Hh797 Privacy Policy – Your Data, Protected

1Who We Are and What This Policy Covers

Hh797 is a Sports Betting and online entertainment platform serving exclusively the Brazilian market. This Privacy Policy describes how hh797 ("we," "our platform") collects, uses, stores, shares, and protects the personal data of users ("you") who access the website or mobile app.

This Policy is an integral part of the Terms and Conditions of hh797 and is aligned with the General Personal Data Protection Law (LGPD — Law No. 13,709/2018), which is Brazil's primary privacy and data protection law. hh797 acts as the controller of personal data collected through the platform.

The most up-to-date version of this Policy will always be available at hh797.net/privacy-policy, with the date of the last revision indicated. We recommend reviewing it periodically to stay informed of any updates.

2What Personal Data We Collect

Hh797 collects different categories of data depending on how you use the platform. The main categories and the specific data within each are listed below:

Registration and Identity Data:

• Full name, date of birth, and CPF;
• Email address and mobile phone number;
• Full residential address including ZIP code;
• Government-issued ID (national ID, driver's license, or passport) and a selfie, when required as part of the KYC process.

Financial and Transaction Data:

• Pix keys and bank details used for deposits and withdrawals;
• Full history of deposits, withdrawals, and bets placed;
• Credit or debit card data (stored in encrypted and tokenized form, with hh797 having no access to the full card number).

Platform Usage Data:

• IP address and approximate geolocation data;
• Device type, operating system, and browser or app version;
• Pages visited, session duration, clicks, and interactions on the platform;
• Betting preferences, favorite sports, and account settings.

Communication Data:

• Chat and email support conversation history;
• Notification and communication preferences (email, push, SMS).

3How We Use Your Personal Data

Hh797 uses the data collected solely for the purposes described below. We do not use your data for any purpose not listed here without notifying you in advance:

• Account creation and management: verify your identity, activate your account, and maintain a secure environment on the platform;
• Transaction processing: process deposits and withdrawals via Pix, boleto, card, PicPay, Mercado Pago, and TED securely and efficiently;
• Service provision: enable access to and use of Sports Betting, online casino, promotions, and all other hh797 features;
• Identity verification (KYC): comply with legal obligations related to anti-money laundering and age verification;
• Account communications: send transaction confirmations, security alerts, important updates, and notifications about bets and promotions (you may opt out of marketing communications at any time);
• User support: analyze interaction history to provide more efficient and personalized customer support;
• Platform improvement: analyze aggregated and anonymized usage patterns to improve the experience, identify bugs, and develop new features;
• Compliance with legal obligations: cooperate with regulatory and judicial authorities as required by applicable Brazilian law;
• Fraud prevention: identify suspicious activity, unauthorized access attempts, and behavioral patterns inconsistent with legitimate use of the platform.

4Legal Basis for Data Processing (LGPD)

The LGPD requires that all collection and use of personal data have a specific legal basis. hh797 processes your data under the following grounds provided by law:

• Contract performance (art. 7, V): processing of registration, financial, and transaction data is necessary to provide the services entered into when creating an account on hh797 and accepting the Terms and Conditions;
• Compliance with legal obligation (art. 7º, II): identity verification data (KYC), financial records, and access logs are retained to comply with legal anti-money laundering requirements and industry regulations;
• Legitimate interest (art. 7º, IX): platform usage data is analyzed to improve the experience, detect fraud, and ensure hh797's operational security, always respecting users' rights;
• Consent (art. 7º, I): marketing communications via email, SMS, or push notifications are sent only to users who have given explicit consent, with the option to opt out at any time.

5Data Sharing with Third Parties

Hh797 does not sell, rent, or transfer your personal data with third parties for commercial or marketing purposes. Data sharing occurs only when strictly necessary and always with appropriate safeguards in place:

• Payment processors: data required to process transactions via Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED is shared with the respective providers (Nubank, Itaú, Bradesco, Banco do Brasil, and others). These partners operate as data processors under contract, with confidentiality and security obligations;
• Identity verification providers: document data may be processed by specialized KYC companies to verify users' identity and age, as required by law;
• Technology infrastructure providers: hosting, cloud computing, and cybersecurity service providers that support hh797's operations have limited access to the data required to deliver their services, always under confidentiality agreements;
• Public and regulatory authorities: hh797 complies with legitimate requests from judicial authorities, the Federal Revenue Service, COAF, and other Brazilian regulatory bodies, sharing only the data specifically requested and required by law;
• Independent auditors: auditors engaged to verify compliance of gaming systems (RNG) and privacy practices have restricted access to anonymized or aggregated data only.

All third parties with access to hh797 user data are contractually required to use that data solely for the specific authorized purpose, implement appropriate security measures, and comply with LGPD requirements.

6Cookies and Tracking Technologies

Hh797 uses cookies and similar technologies to enhance your browsing experience and ensure the platform functions properly. The types of cookies used are:

• Essential cookies: required for the platform's basic operation, such as keeping your session active after login and remembering language and region preferences. They cannot be disabled without affecting your use of hh797;
• Performance cookies: collect anonymous data on how users navigate the platform, which pages are visited most, and where technical errors occur. This information is aggregated and does not identify individual users;
• Functionality cookies: store user preferences such as favorite sports, odds settings, and interface adjustments to personalize your experience on hh797;
• Security cookies: help detect fraud attempts, unauthorized access, and suspicious behavior on the platform.

