Lucky3 Privacy Policy – Data Protection

The Lucky3, operated under the domain lucky3.click, is the controller of the personal data of users registered on the platform, as defined by art. 5, item VI, of the LGPD (Law No. 13.709/2018). This means we are the ones who decide what data to collect, for what purpose, and how long to retain it.

Our Data Protection Officer (DPO) is the point of contact for any questions related to privacy, data subject rights, or security incidents. You can reach the DPO directly at privacidade@lucky3.click.

This Privacy Policy applies to all services offered by Lucky3: Sports Betting, live casino, roulette, poker, the VIP Program, and any auxiliary features accessed through lucky3.click or the official mobile app.

Lucky3 collects only the data strictly necessary to provide its services and meet its legal obligations. The categories of data processed are:

Personal data processed by Lucky3 is collected in the following ways:

• Directly by the user: at the time of registration, while filling out your profile, when making deposits or withdrawals via Pix or another method, and when contacting support.
• Automatically during platform use: technical data such as IP address, device type, operating system, and browsing behavior are automatically collected via cookies and server logs at each session.
• During the identity verification (KYC) process: when required by law or by internal fraud and anti-money laundering policies, we request additional documents, which are reviewed and stored securely.
• Through payment partners: when making a deposit via Pix, boleto bancário, PicPay, or Mercado Pago, payment partners share with Lucky3 only the minimum data necessary to confirm the transaction and link the deposit to the correct account.
• From public or regulatory sources: in compliance with legal anti-money laundering obligations (COAF/BACEN), we may consult public databases to verify the identity and financial background of users in specific situations.

Lucky3 uses the personal data collected solely for the purposes listed below. Each purpose has a corresponding legal basis, detailed in Section 5.

• Account creation and management: verify user identity, create the account, keep the profile up to date, and ensure secure access to the platform.
• Financial transaction processing: receive deposits via Pix, boleto bancário, credit or debit card, PicPay, and Mercado Pago; process withdrawals via Pix to Nubank, Itaú, Bradesco, Banco do Brasil, and other Brazilian banks; and issue transaction receipts.
• Provision of betting and gaming services: record sports bets, manage account balance, calculate results for casino games, roulette, poker, and all other formats available on the platform.
• Fraud prevention and anti-money laundering: monitor atypical behavioral patterns, verify the source of funds, and fulfill legal reporting obligations to COAF and the Banco Central do Brasil.
• Responsible gambling: identify risky behavior patterns, enforce user-configured limits, and trigger protective mechanisms as set out in our responsible gambling policies.
• Service communication: send mandatory transactional notifications by email and SMS — deposit confirmations, withdrawal alerts, account updates, and regulatory notices.
• Personalized marketing: marketing offers and promotions are sent by email or push notification only if the user has opted in to receive marketing communications. This consent can be withdrawn at any time from the account dashboard.
• Legal obligation compliance: to comply with court orders, regulatory requirements, or requests from Brazilian tax authorities requiring the disclosure of specific data.

The LGPD requires that all personal data processing have a legal basis set out in art. 7 of the law. Lucky3 operates under the following legal bases, according to the purpose of each processing activity:

• Contract performance (art. 7, V): the processing of identification, contact, and financial data is necessary to perform the contract entered into with the user at the time of registration — without this data, it is not possible to create an account, process deposits, or pay out withdrawals.
• Legal obligation compliance (art. 7, II): KYC data, transaction history, and information required to meet anti-money laundering obligations (Law No. 9,613/1998) and betting regulation (Law No. 13,756/2018) are processed on the basis of this legal ground.
• Legitimate interest (Art. 7, IX): technical and behavioral data collected automatically (IP, device, browsing history) is processed on the basis of Lucky3's legitimate interest in ensuring platform security, preventing fraud, and improving the user experience — provided this does not prejudice the data subject's fundamental rights.
• Consent (art. 7, I): sending personalized marketing communications requires the user's explicit consent, which may be revoked at any time without any impact on access to the platform.

Lucky3 shares personal data with third parties only in the situations listed below, always with appropriate safeguards and on the basis of a contract or legal obligation:

• Payment processors: to process deposits and withdrawals via Pix, boleto bancário, credit or debit card, PicPay, and Mercado Pago, we share the minimum necessary data with certified payment operators. These operators act exclusively as data processors and may not use the information for their own purposes.
• Cloud infrastructure providers: Lucky3's servers and storage systems are operated by cloud providers that access data solely for technical hosting purposes, under confidentiality agreements and LGPD compliance contracts.
• Casino game providers: to provide slots, live roulette, blackjack, and other games, we share with casino software providers only the session data strictly required for gameplay — with no identity or financial data beyond an anonymous session identifier.
• Authorities and regulatory bodies: we share data with the Ministério da Fazenda, COAF, Banco Central do Brasil, ANPD, Receita Federal, and judicial authorities when required by law, court order, or regulatory directive. In such cases, sharing is mandatory and does not depend on the data subject's consent.
• Identity verification services (KYC): to verify documents submitted during the KYC process, we may use partners specialized in biometric and document verification, under a data processing agreement in compliance with the LGPD.

