Mzmz28 Privacy Policy — Data Protection & LGPD

Mzmz28 is a Sports Betting and online casino platform operated for the Brazilian market, accessible at mzmz28.net. For the purposes of this Privacy Policy, mzmz28 acts as the controller of personal data collected during registration and use of the platform — meaning mzmz28 determines the purposes and means by which that data is processed.

This policy applies to all users who:

• Create an account on mzmz28;
• Access the mzmz28.net website, even without registering;
• Contact support via live chat, email, or any other official channel;
• Take part in mzmz28 promotions, tournaments, or loyalty programs.

This policy is compliant with the Lei Geral de Proteção de Dados (LGPD — Lei nº 13.709/2018), which governs the processing of personal data in Brazil. It complements our Terms and Conditions and should be read together with them for a full understanding of the rights and obligations of each party.

Mzmz28 collects different categories of data depending on how you interact with the platform. The main categories are listed below:

Registration data:

• Full name as it appears on a government-issued ID;
• Date of birth;
• CPF (Individual Taxpayer Registry);
• Email address;
• Mobile phone number;
• Full residential address, including ZIP code.

Identity verification data (KYC):

• Scanned copy of a government-issued ID (RG, CNH, or passport);
• Proof of address issued within the last three months;
• Selfie for identity confirmation, when requested.

Financial data:

• Pix key linked to the account (CPF, email, phone number, or random key);
• Banking details required for TED withdrawals (bank, branch, account number);
• Last four digits of cards used for deposits (never the full card number);
• History of deposits, withdrawals, and bets placed on the platform.

Usage and browsing data:

• Access IP address;
• Device type, operating system, and browser;
• Pages visited, session duration, and features used;
• Cookie and similar technology data (detailed in Section 9).

Mzmz28 uses collected personal data solely for the purposes described below. Each purpose is supported by a specific legal basis under the LGPD:

• Provision of contracted services: creating and managing your account, processing deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, or TED, settling bets, and distributing winnings. Legal basis: contract performance;
• Identity verification and compliance (KYC/AML): verifying user identity prior to withdrawals and fulfilling legal obligations related to anti-money laundering (AML) and counter-terrorism financing, in accordance with Brazilian regulatory requirements. Legal basis: legal obligation;
• Fraud prevention and platform security: monitoring atypical behavior patterns, identifying multiple accounts, preventing promotional abuse, and protecting game integrity. Legal basis: legitimate interest of mzmz28;
• Customer support: answer questions, resolve technical and financial issues, and maintain a support history to improve service quality. Legal basis: contract performance and legitimate interest;
• Marketing communications: sending emails, push notifications, and SMS messages with information about promotions, bonuses, new games, and special events — such as poker freerolls, odds boosts on Libertadores matches, or Spin Fridays. This purpose relies on your consent, which you may withdraw at any time through your account settings or via the unsubscribe link included in every email we send. Legal basis: consent;
• Experience personalization: tailoring displayed content to your preferred games and sports — such as Brasileirão football, live casino, or poker. Legal basis: legitimate interest;
• Statistical analysis and service improvement: understand how users interact with the platform in order to fix issues and develop new features. Data used for this purpose is always anonymized or pseudonymized. Legal basis: legitimate interest.

Mzmz28 does not use your personal data for any purpose beyond those listed above. Any new purpose that may arise in the future will be communicated before it is implemented, with an opportunity for consent where required.

Mzmz28 does not sell, rent, or share your personal data with third parties for commercial purposes. Your data may be shared only in the following specific and limited situations:

• Payment processors: data required to process deposits and withdrawals is shared with the respective payment providers (such as the financial institutions responsible for Pix, boleto bancário, PicPay, Mercado Pago, and credit/debit card networks). These partners act as data processors and are contractually obligated to use the information solely for the specific purpose of payment processing;
• Game Providers: to support live casino games, slots, crash games, and poker, certain technical session data (such as user ID and balance) is shared with the certified providers of those games. Personal identification data is not passed on;
• Identity verification services: to meet our KYC obligations, we use specialized document verification providers. These services process identity data solely to confirm document authenticity;
• Regulatory and legal authorities: mzmz28 promptly complies with formal legal requests from competent Brazilian authorities — such as the Banco Central do Brasil, Receita Federal, Ministério Público, or law enforcement — when required by law or court order. In such cases, data is shared only to the minimum extent necessary to fulfill the legal obligation;
• Independent audits: to ensure the integrity of games and financial processes, certified external auditors may have access to aggregated or anonymized data during periodic audit procedures.

Mzmz28 retains your personal data for as long as necessary to fulfill the purposes described in this policy and to comply with applicable legal obligations. The general retention criteria are:

• Active account: all registration, financial, and usage data is retained for the entire period your account remains active on the platform;
• After account closure: data required to fulfill legal obligations — such as financial transaction records and KYC documents — is retained for a minimum of 5 years after account closure, in accordance with Brazilian anti-money laundering legislation and Central Bank regulations;
• Support data: support history is retained for 3 years after account closure for the purpose of resolving any potential disputes;
• Browsing data and cookies: session and browsing data is retained for up to 13 months. Preference and analytics cookies have specific retention periods detailed in Section 9;
• Permanent self-exclusion: in cases of permanent self-exclusion for responsible gambling, we retain a minimum record of identifying data for the legally required period, solely to prevent new accounts from being created with the same CPF.

