Privacy Policy of 255b6: How We Handle Your Data

255b6 takes user privacy seriously. This Privacy Policy clearly and objectively describes how 255b6 collects, uses, stores, shares, and protects users' personal data — and how you can exercise your rights as a data subject.

This policy is in compliance with the General Data Protection Law (LGPD — Law No. 13.709/2018), which is Brazil's primary personal data protection law. 255b6 applies the LGPD's principles across all its operations: purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability.

This policy applies to all user interactions with 255b6, including registration, Pix deposits, Sports Betting on the Brasileirão and UFC, use of the live casino, slots, crash games, access to the VIP Program, and any other platform features.

255b6 collects only the data needed to provide platform services, meet regulatory obligations, and ensure the security of every transaction. The categories of data collected are listed below:

Data provided directly by the user during registration:

• Full name as shown on official ID
• CPF (Cadastro de Pessoa Física) with the Receita Federal
• Date of birth
• Email address
• Brazilian mobile phone number
• Full residential address (zip code, street, city, state)

Data collected automatically during platform use:

• IP address and approximate geographic location
• Device type, operating system, and browser
• Betting history, deposits, and withdrawals on the platform
• Session data: time on platform, pages visited, features accessed
• Technical and performance cookies (detailed in Section 8)

Data collected during verification (KYC) processes:

• Identity document image (RG or CNH, front and back)
• Selfie with ID document for ownership verification
• Recent proof of address (when required)
• Bank details for ownership verification on withdrawals — Pix key, branch, and account number

Every piece of data collected by 255b6 has a clear, documented purpose. Below is a detailed breakdown of how your data is used:

255b6 does not use users' personal data for any purposes beyond those listed above. Any new processing purpose that does not fall under existing legal bases will be communicated to the user and, where required, new consent will be requested.

The LGPD requires that all personal data processing have a legal basis. 255b6 relies on the following legal bases in its operations:

• Contract performance (Art. 7, V): The processing required to create and maintain your account, handle Pix deposits, settle bets, and process withdrawals. Without this data, we cannot provide the service.
• Compliance with a legal or regulatory obligation (Art. 7, II): Identity verification (KYC), anti-money laundering (AML) controls, responses to requests from competent authorities, and compliance with Brazil's sports betting regulations.
• Legitimate interest (Art. 7, IX): Fraud prevention, platform security, behavioral analysis to identify problematic use (responsible gambling), and continuous service improvement — always ensuring that 255b6's legitimate interests do not override users' rights.
• Consent (Art. 7, I): Sending marketing communications, promotions, and 255b6 news by email or SMS. Consent may be withdrawn at any time without affecting your access to the platform.

255b6 does not sell users' personal data. Sharing occurs only in the situations below, with partners contractually bound to security standards equivalent to those of the platform:

• Payment processors: To process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago, the data required for each transaction is shared with the relevant financial institutions and payment gateways. These partners comply with the regulations of the Banco Central do Brasil.
• Identity verification (KYC) providers: Documents and biometric data may be processed by specialized identity verification providers, all contracted under strict data protection clauses and operating in compliance with the LGPD.
• Casino game providers: To operate slots, live casino, and crash games, minimal technical session data is shared with licensed game providers. These providers do not receive personally identifying information beyond what is strictly necessary for the gaming session.
• Government and regulatory authorities: 255b6 responds to lawful requests from competent authorities — Ministério Público, Receita Federal, COAF, Banco Central — when legally required, in accordance with the procedures established under Brazilian law.
• Analytics and security services: Anonymized or pseudonymized data may be used by platform performance analytics tools and fraud detection systems. No identifiable data is shared for these purposes.

All third parties that receive personal data from 255b6 users are assessed for their privacy and security practices before being engaged, and are contractually bound not to use that data for any purpose beyond what is strictly necessary to deliver the specific service.

255b6 implements robust technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or destruction.

Technical security measures:

• 256-bit SSL/TLS encryption on all connections between the user's browser/app and 255b6 servers
• Passwords stored using modern hashing algorithms with salting — 255b6 never stores passwords in plain text
• Financial data (banking details, Pix keys) encrypted at rest using AES-256
• Multi-factor authentication available for additional account protection
• Intrusion detection system (IDS) and continuous monitoring for suspicious access
• Regular penetration testing (pentest) conducted by specialized security teams

Organizational measures:

• Access to user data restricted to personnel with a genuine need — principle of least privilege
• Personal data access logs maintained for internal auditing
• Mandatory privacy and security training for all 255b6 staff
• Documented and tested security incident response plan

255b6 retains personal data for as long as necessary to fulfill the purposes for which it was collected, observing the minimum retention periods required by law.

