Privacy Policy of y559 — Your Data Protected by the LGPD

01Introduction and Data Controller

This Privacy Policy describes how y559 collects, stores, uses, and protects the personal data of users who register and use the Sports Betting and online casino platform available at y559.best. This document was drafted in compliance with the General Personal Data Protection Law — LGPD (Law No. 13,709/2018) — and reflects y559's genuine commitment to the privacy of every bettor.

Y559 acts as the controller of the personal data collected through the platform. This means y559 is responsible for defining the purposes and means of data processing, ensuring the security of that information, and responding to data subject requests. y559's Data Protection Officer (DPO) can be reached at contato@y559.best.

By creating a y559 account, making a deposit, placing a bet, or using any feature on the platform, you confirm that you have read and understood this Privacy Policy. It should be read together with the Terms and Conditions of y559, which govern general use of the platform. If you have any questions about this policy, y559 support is available via 24-hour chat.

02Data We Collect

Y559 collects personal data at different points during your interaction with the platform. Below are the main types of data and when they are collected:

Y559 follows the principle of data minimization: we collect only what is strictly necessary for the stated purpose. We do not request information that has no defined use, and we do not build behavioral profiles for sale to third parties.

03How y559 Uses Your Data

Personal data collected by y559 is used for the following purposes, each with a legal basis provided under the LGPD:

• Account creation and management: verify your identity, confirm that you meet the eligibility requirements (age, Brazilian residency, valid CPF), and keep your account active and secure.
• Financial transaction processing: process deposits via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago; execute withdrawals via Pix to the registered key; maintain transaction history for accounting and regulatory purposes.
• Betting and casino service operation: register and settle bets, calculate live odds, manage cash out, provide betting history, and allow participation in promotions and bonuses.
• Fraud and money laundering prevention: monitor unusual usage patterns, verify the source of funds when required by law, and ensure the platform is not used for unlawful activities. These checks follow COAF standards and all other applicable regulations.
• Account and service communications: send account-related emails and notifications — deposit confirmations, security alerts, notices of changes to terms, and bonus balance reminders. Marketing communications are only sent to users who have not opted out.
• Responsible gambling: monitor betting patterns to identify signs of problematic behavior and provide active support when needed, using the tools available on the platform.
• Platform improvement: analyze usage data in aggregated and anonymized form to identify technical issues, improve the browsing experience, and develop new features for Brazilian bettors.

Y559 does not use your personal data to make automated decisions that produce significant legal effects without the possibility of human review. Every material decision — such as account closure or balance retention due to suspected fraud — goes through review by the responsible team before being carried out.

04Legal Basis for Processing (LGPD)

The LGPD requires that every personal data processing operation have a specific legal basis. y559 grounds the processing of your data on the following legal bases set out in Article 7 of Law 13.709/2018:

• Contract performance (Art. 7, V): the majority of processing — registration data, financial transactions, bets, and account communications — is necessary to fulfill the contract you enter into when accepting y559's Terms and Conditions. Without this data, the platform simply cannot operate for you.
• Compliance with a legal obligation (Art. 7, II): identity verification (KYC), financial transaction records, and anti-money laundering monitoring are legal requirements that y559 must comply with regardless of your individual preference.
• Legitimate interest (Art. 7, IX): fraud analysis, account security, and platform improvement using aggregated data are activities that y559 carries out based on its legitimate interest, always balanced against the rights of data subjects.
• Consent (Art. 7, I): sending marketing communications — promotions, news, special odds on the Brasileirão — requires the consent you grant (or decline) during registration, which can be withdrawn at any time through your account dashboard.

