5h5h Privacy Policy – Data Protection

The 5h5h, accessible at 5h5h.best, is the platform responsible for processing the personal data described in this Policy. For the purposes of the General Data Protection Law (LGPD – Law No. 13,709/2018), the 5h5h acts as the data controller for its users — meaning it decides how and why this information is processed.

The official channel for exercising rights related to personal data or for any questions about this Policy is the email suporte@5h5h.best. We respond to all requests within 24 business hours. For more complex matters requiring in-depth technical or legal review, the deadline may extend to up to 15 calendar days, as provided under the LGPD.

This Privacy Policy applies to all users registered on the platform 5h5h, including users of Sports Betting (Brasileirão, Copa do Brasil, Libertadores, MMA/UFC, NBB), Live Casino, slots, crash games, poker, and any other service made available on the platform, now or in the future.

The 5h5h collects personal data at different points throughout your journey on the platform. Below, we list the data categories and when each one is collected:

The 5h5h does not collect sensitive data such as racial origin, religious belief, genetic data, biometric data, or health information, except where expressly required by law or a specific regulatory obligation. The platform will never ask for your bank password or access to third-party bank accounts.

The 5h5h uses collected data exclusively for the purposes described below. Any use beyond these purposes requires your explicit consent or a new legal basis:

• Account operation: create and maintain your account, process authentications, manage responsible gambling limits, and personalize your experience on the platform;
• Financial transaction processing: process deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago, and execute withdrawals to the bank account or Pix key registered in your name;
• Identity Verification (KYC): confirm your identity, verify legal age (18+), and comply with anti-money laundering (AML) and counter-terrorism financing (CTF) obligations, as required by Brazilian law;
• Customer support: answering questions, resolving technical issues, handling complaints, and continuously improving customer service;
• Security and fraud prevention: detecting unauthorized access, identifying fraudulent behavior, preventing money laundering, and protecting the integrity of the platform;
• Service communications: send notifications about transactions, terms updates, account changes, and security information;
• Marketing (with consent): send promotions, bonus offers, and platform news, but only to users who have opted in to receive marketing communications. You can opt out at any time;
• Product Improvement: analyze aggregated and anonymized usage patterns to improve the experience, identify bugs, and develop new features;
• Legal Compliance: fulfill tax obligations, comply with court orders, and respond to requests from competent authorities.

The 5h5h always processes your personal data on the basis of one of the legal grounds set out in the LGPD (Art. 7). For each processing purpose, the applicable legal basis is:

• Contract performance: processing required to create and maintain your account, handle bets, and carry out deposits and withdrawals via Pix — without this data, the service simply cannot function;
• Legal obligation: identity verification (KYC), retention of financial records, and anti-money laundering reporting are required by law, regardless of your consent;
• Legitimate interest: fraud detection, unauthorized access prevention, security analysis, and product improvement using anonymized data — purposes that protect both the user and the integrity of the platform;
• Consent: marketing communications, non-essential cookies, and any use of data that does not fall within the categories above. You may withdraw this consent at any time without affecting your access to other services.

Where processing is based on consent, the 5h5h obtains this consent in a clear, specific, and documented manner — never through pre-ticked boxes or ambiguous wording. Withdrawing consent does not affect the lawfulness of any processing carried out prior to that withdrawal.

The 5h5h does not sell, rent, or trade your personal data. Sharing occurs only in the situations described below, always with appropriate safeguards in place:

• Payment processors: only the minimum financial data required is shared with the institutions responsible for processing Pix, credit/debit cards, PicPay, and Mercado Pago to execute your transactions. All payment partners are regulated by the Central Bank of Brazil;
• Identity verification services (KYC): documents provided for verification may be processed by partners specialized in regulatory compliance, always under a data processing agreement that guarantees the same level of protection set out in this Policy;
• Technology Providers: cloud infrastructure, transactional email services, and customer support tools operate as sub-processors with restricted, controlled access to only the data required for each specific function;
• Legal authorities: the 5h5h complies with court orders and requests from the Public Prosecutor's Office, the Federal Revenue Service, COAF (Financial Activities Control Council), and other competent authorities as required under Brazilian law;
• Casino game providers: for live games, a minimal set of session data is shared with the game provider to ensure correct table operation. No financial or full identification data is transferred to game providers.

The 5h5h uses cookies and similar technologies to ensure the platform works correctly and to enhance your experience. The types of cookies used are:

• Essential cookies: required for the basic operation of the platform — login sessions, language preferences, and account settings. They cannot be disabled without affecting your use of the service;
• Performance Cookies: collect anonymized data on how the platform is used — which pages are accessed most, average session duration, and technical errors encountered. Used exclusively to improve the product;
• Functionality cookies: remember preferences such as selected betting filters, notification settings, and chosen language to make future visits faster and more seamless;
• Analytics cookies: with your consent, we use analytics tools to understand usage patterns on an aggregated basis. This data does not identify you individually.

