Privacy Policy of 5hbt – How We Protect Your Data

The controller of the personal data processed under this Policy is the company responsible for operating the platform 5hbt, identified in the official records of the Secretaria de Prêmios e Apostas (SPA/MF) as a licensed fixed-odds betting operator in Brazil.

For inquiries related to personal data processing, please use the channels below:

• General support email: suporte@5hbt.best
• Privacy channel / DPO: suporte@5hbt.best (subject line: "Privacy – LGPD")
• Live chat: available 24h on the 5hbt.best platform

The 5hbt Data Protection Officer (DPO) is responsible for monitoring LGPD compliance and serving as the communication channel between data subjects and the company, as well as with the National Data Protection Authority (ANPD).

The 5hbt collects only the data necessary to deliver its services securely and in compliance with Brazilian law. Data is organized into the following categories:

Data provided directly by you:

• Full name, CPF, date of birth, and nationality (required at registration);
• Email address and mobile phone number;
• Full residential address (ZIP code, street, city, state);
• Identity documents (RG, CNH, or passport) for KYC verification;
• Banking and payment details (Pix key, tokenized card data, bank account for TED);
• Selfie for identity verification, when required by the KYC process.

Data generated through platform use:

• Full Sports Betting history — Brasileirão, Copa do Brasil, e-sports, MMA, and other competitions;
• Live casino, slots, and poker session history;
• Financial transaction history — deposits via Pix, boleto, card, and TED; withdrawals;
• Browsing preferences and most-visited games;
• Access logs: IP address, device type (Android phone, iPhone, desktop), browser, operating system, and access timestamp;
• Approximate geolocation data (derived from IP address) for Brazil residency verification.

Automatically collected data (cookies and similar technologies):

• Session cookies to keep you logged in;
• Analytical cookies to understand how users navigate the platform;
• Preference cookies to remember language and layout settings;
• Tracking pixel for marketing campaign measurement (when consent is given).

The personal data collected by 5hbt are used exclusively for the following purposes:

• Platform operation: Creating and managing your account, processing sports bets on the Brasileirão and other competitions, and running the live casino, slots, and poker features;
• Payment processing: Deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED; withdrawal processing; receipt issuance;
• Identity verification (KYC): Age verification (18+), CPF uniqueness check, and compliance with SPA/MF regulations and anti-money laundering legislation;
• Security and fraud prevention: Detection of multiple accounts, bot usage, abusive arbitrage, money laundering, and other prohibited conduct;
• Customer support: Support via chat and email, resolution of disputes over bets or transactions, and recording of communications for quality purposes;
• Responsible gambling: Monitoring of gameplay patterns to identify potential problem gambling situations and offer self-control tools;
• Operational communications: Emails regarding changes to the Terms and Conditions, deposit/withdrawal confirmations, and security alerts;
• Marketing & personalization (with consent): Sending bonus offers, Brasileirão promotions, and the latest slots and live casino news — only if you opted in to receive them;
• Legal and regulatory obligations: Compliance with orders from SPA/MF, ANPD, the Public Prosecutor's Office, and other competent Brazilian authorities.

The 5hbt processes personal data based on the following legal grounds set out in Article 7 of the LGPD:

• Contract performance (art. 7, V): To create and manage your account, process bets, and handle deposits and withdrawals via Pix and other available methods — without this data, the service cannot be provided;
• Legal or regulatory obligation (art. 7, II): To comply with the requirements of SPA/MF, Law No. 9,613/1998 (anti-money laundering), LGPD, and the Marco Civil da Internet, including KYC verification and log retention;
• Legitimate interest (art. 7, IX): For fraud prevention, platform security, bot detection, and problem gambling pattern monitoring — always with an assessment of the impact on user rights;
• Consent (art. 7, I): For analytical and marketing cookies, sending promotional communications, and personalizing bonus offers related to Brasileirão, slots, and live casino.

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing or your access to other 5hbt services.

The 5hbt does not sell personal data. Sharing occurs only in the situations below, with partners who are contractually bound to confidentiality and LGPD compliance:

• Payment processors: To process deposits and withdrawals via Pix (Banco Central do Brasil), boleto bancário, Visa/Mastercard, PicPay, Mercado Pago, and TED via Nubank, Itaú, Bradesco, Banco do Brasil, and other financial institutions — limited to the data required for each transaction;
• Identity verification providers (KYC): For CPF validation, age verification, and document authentication — data is transmitted in a secure environment and is not retained by the provider beyond what is necessary;
• Game providers: Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, and other providers receive only the anonymous or pseudonymized identifiers required to operate live casino and slots sessions — with no access to the user's CPF or banking details;
• Infrastructure and security providers: Hosting services, DDoS protection providers (such as Cloudflare), and analytics platforms receive anonymized or pseudonymized technical data;
• Brazilian public authorities: Secretaria de Prêmios e Apostas (SPA/MF), ANPD, Conselho de Controle de Atividades Financeiras (COAF), Ministério Público, and the Judiciary — exclusively when required by law, court order, or administrative order;
• Independent auditors: eCOGRA and other certified audit bodies receive anonymized data for game fairness certification purposes.

The 5hbt retains personal data for as long as necessary to fulfill the purposes described in this Policy and to meet applicable legal obligations:

• Registration and KYC data: Retained for at least 5 years after account closure, as required by Law No. 9,613/1998 (anti-money laundering) and SPA/MF regulations;
• Financial transaction history (Pix, boleto, wire transfer): Retained for 5 years, in accordance with financial regulations of the Central Bank of Brazil;
• Sports betting history and casino sessions: Retained for 3 years for audit and dispute resolution purposes;
• Access logs (IP, device, timestamp): Retained for 6 months as required by the Brazilian Internet Civil Framework (Law No. 12,965/2014), and may be extended if an investigation is ongoing;
• Marketing and preference data (consent-based): Deleted within 30 days of consent withdrawal;
• Data from voluntarily closed accounts: Deleted after the mandatory retention period, with only legally required data kept on file.

