Privacy Policy for pg888 — Your Data Protected in Brazil

The controller of the personal data processed under this Privacy Policy is the company operating the platform pg888, responsible for all decisions regarding the collection, purpose, storage, and sharing of personal data of users registered in Brazil.

The pg888 operates exclusively in the Brazilian market, with a focus on online casino and Sports Betting. The entire platform experience — from registration to withdrawal via Pix — is designed and managed with the Brazilian user as the central reference.

For LGPD purposes, the Personal Data Processing Officer (DPO — Data Protection Officer) can be reached at suporte@pg888-khelo.com, with the subject line "LGPD — DPO". Further details about the DPO contact channel are in Section 12 of this policy.

The pg888 collects different categories of personal data depending on the stage of platform use. We collect only what is necessary for the purposes described in this policy — nothing more.

Registration data

• Full name, date of birth, and CPF;
• Full residential address (street, number, neighborhood, city, state, ZIP code);
• Email address and mobile number;
• Account password (stored in encrypted form — pg888 does not have access to your password in plain text).

Identity verification (KYC) data

• Photo ID document (RG, CNH, or Passport) — front and back;
• Selfie with ID document (when requested by the security system);
• Proof of address issued within the last 3 months (when requested).

Financial transaction data

• Deposit history: payment method used (Pix, boleto, credit/debit card, PicPay, Mercado Pago), amount, date, and time;
• Withdrawal history: Pix key or destination bank details, amount, date, time, and processing status;
• Account balance and transaction history;
• Partial card data (last 4 digits and card brand only — no complete card data is stored by pg888).

Platform usage data

• Sports betting history (Brasileirão, Superliga, Copa do Brasil, UFC, CBLOL, and other sports);
• Casino game history (slots, roulette, poker, crash games, bingo);
• Session data: access time, duration, pages visited, features used;
• IP address, device type, operating system, browser, and device identifier (UUID).

Communication data

• Support conversation history (live chat, email, WhatsApp);
• Marketing communication preferences (opt-in/opt-out by channel).

All personal data processing by the pg888 has a defined legal basis under Art. 7 of the LGPD. The table below summarizes the main purposes and their corresponding legal bases:

The pg888 does not process personal data for purposes incompatible with those listed above. Any new use of existing data for a purpose other than the original will be communicated to the data subject before it is implemented.

The pg888 shares personal data with third parties only when strictly necessary to provide contracted services or to comply with a legal obligation. All third parties that receive personal data from pg888 users are bound by data processing agreements containing confidentiality and security clauses equivalent to pg888's own standards.

Categories of third parties that may receive data

• Payment processors: institutions responsible for processing Pix, bank slips, credit/debit cards, PicPay, and Mercado Pago. They receive only the minimum data necessary for each transaction;
• Game providers: companies that supply slots, live roulette, poker, and other casino games integrated into the platform. They receive an anonymous user identifier — not the CPF or full name — for game session and jackpot purposes;
• Identity verification (KYC) service providers: specialized providers in document validation and fraud detection. They receive document and selfie data exclusively for that purpose;
• IT infrastructure providers: cloud servers and CDN services that host the platform. These partners have technical access to data as processors, never as independent controllers;
• Public authorities: pg888 provides personal data to government authorities when required by law — such as the Central Bank of Brazil, the Federal Revenue Service, the Ministry of Finance, and law enforcement with a court order. We do not share data with authorities beyond what the law requires.

The pg888 retains personal data only for as long as necessary for the purposes for which it was collected, respecting the minimum retention periods required under Brazilian law:

• Registration data — retained for the duration of the active account period and for up to 5 years after account closure, in accordance with tax and regulatory requirements;
• Financial transaction data — retained for a minimum of 5 years after each transaction, in compliance with Law No. 9,613/1998 (Anti-Money Laundering Law) and Central Bank regulations;
• KYC documents — retained for 5 years after account closure or for the period required by applicable regulations, whichever is longer;
• Usage data and betting history — retained for up to 3 years after the last active access, for support, auditing, and responsible gambling purposes;
• Support history — retained for up to 2 years after the support ticket is closed;
• Marketing data — deleted immediately upon withdrawal of consent for that purpose.

Once the retention period expires, data is securely and permanently deleted from the systems of pg888, or irreversibly anonymized for statistical purposes. Anonymization eliminates any possibility of individual identification.

The pg888 implements a robust set of technical and organizational measures to protect users' personal data against unauthorized access, misuse, alteration, or destruction:

Technical measures

• SSL/TLS 256-bit encryption across all communications between the user's device and pg888 servers — the same standard used by Brazil's leading digital banks;
• Encryption at rest for sensitive data stored in the database — passwords are stored only as an irreversible hash (bcrypt);
• Two-factor authentication (2FA) available to all users — strongly recommended for account access and withdrawal requests;
• Continuous monitoring of access attempts and intrusion attempts via an automated anomaly detection system;
• Environment segregation — production, testing, and development data are completely isolated;
• Encrypted backups with geographic redundancy, regularly tested to ensure recovery.

Organizational measures

• Access to personal data is restricted to employees and service providers with a demonstrated need — least-privilege principle;
• All staff with access to personal data undergo regular training in data protection and information security;
• Internal security incident policy with defined procedures for detection, containment, notification, and remediation;
• Periodic security audits conducted by an internal team and, where applicable, by external consultants.