You can manage your cookie preferences at any time in your account settings or your browser settings. Disabling essential cookies may affect the functionality of parts of the platform. The 5h5h does not use third-party advertising cookies or fingerprinting technologies for cross-site tracking.

The security of user data is a technical priority for the 5h5h, not a checklist item. The measures implemented include:

• 256-bit SSL/TLS Encryption: all communication between your device and the servers of 5h5h is encrypted, including login credentials, financial transactions, and verification documents;
• Encryption at rest: sensitive data stored on our servers is encrypted with AES-256, including KYC documents and payment data;
• Two-factor authentication (2FA): available to all users as an additional layer of account protection;
• Real-time fraud monitoring: automated systems monitor suspicious access, multiple login attempts, and anomalous transaction behavior 24 hours a day;
• Internal access control: employees of the 5h5h have access only to the data required for their specific roles. Access to financial data and personal documents is restricted, audited, and logged;
• Regular Security Testing: the infrastructure undergoes periodic penetration testing and security audits carried out by specialized teams.

In the event of a security incident that may affect your personal data, the 5h5h will notify you and the National Data Protection Authority (ANPD) within the timeframes set out in the LGPD — in situations of significant risk, notification occurs within 72 hours of becoming aware of the incident. You will be contacted via the email address registered on your account, with clear guidance on the steps to take.

The 5h5h retains personal data only for as long as necessary for each specific purpose. General retention periods are:

• Account and identification data: retained while the account is active and for up to 5 years after closure, in accordance with tax and anti-money laundering obligations under Brazilian law;
• Financial transaction records: retained for 5 years from the transaction date, as required by the Receita Federal and COAF;
• KYC Documents: retained for the duration of the active account plus 5 years, or as otherwise directed by a competent authority;
• Usage and preference data: retained for as long as the account remains active. After closure, data is anonymized within 90 days;
• Support communications: kept for 2 years after the interaction is closed, for potential dispute resolution;
• Marketing data (with consent): retained until consent is withdrawn or the account is closed, whichever comes first.

Once the applicable retention period expires, data is securely deleted or anonymized so that the holder can no longer be identified. User requests for data deletion are handled in accordance with mandatory minimum legal timeframes — the 5h5h cannot delete data that the law requires to be retained.

The LGPD grants you, as the data subject, a set of rights that 5h5h respects and facilitates the exercise of these rights. To exercise any of them, send an email to suporte@5h5h.best with the subject line "LGPD Rights" and a clear description of your request. We respond within 15 business days.

The 5h5h is a platform intended exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. The registration process requires age confirmation and includes CPF verification and, in some cases, supporting documentation.

If the 5h5h identifies that data from a minor was inadvertently collected — through a false age declaration during registration — the account will be immediately blocked, the data will be securely deleted, and any balance in the account will be held for review in accordance with applicable legal obligations. Legal guardians who identify unauthorized registrations of minors should notify us at suporte@5h5h.best.

Some of the technology partners of the 5h5h — such as cloud infrastructure providers and certain live casino game providers — operate servers located outside Brazil. When your data is transferred abroad, the 5h5h adopts the measures required by the LGPD to ensure that the level of protection is equivalent to that applied in Brazil:

• Data processing agreements with standard protection clauses approved by the ANPD or equivalent international standards;
• Transfers carried out only to countries with regulations equivalent to the LGPD or subject to an adequacy assessment;
• Minimizing data transferred to only what is strictly necessary for each operation;
• Regular audits of international partners to ensure ongoing compliance.

All financial transactions — deposits via Pix, boleto, credit/debit card, PicPay, and Mercado Pago — are processed within infrastructure regulated by the Banco Central do Brasil, with no banking data transferred outside the country.

The 5h5h may update this Privacy Policy periodically to reflect changes in data processing practices, new legal requirements, or improvements in transparency for users. The "last updated" date at the top of the document indicates when the current version took effect.

Material changes — those affecting data subjects' rights, introducing new processing purposes, or modifying the scope of data sharing — will be communicated by email and via an in-platform notification at least 15 (fifteen) days in advance. For changes required by law or by a regulatory authority, notice may be given at the same time the change takes effect.

We recommend reviewing this Policy periodically. The current version will always be available at 5h5h.best/privacy-policy. Continued use of the platform after the effective date of any changes constitutes acceptance of the updated Policy.

To exercise your rights as a data subject, ask questions about this Policy, or report any concern related to data processing by the 5h5h, use the channels below:

• General Support Email: suporte@5h5h.best — support in Portuguese, 24 hours a day, 7 days a week;
• Subject line for LGPD requests: use the subject line "LGPD Rights – [briefly describe your request]" for prioritization;
• Response time: up to 24 hours for receipt confirmation; up to 15 calendar days for a final response in accordance with the LGPD.

If you are not satisfied with the response from the 5h5h to a personal data-related request, you have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the public body responsible for enforcing the LGPD in Brazil. Information on how to contact the ANPD is available on the official federal government portal.