H2bt Privacy Policy – How We Protect Your Data

The controller responsible for processing the personal data collected on the platform h2bt is the company that operates the platform, hereinafter referred to simply as "h2bt" or "we". As the data controller, h2bt defines the purposes and means of processing users' personal data, in accordance with the definitions set forth in Law No. 13.709/2018 (LGPD).

The h2bt has appointed a Data Protection Officer (DPO), responsible for handling communications from data subjects and the National Data Protection Authority (ANPD). The direct contact channel for the DPO is the email privacidade@h2bt.best.

The h2bt collects personal data in different ways throughout the user relationship. The main types of data and the points at which they are collected are detailed below:

The h2bt uses collected personal data solely for the purposes listed below. No data will be used for any purpose other than those described without prior notice and, where required by the LGPD, without renewed consent from the data subject:

• Creating and managing your account: identity verification, access authentication, prevention of multiple accounts, and access control;
• Financial transaction processing: deposits via Pix, boleto bancário, credit or debit card, Mercado Pago, and PicPay; processing withdrawals to Pix keys linked to your CPF; issuing payment receipts;
• Provision of betting and gaming services: sports betting records for Brasileirão, UFC, Libertadores, and other events; live casino games, slots, and poker; results history;
• Compliance with legal and regulatory obligations: anti-money laundering compliance (AML/CFT under Law No. 9,613/1998), reporting to regulatory authorities, and cooperation with judicial investigations;
• Operational communications: transaction confirmations, security alerts, account notifications, and updates to terms and policies;
• Marketing communications: sending promotions, offers, and news from h2bt — only for users who have opted in to receive these communications, and who may unsubscribe at any time;
• Security and fraud prevention: detection of suspicious activity, protection against unauthorized access, investigation of irregularities;
• Product improvement: usage behavior analysis to identify platform improvements, fix bugs, and personalize the experience — always in aggregated and anonymized form wherever possible.

The LGPD requires that all personal data processing be grounded in a specific legal basis. The h2bt bases its data processing activities on the following legal grounds:

The h2bt does not sell players' personal data to third parties. Data sharing occurs only in the situations described below, strictly on a need-to-know basis and with contractual confidentiality guarantees:

• Payment providers: the data required to process transactions via Pix is shared with the financial institutions participating in the Banco Central do Brasil's Pix network. For boleto bancário and credit or debit card payments, data is processed by certified payment gateways;
• Game and content providers: basic session information is shared with partner game providers — such as Pragmatic Play, NetEnt, Evolution Gaming, and Spribe — solely to ensure games function correctly. These providers only have access to the session identifier, not to the player's CPF or banking details;
• Identity verification services (KYC): documents submitted for verification may be processed by third-party providers specializing in document validation and fraud prevention, subject to data processing agreements that provide the same protections as this policy;
• Authorities and regulatory bodies: when required by law, court order, industry regulation, or a money laundering investigation, data may be disclosed to the relevant authorities — including the Receita Federal, Banco Central, Polícia Federal, and ANPD;
• External auditors: in compliance audit processes, data may be accessed by independent auditors, under contractual confidentiality.

Personal data is retained only for as long as necessary to fulfill the purpose that motivated its collection or to comply with legal obligations. The standard retention periods applied by the h2bt are:

Once retention periods have elapsed, data is either permanently deleted using secure destruction techniques or irreversibly anonymized — making re-identification of the data subject impossible.

The h2bt implements appropriate technical and organizational measures to protect players' personal data against unauthorized access, alteration, disclosure, or destruction. Among the key measures in place:

• Encryption in transit: all connections between the user's device and the servers of h2bt are protected with TLS 1.2 or higher;
• Encryption at rest: sensitive data — including CPF, banking details, and identity documents — is stored encrypted using AES-256;
• Role-based access control: only staff with a legitimate need to access personal data are granted permission, and all access is recorded in an audit log;
• Two-factor authentication: available to all players and mandatory for staff accessing internal systems that contain personal data;
• Continuous monitoring: automated systems detect anomalous behavior and suspicious access attempts in real time;
• Regular security testing: the platform undergoes penetration testing and periodic security audits conducted by external specialized firms;
• Staff training: all staff with access to personal data receive mandatory training in data protection and information security.

The h2bt uses cookies and similar technologies to ensure the platform operates correctly, improve the user experience, and analyze site performance. Below is a breakdown of the cookies used:

You can manage your cookie preferences through your browser settings or via the preferences panel available on h2bt. Disabling non-essential cookies may affect some platform features, but will not prevent access to games or your betting history.

The LGPD guarantees you, as the data subject whose personal data is processed by h2bt, a set of rights that can be exercised at any time, at no cost and with no hassle. To exercise any of these rights, simply reach out through 24h support or by emailing privacidade@h2bt.best. The response time is up to 15 business days.

The platform h2bt is intended exclusively for users aged 18 and over. The h2bt does not intentionally collect personal data from minors. The registration process includes age verification tied to the CPF provided, and platform access is blocked for users who do not meet the minimum age requirement.

Should h2bt identifies that data belonging to a minor under 18 has been inadvertently collected — for example, due to false information provided during registration — the data will be immediately deleted, the account will be closed, and, where applicable, the case will be reported to the relevant authorities.

If you are the guardian of a minor and believe they may have created an account on h2bt, please contact us immediately via 24h support or by email at privacidade@h2bt.best so we can act promptly.

Some of the partner service providers of h2bt — such as game providers and cloud infrastructure services — may process data on servers located outside Brazil. When this occurs, h2bt ensures the transfer is carried out in compliance with Chapter V of the LGPD, through:

• Specific data protection contractual clauses agreed upon with each international vendor;
• Data transfers only to countries or international organizations that provide an adequate level of data protection as assessed by the ANPD;
• Application of Binding Corporate Rules (BCR) when the provider belongs to a multinational group with an approved internal data protection policy.

In all cases, data transferred internationally is limited to the minimum necessary to provide the specific service, and international vendors are contractually prohibited from using that data for any purpose beyond those authorized by the h2bt.

The h2bt may update this Privacy Policy periodically to reflect changes in Brazilian legislation — particularly the LGPD and ANPD regulations — or to incorporate improvements to its data protection practices. Any material change will be communicated as follows:

• Email notification to your registered address, at least 15 days before the new rules take effect — except where immediate legal requirements apply;
• A prominent notice on the platform's homepage during the transition period;
• Updating the "Last updated" date at the top of this document.

Changes that reduce data subjects' rights or alter the purpose of data processing will require renewed consent when consent is the applicable legal basis. Continued use of the platform after changes unrelated to consent take effect constitutes acceptance of the updated terms.

For any questions, requests, or complaints related to the processing of your personal data by the h2bt, you may use any of the channels below: