Z000 Privacy Policy – Your Data Handled with Respect

1. Data Controller

The controller of personal data collected through the z000 platform is the company responsible for operating the z000.best website in Brazil. For the purposes of this Privacy Policy, z000 is the entity responsible for decisions regarding how users' personal data is handled.

When we refer to "z000", "we", or "the platform" throughout this document, we mean the legal entity that operates the z000.best website and all Sports Betting, online casino, and digital gaming services made available under that brand to users in Brazil.

Z000 collects and processes personal data strictly within the limits established by the Lei Geral de Proteção de Dados (LGPD – Law No. 13,709/2018) and other applicable Brazilian legislation governing the sports betting and digital entertainment sector.

2. Data We Collect

Z000 collects personal data at different points during your interaction with the platform. Below, we describe the categories of data collected and the circumstances under which each is obtained.

Data you provided directly during registration:

• Full name as it appears on an official ID document.
• CPF (Cadastro de Pessoa Física) issued by the Brazilian Federal Revenue Service.
• Date of birth.
• Full residential address (street, number, unit, neighborhood, city, state, ZIP code).
• Active email address.
• Mobile number with area code.
• Access password (stored in encrypted form only — z000 does not have access to your password in plain text).

Data provided for identity verification (KYC):

• Photo ID: national ID card, driver's license, or passport.
• Proof of address in the account holder's name (utility bill for electricity, water, or gas, or a bank statement issued within the last 3 months).
• Selfie holding a valid ID document (required in cases of suspected fraud or for withdrawals above R$ 5,000.00).

Financial data collected automatically during use:

• Pix key registered for withdrawals (CPF, phone number, email, or random key).
• Credit or debit card details (z000 stores only the last four digits and card brand — the full card number is processed by the payment provider, never by z000 directly).
• Deposit and withdrawal history, including amounts, dates, and methods used.
• Betting and gaming history, including selections, amounts wagered, winnings, and losses.

Technical data collected automatically:

• Access IP address.
• Browser type and version.
• Device operating system.
• Unique device identifiers (when accessed via mobile).
• Pages visited within the platform and time spent browsing.
• Cookies and similar technologies (described in Section 8 of this policy).

3. How We Use Your Data

Every piece of data collected by z000 has a specific, defined purpose. The table below summarizes the main uses of personal data on the platform:

Z000 does not use your personal data for purposes other than those listed above without first informing you and, where required, obtaining your consent. If we need to use your data for a new purpose not covered by this policy, you will be notified in advance.

4. Legal Basis for Data Processing

The LGPD requires that all personal data processing have a specific legal basis. z000 processes your data under the following legal grounds set out in Art. 7 of Law No. 13,709/2018:

• Contract performance (Art. 7, V): To provide the Sports Betting and casino services you signed up for when creating your z000 account, including processing deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago.
• Compliance with a legal or regulatory obligation (Art. 7, II): For identity verification (KYC), anti-money laundering compliance, reporting to competent authorities when required by law, and adherence to Sports Betting regulations in Brazil.
• Legitimate interest of the controller (Art. 7, IX): For platform security, fraud detection, service improvement, and operational risk management purposes, provided these do not override your fundamental rights and freedoms.
• Consent (Art. 7, I): For sending marketing communications, using analytics and personalization cookies, and any other processing not covered by the bases above. You may withdraw your consent at any time without affecting your access to z000's core services.

5. Sharing Data with Third Parties

Z000 does not sell, rent, lease, or trade your personal data with third parties. Full stop. This is an absolute internal rule that no business or contractual decision can override.

There are, however, situations where data sharing is necessary for the platform's legitimate operation or to meet legal obligations:

• Payment processors: Your payment data is shared with the processors responsible for handling Pix transactions (via Banco Central), boleto bancário, credit/debit card payments (acquirers such as Cielo, Rede, or Stone), PicPay, and Mercado Pago, strictly for the purpose of processing transactions you have requested. These processors operate as subcontractors of z000 and are bound by contractual confidentiality and security obligations equivalent to those in this policy.
• Public authorities: z000 may share data with the Receita Federal, Banco Central, Polícia Federal, Ministério Público, and other public authorities when required by law, court order, or official investigation. In such cases, z000 shares only the minimum data necessary to fulfill the request.
• Game providers: For the operation of casino games and crash games, minimal technical data (anonymous session identifier, bet amount) is shared with the certified providers that supply games to z000. No personally identifiable data such as CPF or full name is transmitted to game providers.
• External auditors and consultants: In exceptional circumstances, financial auditors or legal advisors engaged by z000 may access anonymized or pseudonymized data for audit purposes, always under a confidentiality obligation.