Once the applicable retention period expires, data is permanently deleted or irreversibly anonymized. Anonymized data — which can no longer be used to identify a user — may be retained indefinitely for statistical purposes.

The LGPD grants you, as the data subject, a set of rights that mzmz28 is committed to respecting and facilitating. See below what those rights are and how to exercise them:

To exercise any of these rights, please contact our Data Protection Officer (DPO) at contato@mzmz28.net with the subject line "LGPD Request — [your right]". You will need to verify your identity before the request is processed, to ensure that information is only provided to the rightful data subject.

If you believe mzmz28 has not adequately handled a request related to your data, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the authority responsible for enforcing the LGPD in Brazil.

Mzmz28 implements technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure. The key safeguards in place include:

• Encryption in transit: all communication between your device and mzmz28 servers is protected by TLS/SSL encryption (indicated by "https" in the address bar). This applies to all transactions — deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED;
• Encryption at rest: sensitive data stored on mzmz28 servers — such as identity documents and banking details — is encrypted at rest;
• Two-factor authentication (2FA): available and recommended for all users. 2FA adds an extra layer of security to account access beyond your password;
• Internal access controls: users' personal data is accessible only to mzmz28 employees who need it to perform their specific functions. Access is governed by the principle of least privilege;
• Intrusion monitoring and detection: mzmz28 systems are continuously monitored to detect unauthorized access attempts and anomalous behavior;
• Periodic security testing: the platform undergoes regular security assessments, including penetration testing (pentest) conducted by independent specialists.

In the event of a security incident involving personal data that may pose a significant risk or harm to data subjects, mzmz28 will notify the ANPD and the affected users within the timeframes and through the channels required by the LGPD.

Mzmz28 operates with a focus on the Brazilian market and prioritizes storing data in Brazil. However, some of our technology partners and game providers operate servers in other countries. When this occurs, mzmz28 ensures that international data transfers are carried out with the appropriate safeguards required by the LGPD, which include:

• Transfer only to countries that offer a level of personal data protection compatible with the LGPD, as assessed by the ANPD;
• Execution of standard contractual clauses with data recipients, ensuring obligations equivalent to those required by the LGPD;
• Obtaining the data subject's specific consent when none of the safeguards above are sufficient.

The game providers that mzmz28 works with are internationally certified and operate under regulations from jurisdictions recognized by the digital entertainment industry. All of them are contractually bound to security and privacy standards consistent with mzmz28's requirements and Brazilian law.

Mzmz28 uses cookies and similar technologies to ensure the platform functions properly, personalize the user experience, and analyze site usage. See the types of cookies we use:

• Essential cookies: required for the basic functioning of the site — such as keeping your session active while browsing, saving language preferences, and ensuring login security. These cookies cannot be disabled without affecting platform functionality;
• Performance and analytics cookies: collect data on how users navigate mzmz28 — most visited pages, session duration, errors encountered — in an aggregated and anonymized form. This information is used to improve the platform. You can opt out of these cookies without affecting core functionality;
• Functionality cookies: allow the platform to remember your preferences, such as favorite games, recent browsing history, and display settings. Disabling them may affect some personalization features;
• Marketing cookies: used only if you have consented to receive personalized communications. These cookies may track your browsing on the mzmz28 website so we can show you relevant offers within the platform. You can disable these cookies in your account settings or via the cookie consent banner displayed on your first visit.

You can manage your cookie preferences at any time through your browser settings or via the privacy preferences panel available in your mzmz28 account. To learn more about how each browser manages cookies, refer to the support documentation for Chrome, Firefox, Safari, or Edge.

Mzmz28 is a platform exclusively for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. During registration, users must confirm they meet the minimum age requirement, and identity verification (KYC) validates date of birth before withdrawals are released.

If mzmz28 determines that data belonging to a person under 18 was collected — whether due to a registration error or any other reason — the account will be immediately closed and all data will be deleted as quickly as possible, subject to any minimum mandatory legal retention periods.

If you are a parent or legal guardian and believe that a minor in your care has created an account on mzmz28, please contact us immediately at contato@mzmz28.net with the subject line "Minor's account — URGENT". Our team will handle the case as a priority and within the timeframes set out by the LGPD.

Mzmz28 has appointed a Data Protection Officer (DPO) as required by the LGPD. The DPO serves as the official point of contact for:

• Requests to exercise data subject rights (access, correction, deletion, portability, etc.);
• Questions about this Privacy Policy or about how mzmz28 handles your data;
• Privacy-related complaints that were not resolved through the general support channel;
• Communications from the National Data Protection Authority (ANPD).

You can reach the mzmz28 Data Protection Officer through the following channel:

Mzmz28 may update this Privacy Policy periodically to reflect changes in our services, applicable legislation, or data processing practices. When a significant update is made:

• The "last updated" date shown at the top of this page will be changed;
• For changes that materially affect user rights or the purposes of data processing, we will send an email notification at least 15 days before the new version takes effect;
• For minor changes that are purely technical or editorial in nature, notification may be given solely by updating the date and posting a notice on the site.

Continued use of the platform after a new version of this policy takes effect constitutes acceptance of the updated terms. If you do not agree with the changes, you may close your account before the effective date — any available balance will be processed for withdrawal in accordance with the Terms and Conditions.

We recommend reviewing this page periodically. A history of previous versions of this policy is available upon request to the DPO at the email address listed in Section 11.