Privacy Policy – 30wim: How We Protect Your Data

1 Introduction and Data Controller

The controller of the personal data processed under this Policy is the company responsible for operating the 30wim platform. For all purposes under the LGPD, 30wim is the agent responsible for decisions regarding the processing of personal data of users registered in Brazil.

This Policy applies to all users who access the platform, register an account, make deposits or withdrawals via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, or TED transfer, and use any feature of 30wim — including Sports Betting on the Brasileirão, Libertadores, volleyball, MMA/UFC, slots, Live Casino, crash games, and other available categories.

2 Data We Collect

30wim collects only the data necessary to operate the platform, process payments, ensure account security, and meet legal obligations. The categories of data collected are listed below:

2.1 Registration Data

• Full name as shown on official ID.
• CPF (Cadastro de Pessoas Físicas) for identity verification and AML compliance.
• Date of birth to confirm legal age (minimum 18 years).
• Email address for communications and account recovery.
• Mobile number for authentication and important notifications.
• Residential address for KYC verification purposes when required.

2.2 Identity Verification Data (KYC)

• Identity documents (national ID, driver's license, or passport) when required for KYC verification.
• Proof of address issued within the last 90 days.
• Verification selfie to confirm the identity of the account holder.

2.3 Financial Data

• Information about deposits and withdrawals made via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED.
• Pix keys and bank details provided for withdrawals — stored in encrypted form.
• Financial transaction history for compliance and anti-money laundering purposes.

2.4 Platform Usage Data

• Full betting history (events, markets, amounts wagered, and outcomes).
• Browsing preferences and most frequently accessed features.
• IP address and approximate geolocation data for security purposes.
• Device used (type, operating system, browser) and technical session identifiers.
• Access logs with date, time, and actions performed on the platform.

2.5 Communication Data

• Content of conversations held via support chat, for quality and security purposes.
• Emails exchanged with the 30wim team.
• Communication preferences (opt-in and opt-out for notifications and promotions).

3 How We Use Your Data

Data collected by 30wim is used solely for the purposes described below. No data is used for any purpose not listed here without your express consent:

• Account operation: create and manage your account, authenticate access, and personalize your experience on the platform.
• Payment processing: securely process deposits and withdrawals via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED.
• Identity verification (KYC): verify your identity to meet legal obligations and protect your account against fraud.
• Compliance with legal obligations: meet anti-money laundering (AML) requirements, sector regulatory standards, and court orders where applicable.
• Operational communications: send account notifications, terms updates, bet confirmations, and security alerts.
• Promotional communications: send personalized offers, bonuses, and promotions — only to users who have consented to this type of communication. You can opt out at any time.
• Platform improvement: analyze usage patterns to improve the experience, identify and fix technical issues, and develop new features.
• Responsible gambling: monitor betting patterns to identify at-risk behavior and proactively offer support when needed.
• Security and fraud prevention: detect and prevent unauthorized access, result manipulation, bonus abuse, and other irregular activities.

4 Legal Basis (LGPD)

All personal data processing carried out by 30wim is grounded in at least one of the legal bases set out in Article 7 of the LGPD. The main legal bases used are:

• Contract performance (art. 7º, V): processing is necessary to perform the service agreement entered into when you create an account at 30wim — including betting operations, payment processing, and VIP Program management.
• Compliance with a legal obligation (art. 7, II): certain categories of data are processed to comply with legal and regulatory obligations, such as anti-money laundering rules and identity verification requirements under Brazilian law.
• Legitimate interest (art. 7, IX): platform usage data and security logs are processed on the basis of 30wim's legitimate interest in maintaining service security and preventing fraud, always balanced against your rights as a data subject.
• Consent (art. 7, I): promotional communications and direct marketing are sent only with your express consent, which can be withdrawn at any time through your account settings or by contacting support.

5 Data Sharing

30wim shares personal data only in the situations described below, and always with the necessary safeguards in place to protect your information:

5.1 Technology and Payment Partners

To process deposits and withdrawals via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED transfers, 30wim shares only the financial data strictly necessary with the payment service providers integrated into the platform. These partners are contractually required to maintain confidentiality and not use the data for any other purpose.

5.2 Game and Content Providers

Slots, Live Casino, and crash games providers receive only the technical identifiers required to record your bets and results. No personally identifiable data is transmitted to game suppliers.

5.3 Legal Compliance and Authorities

30wim may share data with government, regulatory, or judicial authorities when legally required — for example, in response to court orders, money laundering investigations, or other legal requirements under Brazilian law. In such cases, data is shared only to the extent strictly necessary.

5.4 What We Never Do

• We do not sell personal data to third parties.
• We do not share data for third-party marketing purposes without consent.
• We do not allow partners to use your data outside the scope of the contracted service.