6. Data Retention and Deletion

Z000 retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with the minimum retention periods required by Brazilian law.

Applicable retention periods:

• Registration and identity data (CPF, ID document, address): Retained for a minimum of 5 years after account closure, as required by anti-money laundering legislation (Law No. 9,613/1998 and COAF regulations).
• Financial transaction history (deposits and withdrawals): Retained for a minimum of 5 years, in accordance with the National Tax Code and the regulations of the Banco Central do Brasil.
• Betting and gaming history: Retained for a minimum of 2 years after account closure for dispute resolution and audit purposes.
• Access logs and technical data: Retained for 6 months, in accordance with the Marco Civil da Internet (Law No. 12,965/2014, Art. 15).
• Marketing and communications data: Retained for as long as you have not withdrawn consent to receive them. Once consent is revoked, deleted within 30 days.

Once mandatory retention periods have expired, your data is securely deleted from z000's systems or irreversibly anonymized, so that you can no longer be identified from the remaining information.

If you request account deletion, z000 will immediately revoke access and begin deleting any data not subject to mandatory legal retention periods. Data required to be retained by law will be kept for the legally prescribed period and automatically deleted once that period expires.

7. Data Security

Z000 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, unauthorized disclosure, or destruction. The key security measures in place include:

• 256-bit SSL/TLS encryption: All communication between your device (mobile, computer, or tablet) and z000's servers is encrypted. This means that data transmitted during login, deposits, withdrawals, and general platform use cannot be intercepted by third parties in transit.
• Encrypted password storage: Passwords are stored as irreversible hashes with a cryptographic salt. No z000 employee has access to your password in plain text — not even support staff. That's why, if you forget it, recovery is done via email, not through direct disclosure.
• Role-based access control: Access to user data by z000's internal team is restricted to the minimum required for each role. A support analyst, for example, does not have access to a user's full financial history without specific authorization.
• Two-factor authentication (2FA): z000 offers two-factor authentication for your account, adding an extra layer of protection against unauthorized access — especially in the event of a password breach.
• Continuous monitoring: z000 systems are continuously monitored for suspicious access, intrusion attempts, and unusual behavior patterns that may indicate account compromise.
• Secure encrypted backups: Data is replicated in encrypted backups stored on separate infrastructure, ensuring information availability and integrity in the event of a technical failure.

Despite all measures in place, no system is 100% invulnerable. In the event of a security incident that significantly affects your personal data, z000 will notify the National Data Protection Authority (ANPD) and affected users within the timeframe required by the LGPD, with details about what happened, which data was affected, and what steps were taken.

8. Cookies and Tracking Technologies

Z000 uses cookies and similar technologies to ensure the platform works correctly, improve the browsing experience, and — with your consent — personalize content and analyze service usage.

Types of cookies used by z000:

• Essential (technical) cookies: Required for the platform to function properly. This includes session cookies (which keep you logged in while browsing), security cookies (which protect against CSRF and similar attacks), and preference cookies (which remember settings such as language and theme). These cookies cannot be disabled, as the platform will not work correctly without them.
• Analytical cookies: Used to understand how users navigate the platform — which pages are visited most, where form drop-offs occur, average session duration, and so on. The data collected is anonymized and used solely to improve the experience. You can decline these cookies without losing access to any services.
• Marketing and personalization cookies: Used only with your explicit consent to personalize offers and promotions shown within the z000 platform. z000 does not use third-party marketing cookies to track you outside its own site.

You can manage your cookie preferences at any time through the privacy settings panel within your z000 account. You can also manage or block cookies directly through your browser, though doing so may affect how some platform features work.

Z000 does not use social media tracking pixels or device fingerprinting technologies for external advertising purposes.

9. Data of Minors

Z000 is a betting and gaming platform intended exclusively for users aged 18 and over. The platform does not intentionally collect, store, or process personal data from individuals under 18.