Lucky3 uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and meet security obligations. The types of cookies used are:

• Essential cookies: required for the basic operation of the platform — session management, authentication, and security. These cannot be disabled without affecting access to your account.
• Performance cookies: collect anonymous data on how users navigate the platform (pages visited, session duration, errors encountered) to optimize performance and identify technical issues.
• Functional cookies: store user preferences such as language, odds display settings, and preferred game to personalize the experience across sessions.
• Marketing cookies: used only with the user's consent to personalize offers and promotions displayed within the platform. These can be disabled via the cookie consent banner or the account preferences panel.

You can manage your cookie preferences at any time through your account dashboard or via the consent banner displayed on your first visit. Disabling essential cookies will affect the platform's functionality.

Lucky3 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, in compliance with mandatory legal retention periods. The main timeframes are:

• Active account data: retained for the full duration of the account and for up to 5 years after closure, in accordance with the requirements of the Brazilian Civil Code and applicable tax legislation.
• Financial transaction history: retained for 10 years after the transaction, in accordance with anti-money laundering obligations (Lei nº 9.613/1998) and Banco Central do Brasil regulations.
• KYC Documents: retained for 5 years after account closure or after the last transaction that prompted the collection, in accordance with COAF/BACEN regulations.
• Access and security logs: retained for 6 months, pursuant to art. 15 of the Marco Civil da Internet (Law No. 12.965/2014).
• Marketing and communication data: retained until the user revokes consent or requests deletion. After revocation, data is removed within 30 days.

Once the applicable retention period expires, data is permanently deleted or irreversibly anonymized, with no possibility of identifying the account holder.

Lucky3 implements a comprehensive set of technical and organizational measures to protect users' personal data against unauthorized access, loss, destruction, or improper disclosure:

• Encryption in transit: all communication between the user's device and Lucky3's servers is protected by TLS 1.3 with 256-bit encryption.
• Encryption at rest: sensitive data stored in our databases — including CPF, financial data, and KYC documents — is encrypted at rest using AES-256.
• Two-factor authentication (2FA): available and strongly recommended for all users, adding an extra layer of protection to account access.
• Role-based access control: Lucky3 employees only access the data required for their specific roles, with all access recorded, audited, and reviewed on a regular basis.
• Periodic penetration testing: Lucky3's infrastructure undergoes security testing conducted by independent external teams to identify and remediate vulnerabilities before they can be exploited.
• Continuous monitoring: intrusion detection systems and anomaly monitoring operate 24 hours a day to identify suspicious activity in real time.

Despite all measures in place, no system is 100% immune to risk. In the event of a security incident affecting your data, Lucky3 will notify the ANPD and the affected data subjects within the legally required timeframe, with full details of what occurred and the corrective actions taken.

The LGPD grants you, as the data subject, the following rights, all of which can be exercised directly through the account dashboard or by email to privacidade@lucky3.click:

Lucky3 services are intended exclusively for individuals aged 18 years of age or older. The platform does not intentionally collect personal data from minors. Registration requires a CPF, which is verified for age eligibility during the account creation process.

If we become aware that we have inadvertently collected data from a minor, we will close the account and permanently delete all related data immediately, at no cost to the legal guardian. Suspected cases of underage use should be reported to suporte@lucky3.click.

Guardians of minors who have accessed the Lucky3 platform without authorization should contact support immediately so that access can be blocked and data deleted as a priority.

In certain operational situations, users' personal data may be transferred to servers located outside Brazil — primarily due to the use of global cloud infrastructure by providers such as AWS, Google Cloud, or Microsoft Azure, whose data centers are distributed internationally.

When international transfers occur, Lucky3 ensures that:

• The destination country provides an adequate level of data protection, as assessed by the ANPD, or
• Standard contractual clauses approved by the ANPD are adopted to ensure that data subjects retain the same rights provided under the LGPD, or
• The transfer is necessary for the performance of the contract with the data subject (such as in the case of international payment processing).

Lucky3 prioritizes infrastructure based in Brazil whenever technically feasible and economically viable, in order to minimize international data transfers for its Brazilian users.

This Privacy Policy may be updated periodically to reflect changes in legislation, our data processing practices, or the services we offer. When that happens:

• The user will be notified by registered email at least 7 days in advance before the new version takes effect.
• A prominent notice will be displayed on the platform during the transition period.
• The update date and version number will be updated in the header of this page.
• Changes that broaden the scope of data processing or modify the applicable legal bases will require new user consent when consent is the legal basis.

The version currently in effect is always the one published on this page. Version history can be requested by emailing the DPO at privacidade@lucky3.click.

To exercise your rights as a data subject, ask questions about this policy, or report a privacy incident, please use the channels below:

• Data Protection Officer (DPO): privacidade@lucky3.click — for matters related to data subject rights, security incidents, and LGPD compliance.
• General support: suporte@lucky3.click or via live chat within the platform, available 24 hours a day, 7 days a week, in Brazilian Portuguese.
• Autoridade Nacional de Proteção de Dados (ANPD): if you are not satisfied with Lucky3's response to the exercise of your rights, you have the right to file a complaint directly with the ANPD, the federal authority responsible for enforcing the LGPD in Brazil.

We are committed to responding to all privacy-related requests within 15 calendar days, with the possibility of a justified extension of up to 15 additional days in highly complex cases.