Privacy Policy 11pp: Your Data Protected by the LGPD

The 11pp, operator of the 11pp.click website, is the controller of the personal data collected from its users, as defined by the General Data Protection Law (LGPD – Law No. 13.709/2018). This means 11pp is responsible for decisions regarding how and why your data is collected, stored, and used.

For privacy and data protection matters, you can contact 11pp's Data Protection Officer (DPO) by email at contato@11pp.click or via the live chat available 24 hours a day on the platform. The response deadline for formal rights-exercise requests is up to 15 business days, as required by the LGPD.

11pp collects different categories of data depending on how you interact with the platform. Below is a full description of each category:

11pp does not collect full credit or debit card numbers — card payment processing is handled by PCI-DSS certified processors, which receive and tokenize card data directly, so complete card numbers never pass through or are stored on 11pp's servers.

11pp uses your personal data solely for the purposes stated below. No data is processed for purposes incompatible with those listed here without your express authorization.

• Account operation: create and manage your account, authenticate logins, process Sports Betting, unlock slots, crash games, and live casino, and calculate results;
• Financial processing: process deposits via Pix, PicPay, Mercado Pago, bank slip, and card; process withdrawals via Pix; maintain transaction history for auditing purposes;
• Identity verification (KYC): confirm that you are 18 years of age or older, that your information is accurate, and that your account complies with anti-money laundering (AML/CFT) requirements;
• Security and fraud prevention: detect and block unauthorized access, identify suspicious behavioral patterns, and protect your account from misuse;
• Compliance with legal obligations: meet regulatory requirements in the betting industry, comply with court orders, and report suspicious activity to the relevant authorities when required by law;
• Customer support: respond to your questions, resolve complaints, and maintain service history to ensure continuity and quality of support;
• Responsible gambling: monitor usage patterns that may indicate problematic behavior and trigger responsible gambling protocols when necessary;
• Communications and marketing: send you information about 11pp promotions, bonuses, and news, provided you have opted in to receive such communications. You may opt out at any time in your account settings.

11pp uses anonymized, aggregated activity data to improve the platform, understand which sports and games are most popular among Brazilian users, and optimize the live betting experience. The data analyzed is statistical in nature and does not identify individual users.

The LGPD requires that all personal data processing have a legal basis. 11pp grounds the processing of each data category in the following legal bases set out in Articles 7 and 11 of Law No. 13,709/2018:

• Contract performance (art. 7, V): data required to operate your account, process bets, manage payments via Pix, and deliver all platform services you agreed to upon registration;
• Compliance with a legal or regulatory obligation (art. 7, II): data required to comply with Law No. 14,790/2023 (the Brazilian Betting Legal Framework), AML/CFT regulations, and the requirements of the Secretaria de Prêmios e Apostas (SPA);
• Legitimate interest (Art. 7, IX): activity and technical data used to prevent fraud, ensure platform security, and improve the user experience — always balanced against the interests of 11pp and the rights of data subjects;
• Consent (art. 7, I): sending marketing communications and using non-essential cookies — categories for which 11pp requests your explicit consent, which you can withdraw at any time.

11pp never sells your personal data to third parties. Sharing only occurs in the specific situations below, always limited to the minimum necessary data and governed by contractual confidentiality obligations:

• Payment processors: companies responsible for processing Pix, PicPay, Mercado Pago, boleto bancário, and credit/debit card transactions. These partners receive only the data strictly necessary to process each transaction and are contractually prohibited from using that information for any other purpose;
• Game providers: slots, crash games, and live casino studios that provide the games available on 11pp. They receive anonymized session identifiers to process game outcomes — they do not receive users' full personal data;
• Security service providers: companies specialized in fraud detection and anti-money laundering, which analyze transaction patterns to identify suspicious activity in accordance with legal requirements;
• Authorities and regulatory bodies: when required by law, court order, or request from a competent authority (such as the Receita Federal, the Banco Central, or the Secretaria de Prêmios e Apostas). In such cases, 11pp shares only the information specifically requested;
• Technology infrastructure: cloud service and infrastructure providers that store platform data. These providers operate as data processors under the LGPD and are bound by contracts that prohibit the use of data for any purpose beyond delivering the contracted service.

All partners with access to 11pp user data undergo a privacy assessment before any integration and are subject to periodic compliance audits. If a partner fails to meet the required standards, the contract is terminated.

11pp uses cookies and similar technologies to enhance your experience on the platform. Cookies are small text files stored on your device — mobile, desktop, or tablet — that allow the platform to remember your preferences and keep your session active.

