Ok88 Privacy Policy – Protecting Your Data

Ok88 is the entity responsible for processing the personal data of its users in Brazil. For the purposes of the LGPD, ok88 acts as controller of the personal data collected through the platform available at ok88.express.

This Privacy Policy applies to all services offered by ok88, including Sports Betting on football, volleyball, basketball, MMA, and e-sports, online casino with slots, Live Casino, and crash games, as well as all account features, payments, and platform communications.

Ok88 is committed to its users' privacy and handles personal data responsibly, transparently, and securely, in accordance with the principles established by the LGPD: purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability.

Ok88 collects only the data necessary to provide its services securely, in a personalized way, and in compliance with Brazilian law. Below are the types of data collected and the circumstances in which collection occurs:

Data provided directly by you during registration:

• Full name as it appears on an official document;
• CPF (Cadastro de Pessoa Física);
• Date of birth;
• Email address;
• Mobile phone number;
• Full residential address (zip code, street, number, neighborhood, city, state);
• Access password (stored in encrypted form; ok88 has no access to the original value).

Data collected during platform use:

• Betting history (amounts, events, markets, outcomes, and dates);
• Financial transaction history (deposits via Pix, boleto, card, PicPay, Mercado Pago, and TED; withdrawals via Pix);
• Session and access data (IP address, device type, operating system, browser, date and time of access);
• Platform browsing data (pages visited, session duration, interface interactions);
• Support communications (chat conversation history, emails exchanged).

Data collected during the identity verification (KYC) process:

• Copy of government-issued ID (RG, CNH, or passport);
• Proof of address;
• Selfie with ID document (when requested);
• Proof of the payment method used.

Ok88 uses collected personal data exclusively for the purposes described below. No data is used for any purpose beyond those listed without the data subject's specific consent:

Data processing purposes:

• Service provision: process registrations, manage accounts, process bets, calculate returns, and settle winning bets;
• Payment processing: process deposits via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED; process withdrawals via Pix to the user's CPF key;
• Identity verification and fraud prevention: confirm that the account holder is of legal age, verify document authenticity, and identify suspicious activity patterns;
• Legal and regulatory compliance: comply with Brazilian legal obligations, including anti-money laundering requirements (Law No. 9,613/1998) and mandatory reporting to authorities;
• Customer support: answer questions, resolve complaints, and provide personalized support via chat and email;
• Platform improvement: analyze usage patterns to identify errors, improve the user experience, and develop new features;
• Account communications: send transactional notifications about deposits, withdrawals, bet results, and account changes;
• Marketing and promotions (with consent): send bonus offers, information about active promotions, and platform updates only to users who have consented to receive such communications.

You can withdraw consent for marketing communications at any time by clicking the unsubscribe link in any promotional email or by adjusting your notification settings in your ok88 account.

The LGPD requires a valid legal basis for every personal data processing activity. ok88 grounds its processing operations on the following legal bases set out in Article 7 of the LGPD:

• Contract performance (art. 7, V): processing necessary to provide the services contracted by the user upon creating an ok88 account, including Sports Betting, payments, and online casino;
• Legal or regulatory obligation (art. 7, II): processing required to comply with applicable Brazilian laws, including anti-money laundering regulations, customer identification (KYC) requirements, and tax obligations;
• Legitimate interest (Art. 7, IX): processing for purposes such as fraud prevention, platform security, and service improvement, provided these do not override the rights and freedoms of the data subject;
• Consent (Art. 7, I): processing of data for marketing communications and promotions, subject to the user's freely given, informed, and unambiguous consent, which may be withdrawn at any time.

For each processing purpose, ok88 documents the applicable legal basis internally and conducts periodic reviews to ensure that processing remains appropriate and proportionate.

