Privacy Policy h888 – LGPD Data Protection

1 Data Controller

The controller of personal data collected by the platform h888 is the company operating the h888.express website, headquartered in São Paulo, SP, Brazil. For any questions regarding the processing of your personal data, you may contact our privacy team directly at privacidade@h888.express.

A h888 has appointed a Data Protection Officer (DPO) as required by the LGPD. The DPO serves as the official communication channel between data subjects, the company, and the National Data Protection Authority (ANPD). All requests related to data subject rights are forwarded to the DPO for review and response within the statutory deadlines.

2 Data We Collect

A h888 collects personal data in different ways, depending on how you interact with the platform:

Data you provide directly during registration:

• Full name, date of birth, and CPF;
• Email address and mobile number;
• Full residential address (for proof of residence verification);
• Identity documents (RG or CNH) and proof of address, as part of the KYC process;
• Pix key registered for withdrawals — which must be in the account holder's name.

Data generated through platform use:

• Full sports betting history — including football markets (Brasileirão, Copa do Brasil, Libertadores), MMA/UFC, volleyball, and basketball;
• Session history in slots, live casino, and other games;
• Financial transaction history — deposits via Pix, credit/debit card, boleto bancário, PicPay, Mercado Pago, and TED bank transfer;
• Records of interactions with customer support, including chats and emails;
• Gaming preferences and account settings defined by the user.

Automatically collected data:

• IP address and approximate geolocation (city/state);
• Browser type and version, operating system, and device model;
• Pages visited within the platform and time spent browsing;
• Cookies and session identifiers (detailed in section 6);
• Mobile app performance data, when using the h888 app.

3 Purpose of Processing

The personal data collected by the h888 are used exclusively for the following purposes:

• Platform operation: allow you to place bets, play slots, live casino, and use all features available on h888;
• Identity verification (KYC): confirm that you are 18 or older, that you are who you claim to be, and that you are not on any voluntary self-exclusion list;
• Payment processing: process deposits and withdrawals via Pix, card, boleto, and other accepted methods, in compliance with Brazil's Central Bank regulations;
• Anti-money laundering and fraud prevention: monitor unusual transaction patterns and report to the relevant authorities when required by law;
• Responsible gambling: identify behavioral patterns that may indicate problematic platform use and offer proactive support;
• User communication: send notifications about bets, relevant promotions, security updates, and account communications — you can manage your notification preferences in your account settings;
• Service improvement: analyze usage data in aggregate to improve the platform experience, fix issues, and develop new features;
• Compliance with legal obligations: comply with requirements from regulatory authorities, court orders, and tax obligations.

4 Legal Basis for Processing (LGPD)

A h888 processes your personal data based on the following legal grounds set out in article 7 of the LGPD:

• Contract performance (art. 7, V): processing is necessary to perform the platform's terms of use contract that you accepted upon registration. This includes account operation, bet processing, and payments;
• Compliance with a legal or regulatory obligation (art. 7º, II): identity verification (KYC), anti-money laundering, and financial record retention are legal requirements that do not depend on your consent;
• Legitimate interest (art. 7º, IX): the analysis of usage data for platform improvement, fraud detection, and account security is based on h888's legitimate interest, provided it does not infringe on your fundamental rights;
• Consent (art. 7, I): for sending marketing communications and promotions by email or push notification, we rely on your explicit consent, which can be withdrawn at any time in your account settings.

For each processing purpose, the h888 maintains internal documentation identifying the applicable legal basis, available upon request to the DPO.

5 Data Sharing with Third Parties

A h888 may share personal data with third parties in the following situations, always in a limited and proportionate manner:

• Payment processors: financial institutions and payment intermediaries involved in processing Pix transactions — Nubank, Itaú, Bradesco, Banco do Brasil, PicPay, and Mercado Pago — receive only the data strictly necessary to process the specific transaction;
• Game providers: companies such as Pragmatic Play, PG Soft, and Hacksaw Gaming receive an anonymous session identifier to operate the games — we do not share your name, CPF, or financial data with slots or casino providers;
• Infrastructure services: cloud computing and cybersecurity providers that host h888's systems have controlled access to data in accordance with their data processing agreements;
• Authorities and regulatory bodies: when required by law, court order, or official request from a competent authority — such as the Central Bank, the Federal Revenue Service, or law enforcement — h888 shares the requested data without requiring prior consent from the data subject;
• Auditors and legal advisors: professionals providing audit, legal advisory, or compliance services may access personal data under professional confidentiality obligations and contractual restrictions.

A h888 does not share data with marketing companies, data brokers, or advertising platforms. No identifiable personal data is used for third-party ad targeting.

6 Cookies and Tracking Technologies

A h888 uses cookies and similar technologies to ensure the platform works correctly and to improve the user experience. The types of cookies used are:

• Essential cookies: required for the basic operation of the platform, such as keeping your session active after login and remembering your language preferences and settings. They cannot be disabled without affecting platform functionality;
• Security cookies: used to detect unauthorized access attempts, identify suspicious behavior, and protect your account against fraud. They are part of h888's security controls;
• Analytical cookies: collect information about how users navigate the platform — which sections they visit, how long they stay, and which features they use. Data is aggregated and anonymized before analysis;
• Preference cookies: store your in-platform preferences, such as custom betting limits, visual themes, and responsible gambling settings.

You can manage non-essential cookie preferences through the consent banner displayed on your first visit to the platform, or in your account settings. Disabling analytics cookies does not affect platform functionality.