The cookies used by 11pp fall into three categories:

• Essential cookies: required for the basic operation of the platform. These include authentication cookies (which keep you logged in during a session), security cookies (which detect fraudulent access attempts), and responsible gambling preference cookies. These cookies cannot be disabled without affecting account functionality;
• Performance cookies: collect anonymized data on how users navigate the platform — which pages are visited most, how long sessions last, and which features are used most often. This data helps 11pp improve the experience but does not identify individual users;
• Marketing cookies: used to personalize relevant communications and ads. These cookies are only activated with your explicit consent. You may withdraw that consent at any time in your account settings under "Privacy Preferences".

11pp does not use third-party tracking pixels for advertising retargeting outside the platform without prior consent. When you create your account, you are informed about the cookies in use and can manage your preferences in a granular way.

11pp applies robust technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or any form of improper processing. Our key security measures include:

• SSL/TLS encryption: all communications between your device and 11pp's servers are encrypted using the latest SSL/TLS protocols — the same standard used by banks like Nubank, Itaú, and Bradesco;
• Encryption of data at rest: sensitive data such as your CPF, banking details, and verification documents are stored in encrypted format on our servers, even at rest;
• Access control: only employees with a legitimate need have access to user data, and that access is controlled by multi-factor authentication and full audit logs;
• 24-hour monitoring: 11pp's systems are continuously monitored by intrusion detection tools. Any anomalous activity triggers immediate alerts to the security team;
• Regular backups: data undergoes regular backup processes with storage across geographically separate locations, ensuring availability even in the event of technical incidents;
• Security testing: 11pp's infrastructure undergoes periodic penetration testing carried out by independent specialized firms.

In the event of a security incident involving users' personal data — such as a data breach — 11pp will notify affected users and the National Data Protection Authority (ANPD) within the timeframes established by the LGPD.

The servers that store 11pp user data are located in Brazil or in countries with data protection laws equivalent to or stronger than the LGPD. No international data transfers are made to countries without an adequate level of protection unless specific contractual safeguards are in place.

11pp retains your personal data only for as long as necessary to fulfill the purposes stated in this policy or to meet legal obligations. The main retention periods are:

• Active account data: retained for as long as your account remains active on the platform;
• Financial and betting data: retained for a minimum of 5 years after account closure, as required by Brazilian tax and anti-money laundering legislation;
• KYC verification documents: retained for a minimum of 5 years after account closure, as required by betting industry regulations;
• Support communication records: retained for 2 years after account closure or last contact, for the purpose of resolving any potential disputes;
• Technical data (access logs, IPs): retained for 6 months, as required by the Brazilian Internet Civil Rights Framework (Law No. 12.965/2014);
• Permanent self-exclusion data: retained indefinitely to ensure that the permanent block remains effective and that a new registration using the same data is prevented.

Once the applicable retention period ends, data is securely deleted or irreversibly anonymized so that it can no longer be linked to any specific user.

The LGPD grants you a set of rights over your personal data. 11pp is committed to fulfilling all rights-exercise requests within the legal deadline. See each right and how to exercise it:

To exercise any of your rights, contact the 11pp DPO by email at contato@11pp.click with the subject line "LGPD Rights Request" or access your account settings under "Privacy & Data". We will respond within 15 business days. In more complex situations, this deadline may be extended by an additional 15 days, and you will be notified of the reason for the extension.

If you believe your data is being processed in violation of the LGPD or this Privacy Policy, you have the right to file a complaint with the National Data Protection Authority (ANPD) — the regulatory body responsible for enforcing the LGPD in Brazil.

The 11pp platform is strictly prohibited for users under 18 years of age. 11pp does not knowingly collect personal data from minors. The registration process includes date-of-birth verification, and all accounts go through identity verification before withdrawals are approved.

If you believe a person under 18 has created an account on 11pp, please contact us immediately via live chat or at contato@11pp.click. The account will be investigated and, if the user is confirmed to be a minor, it will be closed and all of their personal data will be deleted from our systems within 30 days.

11pp may periodically update this Privacy Policy to reflect changes in Brazilian data protection law, our data processing practices, or the services offered on the platform. When there are significant changes — especially those affecting your rights or how we use your data — we will notify you by email at least 7 days in advance.

For minor changes — such as wording adjustments or clarifications that do not materially alter the content — publishing the new version on the platform with the updated date is sufficient. The date of the last update will always be visible at the top of this page.

Continued use of the platform after a new version of this Policy is published constitutes acceptance of the updated terms. If you disagree with any changes, you may close your account before the new version takes effect.

For any questions about privacy, data protection, or exercising your rights under the LGPD, you can reach 11pp through the following channels:

• DPO email: contato@11pp.click — use the subject line "Privacy – LGPD" for automatic prioritization;
• Live chat: available 24 hours a day, 7 days a week, on the platform — for urgent privacy matters or suspected data breaches;
• Account settings: many privacy requests — such as revoking marketing consent, managing cookies, and exporting data — can be completed directly through your account settings without needing to contact support.

The response time for formal LGPD rights requests is up to 15 business days from the date of receipt. For general privacy-related support questions, live chat resolves most inquiries in real time.