You can manage cookie preferences in your browser or app settings. Disabling non-essential cookies may affect some platform features but will not prevent basic access to hh797.

7Data Security

Hh797 implements a robust set of technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure:

• 256-bit SSL Encryption across all communications between your device and hh797's servers — identical to the standard used by Brazil's largest banks;
• Encrypted storage of sensitive data, including passwords (stored with secure hashing, never in plain text) and payment instrument data;
• Strict access controls: hh797 employees have access only to the data strictly necessary for their role, with mandatory multi-factor authentication required to access internal systems;
• Continuous monitoring of suspicious activity, intrusion attempts, and security anomalies in the platform's systems;
• Penetration testing and security audits conducted periodically by independent specialists;
• Incident response plan active: in the event of a data breach, hh797 will notify the National Data Protection Authority (ANPD) and affected users within the timeframes established by the LGPD.

8How Long We Retain Your Data

Hh797 retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by Brazilian law:

• Registration and identity data: retained for the duration of the active account and for a minimum of 5 years after account closure, in accordance with anti-money laundering regulations;
• Financial transaction records: retained for a minimum of 5 years, in accordance with Brazilian Federal Revenue requirements and applicable tax legislation;
• Betting history: retained for a minimum of 5 years for audit purposes, dispute resolution, and compliance with regulatory obligations;
• Access and security logs: retained for 6 months for security purposes, in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014);
• Non-essential cookie data: retained for no more than 12 months, unless consent is renewed;
• Support communications: kept for 2 years for service quality purposes and resolution of any complaints.

Once retention periods expire, data is securely deleted or irreversibly anonymized. Users may request early deletion, though this is subject to mandatory minimum retention periods required by law.

9Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the data subject, a broad set of rights that hh797 is committed to fulfilling promptly and without unnecessary bureaucracy. You may exercise the following rights:

• Access: request a copy of all personal data hh797 holds about you;
• Correction: request the update or correction of inaccurate, outdated, or incomplete data;
• Deletion: request the deletion of personal data that is unnecessary or processed in violation of the LGPD (subject to the minimum legal retention periods described in section 8);
• Portability: request the transfer of your data to another controller in a structured, commonly used format, where technically feasible;
• Objection: object to the processing of data carried out on the basis of legitimate interest, where valid grounds exist;
• Consent withdrawal: withdraw consent given for marketing communications at any time, without affecting any processing carried out beforehand;
• Information on data sharing: request information about which third parties your data has been shared with;
• Review of automated decisions: request human review of decisions made solely by automated processes that affect your interests, such as account suspension due to suspected fraud.

To exercise any of these rights, please contact our Data Protection Officer by email at privacidade@hh797.net. hh797 is committed to responding to requests within 15 business days, in accordance with the timeframe established by the LGPD.

10Minors

Hh797 is a platform exclusively for individuals 18 years of age or older. We do not intentionally collect personal data from anyone under 18. The identity verification (KYC) process includes age confirmation as a mandatory step before full account activation.

If we become aware that data from a user under 18 has been inadvertently collected, we will take the following steps:

• Immediate suspension of the associated account;
• Deletion of all personal data collected from the minor;
• Refund of any deposited amounts to the original bank account;
• Notification to the legal guardian, where identifiable, regarding the incident.

If you are the guardian of a minor and suspect they have created an account on hh797, please contact our support team immediately via chat or at suporte@hh797.net so we can act promptly.

11International Data Transfers

In some cases, hh797 user data may be processed by servers or service providers located outside Brazil — primarily cloud infrastructure providers and cybersecurity systems.

When this occurs, hh797 ensures the transfer is carried out with the appropriate safeguards required by the LGPD, including:

• Engagement only of providers located in countries or international organizations that offer a level of data protection equivalent to that of the LGPD;
• Use of standard contractual clauses that ensure the same rights and protections applicable in Brazil;
• Strict limitation to the minimum data necessary for each specific service provided by the international partner.

Hh797 does not transfer user data to jurisdictions that lack adequate privacy protections. All international transfers are documented and available for review through our DPO.

12Changes to This Privacy Policy

Hh797 may periodically revise this Privacy Policy to reflect changes in privacy practices, updates to Brazilian legislation, or improvements to our data protection systems.

Any significant update to this Policy will be communicated with a minimum advance notice of 7 calendar days through:

• Email notification to the address registered on your hh797 account;
• Informational banner on the platform's home page;
• Push notifications via the mobile app, where available.

The date of the most recent update will always be shown at the top of this page. Continued use of the platform after changes take effect constitutes acceptance of the updated Policy. If you do not agree with the changes, you may close your account before the effective date without penalty, and your available balance will be returned in accordance with the Terms and Conditions.

13DPO Contact and Support Channels

For any questions regarding this Privacy Policy, the processing of your personal data by hh797, or the exercise of your rights under the LGPD, you may reach us through the following channels:

• Data Protection Officer (DPO): privacidade@hh797.net — for specific privacy matters and the exercise of LGPD rights;
• General support: suporte@hh797.net — for general platform inquiries, available 24 hours a day, 7 days a week;
• Live chat: available directly on the hh797 website and app, with support in Brazilian Portuguese;
• ANPD: you may also contact the National Data Protection Authority directly if you believe your rights are not being properly respected.

Hh797 is committed to responding to all personal data requests within 15 business days from the date of receipt, with the option to extend this period for complex requests, with prior notice to the user.