M9Game Privacy Policy — Your Data, Protected

1. Introduction

Your privacy matters to m9game. This Privacy Policy ("Policy") describes how the m9game platform, operated by M9Game Entretenimento Digital ("m9game", "we", or "platform"), collects, uses, stores, shares, and protects the personal data of users who access the site, create an account, or use any available service — including Sports Betting, live casino, slots, crash games, and other modalities.

This Policy was drafted in compliance with the General Personal Data Protection Law (LGPD — Law No. 13,709/2018) and other applicable Brazilian regulations. By creating an account on m9game or continuing to use the platform after this Policy is published, you confirm that you have read and understood the practices described here.

M9game processes personal data only for legitimate purposes related to platform operations, fraud prevention, compliance with legal obligations, and continuous service improvement. We never sell user data to third parties.

2. Data Controller

For the purposes of the LGPD, the controller of your personal data is the company responsible for operating the m9game platform. The controller defines the purposes and means of processing the data collected on the platform.

M9game maintains a Data Protection Officer (DPO) available to receive requests, answer questions, and log complaints related to personal data processing. To contact m9game's DPO, send an email to privacidade@m9game.best or use the platform's live chat and let the agent know you wish to discuss personal data protection.

3. Data We Collect

M9game collects different categories of personal data depending on how you interact with the platform. See below what is collected and when:

3.1 Data provided directly by you

• Registration data: full name, CPF, date of birth, email address, mobile number, residential address, and ZIP code;
• Identity verification data (KYC): copy of a government-issued ID (RG or CNH), proof of address, and, where applicable, a selfie for facial verification;
• Financial data: registered Pix key, bank details for wire transfers, credit or debit card information (tokenized by the payment processor — m9game does not store full card numbers), and email address linked to PicPay or Mercado Pago;
• Preferences and communications: account settings, betting history, messages sent to support, and service ratings.

3.2 Automatically collected data

• Access data: IP address, device type, operating system, browser, screen resolution, and device identifiers;
• Browsing data: pages visited, time spent, clicks, traffic source (organic search, direct link), and navigation flow within the platform;
• Session data: login and logout times, approximate location (based on IP), and geolocation data if you grant permission through your browser or device;
• Cookies and similar technologies: as described in Section 7 of this Policy.

3.3 Third-party data

M9game may receive supplementary data from identity verification and fraud prevention providers to confirm the accuracy of the information submitted during registration. This data is used solely for verification purposes and is not stored beyond the period required.

4. How We Use Your Data

M9game uses the personal data collected for the following purposes:

• Account management: create and maintain your active account, process registration, verify identity (KYC), and authenticate access;
• Transaction processing: process deposits via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED bank transfer, as well as handle withdrawal requests;
• Service delivery: offer Sports Betting (Brasileirão, Copa do Brasil, Libertadores, UFC, CBLOL, CS2, and more), live casino, slots, and crash games;
• Fraud prevention and security: monitor suspicious activity, detect the use of multiple accounts, verify the origin of financial transactions, and fulfill anti-money laundering (AML) obligations;
• Responsible gambling: identify behavioral patterns that may indicate problem gambling and apply the protective tools active on the user's account;
• Communication: send account activity notifications, security alerts, bet confirmations, and — with your consent — promotional communications about m9game offers;
• Platform improvement: analyze browsing behavior in aggregate to identify improvements to the user experience, technical performance, and m9game features;
• Legal compliance: comply with orders from competent authorities, regulatory bodies, and courts in accordance with Brazilian law.

5. Legal Basis for Processing (LGPD)

The LGPD requires that all processing of personal data be grounded in one of the legal bases set out in Article 7 of the law. m9game processes your data under the following bases:

• Contract performance (art. 7, V): processing necessary to fulfill the contract between you and m9game upon registration — handling bets, payments, and withdrawals;
• Legal or regulatory obligation (art. 7, II): data processed to comply with legal requirements, such as anti-money laundering rules, age verification, and user identification;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, and aggregated browsing analysis to improve our services — always balanced against users' rights and expectations;
• Consent (Art. 7, I): sending promotional communications and using non-essential cookies. You may withdraw this consent at any time in your account settings or by contacting the DPO.

6. Data Sharing

M9game shares personal data only when strictly necessary for the operation of its services, and always under a confidentiality agreement or legal obligation. See who your data may be shared with:

• Payment processors: companies responsible for processing Pix, boleto bancário, credit and debit cards (Visa, Mastercard, Elo), PicPay, and Mercado Pago — exclusively to complete financial transactions;
• Identity verification providers: KYC platforms used to verify the authenticity of documents submitted during registration;
• Casino game providers: the studios that supply slots, crash games, and live tables to m9game receive only the minimum data necessary to manage rounds and results;
• Security and anti-fraud providers: specialized systems for fraud detection and anti-money laundering that analyze transaction patterns;
• Public and regulatory authorities: government agencies, the Central Bank of Brazil, the Financial Activities Control Council (COAF), and others, when required by law or court order.

M9game does not sell, rent, or share personal data with advertisers, marketing partners, or any third party not listed above without your explicit consent.

7. Cookies and Tracking Technologies

M9game uses cookies and similar technologies to ensure the platform functions correctly, enhance the user experience, and, with your consent, personalize content. See the types used below:

7.1 Essential cookies

Required for the basic functioning of the platform — session authentication, login security, and language preferences. They cannot be disabled without compromising your use of m9game.

7.2 Performance cookies

They collect aggregated, anonymous data on how users navigate m9game — most visited pages, load times, and technical errors. Used to improve platform speed and stability.

7.3 Functionality cookies

Store user preferences such as favorite sport, language, and odds settings to personalize the experience without requiring reconfiguration on every visit.

7.4 Analytics cookies

They enable analysis of browsing behavior to improve services and identify opportunities to enhance the platform. Activated only with your consent.

You can manage your cookie preferences in your browser or device settings at any time. Disabling non-essential cookies will not prevent you from using m9game's core features, but may limit some personalization options.

8. Data Retention and Deletion

M9game retains personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations:

• Active account data: retained for as long as the account remains active or until the user requests deletion;
• Financial transaction data: retained for a minimum of 5 years following completion of the transaction, as required by anti-money laundering legislation and Central Bank regulations;
• Identity verification data (KYC): retained for a minimum of 5 years after account closure, in accordance with regulatory obligations;
• Support and communications data: retained for up to 2 years after the last contact, for dispute resolution purposes;
• Browsing data and cookies: retained for up to 13 months in line with privacy best practices.

Once retention periods have expired, data is securely deleted or irreversibly anonymized. Anonymized data may be kept indefinitely for statistical purposes, with no possibility of identifying the user.

9. Data Security

M9game employs robust technical and organizational measures to protect users' personal data against unauthorized access, alteration, accidental or unlawful disclosure, or destruction:

• 256-bit SSL encryption: all communications between your device and m9game's servers are encrypted to the same standard used by Brazilian digital banks such as Nubank and Itaú;
• Financial data tokenization: credit and debit card numbers are never stored on m9game servers — they are tokenized by the payment processor;
• Two-factor authentication (2FA): available to all users in the account settings. m9game strongly recommends enabling 2FA for additional security;
• Role-based access control: only m9game staff with a justified operational need may access users' personal data — and all access is recorded in logs;
• Continuous monitoring: automated intrusion detection systems monitor the platform around the clock to identify suspicious access;
• Secure, encrypted backups: data is replicated across secure environments with encryption at rest.

In the event of a security incident involving users' personal data that poses a significant risk, m9game will notify the National Data Protection Authority (ANPD) and the affected users within the timeframe established by the LGPD, providing details on the nature of the incident and the measures taken.

10. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the data subject, a set of rights that m9game is fully committed to upholding. See below what you can request at any time:

To exercise any of these rights, please contact the m9game DPO at privacidade@m9game.best or via the platform's live chat. Requests are responded to within 15 business days. In more complex cases, this deadline may be extended by an equal period, with prior notice to the user.

If you believe your rights have not been properly addressed by m9game, you may file a complaint with the National Data Protection Authority (ANPD), as provided under the LGPD.

11. Minors

M9game services are intended exclusively to users aged 18 and over. m9game does not intentionally collect personal data from users under 18. If it is determined that a minor created an account — even by providing false date of birth information — the account will be immediately closed, the data will be deleted, and any deposited funds may be withheld in accordance with our fraud prevention policies.

12. International Data Transfers

Some service providers used by m9game — such as cloud infrastructure providers, anti-fraud systems, and live casino game providers — may process data on servers located outside Brazil. When this occurs, m9game requires those providers to adopt protection mechanisms equivalent to those required by the LGPD, including:

• Standard contractual clauses approved by the ANPD or by data protection authorities in recognized jurisdictions;
• Certifications of compliance with international data security standards;
• Internal data protection policies subject to regular audits.

M9game does not transfer data to countries that do not provide an adequate level of personal data protection, as assessed by the ANPD.

13. Changes to This Privacy Policy

M9game may update this Privacy Policy periodically to reflect changes in Brazilian law, data processing practices, or the services offered. Any material change will be communicated as follows:

• Email notification sent to the address registered on the account;
• A prominent notice on the platform upon login;
• Updating the "Last updated" date at the top of this page.

Changes that represent a significant shift in m9game's privacy practices will be communicated with a minimum advance notice of 7 days before it takes effect. Continued use of the platform after that date constitutes acceptance of the new terms. If you do not agree with the changes, you must close your account before the effective date.

14. Contact — DPO and Privacy Support

For any questions, requests, or complaints regarding how m9game handles your personal data, please reach out through the channels below:

• DPO Email: privacidade@m9game.best — For formal requests related to LGPD-guaranteed rights (access, correction, deletion, portability). Response time: up to 15 business days.
• General support: suporte@m9game.best — For general privacy inquiries and account settings. Response time: up to 24 business hours.
• Live chat: Available on the platform 24 hours a day, 7 days a week. For privacy requests via chat, please specify that you wish to discuss personal data protection.