PP11 Privacy Policy – Player Data Protection

The PP11, the operator of the platform available at pp11.world, is the controller of its users' personal data for the purposes described in this Policy. When you create an account, make a deposit via Pix, place a bet on the Brasileirão, or play live roulette, you are entrusting your data to PP11, which takes responsibility for the secure, lawful, and transparent processing of that information.

To exercise any rights related to your personal data or to ask questions about this Policy, please contact us at contato@pp11.world or via the support chat available 24 hours a day on the platform. Our Data Protection Officer (DPO) is reachable through the same channel and has up to 15 business days to respond to LGPD-related requests.

The PP11 collects data in three ways: directly when you provide it, automatically through your use of the platform, and occasionally from third-party sources for verification purposes. Below is a summary of the data categories and how each is obtained:

The PP11 does not collect sensitive data such as racial origin, religious belief, genetic data, or biometric data — except for the selfie with ID document required during the KYC process, which is collected solely for identity verification and discarded once the process is complete.

Each piece of data collected by the PP11 has a specific purpose. Data is never collected for its own sake — every piece of information serves a concrete, documented purpose. These are the main purposes:

• Operating the platform: process your registration, authenticate your access, record bets, credit winnings, and handle deposits and withdrawals via Pix, boleto bancário, credit/debit card, TED, PicPay, and Mercado Pago;
• Identity verification (KYC): fulfill legal obligations related to anti-money laundering (AML) and counter-terrorism financing (CTF) as required by the Banco Central do Brasil;
• Personalizing your experience: recommend relevant bet types, adjust betting limits to match your profile, and show promotions aligned with your gaming history — such as offers for Brasileirão or Libertadores matches if you frequently bet on football;
• Fraud prevention: identify suspicious behavior, unauthorized access, and potential cases of duplicate accounts or bonus manipulation;
• Customer support: answer your questions, resolve issues, and keep a record of your support history for future reference;
• Communications: send transactional emails (registration confirmation, processed withdrawal), promotional notifications — when you opt in — and important announcements about platform changes;
• Analytics and improvement: understand how the platform is used so we can fix issues, add features, and improve the overall experience;
• Responsible gambling: monitor gambling patterns that may indicate compulsive behavior and offer proactive support when needed.

The LGPD requires that all data processing have a legal basis. The PP11 documents and records the applicable legal basis for each processing activity. The main bases used are outlined below:

• Contract performance (Art. 7, V of the LGPD): the primary basis for processing bets, deposits, withdrawals, and managing the player's account. Without this data, the service simply cannot be provided;
• Legal obligation (art. 7, II): KYC verification, anti-money laundering compliance, retention of tax records, and fulfillment of requests from competent judicial and regulatory authorities;
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, behavioral analysis for compulsive gambling detection, and continuous product improvement — always in the data subject's interest;
• Consent (art. 7, I): sending marketing communications, use of non-essential cookies, and advanced personalization based on stated preferences. Consent may be withdrawn at any time.

When the legal basis is consent, PP11 will ensure it is obtained freely, informedly, unambiguously, and specifically for each purpose. Withdrawing consent is straightforward: simply go to the privacy settings in your account or send an email to contato@pp11.world.

The PP11 does not sell personal data. Full stop. Data sharing only occurs in the situations listed below, with partners who sign confidentiality and data processing agreements aligned with the LGPD:

• Payment processors: to enable deposits and withdrawals via Pix (integrated with the Central Bank), boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers through Nubank, Itaú, Bradesco, and Banco do Brasil. Only the data strictly necessary for the transaction is shared;
• Game providers: partners providing slots, live roulette, crash games, and other bet types receive minimal session data to process bets and calculate results. No complete identity data is shared with game providers;
• Identity verification services: document validation platforms used in the KYC process, operating under contract with explicit data protection obligations;
• Technology infrastructure: hosting, CDN, and security providers that process data as operators under direct instruction from PP11, with no authorization to use it for their own purposes;
• Legal authorities: when required by court order, determination from the Central Bank, Federal Revenue Service, or another competent authority with legal backing — and only to the extent necessary to comply with that determination.

The PP11 uses cookies and similar technologies to ensure the platform functions correctly and to improve your browsing experience. There are different categories of cookies, each serving a distinct purpose:

• Essential cookies: required to keep your session active, authenticate your login, process bets, and ensure the platform's basic functionality. They cannot be disabled without compromising your use of the service;
• Analytical cookies: collect aggregated and anonymized data about how users navigate the platform — which sections they visit most, session duration, pages viewed. Used to improve the product. Require consent;
• Preference cookies: store your language settings, gameplay preferences, and interface customization so you do not need to reconfigure them on every visit. Require consent;
• Security cookies: detect anomalous session behavior, automated login attempts, and other suspicious patterns. An integral part of PP11's anti-fraud system.

