Wim22 Privacy Policy – Data Protection and LGPD

1Who is the Data Controller

The wim22 is the controller of the personal data collected and processed on its Sports Betting and online casino platform, accessible at wim22.net and associated applications. As data controller, wim22 determines the purposes and means of processing users' personal data, in compliance with the General Data Protection Law (LGPD – Law No. 13,709/2018) and other applicable Brazilian regulations.

To exercise your rights as a data subject or for any inquiries related to this Privacy Policy, you can contact wim22 by email suporte@wim22.net or via the live chat available 24 hours a day on the platform, always in Brazilian Portuguese.

2What Data We Collect

Wim22 collects different categories of personal data depending on how the user interacts with the platform. We only collect what is necessary to provide the contracted services, meet legal obligations, and ensure the security of operations.

Data provided directly by you:

• Full name, CPF, date of birth, and nationality — required for identification, age verification, and regulatory compliance;
• Full residential address and proof of residence — required for identity verification (KYC) and compliance with legal obligations;
• Email address and mobile phone number — used for communication, account authentication, and security notifications;
• Identity documents (national ID, driver's license) submitted during the account verification process;
• Banking and payment data: Pix key, credit or debit card details (Visa/Mastercard), TED bank transfer account information, PicPay or Mercado Pago account data — used exclusively to process deposits and withdrawals in BRL (R$);
• Information voluntarily provided to support via live chat or email.

Data collected automatically during platform use:

• IP address, device type, operating system, and browser;
• Approximate location data based on IP address;
• Browsing history within the wim22 platform, pages visited, and session duration;
• Complete history of Sports Betting (football, MMA, e-sports, etc.), Crash Games and slots rounds, and financial transactions;
• Data from cookies and similar tracking technologies — described in detail in Section 6 of this Policy.

3How and Why We Use Your Data

Wim22 uses the personal data collected for the following purposes, each with an appropriate legal basis under the LGPD:

• Account creation and management: process registration, verify identity, keep account details up to date, and ensure secure access to the platform;
• Service provision: process Sports Betting on football, Copa do Brasil, Libertadores, MMA/UFC, e-sports, and other markets; provide Crash Games, slots, and Live Casino; execute deposits and withdrawals via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED bank transfer;
• Fraud and money laundering prevention: monitor financial transactions to identify suspicious patterns, conduct due diligence in accordance with COAF regulations and Brazilian anti-money laundering legislation;
• Compliance with legal and regulatory obligations: respond to requests from competent authorities, fulfill tax and fiscal obligations, and comply with applicable sports betting legislation in Brazil;
• User support: answer questions and resolve issues related to accounts, payments, or bets via live chat and email;
• Responsible gambling: monitor usage patterns to identify at-risk behavior and trigger player protection tools when necessary;
• Communications and marketing: send notifications about promotions, new games, platform updates, and other relevant communications — with the option to unsubscribe at any time;
• Platform improvement: analyze usage data to improve the player experience, identify technical issues, and develop new features.

Wim22 does not use your personal data for purposes incompatible with those described above. Any significant new use will be communicated through an update to this Privacy Policy.

4Legal Basis for Processing (LGPD)

All personal data processing carried out by wim22 is grounded in one of the legal bases set out in Article 7 of the LGPD. The main bases used are:

• Contract performance (art. 7, V): processing required to provide the services contracted by the user upon creating an account at wim22, including bet processing, deposits, and withdrawals;
• Compliance with a legal or regulatory obligation (art. 7, II): processing required by Brazilian sports betting legislation, by Banco Central do Brasil regulations governing Pix and TED payment transactions, and by anti-money laundering obligations (Law No. 9.613/1998);
• Legitimate interest (art. 7, IX): processing for fraud prevention, platform security, usage behavior analysis to improve services, and operational communications relevant to the user, always respecting data subjects' rights and reasonable expectations;
• Consent (art. 7, I): processing of data for marketing and promotional communications purposes, consent for which may be withdrawn at any time through the account settings or via live chat.

