4wim Privacy Policy — Data Protection & LGPD

4wim takes user privacy seriously. This Privacy Policy clearly and straightforwardly explains how we collect, use, store, share, and protect the personal data of everyone who uses the platform — whether through the website, the Android or iOS app, or any other official 4wim communication channel.

This Policy applies to all services offered by 4wim, including pre-game and live Sports Betting, Live Casino, poker, slots, crash games, the predictions section, and all other platform features. By creating a 4wim account, you confirm that you have read and understood this Policy and consent to the processing of your data as described herein.

4wim acts as controller of the personal data processed under this Policy, as defined in article 5, item VI, of the General Data Protection Law (Lei 13.709/2018 — LGPD). 4wim's Data Protection Officer (DPO) is available for contact at privacidade@4wim.best.

4wim collects personal data at various points throughout your experience on the platform. Each category is detailed below:

Data provided directly by you:

• Full name, date of birth, and CPF — collected at registration for identity verification;
• Email address and mobile number — for communication and authentication;
• Full residential address — required for legal compliance and fraud prevention purposes;
• Identity documents (national ID, driver's license, or passport) and proof of address — collected during the KYC (identity verification) process prior to your first withdrawal;
• Banking and payment details — account number, Pix key, tokenized credit or debit card data, and information related to PicPay, Mercado Pago, or your bank (Nubank, Itaú, Bradesco, Banco do Brasil, and others);
• Any health-related information voluntarily provided in the context of responsible gambling, such as a self-declaration of dependency.

Data collected automatically during use of the platform:

• IP address, browser or app type and version, operating system, and device identifiers;
• Approximate geolocation data (country and state), derived from IP address;
• Betting history, games accessed, markets browsed, amounts wagered, and outcomes;
• Session data: login time, session duration, pages and sections visited, actions taken;
• Information from cookies and similar technologies (detailed in Section 6 of this Policy).

Data received from third parties:

• Identity verification information received from partner KYC providers;
• Data from gambling self-exclusion lists, consulted to fulfill legal obligations;
• Fraud prevention and anti-money laundering data received from specialized partners.

4wim uses the personal data collected exclusively for the purposes listed below. No data is processed in a way that is incompatible with the purpose for which it was collected:

• Create and manage your account — identity verification, login authentication, and transactional communications related to your account;
• Process financial transactions — deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, TED; withdrawal processing; transaction history;
• Providing platform services — Sports Betting, live casino, poker, slots, crash games, predictions, and all other 4wim products;
• Identity verification (KYC) — compliance with legal requirements for fraud prevention and anti-money laundering (Law 9.613/1998);
• Fraud prevention and security — monitoring of suspicious activity, detection of multiple accounts, and protection of user balances;
• User support — support via live chat, WhatsApp, and email; interaction history for seamless continuity of service;
• Responsible gambling — monitoring of behavioral patterns to proactively identify at-risk situations, limit management, and self-exclusions;
• Marketing communications — sending promotions, bonuses, news, and relevant content, exclusively with your prior and revocable consent;
• Service improvement — analysis of platform usage to improve features, fix bugs, and develop new functionality;
• Compliance with legal and regulatory obligations — reports required by competent authorities, responses to court orders, and requests from regulatory bodies.

All personal data processing carried out by 4wim is grounded in at least one of the legal bases set out in Article 7 of the LGPD. The table below summarizes the main bases used by processing type:

* For processing based on consent, you may withdraw your consent at any time in your account settings or by contacting the DPO, without affecting the lawfulness of any processing carried out prior to that withdrawal.

4wim does not sell its users' personal data. Sharing with third parties occurs only in the situations below, always with appropriate safeguards in place:

• Payment processors: financial institutions and payment intermediaries responsible for processing transactions via Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED. These partners receive only the data strictly necessary to process each transaction;
• Identity verification (KYC) providers: specialized companies that assist with document verification and fraud prevention, operating under strict data processing agreements;
• Game and casino providers: game software providers (slots, crash games, live casino) that require a user identifier to record game results and transactions — without access to the user's full personal data;
• Infrastructure and cloud providers: companies that host the platform's servers and databases, operating as data processors under contracts containing data protection clauses equivalent to the LGPD;
• Public authorities: sharing with regulatory bodies, tax authorities, law enforcement, or judicial authorities takes place exclusively when required by law, court order, or formal request from a competent authority.

All third-party partners that process personal data of 4wim users are bound by contracts requiring compliance with the LGPD and equivalent standards of security and confidentiality.

4wim uses cookies and similar technologies (such as pixels, web beacons, and local storage) to ensure the platform works properly, personalize your experience, and analyze how our services are used. Below we detail the types of cookies in use:

• Strictly necessary cookies: essential for the platform to function — session authentication, security, language preferences. These cannot be disabled without affecting your ability to use 4wim;
• Functional cookies: remember your preferences on the platform, such as favorite sports, preferred markets, and odds display settings;
• Analytical cookies: used to analyze how users interact with the platform — most visited pages, navigation flows, errors encountered. All information is aggregated and anonymized;
• Marketing cookies: used only with your explicit consent, for personalizing communications and measuring the effectiveness of 4wim's own promotional campaigns.

You can manage your cookie preferences at any time through the cookie banner displayed on your first visit to the platform or in your account settings. Rejecting non-essential cookies will not prevent you from using 4wim, but may affect some personalization features.

