Privacy Policy of 18bet – Your Data Protected in Brazil

For the purposes of this Privacy Policy and the General Data Protection Law (LGPD), the 18bet — operated under the 18bet brand and accessible at 18bet-bangla.com — is the controller of its users' personal data. This means that the 18bet is responsible for deciding how, why, and for how long your data is processed.

The Data Protection Officer (DPO) of 18bet can be contacted by email at suporte@18bet-bangla.com with the subject line "LGPD — DPO". The DPO is the official point of contact for matters related to data processing, the exercise of rights, and data subject complaints.

A 18bet only collects the data necessary to operate the platform securely, process payments, meet legal obligations, and deliver a personalized experience. Nothing more.

Data you provided directly during registration:

• Full name;
• CPF (Cadastro de Pessoas Físicas);
• Date of birth;
• Email address;
• Mobile phone number;
• Full residential address;
• Account password (stored in encrypted hash format — never as plain text).

Identity verification data (collected at first withdrawal):

• Government-issued ID image (national ID, driver's license, or passport);
• Selfie for identity confirmation;
• Recent proof of address.

Data automatically generated through platform use:

• IP address and approximate geolocation;
• Device type, operating system, and browser;
• Betting history, games accessed, and transactions;
• Session time and browsing patterns within the platform;
• Cookies and session identifiers (detailed in section 7).

Financial data:

• Registered Pix key for withdrawals;
• Partial credit or debit card details (18bet 18bet does not store your full card number — this is handled directly by the PCI-DSS certified payment processor);
• Deposit and withdrawal history.

Each piece of data collected by 18bet has a specific, declared purpose. We do not process data for purposes other than those that motivated its collection. The purposes are:

• Account management: login authentication, balance management, betting history, access to the VIP Program;
• Payment processing: deposits via Pix, bank slip, card, and digital wallets; withdrawal processing to the registered Pix key;
• Identity verification and fraud prevention: document verification on the first withdrawal, duplicate account detection, suspicious pattern analysis;
• Compliance with legal obligations: compliance with the LGPD, betting industry regulations, tax obligations, and record retention as required by Brazilian law;
• Customer support: support via chat, email, and WhatsApp; dispute resolution; response to LGPD requests;
• Communications: transactional notifications (deposit confirmation, withdrawal processed), promotional communications about the Brasileirão, new games, and bonuses — only if you have not opted out of marketing communications;
• Responsible gambling: monitoring of usage patterns to identify risk behaviors and provide appropriate support;
• Platform improvement: aggregated and anonymized usage analysis to improve features, fix bugs, and personalize the experience.

A 18bet does not use your data for solely automated decision-making that produces legal effects or significant impacts without the possibility of human review — except in cases of fraud detection, where automation is necessary for security reasons and the user always retains the right to contest the decision.

The LGPD requires that all personal data processing have an identified legal basis. The 18bet processes your data based on the following legal grounds set out in Law No. 13,709/2018:

• Contract performance (Art. 7, V): processing required to operate your account, handle bets, process Pix payments, and deliver the services contracted through acceptance of the Terms and Conditions;
• Compliance with a legal obligation (Art. 7, II): retention of financial records, identity verification, and compliance with regulatory requirements in Brazil's betting industry;
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, responsible gambling monitoring, and support communications necessary for the service to function;
• Consent (Art. 7, I): sending marketing communications, promotions, and news — you may withdraw this consent at any time in your account settings or by contacting support.

A 18bet does not sell, rent, or transfer your personal data to third parties for commercial or marketing purposes. Period. Data sharing only occurs in the following situations, each with an identified legal basis and data protection agreements in place:

• Payment processors: to process deposits and withdrawals via Pix, boleto, card, PicPay, and Mercado Pago. These partners are PCI-DSS certified and operate under contracts with specific data protection clauses;
• Game providers: Evolution Gaming, Pragmatic Play, NetEnt, and other providers receive only an anonymized session identifier — not your name, CPF, or financial details — to operate live casino tables and slots;
• Identity verification services: to process document verification on the first withdrawal, using certified vendors who handle the data exclusively for that purpose;
• Competent authorities: when required by law, court order, or determination by a Brazilian regulatory authority — such as the Banco Central do Brasil, Receita Federal, or betting sector authorities;
• Fraud prevention: sharing with specialized risk analysis services, strictly limited to what is necessary and always backed by adequate contractual safeguards.

In all sharing scenarios, the 18bet requires partners to maintain security and confidentiality standards equivalent to those applied internally. Any subcontracting involving personal data is documented and auditable.

The data of users of 18bet are stored on servers with the following protections:

• At-rest encryption for all personal and financial data;
• In-transit encryption (TLS 1.3) for all communications;
• Role-based access controls (RBAC) following the principle of least privilege;
• Audit logs for all access to personal data;
• Automatic encrypted backups with geographically redundant storage;
• Continuous security monitoring and periodic penetration testing by independent third parties.

Data retention periods are:

• Active account data: retained for as long as the account remains active;
• Closed account data: deleted or anonymized within 90 days of account closure, except where retention is required by law;
• Financial records (Pix, boleto, card): retained for 5 years in accordance with Brazilian financial and tax sector regulations;
• Security logs: retained for 6 months for incident investigation;
• Identity verification data: retained for the duration of the account plus 5 years.

A 18bet uses cookies and similar technologies to ensure the platform functions correctly, analyze usage, and personalize your experience. You can manage your cookie preferences in your browser settings, but disabling essential cookies may affect the functionality of the site and app.

A 18bet does not use third-party tracking cookies for advertising on external networks. Analytics cookies are processed in an aggregated and anonymized manner — the goal is to understand how the platform is used overall, not to monitor you individually.

The LGPD guarantees you, as a data subject, a robust set of rights that the 18bet is committed to upholding. All rights can be exercised by sending an email to suporte@18bet-bangla.com with the subject line "LGPD — [right name]". We respond within 15 business days.