Retention periods by category:

• Active account data: for the entire period the account remains active on the platform
• Financial data and transaction history: minimum of 5 years after account closure, as required by Brazilian tax regulations and anti-money laundering rules
• Identity verification (KYC) documents: minimum of 5 years after last activity or account closure
• Access and security logs: minimum of 1 year, as required by the Marco Civil da Internet (Law No. 12.965/2014)
• Support communications: 2 years after the ticket is closed

After voluntary account closure and once all mandatory legal retention periods have elapsed, personal data that no longer serves a purpose or legal obligation is deleted or anonymized so that the data subject can no longer be identified.

You may request the deletion of personal data not subject to a legal retention period at any time, in accordance with your rights described in Section 10.

255b6 uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and — with your consent — personalize content and communications. The first time you access the platform, you will see a cookie notice with the available options.

Cookie categories in use:

• Essential cookies: Required for basic platform functionality — authentication, active session management, language preferences, and security. These cannot be disabled without affecting how the platform works.
• Performance cookies: These collect anonymized information about how users navigate the platform — most-visited pages, load times, errors. Used to improve 255b6's performance without identifying any individual user.
• Preference cookies: Store user preferences on the platform — such as favorite sports, odds display settings, and notification preferences.
• Marketing cookies (with consent): Used to personalize communications about 255b6 promotions. Only activated with your explicit consent and can be disabled at any time from the cookie preferences panel.

You can manage your cookie preferences at any time from the platform's settings panel. Disabling non-essential cookies does not affect access to 255b6's core features — Sports Betting, Pix, casino, and all other services remain fully available.

Payments on 255b6 are processed exclusively in Brazilian Reais (R$). Users' financial data receives special handling given its sensitivity.

When you make a deposit via Pix — whether from Nubank, Itaú, Bradesco, Banco do Brasil, or any other bank — the transaction information is processed in accordance with the regulations of the Central Bank of Brazil for the Instant Payment System (SPI). 255b6 receives only the data necessary to reconcile the payment: amount, receipt, and payer identification.

For Pix withdrawals, the Pix key provided is used solely to process the transfer to the account holder's CPF. Withdrawal data is retained for the minimum period required by Brazilian financial legislation (5 years) for regulatory compliance purposes.

Transactions via boleto bancário, Visa, Mastercard, or Elo credit/debit cards, PicPay, and Mercado Pago are processed by their respective payment gateways, each compliant with PCI-DSS standards and Banco Central do Brasil regulations. 255b6 does not store full credit card data on its servers.

The LGPD grants eight fundamental rights to personal data subjects. 255b6 makes it easy to exercise all of them through the privacy channel. See each right and how to use it:

255b6 does not offer services to anyone under 18 and does not intentionally collect personal data from minors. Registration requires age confirmation and CPF verification — a CPF is only issued to individuals aged 16 or older, but the platform requires full legal adulthood (18 years) to use.

If we identify that an account was created by a minor, it will be closed immediately, the data will be deleted in accordance with the LGPD, and any deposited funds will be returned after verification. Parents or guardians who suspect a minor is using the platform should contact support immediately at suporte@255b6.best.

255b6 may update this Privacy Policy to reflect changes in Brazilian law, data processing practices, or platform services. Whenever material changes are made, you will be notified via your registered email and/or through a notice in your account dashboard.

The date of the last update appears at the top of this page. We recommend reviewing this policy periodically. Continued use of the platform after the effective date of any new terms indicates acknowledgment of the changes.

For previous versions of this policy or to question specific changes, please contact us at privacidade@255b6.best. We maintain a version history available upon request.

255b6 has appointed a Data Protection Officer (DPO) as required by the LGPD for organizations that process data at scale or handle sensitive data.

For any questions related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, you can reach us through the channels below:

• Privacy channel (DPO): privacidade@255b6.best — for formal requests regarding personal data, exercise of LGPD rights, and regulatory matters
• General support: suporte@255b6.best — for operational account matters involving personal data
• Live chat: available 24 hours on the platform — for immediate routing to the responsible team

The response time for formal requests to the DPO is up to 15 calendar days. For urgent security matters — such as suspected unauthorized account access — live chat is the fastest channel.

If you believe your rights as a data subject have not been properly upheld by 255b6, you have the right to appeal to the Autoridade Nacional de Proteção de Dados (ANPD), the Brazilian regulatory authority responsible for enforcing the LGPD.