improve the user experience, provided this does not override your fundamental rights and freedoms.
• Consent (Art. 7, I): for optional marketing communications and the use of non-essential cookies, we ask for your express consent, which can be withdrawn at any time.

5 Sharing Data with Third Parties

Boys888 does not sell, rent, or share your personal data with third parties for commercial or advertising purposes. Data sharing occurs only in the following specific situations and for defined purposes:

• Payment processors: financial data required to process deposits and withdrawals is shared with the payment platforms we use (Brazilian banking institutions, card operators, Mercado Pago, PicPay), solely to complete the requested transaction.
• Technology providers: companies that provide boys888 with essential IT infrastructure services, such as server hosting and cloud services, under confidentiality agreements and data protection clauses aligned with the LGPD.
• Competent authorities: data may be shared with the Banco Central do Brasil, COAF, Polícia Federal, Ministério Público, or judicial authorities when required by explicit legal order or applicable regulatory obligation.
• Identity verification companies: for the KYC (Know Your Customer) process, identity documents may be processed by certified partner services under confidentiality and data protection agreements.

In all cases of data sharing, boys888 requires recipients to adopt security measures consistent with those set out in this policy and with LGPD requirements. boys888 remains responsible for ensuring that sharing occurs only within the purposes described herein.

6 Cookies & Tracking Technologies

Boys888 uses cookies and similar technologies to ensure the platform functions properly, analyze performance, and personalize the user experience. The types of cookies used are:

• Essential cookies: required for the basic operation of the site, such as maintaining login sessions, language preferences, and registration form security. These cannot be disabled without affecting your ability to use the platform.
• Performance cookies: collect anonymous, aggregated information about how users interact with boys888, such as the most visited pages and any technical errors. Used exclusively to improve the platform.
• Functionality cookies: store personal user preferences — such as favorite sports, default payment method, and display settings — to deliver a more personalized experience.
• Marketing cookies (opt-in): used only with your express consent, these allow boys888 to display relevant content based on your usage history. You can withdraw this consent at any time in the platform's cookie settings.

7 Data Storage and Security

Boys888 employs a robust set of technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction:

• 256-bit SSL encryption across all communication between users and platform servers.
• Data stored on servers with restricted access controls, multi-factor authentication, and continuous security monitoring.
• Credit card data is tokenized — boys888 never stores the full card number in its systems.
• User passwords are stored in encrypted form using one-way hash functions — not even the boys888 team can access your password in plain text.
• Regular security audits and penetration testing to identify and fix vulnerabilities before they can be exploited.
• Formal security incident response plan, with defined procedures for containment, investigation, and notification of affected parties.

Despite all the measures we have in place, no system is 100% invulnerable. boys888 is committed to acting swiftly in the event of any security incident and to notifying affected users within the legally required timeframes.

8 Data Retention and Deletion

Boys888 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, in accordance with applicable legal obligations:

• Active account data: retained for the entire period your account remains active on boys888.
• Financial data and betting history: retained for up to 5 years after account closure, in accordance with Brazilian anti-money laundering legislation and tax regulations.
• Identity verification data (KYC): retained for the minimum period required by Brazilian regulatory authorities.
• Non-essential cookie data: deleted according to each cookie's defined lifespan, typically between 30 days and 12 months.
• Support data: support history retained for up to 2 years for quality assurance and potential dispute resolution purposes.

Once the applicable retention period has elapsed, data is securely and permanently deleted from boys888 systems in a way that makes it unrecoverable.

9 Your Rights as a Data Subject

The LGPD grants you a set of rights regarding your personal data. boys888 is committed to fulfilling all requests within the legal timeframes (up to 15 days for an initial response):

10 Minors

Boys888 is a platform intended exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. If you believe a person under 18 has created a boys888 account or had their data collected, please contact our 24/7 support immediately so the situation can be investigated and resolved.

Parents and legal guardians should use parental control tools available on devices and browsers to prevent minors from accessing the platform. boys888 actively supports measures to protect minors and cooperates fully with any related investigations.

If an account is found to have been created by a person under 18 years of age, boys888 will immediately close the account, delete all collected data, and return any deposits to the identified legal guardian, in accordance with internal verification procedures.

11 Financial Data & Payments

Boys888 accepts deposits and processes withdrawals exclusively through Brazilian national payment methods. Financial data is handled to high security standards:

• Pix: the Pix key used for withdrawals must be linked to the CPF on file. boys888 does not store your Pix key beyond what is needed to process the transaction.
• Credit & Debit Card: card details are tokenized by the payment processor. boys888 never has access to the full card number after the initial transaction.
• Bank slip (Boleto), Mercado Pago & PicPay: transactions processed by their respective platforms under their own privacy and security terms, in compliance with Brazilian legislation.
• TED bank transfer via Nubank, Itaú, Bradesco, Banco do Brasil: account data used solely to process the requested deposit or withdrawal, with no storage beyond what is necessary.

Boys888 only processes transactions to and from accounts registered under the same CPF on the platform. This is both a security requirement and a safeguard against financial fraud for the user.

12 Communications & Marketing

Boys888 may send communications related to your account (transaction confirmations, security alerts, important updates) without requiring additional consent, as these are necessary for the performance of the service agreement.

For marketing communications — promotions, VIP Program news, special offers, and featured tips — we rely on the consent you provided at registration. You may opt out of these communications at any time through any of the following methods:

• By clicking the "unsubscribe" link in any marketing email received from boys888.
• By accessing the notification settings in your account dashboard on the platform.
• By submitting an express request through 24/7 support or by emailing contato@boys888.click.

Opting out of marketing communications does not affect essential account-related communications. Opt-out requests are processed within up to 5 business days.

13 Changes to this Privacy Policy

Boys888 may update this Privacy Policy periodically to reflect changes in data processing practices, applicable Brazilian legislation, or platform features. When this occurs:

• The "Last updated" date at the top of this page will be revised to reflect the most recent version.
• Substantial changes will be communicated by email to your registered address at least 7 days before they take effect.
• Continued use of the platform after the effective date of any changes constitutes acceptance of the updated policy.
• If you disagree with any material changes, you may close your account and request deletion of your data before the changes take effect.

We recommend reviewing this Privacy Policy periodically. The version currently in force is always the one published on this page. Previous versions can be requested through boys888 support.

14 Contact, DPO & Privacy Channel

Boys888 has appointed a Data Protection Officer (DPO) responsible for overseeing the platform's privacy practices and serving as the point of contact between data subjects and boys888 on matters related to the LGPD.