You can manage your cookie preferences through the banner shown on your first visit or through the privacy settings panel in your account. Disabling non-essential cookies may limit some personalized features on the platform, but will not prevent access to core functionality.

The PP11 does not use third-party behavioral advertising tracking cookies. Data collected via cookies stays within the platform's ecosystem.

The PP11 does not retain data beyond what is necessary. Retention periods are defined based on the purpose of processing and applicable legal obligations:

• Registration and identity data: for the period the account remains active and for up to 5 years after closure, for audit purposes and compliance with legal obligations related to gaming and anti-money laundering;
• Financial data (transactions via Pix, boleto, card, TED): minimum of 5 years as required by the Receita Federal and Banco Central do Brasil regulations;
• Betting history and gaming sessions: up to 5 years after the last account activity, for audit and dispute resolution purposes;
• Support data: 2 years after the support ticket is closed, for reference in cases of repeat issues or disputes;
• Analytical cookies: aggregated data retained for up to 26 months; individual identifiers deleted at the end of each session or within the timeframe set in the consent;
• KYC verification data (selfie, documents): deleted after successful verification is completed, except where regulations require retention for compliance purposes.

The security of your data is treated as a top technical and operational priority at PP11. Security measures in place include:

• 256-bit SSL/TLS encryption in all communications between your device and PP11's servers;
• Encrypted storage of passwords using secure hashing algorithms — no PP11 staff member has access to your password in plain text;
• Least-privilege access control: each team member only accesses the data strictly necessary to carry out their role;
• Real-time monitoring of access and transactions to identify anomalous behavior and block unauthorized access attempts before they cause harm;
• Two-factor authentication (2FA) available to all users and mandatory for PP11 staff accessing internal systems that handle personal data;
• Penetration testing and security audits periodic audits conducted by independent specialized firms;
• Incident response plan: in the event of a data breach, PP11 will notify the ANPD (Autoridade Nacional de Proteção de Dados) and affected users within 72 hours, as required by the LGPD.

The LGPD guarantees you, as a data subject, a robust set of rights. PP11 is committed to honoring them promptly and transparently. Learn about each one:

The PP11 has a zero-tolerance policy for the registration of users under 18 years of age. Our platform is designed exclusively for adults and does not intentionally collect data from minors.

If we determine that an account was created by someone under 18, it will be closed immediately. All collected data will be deleted, and any deposited funds will be returned to the original payment method. This policy is applied without exception.

To operate the platform, the PP11 uses technology infrastructure and partners that may process data on servers located outside Brazil. When this occurs, the transfer follows the safeguards established by the LGPD:

• Transfers to countries or international organizations with an adequate level of protection recognized by the ANPD;
• Adoption of standard contractual clauses approved by the ANPD with partners in countries without an adequacy recognition;
• Contractual guarantee that the receiving partner applies security measures equivalent to or exceeding those required by the LGPD.

The live casino game providers with which the PP11 operate studios across different countries, and minimal session data is shared to process each round. These partners are selected based on international security certifications and compliance with data protection regulations equivalent to the LGPD.

To find out which countries receive international data transfers in connection with your account, submit an access request as described in Section 9 of this Policy.

The PP11 may update this Policy periodically to reflect changes in legislation, new platform features, updates to data processing practices, or recommendations from the ANPD. All updates follow the process below:

• Publication of the new version on this page with its effective date;
• Email notification to all registered users at least 7 calendar days in advance of any material changes;
• Display of a notice banner on the platform during the transition period between versions;
• When a change involves new processing activities that require consent, explicit consent will be requested before the new practice takes effect.

The version in effect is always the one published on this page. If you disagree with any changes, you may exercise your data subject rights as outlined in section 9, or request account closure before the new version's effective date.

The PP11 has appointed a Data Protection Officer (DPO), as required by the LGPD for operations that process data at scale. The DPO is the official point of contact between the company, data subjects, and the National Data Protection Authority (ANPD).

To exercise your rights, report a privacy incident, question data processing practices, or simply learn more about how PP11 uses your information, please use the channels below:

• DPO and privacy email: contato@pp11.world (subject: "Privacy – LGPD")
• Support chat: available 24 hours a day at pp11.world, with agents trained to direct privacy requests to the DPO
• Response time: up to 15 business days for LGPD requests, as established by law

The PP11 treats every privacy request as a priority. Our team and DPO are committed to responding clearly, within the legal timeframe, and without unnecessary red tape — because we understand that transparency is the foundation of any trust-based relationship between a platform and its users.