The pg888 acknowledges that no system is 100% invulnerable. In the event of a security incident that poses a real risk to affected users, pg888 will notify those users and the ANPD within the legally required timeframes, with clear information about what occurred, which data was involved, and what measures were taken.

The pg888 uses cookies and similar technologies (localStorage, sessionStorage, pixels) to ensure the platform works correctly, improve the user experience, and — with consent — personalize content and communications. See the types of cookies used below:

You can manage your cookie preferences at any time in your account's privacy settings. Essential and security cookies cannot be disabled without affecting the platform's functionality. Declining optional cookies does not impact access to the main features of the pg888.

The pg888 is a platform exclusively for adults aged 18 and over. We do not intentionally collect personal data from anyone under 18. Account registration requires confirmation of legal age, and the KYC process includes verification of date of birth via official ID.

If pg888 determines that a registered user is under 18 — by any means, including reports, document verification, or automated detection — the account will be immediately closed, all bets placed will be voided, and any deposited balance will be refunded to the original payment method. Data collected will be deleted in accordance with the LGPD.

Some of the technology partners of the pg888 — such as cloud infrastructure providers and casino game suppliers — operate servers outside Brazil. When this occurs, the international transfer of personal data is carried out in compliance with the requirements of the LGPD (Art. 33), ensuring that the destination country or organization offers an adequate level of protection for personal data.

Pg888's international transfers are carried out with the following safeguards:

• Standard data protection contractual clauses (equivalent to European SCCs) with all international partners;
• Prior assessment of the data protection level in the destination country before any new transfer;
• Data transferred internationally is subject to the same confidentiality and security obligations that apply in Brazil.

Under no circumstances shall pg888 transfers data to countries that the ANPD considers to have an inadequate level of protection without implementing additional safeguards approved by the Brazilian regulatory authority.

The pg888 sends marketing communications — such as slots promotions, Brasileirão betting offers, volleyball bonuses, and e-sports deals — only to users who have expressly consented to receive them. Consent is collected at registration and can be managed in the account's communication preferences.

Marketing channels used

• Email: promotions, product news, and transactional communications (deposit, withdrawal, and registration confirmations). Transactional messages are sent regardless of marketing preferences;
• SMS and WhatsApp: only with explicit opt-in for that channel. Frequency limited to relevant, non-repetitive communications;
• Push notification: only for users who have enabled browser or app notifications. These can be turned off at any time in your device settings.

To unsubscribe from any marketing communications from the pg888, the user may:

• Click the "Unsubscribe" link found in every marketing email;
• Adjust communication preferences in your account dashboard (Settings → Communication Preferences);
• Send a request to suporte@pg888-khelo.com with the subject line "Cancel Marketing".

Opting out of marketing communications does not affect the receipt of essential transactional emails, such as withdrawal confirmations and security alerts.

The pg888 uses automated systems in certain specific situations, such as fraud detection, anti-money laundering, and identifying patterns of problem gambling (responsible gaming). These systems analyze behavioral and transactional data to identify risks to platform security or user well-being.

In none of these situations does an automated decision produce significant negative effects for the user without prior human review. Every account suspension or block resulting from an automated alert goes through manual verification before being confirmed.

The user has the right to:

• Be informed when a significant decision has been made based on an automated process;
• Request human review of any automated decision that affects you;
• Obtain an explanation of the criteria used in the automated process that led to the decision.

Requests for review of automated decisions must be sent to suporte@pg888-khelo.com with the subject line "LGPD — Automated Decision Review". The response deadline is up to 10 business days.

In accordance with Art. 41 of the LGPD, pg888 has appointed a Personal Data Processing Officer (DPO — Data Protection Officer), responsible for:

• Receive and respond to communications from data subjects regarding the exercise of their LGPD rights;
• Receive communications from the ANPD (National Data Protection Authority);
• Educate employees and service providers on the data protection practices adopted by pg888;
• Carry out any other duties assigned by pg888 or established under supplementary regulations.

How to contact pg888's DPO

• Email: suporte@pg888-khelo.com — subject: "LGPD — [Request Type]";
• Live chat: available on the platform 24 hours a day, 7 days a week — let us know you'd like to speak about LGPD;
• Response time: up to 15 business days for LGPD rights requests; up to 72 hours for incident notifications.

The pg888 is committed to responding to all personal data requests clearly, without excessive legal jargon, and within the deadlines established by the LGPD.

The pg888 may update this Privacy Policy periodically, in response to changes in Brazilian law (especially ANPD regulations), updates to the products and services offered, or evolving market practices in data protection.

Any material changes to this policy will be communicated at least 7 (seven) calendar days in advance via your registered email and through a notification in your account dashboard. The date of the last update is always shown at the top of this document and in the side header.

Continued use of the platform after any changes take effect constitutes implicit acceptance of the updated policy. If you do not agree with the changes, you may close your account and request deletion of data processed on the basis of consent before the new version's effective date.

This version (2.4) came into effect on January 10, 2026 and fully supersedes all previous versions of the Privacy Policy published by pg888. To access earlier versions, please contact support.