Registration requires a date of birth and CPF verification, which automatically prevents minors from signing up. Additionally, the identity verification (KYC) process requires a photo ID that confirms the user is of legal age.

If z000 determines that a user provided false information about their age, or discovers that an account belongs to a minor, the account will be immediately closed, the balance will be returned to the legal guardian upon verification, and any collected data will be deleted from our systems within 30 days, except where retention is legally required for investigation purposes.

If you suspect that a minor has created or is using an account on z000, please contact support immediately via the platform chat or by email at contato@z000.best.

10. International Data Transfers

Z000 operates with a focus on the Brazilian market and prioritizes storing data on servers located in Brazil or in countries that offer a level of protection equivalent to the LGPD.

In certain operational situations, your data may be processed on servers located outside Brazil, particularly when:

• Internationally certified game providers process technical session data on servers in Europe or the United States.
• Security and fraud detection tools operate on cloud infrastructure with globally distributed servers.

When data is transferred internationally, z000 ensures the transfer is carried out using appropriate safeguards, such as standard contractual clauses approved by the ANPD, compliance with the European GDPR (where applicable), or certification equivalent to the level of protection required by the LGPD.

Z000 does not transfer identifiable personal data (such as CPF, full name, or banking details) to servers outside Brazil. Any data transferred internationally consists entirely of anonymized or pseudonymized technical data.

11. Your Rights as a Data Subject

The LGPD grants you, as the data subject whose personal data is processed by z000, a set of rights that can be exercised at any time. z000 commits to responding to all requests within the legal deadline of 15 business days.

You have the right to:

• Confirmation and access: Know whether z000 processes your data and, if so, access what data is being processed, how, and for what purpose.
• Correction: Request the correction of incomplete, inaccurate, or outdated data — for example, updating your address or fixing an error in your registered phone number.
• Anonymization, blocking, or deletion: Request that unnecessary or excessive data be anonymized, blocked, or deleted, subject to the mandatory retention periods described in Section 6.
• Portability: Request an export of your personal data in a structured, machine-readable format so you can transfer it to another service provider, where technically feasible.
• Information on data sharing: Find out which entities z000 shares your data with and under what circumstances.
• Withdrawal of consent: Withdraw consent given for processing based on that legal basis (such as marketing communications), without affecting your access to the platform's core services.
• Objection: Object to data processing carried out on the basis of legitimate interest, where you believe it infringes your fundamental rights.
• Review of automated decisions: Request human review of decisions made exclusively by automated systems that affect your interests, such as an account block triggered by a fraud detection system.

To exercise any of these rights, please contact us at contato@z000.best with the subject line "LGPD Rights – [your CPF]" and describe your request. We may ask you to verify your identity before processing the request, to ensure it is being made by the account holder.

12. Data Protection Officer (DPO)

Z000 has appointed a Data Protection Officer (DPO) as required by Art. 41 of the LGPD. The DPO is the official communication channel between z000, data subjects, and the Autoridade Nacional de Proteção de Dados (ANPD).

The z000 data protection officer is responsible for:

• Receive and respond to data subjects' requests regarding their personal data.
• Guide z000 staff and service providers on data protection practices.
• Serve as the point of contact with the ANPD in the event of security incidents or regulatory investigations.
• Monitor compliance with this Privacy Policy and LGPD requirements within the organization.

To contact z000's DPO directly regarding privacy and data protection matters, send an email to contato@z000.best with the subject line "DPO – Privacy". All communications are treated with strict confidentiality.

13. Changes to This Privacy Policy

Z000 may update this Privacy Policy periodically to reflect changes in data processing practices, Brazilian legislation, or the services offered by the platform.

When significant changes are made, z000 will notify users via:

• Email sent to the address registered on the account, at least 7 days before the changes take effect.
• A prominent notice on the platform's home page and login area.
• Update of the "Last updated" date at the top of this page.

Continued use of the z000 platform after any changes take effect means you have read and accepted the updated version of this policy. If you disagree with the changes, you may close your account before the effective date and request a withdrawal of your available balance.

The most recent version of this Privacy Policy is always available on this page, in plain and accessible language, and can be consulted at any time — even without being logged in.