Rio234 Privacy Policy – LGPD Data Protection

1. Personal Data Controller

A rio234 is the controller of the personal data collected and processed through the platform available at rio234.best. As the data controller, rio234 is responsible for decisions regarding how and for what purposes your information is processed, as defined by the LGPD.

For any questions regarding the processing of your personal data, you can reach us directly at privacidade@rio234.best or through the 24/7 support chat available on the platform. The rio234 Data Protection Officer (DPO) is responsible for receiving and responding to requests related to user privacy.

2. What Personal Data We Collect

A rio234 collects only the data strictly necessary to provide its services, ensuring you can bet, deposit, withdraw, and enjoy all the benefits of the platform safely. Data is categorized as follows:

Data provided directly by you:

• Full name, date of birth, and CPF (required at registration);
• Email address and mobile phone number;
• Full residential address (ZIP code, street, city, state);
• Identity documents submitted for KYC verification (national ID, driver's license, or passport, and proof of address);
• Banking and payment details used for deposits and withdrawals (Pix key, tokenized card data, TED account);
• Information provided through interactions with customer support.

Data automatically generated through use of the platform:

• IP address, device type, operating system, and browser;
• Session data: pages visited, time spent, navigation flow;
• Betting history, deposits, withdrawals, and bonuses used;
• Approximate geolocation data (IP-based, no GPS);
• Access logs and security events for fraud prevention.

3. How We Use Your Personal Data

The data collected by rio234 are used exclusively for the purposes described below. Each use has a corresponding legal basis, as detailed in Section 4:

Rio234 does not use your personal data for purposes beyond those listed above without prior notice and, where applicable, without obtaining fresh consent. Any change of purpose that is incompatible with the original use will be communicated before it takes effect.

4. Legal Basis for Processing (LGPD)

Every personal data processing operation carried out by rio234 has a defined legal basis in accordance with Article 7 of the LGPD. The main legal bases used are:

• Contract performance — processing required to fulfill contractual obligations to the user, such as processing deposits, settling bets, and crediting VIP cashback;
• Legal or regulatory obligation — processing required by applicable Brazilian law, including anti-money laundering regulations (Law No. 9,613/1998) and betting industry rules;
• Legitimate interest — processing required for legitimate rio234 purposes that do not override users' rights and expectations, such as fraud prevention, platform security, and service improvement;
• Consent — for optional processing, such as sending marketing communications and personalized promotions. Consent may be withdrawn at any time without affecting access to the platform's core services.

5. Sharing Data with Third Parties

A rio234 does not sell or transfer users' personal data to third parties for their own commercial purposes. Data sharing occurs only in the following situations, all with clear legal and operational justification:

• Payment processors — to facilitate deposits and withdrawals via Pix, bank slip, credit/debit card, PicPay, Mercado Pago, and TED. These partners receive only the data strictly necessary to process the transaction and are subject to data processing agreements with confidentiality clauses;
• Casino game providers — to ensure the correct operation of slots, Live Casino, and crash games provided by certified third parties. Data sharing is limited to what is necessary for the gaming session;
• Fraud prevention tools — specialized systems that analyze behavioral patterns to identify suspicious activity, always under confidentiality agreements;
• Competent authorities — when required by law, court order, or request from a Brazilian government authority with legal jurisdiction to make such a request;
• Infrastructure service providers — hosting providers, CDN, and IT services that keep the platform running, always under LGPD-compliant data processing agreements.

All third parties that receive rio234 user data are vetted against strict security and privacy criteria and are contractually bound to use the information solely for the agreed purposes, with no independent use for any other purpose permitted.

6. Data Retention and Deletion

A rio234 retains users' personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by Brazilian law:

• Registration and identification data: retained for as long as the account is active and for at least 5 years after account closure, in accordance with anti-money laundering requirements;
• Financial history (deposits, withdrawals, bets): retained for 5 years from the date of each transaction, in accordance with tax and regulatory obligations;
• Security and access logs: retained for 6 months for fraud investigation and security incident purposes;
• Support communications: retained for 2 years for dispute resolution and internal audit purposes;
• Non-essential cookie data: retained for the period defined for each cookie type, never exceeding 2 years.