4wim does not use cookies to track browsing activity outside its own platform, nor does it share cookie data with third-party advertising networks.

The technical protection of user data is treated as a top priority at 4wim. The security measures in place include:

• Encryption in transit: all data transmitted between the user's device and 4wim's servers is protected by TLS 1.3 with a 256-bit SSL certificate;
• Encryption at rest: sensitive data stored in our databases — passwords, identity documents, banking details — is encrypted using AES-256;
• Two-factor authentication (2FA): available to all users and mandatory for high-risk operations, such as changing your withdrawal method;
• Access control: access to users' personal data is restricted to employees with a justified operational need, and all access is logged and auditable;
• Continuous monitoring: intrusion detection and anomaly monitoring systems operating 24 hours a day, with immediate alerts to the security team;
• Regular security testing: penetration tests and security audits conducted periodically by independent firms;
• Incident response plan: a documented procedure for the identification, containment, and notification of data breaches, including communication to the ANPD and affected users within the timeframes required by the LGPD.

Despite all the measures above, no system is 100% breach-proof. In the event of a security incident affecting users' personal data, 4wim commits to notifying the affected data subjects and the National Data Protection Authority (ANPD) within the legally required timeframes, with clear information about the nature of the incident and the measures taken.

4wim retains personal data only for as long as strictly necessary to fulfill the purposes described in this Policy or to comply with legal obligations. The criteria used to determine retention periods include:

• Active account data: retained for as long as your account is active and for up to 5 years after closure, in compliance with legal obligations related to anti-money laundering and financial recordkeeping;
• Financial transaction data: retained for 5 years from the transaction date, as required by Brazilian tax and financial regulations;
• KYC documents: retained for the same period as account data — required for potential regulatory audits;
• Betting data & game history: retained for 5 years for dispute resolution and regulatory compliance purposes;
• Analytical cookie data: retained for up to 13 months from the date of collection;
• Support communications: retained for 2 years for quality assurance and service continuity purposes.

Once the applicable retention period ends, data is securely deleted or anonymized in a way that makes it impossible to re-identify the data subject, depending on the type of data and any remaining purpose.

As a 4wim account holder, the LGPD grants you a robust set of rights over your personal data that you can exercise at any time. See below what you can request and how:

• Access: to obtain confirmation that your data is being processed by 4wim and to receive a full copy of the personal data we hold about you;
• Correction: request the correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion: for data that is unnecessary, excessive, or processed in violation of the LGPD;
• Portability: to receive your data in a structured, machine-readable format for transfer to another service provider;
• Deletion: request the deletion of data processed on the basis of your consent, except where retention is required by law;
• Data sharing information: to know which public and private entities 4wim has shared your data with;
• Withdrawal of consent: withdraw consent previously given for processing based on that legal basis, such as marketing communications, without penalty;
• Objection: to object to processing based on legitimate interest when you believe your fundamental rights take precedence.

To exercise any of these rights, contact 4wim's DPO at privacidade@4wim.best or via the support chat. 4wim responds to all requests within 15 calendar days of receipt. For more complex cases, this period may be extended by an equal amount of time, with notice to the data subject explaining the reason for the extension.

If you believe your rights have not been adequately addressed, you have the right to file a complaint directly with the National Data Protection Authority (ANPD).

4wim is a platform exclusively for users aged 18 and over. We do not knowingly collect personal data from individuals under 18, and we do not permit this audience to register or use our services.

If 4wim identifies that it has collected data from a minor, that data will be immediately deleted and the account will be closed. If you suspect that a minor has created an account on the platform using false information, please notify our support team immediately at suporte@4wim.best or via live chat.

Parents or legal guardians who identify that a minor in their care has used the platform have the right to request the immediate deletion of all collected data and a refund of any amounts deposited by that minor.

4wim may update this Privacy Policy periodically to reflect changes in the services offered, applicable legislation, industry practices, or internal data processing procedures. Any material change will be communicated by email to the address registered on your account at least 15 days before taking effect.

The current version of this Policy will always be available on this page, with the date of the last update indicated at the top of the document. Your continued use of the platform after an updated version takes effect constitutes acceptance of the new terms. For processing activities that require consent, 4wim will request new explicit consent whenever changes affect the scope of the originally consented processing.

We recommend checking this page periodically. Any questions about updates can be addressed by our DPO at privacidade@4wim.best.

To exercise your rights as a data subject, ask questions about this Policy, or file a complaint regarding the handling of your personal data, please use the following channels:

• DPO (Data Protection Officer): privacidade@4wim.best — a channel dedicated exclusively to privacy and data protection inquiries, with responses within 15 calendar days;
• General support: suporte@4wim.best or live chat on the platform, available 24/7 in Brazilian Portuguese;
• WhatsApp: human support for general inquiries, including privacy-related questions.

4wim is committed to handling all personal data requests seriously and within the deadlines established by the LGPD. If the response you receive is unsatisfactory, you have the right to escalate your complaint directly to the National Data Protection Authority (ANPD), as provided for in article 18, paragraph 1, of Lei 13.709/2018.

This Privacy Policy is governed by the laws of the Federative Republic of Brazil, in particular Lei 13.709/2018 (LGPD) and the Consumer Protection Code (Lei 8.078/1990).