Privacy Policy of 39hh – Data Protection

The 39hh is a Sports Betting and online casino platform operated for the Brazilian market, accessible at https://39hh.best. For the purposes of this Privacy Policy and the General Data Protection Law (Lei nº 13.709/2018 — LGPD), 39hh acts as controller of personal data of registered users on the platform.

The controller is responsible for decisions regarding the processing of personal data collected and must ensure that such processing always complies with applicable law, based on legitimate and transparent purposes.

This Privacy Policy applies to all 39hh users — site visitors, registered users, former users, and anyone whose data was collected during interaction with the platform. For privacy inquiries or to exercise your rights as a data subject, please contact us at privacidade@39hh.best.

39hh collects personal data in different ways depending on how users interact with the platform. The categories of data collected and how each is obtained are described below:

Data provided directly by the user at registration:

• Full name
• CPF (Cadastro de Pessoa Física)
• Date of birth
• Full residential address (street, number, unit, neighborhood, city, state, ZIP code)
• Email address
• Brazilian mobile number
• Account password (stored in encrypted format — never as plain text)

Data collected during platform use:

• Betting history, transactions, and platform activity
• Device data: device type, operating system, browser version, unique device identifier
• Connection data: IP address, access date and time, pages visited, session duration
• Approximate geolocation data derived from IP address
• Betting preferences and favorite sports markets

Financial data collected to process payments:

• Pix key (CPF, email, phone number, or random key)
• Credit and debit card data (processed by PCI DSS-certified intermediaries — 39hh does not store full card numbers)
• Bank account details for TED transfers (bank, branch, account number)
• Deposit and withdrawal history

Communication data:

• Content from conversations with our customer support team via live chat
• Emails exchanged with the 39hh team
• Responses to satisfaction surveys or contact forms

Personal data collected by 39hh is used exclusively for the following purposes:

39hh may send marketing communications by email or mobile about promotions, bonuses, and platform news. You can opt out at any time by clicking "unsubscribe" in the footer of our emails or by contacting support. Opting out of marketing does not affect essential transactional communications related to your account.

All personal data processing carried out by 39hh is grounded in one or more legal bases established by the LGPD (Law No. 13,709/2018). The legal bases used by 39hh are:

• Contract performance (Art. 7, V): Processing is required to deliver the services contracted by the user upon creating their 39hh account — including registration, betting, Pix payment processing, and customer support.
• Compliance with a legal obligation (Art. 7, II): 39hh is subject to legal and regulatory obligations that require the collection and retention of certain data, particularly for anti-money laundering purposes (Lei nº 9.613/1998) and identity verification.
• Legitimate interest (Art. 7, IX): 39hh processes data for fraud prevention, platform security, continuous service improvement, and performance analysis — always upholding the fundamental rights of data subjects.
• Consent (Art. 7, I): For marketing communications and the use of non-essential cookies, processing is based on your explicit consent, which may be withdrawn at any time.

39hh does not sell personal data of users to third parties and does not share it for third-party advertising or commercial purposes. Data sharing only occurs in the following situations, always limited to the minimum necessary:

• Payment processors: Financial data is shared with certified payment intermediaries to process transactions via Pix, credit and debit card, PicPay, and Mercado Pago. These partners act as data processors under contract with 39hh and comply with PCI DSS security standards.
• Technology service providers: 39hh uses cloud infrastructure providers and essential technology services to operate the platform. These providers access only the data required for their specific functions and are bound by confidentiality agreements.
• Casino game providers: For the live casino and slots sections, minimal session data is shared with game providers to enable connection to live tables. These providers do not have access to full financial data.
• Competent authorities: 39hh may be required by law, court order, or regulatory authority to share user data in investigations involving money laundering, fraud, or other unlawful activity. Any such disclosure is made strictly within the limits required by law.
• Fraud prevention: In cases of suspected fraud or abusive behavior, data may be shared with specialized fraud detection services to protect the integrity of the platform and its users.

All third parties that receive data from 39hh are contractually required to handle that information with confidentiality and security, using it solely for the specific purpose for which it was shared.