Once applicable retention periods have expired, data is securely deleted or irreversibly anonymized. Anonymized data is no longer considered personal data and may be used for statistical purposes without restriction under the LGPD.

7. Data Security

Protecting user data is a core technical and operational priority for rio234. The platform implements multiple layers of security to prevent unauthorized access, data leaks, and misuse of information:

• SSL/TLS 256-bit encryption on all communications between the user's device and the platform's servers;
• Passwords stored using irreversible cryptographic hashing — rio234 has no access to any user's password in plain text;
• Two-factor authentication (2FA) available and encouraged for all users;
• Role-based internal access control — staff can only access the data strictly necessary for their responsibilities;
• Continuous monitoring for unauthorized access attempts, SQL injection, and other common attack vectors;
• Regular security testing (penetration testing) carried out by specialized teams;
• Encrypted backups stored on geographically separated infrastructure;
• Security incident response plan with notification to the ANPD and affected users in the event of a data breach, within the timeframes established by the LGPD.

Despite every security measure in place, no system is entirely immune to risk. In the event of a security incident that may compromise your data, rio234 commits to notifying you by email within an appropriate timeframe and to reporting the incident to the National Data Protection Authority (ANPD) as required by law.

8. Cookies and Tracking Technologies

A rio234 uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and — with your consent — personalize content and communications. The types of cookies used are described below:

You can manage your cookie preferences through your browser settings at any time. Disabling non-essential cookies will not affect your access to rio234's core features.

9. Protection of Minors' Data

A rio234 is a platform intended exclusively for users aged 18 and over. We do not knowingly collect, process, or store personal data from minors.

Registration on the platform requires age verification and is linked to a valid CPF. In cases where the platform identifies or is notified that a user may be a minor, the account is preventively suspended for review and the data is processed solely for investigation and deletion purposes.

10. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a data subject, a set of rights that rio234 is fully committed to upholding. You may exercise any of these rights at any time via the support chat or by emailing privacidade@rio234.best:

Rio234 responds to rights requests within 15 business days of receipt, except in cases of greater complexity, which may require up to 30 days with prior justification. Exercising the above rights is free of charge and cannot be made conditional on maintaining or closing your account.

11. International Data Transfers

In some cases, operating the platform may involve processing data on servers or through service providers located outside Brazil — for example, cloud infrastructure providers or casino game suppliers headquartered abroad.

When this occurs, rio234 ensures that any international data transfer is carried out with the appropriate safeguards required by the LGPD, including:

• Transfer to countries or international bodies that provide a level of personal data protection equivalent to that required by the LGPD;
• Specific data protection contractual clauses between rio234 and the international recipient;
• Certifications or seals recognized by the ANPD, where available.

All international data transfer agreements for rio234 are available for review upon request to the Data Protection Officer at privacidade@rio234.best.

12. Changes to This Privacy Policy

A rio234 may review this Privacy Policy periodically to reflect changes in its services, applicable Brazilian legislation, or the platform's security practices. Material changes will be communicated by email at least 7 days before taking effect.

The current version of this Privacy Policy is always the one available on this page, with the last updated date shown at the top of the document. Continued use of the platform after the effective date of any new terms constitutes acceptance of the changes made.

For changes that involve new data processing based on consent, rio234 will request fresh explicit consent before processing begins, with no impact on access to the platform's core services.

13. Data Protection Officer (DPO)

As required by the LGPD, the rio234 has appointed a Data Protection Officer (DPO) responsible for:

• Receive and respond to data subject rights requests;
• Communicate with the National Data Protection Authority (ANPD) when required;
• Guide rio234 staff on data protection best practices;
• Oversee compliance with this Privacy Policy and the LGPD;
• Investigate and respond to security incidents involving personal data.

You can contact rio234's DPO directly at privacidade@rio234.best. The standard response time is up to 5 business days to confirm receipt and up to 15 business days to provide a full response to your request.

For complaints that are not satisfactorily resolved by rio234, you have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD), the federal authority responsible for overseeing LGPD compliance in Brazil.