Big5 Privacy Policy – Data Protection and LGPD

For the purposes of this Policy and the General Data Protection Law (LGPD – Law No. 13,709/2018), the controller of your personal data is the big5, a Sports Betting and online casino platform operated at big5.best and available to users in Brazil.

The big5 is responsible for all decisions regarding the processing of personal data collected on its platform — what to collect, how to use it, how long to store it, and with whom to share it. This entire framework is described in this Policy and may be questioned or challenged by data subjects at any time.

The big5 collects only the data strictly necessary to provide the contracted services and fulfill applicable legal obligations. Below is a complete overview of what is collected and at what point:

The big5 does not collect health data, facial biometric data, racial or ethnic origin data, religious beliefs, or political opinions. Should it ever become necessary to collect additional sensitive data for specific purposes, you will be informed in advance and your explicit consent will be requested separately.

Each piece of data collected by big5 serves a specific and legitimate purpose. Here is how we use the information you entrust to us:

• Creating and managing your account: your name, CPF, and email are used to create your profile, authenticate your logins, and ensure that each account belongs to a real, unique individual on the big5 platform;
• Process financial transactions: banking and payment data (Pix key, deposit history via Nubank, Itaú, Bradesco, Banco do Brasil, PicPay, Mercado Pago, and other accepted methods) is used exclusively to process deposits and withdrawals securely;
• Identity verification (KYC/AML): documents such as a government-issued ID, driver's license, and proof of address are used to confirm that you are 18 or older, that the CPF provided is valid, and that there are no signs of fraudulent activity or money laundering — a legal obligation imposed on big5 by Brazilian betting regulation;
• Providing betting and casino services: betting history for Brasileirão, Libertadores, UFC, NBB, and Live Casino tables is required to process results, calculate winnings, resolve disputes, and allow you to track your activity history within the platform;
• Account communications: registration confirmations, deposit notifications, bet result alerts, security notices — sent by email or SMS exclusively when relevant to managing your big5 account;
• Marketing communications: promotions, bonuses, special odds, and platform updates — sent only to users who have explicitly consented to receive this type of communication. You can unsubscribe at any time by clicking "unsubscribe" in any big5 marketing email;
• Fraud prevention and security: technical data such as IP address, device type, and access patterns are used to detect suspicious behavior, unauthorized access attempts, and the use of multiple accounts under the same CPF;
• Platform improvement: aggregated and anonymized usage data (with no individual identification) is analyzed to improve the interface, identify the most-used features, and enhance the overall experience for big5 users.

The big5 does not use your personal data for purposes incompatible with those listed above without notifying you in advance and, where required, obtaining your explicit consent.

The LGPD requires that all personal data processing have a clear and specific legal basis. The big5 processes your data based on the following legal grounds set out in Art. 7 of Law No. 13.709/2018:

• Contract performance (Art. 7, V): the processing of identification, contact, and financial data is necessary to perform the service agreement entered into when you created your big5 account. Without this data, providing the services simply is not possible;
• Compliance with a legal obligation (Art. 7, II): identity verification (KYC), anti-money laundering (AML), and compliance with Brazilian Sports Betting legislation (Law No. 14.790/2023) are legal obligations that require the processing of certain personal data, regardless of user consent;
• Legitimate interest (Art. 7, IX): data analysis for fraud prevention, platform security, and service improvement is carried out on the basis of big5's legitimate interest and that of its users, always proportionate and respectful of data subjects' rights;
• Consent (Art. 7, I): marketing communications sent by email and SMS are based exclusively on the user's explicit consent, which may be withdrawn at any time without affecting access to any other big5 services.

The big5 does not sell, rent, exchange, or otherwise trade your personal data with third parties for any commercial purpose. Full stop. That said, there are specific situations where sharing is necessary to operate the platform or meet legal obligations:

• Payment processors: to process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED, relevant financial data must be shared with the financial institutions and partner processors involved. These partners are contractually required to use your data solely for that specific purpose;
• Identity verification providers: for the KYC process, big5 may use specialized CPF validation and document authenticity services. Only the data strictly necessary for verification is shared;
• Casino game providers: to operate the Live Casino tables and slots available on the platform, certain technical session data (anonymized user identifier, session bets) is shared with the certified providers that supply the games. These partners operate under data processing agreements compliant with international privacy standards;
• Competent authorities: big5 may disclose personal data when required by law, court order, or request from Brazilian regulatory authorities (such as the Ministry of Finance and the Central Bank). In such cases, only the data specifically requested is provided;
• Technology infrastructure services: cloud hosting providers, transactional email services, and security analysis tools are considered sub-processors of big5 and operate under contracts requiring the same level of data protection that big5 applies internally.