5Data Sharing with Third Parties

Wim22 does not sell, rent, or trade users' personal data to third parties. Data sharing occurs only in the situations described below, always with the purpose of enabling the contracted services or fulfilling legal obligations:

• Payment processing partners: financial institutions and payment systems such as Banco Central do Brasil (Pix system), partner banks (Nubank, Itaú, Bradesco, Banco do Brasil, Caixa, Santander), card networks (Visa, Mastercard), PicPay, and Mercado Pago — exclusively to process transactions in BRL (R$);
• Game and technology providers: certified crash game providers (such as Spribe for Aviator), slots, and live casino operators that require minimal data to authenticate users and record gameplay history;
• Identity verification (KYC) companies: specialized partners in document verification and fraud prevention who assist with regulatory compliance processes;
• Competent Authorities: data may be shared with the Ministério da Fazenda, Receita Federal, COAF, Banco Central do Brasil, and judicial or law enforcement authorities upon a duly substantiated legal request;
• Analytics tools and technical infrastructure: hosting, CDN, and performance analytics providers that process access data to ensure the secure and efficient operation of the wim22 platform.

All third parties that receive personal data from wim22 users are contractually required to maintain confidentiality, use the data solely for the authorized purposes, and implement adequate security measures, in compliance with the LGPD.

6Cookies and Tracking Technologies

Wim22 uses cookies and similar technologies to ensure the platform functions correctly, personalize the user experience, and analyze service performance. The cookie categories used are listed below:

• Strictly necessary cookies: essential for platform operation — session authentication, bet slip maintenance, and basic language preferences. These cannot be disabled without affecting service functionality;
• Performance and analytics cookies: collect information about how users interact with wim22 — most visited pages, session duration, technical errors — to continuously improve the experience. Data is aggregated and does not identify individual users;
• Functional cookies: store user preferences such as betting settings, responsible gambling limits, and notification preferences, to personalize the experience on return visits;
• Marketing cookies: used solely with the user's consent to measure the effectiveness of communications and display relevant content within the platform. Never used for advertising on third-party websites.

Users can manage cookie preferences through the consent banner displayed on their first visit to wim22 or via browser settings. Disabling performance and marketing cookies does not affect access to the platform's core services.

7Personal Data Security

Wim22 adopts appropriate technical and organizational measures to protect users' personal data against unauthorized access, alteration, improper disclosure, loss, or destruction. Key measures in place include:

• SSL/TLS encryption: all communications between the user's device and wim22's servers are encrypted, including login data, bets, and financial transactions via Pix, credit card, and other payment methods;
• Data encryption at rest: sensitive data stored on wim22 servers, including financial information and identity documents, is encrypted at rest;
• Access control: only employees and partners with a legitimate need have access to users' personal data, and such access is logged and regularly audited;
• Two-factor authentication: available for users who want to strengthen account access security, especially recommended for accounts with high financial transaction volume;
• Continuous monitoring: automated systems monitor the platform in real time to detect suspicious access, fraud attempts, and anomalous behavior;
• Regular audits: periodic security assessments, including penetration testing carried out by independent specialized firms.

In the event of a security incident that may affect users' personal data, wim22 will notify the National Data Protection Authority (ANPD) and the affected users within the deadlines established by the LGPD, providing clear information about the nature of the incident, the data involved, and the measures taken to remedy the situation.

