123rf Privacy Policy — Your Data, Your Security

1Who We Are — The Data Controller

For the purposes of Brazil's General Data Protection Law (Law No. 13,709/2018 — LGPD), the controller of the personal data collected on this platform is the 123rf, responsible for making decisions regarding the processing of users' personal information.

123rf is a Sports Betting and online casino platform focused on the Brazilian market, offering services that include bets on football (Brasileirão Série A, Copa do Brasil, Copa Libertadores), volleyball, MMA and UFC, e-sports, and basketball, as well as Live Casino, slots, and crash games. All financial transactions are conducted in BRL (R$), with Brazilian payment methods such as Pix, boleto bancário, credit and debit cards, Mercado Pago, PicPay, and TED transfers via Nubank, Itaú, Bradesco, and Banco do Brasil.

For questions, requests, or to exercise rights related to this policy, please contact us at: suporte@123rf.asia.

2Personal Data We Collect

123rf collects the following types of personal data, always on the basis of a legitimate purpose proportionate to the service provided:

3How We Collect Your Data

123rf collects personal information in three main ways:

• Directly from you: when you create an account, fill out the registration form, make a deposit via Pix or another method, submit documents for identity verification, or contact 123rf support.
• Automatically during use: when you browse the platform, place bets, play at the casino, or interact with any feature, we collect technical data such as IP address, device type, and usage patterns through cookies and similar technologies.
• From authorized third parties: in specific identity verification or fraud prevention situations, 123rf may consult databases from certified partners — always on an appropriate legal basis and proportionate to the platform's security requirements.

4How We Use Your Data

Data collected by 123rf is used exclusively for the purposes described below. It is never used for commercial purposes with third parties or to monetize personal data:

• Service provision: create and manage your account, process deposits via Pix, boleto, and card, record bets and winning payments, and operate the live casino and other platform products.
• Identity verification (KYC/AML): confirm that you are 18 or older, verify the authenticity of the documents provided, and prevent fraud, money laundering, and misuse of the platform.
• Account security: detect suspicious access, unauthorized login attempts, and behavior indicating a potential security breach.
• Compliance with legal obligations: comply with requirements from competent authorities, respond to court orders, and meet regulatory obligations applicable to the online betting sector.
• Ongoing product improvement: analyze usage patterns in aggregate, anonymized form to improve the platform experience, fix technical issues, and develop new features.
• Communication: send notifications about your account, changes to terms or policies, and — if you choose to receive them — updates on 123rf promotions and news. Promotional communications are always optional and easy to unsubscribe from.
• Responsible gambling: monitor behavioral patterns that may indicate problematic use of the platform, in line with our user protection obligations.

5Legal Basis for Processing (LGPD)

All personal data processing carried out by 123rf is grounded in one of the legal bases established by the LGPD. The main bases we rely on are:

• Performance of a contract (art. 7, V): processing is necessary to provide the services you signed up for when creating your 123rf account — betting, payments, support, and all platform features.
• Compliance with a legal obligation (art. 7, II): certain data must be processed to comply with legal and regulatory requirements, such as anti-money laundering rules and age verification.
• Legitimate interest (art. 7º, IX): for platform security, fraud prevention, product improvement, and institutional communications, provided these interests do not override your fundamental rights.
• Consent (art. 7, I): for sending promotional communications and marketing, processing only takes place with your express consent, which can be withdrawn at any time.

6Data Sharing with Third Parties

123rf does not sell, rent, or trade your personal data to third parties. Data sharing occurs only in the situations below, always with appropriate contractual safeguards:

• Payment processors: to process deposits via Pix, boleto bancário, credit/debit card, Mercado Pago, PicPay, and TED transfers, we share only the data strictly necessary with the financial intermediaries that handle each transaction. These partners are bound by contracts requiring the same level of data protection that 123rf maintains.
• Casino game providers: to operate the live casino, slots, and crash games, minimal technical data is shared with software providers solely to enable the gaming experience.
• Identity verification services (KYC): certified partners that support document verification and fraud prevention. These services process data under our instructions and do not use it for any other purpose.
• Technology infrastructure: cloud, hosting, and security providers that support the platform's operations. All are bound by data processing agreements compatible with the LGPD.
• Competent authorities: when required by law, court order, or regulation applicable to the online betting sector, we may be compelled to share information with government or regulatory authorities.

Any new sharing that falls outside the categories above will be communicated to you in advance and will only take place with your explicit authorization, where required by the LGPD.

7Cookies & Tracking Technologies

123rf uses cookies and similar technologies to ensure the platform functions correctly, personalize your experience, and analyze usage patterns in aggregate form. The types of cookies we use are:

• Essential cookies: required for the platform's core functionality — keeping your session active, processing bets, and securing login. These cannot be disabled without affecting your ability to use the services.
• Preference cookies: store your language, display, and other preferences so you do not have to reset them each time you log in.
• Analytics cookies: collect aggregated and anonymized data on how users navigate the platform, helping 123rf identify technical issues and improvement opportunities. The data generated does not allow for individual identification.
• Security cookies: used to detect suspicious behavior, prevent fraud, and protect the integrity of 123rf user accounts.

You can manage your non-essential cookie preferences through your browser settings. Disabling essential cookies may affect the functioning of critical platform features, such as the login process and bet confirmation.

8Data Security

123rf takes the protection of your information seriously. We have implemented multiple layers of technical and organizational security to reduce the risk of unauthorized access, data loss, or data leaks:

• 256-bit SSL encryption on all data transmissions between your device and 123rf's servers.
• Secure storage on servers with physical and logical access controls, periodic audits, and continuous monitoring for suspicious activity.
• Financial data tokenization: credit card details and Pix keys are stored in tokenized format, not directly accessible to 123rf's internal team.
• Role-based access control: only staff with a specific business need can access sensitive personal data, and all access is logged and auditable.
• Two-factor authentication: available for users who want to add an extra layer of protection to their 123rf account.
• Threat monitoring: automated systems detect unauthorized access attempts, data leaks, and anomalous behavior in real time.

In the event of a security incident that may affect your personal data, 123rf will notify the affected data subjects and the Autoridade Nacional de Proteção de Dados (ANPD) within the timeframes and in the manner required by the LGPD.

Despite all the controls we have in place, no digital system is 100% breach-proof. You play an important role too: use a strong, unique password for your 123rf account, never share it with anyone, and contact support immediately if you suspect unauthorized access.

9Data Retention & Deletion

123rf retains your personal data for as long as necessary for the purposes that justified its collection, in compliance with applicable legal retention periods. The general retention criteria are:

• Active account: while your account is active on 123rf, all data related to registration, betting history, and financial transactions is retained to provide the service.
• After account closure: identity and financial transaction data are retained for the minimum period required by applicable Brazilian law for the sector — generally five years from account closure — for audit purposes, compliance with regulatory obligations, and anti-money laundering requirements.
• Cookie and browsing data: retained for up to 12 months from collection, except where required for security purposes and incident investigation.
• Support communications: support records are retained for up to 24 months for quality and traceability purposes.

Once the applicable retention period has elapsed, your data is securely deleted or anonymized so that the data subject can no longer be identified. You may request early deletion of data not subject to a legal retention obligation by emailing suporte@123rf.asia.

10Your Rights as a Data Subject (LGPD)

The LGPD grants you a set of rights regarding your personal data processed by 123rf. You may exercise any of them at any time, free of charge, by emailing suporte@123rf.asia: