Rico33 Privacy Policy – LGPD Data Protection

1Who We Are — The Data Controller

The data controller responsible for processing your personal data is Rico33, an online casino platform operating for the Brazilian market. For the purposes of this policy, Rico33 is the "controller" as defined by the General Data Protection Law (LGPD — Law No. 13,709/2018).

Our Data Protection Officer (DPO) is responsible for ensuring day-to-day LGPD compliance across our operations and is available to handle requests related to personal data through the channel below:

• DPO Email: privacidade@rico33.best
• General support channel: live chat on the platform, available 24/7
• Response time: up to 15 business days for formal LGPD rights requests

This policy applies to all registered players on rico33, visitors to rico33.best, and anyone whose data is processed as a result of using the platform — regardless of VIP level or gaming history.

2What Data We Collect and How

Rico33 collects personal data through different means, always in proportion to the need and with an appropriate legal basis. The data collected falls into the following categories:

Data provided directly by you at registration:

• Full name, date of birth, CPF
• Email address and phone number
• Residential address (zip code, street, number, city, state)
• Identity documents submitted during the verification process (KYC): national ID (RG), driver's license (CNH), or passport, plus proof of address

Payment data:

• Pix key used for deposits and withdrawals
• Partial credit or debit card details (masked number, card brand) — the full card number is never stored on our servers
• Bank account details for wire transfers where applicable

Data automatically generated during platform use:

• IP address and approximate location (state/city)
• Device type, operating system, and browser used
• Session history: access time, duration, pages visited
• Betting history, games accessed, and results (required for bonus verification and VIP Program)
• Financial transaction logs: deposits, withdrawals, bonuses applied

3How We Use Your Data

Rico33 uses your personal data exclusively for the purposes stated below. No data is processed for purposes incompatible with those described here without prior notice and, where required, renewed consent.

• Account creation and management: to uniquely identify you on the platform, enable login, manage preferences, and ensure that only you can access your account.
• Identity verification (KYC): to fulfill legal obligations related to anti-money laundering, minimum age verification (+18 years), and confirmation of payment method ownership.
• Financial transaction processing: to process deposits via Pix, boleto, card, PicPay, Mercado Pago, and TED, and to execute withdrawals quickly and securely.
• Provision of gaming services: to register bets, calculate results, track bonus rollover progress, and manage VIP Program levels.
• Customer support: to handle live chat requests, resolve disputes, and maintain a record of interactions for future reference.
• Security and fraud prevention: to detect and prevent platform misuse, creation of multiple accounts, fraud attempts, and money laundering.
• Operational communications: to send registration confirmations, security alerts, withdrawal notifications, and other communications essential to your account.
• Marketing communications (with consent): to send promotions, bonuses, and platform news — only if you opted in, with the option to unsubscribe at any time.
• Compliance with legal and regulatory obligations: to comply with requests from competent authorities when required by law.

4Data Sharing with Third Parties

Rico33 does not sell, rent, or transfer personal data to third parties for commercial purposes. Data sharing occurs only in the situations described below, all of which are necessary for platform operation or compliance with legal obligations:

• Payment providers: to process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers. We share only the minimum data necessary for each transaction.
• Game providers: Evolution Gaming, Playtech, Pragmatic Play, Microgaming, and other partner studios receive an anonymous session identifier to record game results. We do not share your name, CPF, or financial details with game providers.
• Identity verification services (KYC): specialized partners who assist us with document verification and anti-money laundering compliance, bound by confidentiality agreements and equivalent LGPD obligations.
• Technology infrastructure: cloud hosting providers, transactional email services, and security monitoring tools — all contracted with data protection clauses.
• Public authorities: when required by court order, request from a competent public authority, or applicable legal obligation, Rico33 provides data as directed, notifying the player whenever legally permitted.

All third parties with whom Rico33 shares data are bound by contracts requiring equivalent data protection standards and prohibiting use for unauthorized purposes.

5How Long We Keep Your Data

Rico33 retains personal data for as long as necessary to fulfill the stated purposes or to meet applicable legal and regulatory obligations. The general retention periods are as follows:

• Active account data: retained for as long as the account is active. After account closure, data is kept in accordance with the legal retention periods below.
• Financial transaction data (deposits and withdrawals): minimum of 5 years after the transaction, in accordance with Brazilian financial and anti-money laundering legislation.
• Identity verification documents (KYC): minimum of 5 years after account closure or the last transaction, whichever is more recent.
• Betting history: minimum of 2 years for dispute resolution and internal audit purposes.
• Support communication logs: 2 years after the last interaction.
• Marketing data (with consent): until consent is withdrawn or the account is closed.

Once the applicable retention periods have expired, data is securely deleted or anonymized so it can no longer be linked to you as an identifiable individual.

In the event of ongoing judicial, administrative, or regulatory proceedings, relevant data may be retained beyond the standard retention periods until the matter is fully resolved.

6Information Security

Rico33 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or improper disclosure. The key measures in place include:

• 256-bit SSL/TLS encryption: all communication between your device (phone, computer) and Rico33's servers is encrypted. This means that transmitted data — including passwords, payment details, and personal information — cannot be intercepted in transit.
• Secure password storage: passwords are stored exclusively as salted cryptographic hashes. Not even our own team can access your password in plain text — it is technically impossible.
• Two-factor authentication (2FA): available and strongly recommended for all players. It adds an extra layer of login protection, preventing unauthorized access even if your password is compromised.
• Restricted access controls: only employees with a legitimate need have access to players' personal data. Access is logged and periodically audited.
• Continuous monitoring: intrusion detection and anomalous behavior systems operate 24 hours a day to identify unauthorized access attempts.
• Periodic security testing: we conduct regular penetration tests and security audits to identify and fix vulnerabilities before they can be exploited.

In the event of a security incident that may affect your data, Rico33 is committed to notifying you within the timeframes set out in the LGPD, with clear information about what happened, which data was affected, and the steps taken to mitigate the impact.

7Cookies and Similar Technologies

The rico33.best website uses cookies and similar technologies to ensure the platform functions correctly, improve your experience, and — with your consent — for analytical purposes. The types of cookies used are:

• Essential cookies: required for the basic operation of the platform — maintaining login sessions, language preferences, and security settings. They cannot be disabled without affecting your ability to use the platform.
• Performance and analytics cookies: collect aggregated, anonymous information about how users interact with the platform — most visited pages, session duration, and navigation flow. Used exclusively to improve the experience. Require consent.
• Functional cookies: allow the platform to "remember" your preferences — such as the game you were playing or your display settings. They improve convenience without storing sensitive data. Consent is required.

Rico33 does not use third-party tracking cookies for behavioral advertising or data sharing with external ad networks.

You can manage your cookie preferences at any time through the consent banner displayed on your first visit, or through the privacy settings panel in your account. Disabling essential cookies may affect the proper functioning of the platform.

8How to Exercise Your Rights as a Data Subject

The LGPD grants you a set of rights over your personal data, all detailed in the previous section of this policy. To exercise any of these rights, use one of the channels below:

• Live Chat: available 24/7 directly on the platform. Ask the support agent to formally log your LGPD rights request. The response deadline is up to 15 business days.
• DPO Email: privacidade@rico33.best — for formal requests involving access, deletion, portability, or any request requiring specific documentation.

To process your request, we may need to verify your identity to ensure we are responding to the correct data subject — and not a third party attempting to access someone else's information. This verification follows the same security standards as the rest of the platform.

Rico33 responds to all LGPD rights requests within 15 business days. In cases that require more in-depth review, we will inform you of the estimated completion timeframe within the first 15 days.

If you believe that rico33 has not adequately handled your request or that your rights have been violated, you have the right to file a complaint with the National Data Protection Authority (ANPD), the authority responsible for LGPD enforcement in Brazil.

9Data of Minors

Rico33 is an online casino platform intended exclusively for adults aged 18 or older. We do not intentionally collect, process, or store personal data from anyone under 18.

During registration, the player confirms they meet the minimum age requirement. This declaration is reinforced by the identity verification process (KYC), which confirms the date of birth through an official photo ID.

If we identify that an account was created by a minor, we take the following immediate steps:

• Immediate account block and suspension of all pending transactions;
• Refund of any real balance deposited to the original payment method;
• Deletion of all collected personal data, as permitted by applicable law;
• Notification to the legal guardian when identified.

If you believe a minor has created an account on Rico33, please notify our team immediately via live chat or by emailing privacidade@rico33.best. We will handle the matter with the highest priority.

10Changes to This Privacy Policy

Rico33 reserves the right to update this Privacy Policy whenever necessary — due to changes in legislation, in how we operate, or in the services we offer. The date of the last update is always displayed at the top of this page.

When we make significant changes — ones that materially affect how we process your data or your rights as a data subject — you will be notified at least 7 calendar days by email and via notification upon your next login to the platform.

Minor changes — such as text corrections, contact updates, or clarity improvements that don't affect the substance — may be made without formal prior notice, but the update date at the top of the document will always be revised.

By continuing to use the platform after the effective date of any change, you confirm that you have read and accepted the updated version of this policy. If you do not agree with the new terms, you may close your account and request deletion of your data, as described in section 8.