6 Information Security

30wim employs technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or improper destruction. The key measures in place include:

• SSL/TLS Encryption: all communications between your device and the 30wim platform are protected by bank-grade encryption.
• Encryption at rest: sensitive financial data, such as Pix keys and banking details, is stored with encryption across all servers.
• Access control: only staff and systems with a proven operational need have access to personal data, always under audit logging.
• Two-factor authentication: available to all users as an additional layer of security when accessing your account.
• Continuous monitoring: automated systems monitor suspicious access, fraud attempts, and anomalous activity in real time.
• Regular security testing: the platform undergoes regular security assessments to identify and address vulnerabilities before they can be exploited.

Despite all measures in place, no system is 100% breach-proof. In the event of a security incident affecting your personal data, 30wim will take appropriate action and notify affected users within the timeframe required by the LGPD.

7 Data Retention and Deletion

30wim retains your personal data for as long as necessary to fulfill the purposes described in this Policy and to meet applicable legal obligations. The criteria used to determine retention periods include:

• Active account data: retained for as long as your account is active or in regular use on the platform.
• Financial and transaction data: retained for a minimum of 5 years after the last transaction, in compliance with anti-money laundering regulations and Brazilian tax legislation.
• KYC verification data: retained in accordance with the timeframes required by the regulations applicable to the betting and financial services sector in Brazil.
• Security and access logs: retained for up to 12 months for security incident investigation and fraud prevention purposes.
• Support data: support conversations are retained for up to 24 months for quality assurance and dispute resolution purposes.

After account closure, data that does not need to be retained for legal obligations will be deleted or irreversibly anonymized within a reasonable timeframe. To request deletion of your data, contact our support team or the Data Protection Officer (DPO) channel listed in Section 13.

8 Cookies and Tracking Technologies

30wim uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and analyze traffic. The types of cookies used are listed below:

Essential cookies are required for the platform to function and cannot be disabled. For all other types, you can manage your cookie preferences in your browser settings. Disabling functional cookies may affect certain platform features, such as saving preferences between sessions.

9 Your Rights as a Data Subject

The LGPD grants you, as a data subject, a set of rights that 30wim is fully committed to upholding. These rights can be exercised by contacting our support team or our Data Protection Officer (DPO):

To exercise any of these rights, contact us via live chat on the platform or by email at suporte@30wim.click. 30wim will respond within the legal deadline of up to 15 days and may request proof of identity before processing the request.

10 Users Under 18

30wim is a betting and gambling platform intended exclusively for users aged 18 and over. Registration and use of the platform by minors is strictly prohibited and constitutes a violation of 30wim's Terms and Conditions.

30wim does not knowingly collect personal data from users under 18. If we become aware that an account was created by a minor, it will be closed immediately and the associated data deleted, except where retention is required by law.

11 International Data Transfers

Some of the technology services used by 30wim — such as cloud hosting infrastructure and analytics tools — may involve processing data on servers located outside Brazil. When this occurs, 30wim ensures that transfers are carried out in compliance with LGPD requirements, with appropriate safeguards such as:

• Standard data protection contractual clauses with the service providers involved.
• Transfers only to countries recognized by the Autoridade Nacional de Proteção de Dados (ANPD) as providing an adequate level of data protection, where applicable.
• Transfer impact assessments to ensure your data receives a level of protection equivalent to that guaranteed under Brazilian law.

In all cases, internationally transferred data remains subject to the terms of this Privacy Policy and your rights as a data subject guaranteed under the LGPD.

12 Changes to This Policy

30wim may update this Privacy Policy periodically to reflect changes in our services, applicable law, or data processing practices. When significant changes occur that affect your rights or how your data is handled, you will be notified at least 7 days in advance by email and through a notice on the platform.

The date of the last update is always shown at the top of this document. We recommend reviewing this Policy periodically. Continued use of the platform after any changes take effect constitutes acceptance of the updated version.

13 Contact and Data Protection Officer (DPO)

To exercise your rights as a data subject, ask questions about this Policy, or report any concerns regarding the handling of your personal data, please reach out through the following channels:

• Live Chat — available 24 hours a day, 7 days a week, directly on the 30wim platform.
• Support email — suporte@30wim.click, with a response within 24 hours.
• DPO (Data Protection Officer) Email — privacidade@30wim.click, dedicated exclusively to requests related to personal data and the LGPD.
• FAQ Center — visit the FAQ for quick answers about privacy and your data.

Requests from data subjects will be responded to within up to 15 business days from receipt, and may be extended with justification, as provided under the LGPD. For data deletion or portability requests, identity verification may be required before processing.

If you believe your rights as a data subject have not been properly addressed by 30wim, you may also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the regulatory authority responsible for enforcing the LGPD in Brazil.