7 Data Security

A h888 employs a comprehensive set of technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit: all communication between your device and h888's servers uses the HTTPS protocol with 256-bit SSL/TLS encryption;
• Encryption at rest: sensitive data stored in h888's databases, such as KYC documents and financial information, is encrypted at rest;
• Access control: internal access to user data is role-restricted and based on the principle of least privilege — only employees with a specific operational need have access to identifiable personal data;
• Continuous monitoring: h888's systems are monitored 24 hours a day to detect anomalous access, intrusion attempts, and other security incidents;
• Two-factor authentication (2FA): available and recommended for all h888 users, adding an extra layer of protection to your account;
• Periodic security testing: the platform undergoes regular security assessments, including penetration tests conducted by specialized firms.

In the event of a security incident that may affect your personal data, h888 commits to notifying affected data subjects and the ANPD within a maximum of 72 hours after the incident is confirmed, as required by the LGPD.

8 Data Retention and Deletion

A h888 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or to meet legal obligations. General retention periods are:

• Identification and KYC data: 5 years after account closure, in accordance with regulatory requirements for the betting market;
• Financial history (deposits and withdrawals via Pix, card, boleto): 5 years from the date of each transaction, in accordance with Brazilian Central Bank and Federal Revenue regulations;
• Betting history and gaming sessions: 5 years after account closure;
• Browsing data and access logs: 13 months from the date of registration;
• Support communications (chats and emails): 2 years after the support ticket is closed.

Once retention periods expire, data is securely deleted or irreversibly anonymized. Anonymization preserves the usefulness of data for statistical analysis without allowing identification of the individual.

If you request the closure of your account at h888, data not subject to a legal retention obligation will be deleted within 30 days of confirmed account closure. You will receive an email confirmation once the deletion is complete.

9 Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the data subject whose personal data is processed by h888, the following rights, which may be exercised at any time:

• Confirmation and access (art. 18, I and II): you may request confirmation that h888 processes your personal data and obtain a full copy of the information we hold about you;
• Correction (art. 18, III): you may request correction of incomplete, inaccurate, or outdated data — such as your address, email, or phone number;
• Anonymization, blocking, or erasure (art. 18, IV): you may request that data which is unnecessary or processed in violation of the LGPD be anonymized, blocked, or deleted;
• Portability (art. 18, V): you may request the portability of your personal data to another service controller, in a structured and interoperable format;
• Erasure with consent (art. 18, VI): for data processed on the basis of your consent, you may request deletion after revoking that consent;
• Information on sharing (art. 18, VII): you have the right to know which public and private entities h888 has shared your data with;
• Withdrawal of consent (art. 18, IX): you may withdraw consent granted for specific purposes, such as receiving marketing communications.

To exercise any of these rights, send a request to privacidade@h888.express with the subject line "Exercício de Direitos LGPD", including your CPF, the email registered with h888 and the specific right you wish to exercise. Requests are responded to within 15 business days.

10 Minors

A h888 is a Sports Betting and online casino platform intended exclusively for users aged 18 and over. We do not intentionally collect personal data from anyone under 18.

If we become aware that data belonging to a person under 18 was collected through false age declarations during registration, we will take the following steps immediately:

• Immediate account suspension and cancellation of all active bets and sessions;
• Refund of the BRL balance via Pix or another method to the identified legal representative;
• Deletion of all personal data associated with the account, except for the minimum records needed to document the incident;
• Notification to the DPO for assessment of any additional compliance measures.

If you believe a minor may have created an account on h888, please contact us immediately at suporte@h888.express so we can act as quickly as possible.

11 International Data Transfer

Some of the infrastructure providers and technology partners of the h888 are located outside Brazil. When personal data needs to be transferred to other countries, the h888 ensures that such transfers only take place when:

• The destination country offers an adequate level of personal data protection, as recognized by the ANPD;
• Standard contractual data protection clauses are in place between h888 and the recipient, ensuring a level of protection equivalent to that of the LGPD;
• The recipient is part of a corporate group with a global data protection policy that meets LGPD requirements.

Slots and casino providers, such as Pragmatic Play and PG Soft, receive only anonymous session identifiers — no identifiable personal data is transferred to these providers in the normal course of platform use.

12 Changes to This Policy

A h888 may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or platform features. All material changes will be communicated to users with an active account via their registered email at least 7 days before taking effect.

The version currently in effect is always the one published at h888.express/privacy-policy, with the date of the last update shown at the top of the document. Continued use of the platform after the effective date of any changes constitutes implied acceptance of the updated Policy.

If the changes involve new consent-based processing purposes, we will request your express consent before initiating the new processing.

13 Contact & Data Protection Officer (DPO)

For any matter related to privacy, data protection, or the exercise of your rights under the LGPD, you can contact the h888 through the following channels:

• Privacy email: privacidade@h888.express — dedicated channel for LGPD rights requests and data processing inquiries;
• General support: suporte@h888.express — for questions about your account, Pix payments, and how the platform works;
• Live chat: available 24 hours a day in Portuguese on the h888 website and app, for immediate assistance on any matter.

LGPD rights requests submitted to privacidade@h888.express are routed directly to the DPO and answered within 15 business days. If a request is complex or requires additional identity verification, this period may be extended by a further 15 business days, with prior notice to the data subject.

If, after contacting h888, you believe your rights as a data subject have not been adequately addressed, you may file a complaint with the National Data Protection Authority (ANPD) at gov.br/anpd.