8Data Retention and Deletion

Wim22 retains users' personal data for as long as necessary to fulfill the purposes described in this Policy, in compliance with the minimum mandatory retention periods required by Brazilian law:

• Registration and identity data: retained for as long as the account remains active and for a minimum of 5 years after closure, in accordance with anti-money laundering requirements (Law No. 9.613/1998) and tax legislation;
• Financial transaction history (deposits and withdrawals via Pix, boleto, card, PicPay, Mercado Pago, TED): retained for a minimum of 5 years after each transaction, in accordance with tax obligations and Banco Central do Brasil requirements;
• Betting and gaming history: retained for a minimum of 5 years for regulatory audit purposes, dispute resolution, and protection of the rights of both wim22 and its users;
• Access data and security logs: retained for 12 months for security purposes and compliance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014);
• Marketing data and preferences: retained for as long as consent has not been withdrawn; deleted within 30 days after consent is revoked.

Once the applicable retention periods have elapsed, data is securely deleted or irreversibly anonymized. Anonymized data may be used for statistical and research purposes without LGPD restrictions, as it no longer allows identification of data subjects.

9Your Rights as a Data Subject (LGPD)

The General Data Protection Law grants you, as a data subject, a set of rights that wim22 is committed to respecting and upholding. See your main rights and how to exercise them below:

Wim22 will respond to data subject rights requests within 15 calendar days of receipt, in line with the timeframes recommended by the ANPD. For more complex cases requiring additional review, we will communicate the extended timeframe along with the appropriate justification. To exercise any right, submit your request including your full name, CPF, and a description of what you are asking for to suporte@wim22.net or via live chat.

10Data of Minors

Wim22 services are intended exclusively for individuals aged 18 years of age or older. wim22 does not knowingly collect, process, or store personal data from individuals under 18 years of age. The registration process includes date of birth verification and requires the user to confirm they are of legal age.

When there is reasonable suspicion that a user is a minor, wim22 immediately suspends the account, halts all data processing, and requests documentation proving legal age. If the suspicion is confirmed, all data related to the minor is securely deleted and any deposited funds are returned pursuant to internal compliance policy.

If you believe that data belonging to a person under 18 years of age has been inadvertently collected by wim22, please contact us immediately at suporte@wim22.net so that the appropriate measures can be taken with the highest priority.

11International Data Transfer

Some of wim22's technology providers and partners may process personal data outside Brazilian territory. When this occurs, wim22 contractually requires those partners to adopt data protection measures equivalent to or exceeding those required by the LGPD, including:

• Execution of Standard Contractual Clauses (SCCs) to ensure an adequate level of protection;
• Data use strictly limited to the purposes contractually defined with wim22;
• Implementation of technical and organizational security controls in line with international standards;
• Immediate notification to wim22 in the event of a security incident involving personal data of Brazilian users.

Wim22 periodically reviews the countries and jurisdictions to which personal data may be transferred and keeps this assessment up to date in accordance with ANPD guidance. Financial data related to transactions via Pix, TED, and other instruments regulated by the Banco Central do Brasil is processed exclusively on servers located within Brazilian territory.

12Changes to This Privacy Policy

Wim22 may update this Privacy Policy periodically to reflect changes in Brazilian data protection legislation, the platform's data processing practices, the services offered, or ANPD guidance. Any changes will be published on this page along with the effective date of the new version.

Changes that materially affect data subjects' rights or the way data is processed will be communicated via registered email at least 7 days before taking effect. Continued use of the wim22 platform after the effective date of the changes constitutes tacit acceptance of the updated Privacy Policy. If you do not agree with the changes, you may close your account and request deletion of data processed on the basis of consent.

13Contact, DPO & Privacy Channel

To exercise your rights as a data subject, clarify questions about this Policy, or report any privacy or personal data processing concerns related to wim22, use the channels below, all available in Brazilian Portuguese:

• Data Protection Officer (DPO): responsible for personal data protection at wim22, reachable by email suporte@wim22.net with the subject line "Privacy – [your request]";
• Live chat: support available 24 hours a day, 7 days a week, directly on the wim22 platform;
• Help Center: section of FAQ with answers to the most common questions about privacy, personal data, and account security;
• Response timeframe: data subject rights requests will be responded to within 15 calendar days; general inquiries within 24 business hours.