The big5 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, in accordance with the minimum retention periods required by Brazilian law:

• Active account data: while your big5 account is active and you continue using our services, all registration and history data is retained to ensure continuity of service;
• After account closure: identification data (name, CPF), financial transaction history, and betting records are retained for 5 years after account closure, as required by Brazilian tax legislation and Sports Betting regulation (Law No. 14.790/2023);
• KYC verification data: identity documents and proof of address are retained for 5 years after account closure, in accordance with anti-money laundering requirements (Law No. 9,613/1998);
• Marketing data (with consent): retained for as long as consent remains active. After consent is withdrawn, data is deleted from communication systems within 30 days;
• Cookies and technical data: session data is deleted when you close your browser. Preference and analytics cookies have specific expiry periods listed in our Cookie Center, ranging from 30 days to 12 months.

Once retention periods have expired, the big5 securely and irreversibly deletes or anonymizes data. Anonymized data (which can no longer be used to identify an individual) may be retained indefinitely for statistical purposes.

The big5 implements strict technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or accidental or unlawful destruction:

• Encryption in transit: all communication between your device and big5's servers is protected by TLS (Transport Layer Security) protocol — the same standard used by Brazilian banks and fintechs. You can verify this by the padlock icon displayed in your browser's address bar;
• Encryption at rest: sensitive data stored in big5's databases — such as identity documents and financial information — is encrypted at rest using AES-256 standards;
• Access control based on the principle of least privilege: each big5 employee has access only to the data strictly necessary for their specific role. No staff member has unrestricted access to the entire user database;
• Two-factor authentication: for administrative access to big5's internal systems, two-factor authentication (2FA) is mandatory;
• Continuous monitoring: automated systems monitor big5 servers 24 hours a day for any suspicious activity, including unauthorized access attempts, mass data extraction, and injection attacks;
• Security audits: big5 conducts regular penetration testing and security audits carried out by independent specialized firms.

The big5 uses cookies and similar technologies to improve the browsing experience and ensure the platform functions correctly. See the types of cookies we use:

• Essential cookies (required): required for you to log in, browse the platform, keep your session active, and process bets. Without these cookies, big5's services simply won't work. They cannot be disabled;
• Preference cookies: remember your platform settings — preferred language, odds format, selected sport filters — so you don't have to reconfigure them on every visit;
• Analytics cookies: collect aggregated and anonymized data on how users navigate big5 — which pages are visited most, where loading errors occur, and which features are least used. This data helps improve the platform. These cookies can be disabled in your browser settings;
• Marketing cookies (optional): used only if you have consented to receive marketing communications. Allows big5 to display offers and promotions relevant to your profile. Can be disabled at any time.

You can manage or block cookies directly in your browser settings — Chrome, Safari, Firefox, Edge — or through the cookie banner shown on your first visit to big5.best. Disabling essential cookies may affect platform functionality.

The services of big5 are intended exclusively for users aged 18 and over. big5 does not intentionally collect personal data from minors. If we identify that a minor's data was collected without proper consent — due to fraudulent registration, for example — we will act immediately to:

• Close any account identified as belonging to a minor;
• Delete all collected personal data associated with this account;
• Return any deposited funds to the rightful owner of the financial data used;
• Report the case to the relevant authorities where applicable.

If you are a parent or legal guardian and believe a minor has accessed big5 using your details, please contact us immediately at privacidade@big5.best. We will take all necessary steps with the highest priority.

The LGPD grants you, as a data subject, a robust set of rights regarding your personal information processed by the big5. See what they are and how to exercise them:

Due to the global nature of some of the technology services used by big5 — such as cloud infrastructure and certain casino game providers — some personal data may be transferred to servers located outside Brazil.

The big5 ensures that any international data transfer is carried out in compliance with Art. 33 of the LGPD, adopting one of the following safeguards:

• Transfer to countries with an adequate level of personal data protection, as recognized by the ANPD;
• Existence of approved standard contractual clauses that guarantee data subjects the same rights provided under the LGPD;
• Adoption of binding corporate rules by partner business groups.

For specific details on data destination countries and the safeguards in place, contact big5's DPO at privacidade@big5.best.

The big5 may update this Privacy Policy periodically to reflect changes in Brazilian data protection legislation, the way we operate our services, or to incorporate new privacy practices that benefit users.

Whenever significant changes are made, big5 will notify users by email at least 7 days before the changes take effect. For minor updates — such as text corrections or clarifications with no practical impact on data subjects — the change will be made directly on this page with a revised date.

The most current version of this Policy will always be available at big5.best/privacy-policy. We recommend reviewing this document periodically to stay informed about how big5 protects your data.

The big5 has appointed a Data Protection Officer (DPO) as required by Art. 41 of the LGPD. The DPO is the official point of contact for all matters related to privacy and personal data protection on the platform.

• DPO email: privacidade@big5.best — for rights exercise requests, questions about how your data is processed, and reporting incidents noticed by the user;
• General support: contato@big5.best — for general questions about your account, payments, and platform use that do not specifically involve privacy matters;
• Response time: big5 is committed to responding to LGPD-related requests within 15 business days of receipt. For access or portability requests involving large volumes of data, additional time may be required, and you will be informed accordingly;
• ANPD: if you are not satisfied with big5's response, you have the right to file a complaint directly with the National Data Protection Authority (www.gov.br/anpd).