Once retention periods have elapsed, data is securely deleted or irreversibly anonymized, making it impossible to associate with any specific individual.

The 5hbt adopts robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, accidental loss, or destruction:

• Encryption in transit: TLS 1.3 / SSL 256-bit across all communications between your device (mobile or desktop) and 5hbt's servers;
• Encryption at rest: Sensitive data stored with AES-256 encryption, including payment information and identity documents;
• Payment data tokenization: Card numbers are not stored directly — only tokens generated by our partner payment processors;
• Internal access control: Access to user data is restricted to staff with a verified operational need, using multi-factor authentication (MFA) and the principle of least privilege;
• Audit logs: All internal access to user data is automatically logged and monitored;
• Security testing: Penetration testing and vulnerability assessments conducted periodically by specialized teams;
• DDoS Protection: Infrastructure protected against denial-of-service attacks to ensure platform availability.

The 5hbt uses cookies and similar technologies to improve your experience on the platform. When you visit the site for the first time, a cookie consent banner will appear where you can choose which categories to accept.

We use the following types of cookies:

• Essential cookies (required): Required for basic platform functionality — authentication, session security, and the bet slip. These cannot be disabled without impairing your use of the services;
• Analytical cookies (optional): They collect anonymized information about how you browse 5hbt — pages visited, session duration, errors encountered — so we can improve the platform;
• Preference cookies (optional): They remember your language settings, preferred layout, and recent game history to personalize your experience;
• Marketing cookies (optional, consent-based only): They allow us to measure the effectiveness of marketing campaigns and personalize bonus offers related to Brasileirão, slots, and live casino games you typically play.

You can manage your cookie preferences at any time by accessing "Privacy Settings" in the platform footer or in your account settings. Disabling analytics and marketing cookies does not affect your access to 5hbt services.

The services of 5hbt are intended exclusively for individuals aged 18 and over. The platform does not intentionally collect data from minors.

During registration, 5hbt verifies the date of birth provided and, as part of the KYC process, confirms the user's age through an official identity document. Accounts showing signs of underage registration are blocked immediately and any data collected in the process is deleted without being used.

If you believe data belonging to a minor under 18 was collected by mistake, please contact us immediately at suporte@5hbt.best for immediate data deletion.

To provide its services, the 5hbt may transfer personal data to servers located outside Brazil, particularly due to partnerships with international game providers such as Evolution Gaming, Pragmatic Play, NetEnt, and Ezugi, which operate on a global infrastructure.

All international transfers of personal data belonging to Brazilian users are carried out in compliance with Article 33 of the LGPD, ensuring that the destination country offers an adequate level of data protection or that sufficient contractual safeguards are in place, such as:

• Standard contractual clauses for data protection;
• Internationally recognized privacy and security certifications;
• Binding Corporate Rules of the business groups involved.

Data transferred internationally is limited to the minimum necessary for the technical operation of the services — typically pseudonymized session identifiers, never CPF numbers, banking details, or complete identity documents.

To exercise any of your rights as a personal data subject under the LGPD, you can:

• Access "Privacy Settings" in your 5hbt account for access requests, data correction, and consent withdrawal;
• Send email to suporte@5hbt.best with the subject line "Privacy – [request type]" (e.g., "Privacy – Data Deletion");
• Chat with the team via live chat, available 24 hours a day.

The response timeframe for personal data requests is up to 15 calendar days from the date of receipt. In more complex cases, this deadline may be extended by a further 15 days, with prior notice and justification provided to the requesting user.

To handle your request securely and confirm we are speaking with the actual data subject, an identity verification may be required before your request is processed.

The 5hbt maintains an information security incident response plan. In the event of a data breach that could pose significant risk or harm to users, 5hbt commits to:

• Notify the Autoridade Nacional de Proteção de Dados (ANPD) within the timeframe required by applicable law;
• Notify affected users by registered email, describing the nature of the data involved, the potential risks, and the measures taken to mitigate harm;
• Immediately take the technical and organizational measures necessary to contain the incident and prevent further unauthorized access;
• Document the incident and the measures taken for accountability purposes before the ANPD.

If you suspect your 5hbt account has been accessed without authorization or that your data has been compromised, contact us immediately via live chat or email suporte@5hbt.best so we can investigate and take the appropriate action.

The 5hbt may update this Privacy Policy periodically to reflect changes in our services, Brazilian data protection legislation, or SPA/MF regulations. The date of the most recent update is always shown at the top of this page.

Material changes will be communicated by email to the address registered on your account at least 15 days before taking effect. For changes that expand data collection or modify purposes based on consent, we will request new consent before implementing them.

We recommend reviewing this Policy periodically. Continued use of the platform after updates take effect constitutes acceptance of the changes made.

For any questions, requests, or complaints related to how your personal data is handled by 5hbt, use the channels below:

• Privacy email / DPO: suporte@5hbt.best (subject line: "Privacy – LGPD")
• Live chat: Available 24 hours a day, 7 days a week, on the 5hbt.best platform
• Response timeframe: Up to 15 calendar days for data subject rights requests

The 5hbt Data Protection Officer (DPO) is responsible for overseeing all privacy and data protection matters, acting as the point of contact for the ANPD and for data subjects whose personal data is processed on the platform.