Ok88 does not sell your personal data. Information is only shared with third parties in the situations described below, always on an appropriate legal basis:

Situations in which data may be shared:

• Payment processors: data required to process financial transactions is shared with the operators of the payment methods used (Pix via Banco Central, card processors, PicPay, Mercado Pago, banks for wire transfers such as Nubank, Itaú, Bradesco, and Banco do Brasil). These partners act as data processors and are contractually bound to protect your information;
• Identity verification (KYC): document data may be processed by certified identity verification service providers, acting as operators under ok88's instructions;
• Technology providers: cloud infrastructure, hosting, and digital security providers that process data on a technical basis to keep the platform running, without access to data content for their own purposes;
• Competent authorities: data may be shared with the Banco Central do Brasil, Conselho de Controle de Atividades Financeiras (COAF), Receita Federal, Ministério Público, and other public authorities when required by law, court order, or directive from a competent authority;
• Auditors and legal advisors: professionals bound by confidentiality obligations who provide audit, legal, or accounting services to ok88.

Ok88 requires all third parties with whom it shares personal data to adopt adequate security measures and to use the information only for authorized purposes, in compliance with the LGPD.

Ok88 retains your personal data for as long as necessary to fulfill the purposes of processing and to meet applicable legal obligations. General retention periods are as follows:

• Registration data and active account: retained for the full duration of the contractual relationship (while the account remains active);
• Financial transaction data: retained for a minimum of 5 years after the transaction, in accordance with anti-money laundering obligations and Brazilian tax legislation;
• Identity verification data (KYC): retained for a minimum of 5 years after account closure, as required by regulation;
• Betting history: retained for a minimum of 5 years for audit and regulatory compliance purposes;
• Support communications: retained for up to 2 years after each support interaction is closed;
• Browsing data and access logs: retained for up to 6 months, extendable in the event of an active security investigation.

Once retention periods expire, data is securely deleted or anonymized in a way that prevents identification of the data subject. ok88 runs periodic data review and cleanup cycles to ensure that unnecessary information is not kept beyond the appropriate timeframe.

If you request the deletion of your data before the legal retention period ends, ok88 will delete any information not subject to a legal retention obligation and will inform you which data must be kept by law and for how long.

Ok88 implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or destruction. Key security measures include:

• SSL/TLS 256-bit encryption across all communications between the user's device and ok88's servers;
• Encryption at rest for sensitive data stored in the platform's databases;
• Secure password hashing with modern cryptographic hash algorithms; passwords are never stored in plain text and ok88 staff have no access to the original value;
• Role-based access control (RBAC), ensuring that team members only access the data required for their specific roles;
• Multi-factor authentication for internal access to systems containing personal data;
• Continuous monitoring of access and activity across systems to detect anomalous behavior in real time;
• Periodic security testing, including vulnerability assessments and code reviews;
• Regular training of the team on information security best practices and data protection.

Despite every effort, no digital system is entirely immune to risk. In the event of a security incident that may affect personal data, ok88 will notify the affected users and the National Data Protection Authority (ANPD) within the timeframes established by the LGPD.

Ok88 uses cookies and similar technologies to ensure the platform functions correctly, personalize the user experience, and analyze service performance. Cookies are small text files stored in your browser when you access the platform.

Types of cookies used:

• Essential cookies: required for the platform's basic functionality, such as keeping your session active after login, processing bets, and accessing protected areas of your account. These cookies cannot be disabled without affecting your ability to use the platform;
• Performance and analytics cookies: collect anonymized information about how users interact with the platform, such as most-visited pages, session duration, and errors encountered. This information helps ok88 improve the user experience;
• Preference cookies: remember your personal platform settings, such as language, notification preferences, and frequently used betting filters;
• Security cookies: used to detect fraud attempts, automated behavior (bots), and suspicious access, helping to keep your account secure.

Ok88 does not use third-party advertising cookies to track users' behavior across other websites for external ad targeting purposes.

You can manage and disable cookies in your browser settings. However, disabling essential cookies may prevent the platform from functioning correctly, including the login process and bet confirmation. To learn how to manage cookies in your browser, refer to the help documentation for Chrome, Safari, Firefox, or whichever browser you use on your device.

The LGPD grants you, as the holder of personal data processed by ok88, a set of rights that can be exercised at any time. ok88 is committed to responding to all requests within the legal deadline of 15 days.