39hh implements robust technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, or improper disclosure. The key security measures in place are:

• 256-bit SSL/TLS encryption: All communication between your device and 39hh's servers is protected with bank-grade encryption — the same standard used by Itaú, Bradesco, Banco do Brasil, and Nubank.
• Data-at-rest encryption: Sensitive data stored on 39hh servers, including passwords and financial information, is encrypted. Passwords are stored exclusively as irreversible hash values (bcrypt).
• Role-based access control: Only 39hh staff with a verified business need have access to users' personal data, and all such access is logged and regularly audited.
• 24/7 security monitoring: The platform uses intrusion detection systems and continuous monitoring for suspicious activity across servers and user accounts.
• Two-factor authentication: 39hh offers two-factor authentication to strengthen account security. We strongly recommend that all users enable this feature.
• Certified cloud infrastructure: 39hh's servers are hosted with cloud providers that hold internationally recognized security certifications.

Despite all measures in place, no security system is completely infallible. In the event of a security incident that may affect your data, 39hh will notify impacted users and the National Data Protection Authority (ANPD) within the timeframes required by the LGPD.

39hh uses cookies and similar technologies to enhance the user experience, ensure the platform functions correctly, and carry out performance analytics. The types of cookies used are:

• Essential cookies: Required for basic platform functionality — they keep your session active, remember your language preferences, and ensure secure login. They cannot be disabled without affecting your use of 39hh.
• Performance and analytics cookies: These collect information about how you use the platform — pages visited, time spent, errors encountered. Data is aggregated and anonymized for service improvement purposes.
• Functionality cookies: They store your platform preferences — such as favorite sports and odds display settings — to personalize your 39hh experience.
• Marketing cookies: Used to display relevant promotions within the 39hh platform itself. 39hh does not use cross-site tracking cookies for third-party advertising.

You can manage your cookie preferences in your browser settings. Please note that disabling essential cookies may prevent the platform from functioning properly. For more information on managing cookies in different browsers, consult your browser's help section.

39hh retains your personal data only for as long as necessary for the purposes described in this policy or as required by law. The general retention periods are:

• Active account data: Retained for as long as the account is active and for up to 5 years after closure, in accordance with compliance and anti-money laundering requirements.
• Financial transaction history: Retained for a minimum of 5 years after each transaction, as required by Brazilian anti-money laundering legislation (Law No. 9,613/1998).
• Support communication data: Chat conversations and emails retained for 2 years for quality assurance and dispute resolution purposes.
• Access and security logs: Retained for 6 months, in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014).
• Marketing data: Retained until the user withdraws consent or closes their account, whichever comes first.

Once the applicable retention period has ended, data is securely deleted or anonymized so that the individual can no longer be identified.

As the data subject whose personal data is processed by 39hh, the LGPD grants you the following rights, which you may exercise at any time by emailing privacidade@39hh.best:

To exercise any of these rights, send a request to privacidade@39hh.best with the subject line "LGPD Rights – [your name]" and a brief description of your request. 39hh will respond within 15 calendar days. For complex requests, this period may be extended by an additional 15 days, with prior notice to the data subject.

39hh is a platform exclusively intended for users aged 18 and over. We do not intentionally collect personal data from anyone under 18. The registration process requires CPF verification and date of birth confirmation specifically to prevent minors from accessing the platform.

39hh treats the protection of minors as a top priority and cooperates with competent authorities in any investigation related to unauthorized access by minors to the platform.

39hh may update this Privacy Policy periodically to reflect changes in data processing practices, applicable law, or the services offered. Material changes will be communicated via:

• Email notification sent to the address registered on the account.
• A notice displayed on the platform at least 7 days before the changes take effect.
• Updating the "Last updated" date at the top of this page.

Continued use of the platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you may close your account and request deletion of your data before the effective date.

The version currently available on this page is always the one in effect. Previous versions may be requested by emailing privacidade@39hh.best.

For any questions, requests to exercise your rights, or complaints regarding the processing of personal data by 39hh, you may reach us through the channels below:

• DPO (Data Protection Officer) email: privacidade@39hh.best
• Customer support (general account queries): Live chat on the platform or suporte@39hh.best

39hh is committed to responding to privacy-related requests within 15 calendar days. For complaints that cannot be resolved internally, you have the right to file a petition with the National Data Protection Authority (ANPD), the federal authority responsible for enforcing the LGPD in Brazil.