Rights guaranteed under the LGPD that you can exercise:

• Confirmation and access: confirm whether ok88 processes your personal data and, if so, access a copy of the information held about you;
• Correction: request the correction of incomplete, inaccurate, or outdated information in your account;
• Anonymization, blocking, or deletion: request the anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data;
• Portability: request the portability of your data to another service or product provider, under the terms regulated by the ANPD;
• Deletion: request the deletion of data processed on the basis of consent, except where ok88 has a legal obligation to retain it;
• Data sharing information: obtain information about which public and private entities have received your data;
• Withdrawal of consent: withdraw consent for processing activities based on that legal ground, without affecting the lawfulness of processing carried out prior to withdrawal;
• Right to Object: object to data processing based on legitimate interest when you believe it does not comply with the LGPD;
• Review of automated decisions: request human review of decisions made solely on the basis of automated data processing that affect your interests.

To exercise any of these rights, contact us at privacidade@ok88.express with the subject line "LGPD Right – [request type]". ok88 may request identity verification before processing the request to ensure data is provided to the correct holder.

Ok88's services are intended exclusively for users aged 18 and over. ok88 does not intentionally collect or process personal data from minors. The registration process includes date-of-birth verification and requires a valid CPF, which allows confirmation of legal age under Brazilian law.

If ok88 determines that it has collected data from a minor, it will immediately take the following steps:

• Closure of the account identified as belonging to a minor;
• Refund of the actual financial balance to the legal holder of the payment method used;
• Deletion of all personal data relating to the minor from ok88's systems, except for data that must be retained under a legal obligation;
• Notification of the legal guardian, where identifiable, about the incident.

If you suspect that a child or teenager is using the ok88 platform, please contact us immediately via 24-hour chat or by emailing privacidade@ok88.express. ok88 treats these cases as the highest priority.

Ok88's technical infrastructure may involve the use of servers and service providers located outside Brazil, such as cloud computing services, which may result in the international transfer of personal data.

When personal data of Brazilian users is transferred to other countries, ok88 ensures that such transfers only take place when:

• The destination country or organization provides a level of personal data protection adequate to that required by the LGPD, as assessed by the ANPD;
• Or there are sufficient contractual safeguards in place, such as standard data protection clauses, ensuring a level of protection equivalent to the LGPD for the transferred data.

Ok88 maintains a record of international transfers carried out and the legal instruments that support them, available upon request through the privacy channel.

Ok88 may update this Privacy Policy periodically to reflect changes in its data processing practices, applicable Brazilian legislation, or the services offered on the platform. The last updated date shown at the top of this page is revised whenever changes are made.

For significant changes that directly affect data subjects' rights — such as changes to processing purposes, the data collected, or the third parties with whom information is shared — ok88 will notify users by email at least 15 days before the new terms take effect.

Continued use of the platform after an updated version of this Policy takes effect constitutes acceptance of the new terms. If you do not agree with the changes, you may exercise your data subject rights, including requesting the deletion of data not subject to legal retention.

Ok88 has appointed a Data Protection Officer (DPO) responsible for overseeing the platform's privacy practices and serving as the communication channel between ok88, data subjects, and the National Data Protection Authority (ANPD).

How to get in touch about privacy:

• Privacy channel (email): privacidade@ok88.express – for LGPD rights requests, questions about data processing, and incident notifications;
• General 24-hour support: contato@ok88.express or live chat on the platform – for general account matters involving personal data;
• Response time: up to 15 days for LGPD rights requests, starting from the confirmation of the requester's identity.

For LGPD rights requests submitted by email, include "LGPD Right – [type of request]" in the subject line and, in the body of the email, the CPF registered to your ok88 account along with a clear description of what you are requesting. ok88 may ask for additional identity verification to protect your data from unauthorized access.

Complaints that are not resolved satisfactorily by ok88 may be escalated to the Autoridade Nacional de Proteção de Dados (ANPD) through the official channels available on the federal government portal at gov.br.