05Data Sharing with Third Parties

Y559 does not sell users' personal data. Information is only shared with third parties in the cases below, each with a specific, controlled purpose:

• Payment processors: the data required to process Pix, boleto bancário, credit/debit card, and digital wallet transactions is shared with payment service providers authorized by y559. These partners act as data processors under contracts that impose security and confidentiality obligations equivalent to those of y559.
• Game software providers: to operate the live casino tables and slots, y559 uses licensed software platforms. These providers receive only the minimum data necessary to run the games — such as session identifier and balance — and are contractually prohibited from using that information for any other purpose.
• Analytics and security providers: fraud monitoring and cybersecurity tools used by y559 may process technical data (IP address, device fingerprint) to identify suspicious access. This data is handled in pseudonymized form and is not used for advertising purposes.
• Competent authorities: y559 may share data with the Brazilian Central Bank, Federal Revenue Service, COAF, Federal Police, or other authorities when legally required, pursuant to a court order, formal administrative request, or to fulfill anti-money laundering obligations.

No personal data is shared with advertisers, data brokers, behavioral advertising platforms, or any other company not directly involved in operating the service. All third parties that receive data from y559 are subject to data processing agreements requiring LGPD compliance and equivalent security standards.

06Cookies and Tracking Technologies

Y559 uses cookies and similar technologies to ensure the platform runs properly, improve the user experience, and analyze performance. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — keeping your session active, remembering your selected language, and ensuring the bet slip works correctly. These cookies cannot be disabled without affecting platform functionality.
• Performance cookies: collect data about how you navigate the platform — which pages you visit, how long you spend in each section, and which features you use most. The information is aggregated and anonymized, with the goal of identifying usability improvements.
• Preference cookies: remember settings you have chosen — such as displaying odds in decimal or fractional format, or which sports appear on your home screen — to personalize your experience without requiring you to reconfigure them on every visit.
• Security cookies: help detect fraudulent access attempts by identifying unknown devices and unusual browsing patterns that may indicate account compromise.

Y559 does not use third-party behavioral advertising cookies. There are no social media tracking pixels or ad platform trackers installed on any page of the platform. You can manage your non-essential cookie preferences in your browser settings, but disabling essential cookies may impair or prevent normal use of y559.

07Information Security

Y559 applies a set of technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure. Key measures in place include:

• 256-bit SSL encryption across all communication between your device and y559's servers. Every piece of data transmitted — including passwords, payment details, and personal information — is encrypted in transit.
• Encrypted storage: passwords are stored using one-way hashing — not even y559's team has access to your password in plain text. Sensitive financial data is encrypted at rest.
• Role-based access control: only employees with a specific operational need have access to users' personal data. Access is logged and periodically audited.
• Continuous monitoring: automated intrusion detection systems monitor the infrastructure 24 hours a day. Suspicious access attempts are blocked automatically and investigated by the security team.
• Regular security testing: y559 conducts regular security audits and penetration tests to identify and address vulnerabilities before they can be exploited.

Despite every effort, no online platform can guarantee absolute security against all types of threat. In the event of a security incident that may affect your personal data, y559 will notify impacted users and the National Data Protection Authority (ANPD) within the timeframes required by law, as set out in the LGPD.

08Data Retention and Deletion

Y559 retains personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with mandatory legal retention periods. The retention criteria are as follows:

• Registration and identity data: retained for the entire period the account is active and for a minimum of 5 years after closure, in accordance with anti-money laundering regulations and tax obligations.
• Financial transaction history: retained for a minimum of 5 years after each transaction, in accordance with Brazil Central Bank regulations and Brazilian tax legislation.
• Betting history: retained for the duration of the account and for 2 years after closure, for audit, dispute resolution, and regulatory compliance purposes.
• Access logs and technical data: retained for up to 6 months, which may be extended in the event of an ongoing security investigation or legal proceeding.
• Support communications: retained for 2 years for customer service quality and dispute resolution purposes.

When retention periods expire and there is no legal obligation requiring the data to be kept, y559 carries out secure deletion or irreversible anonymization. To request deletion of data not subject to mandatory retention, contact us at contato@y559.best or via the support chat.

09Your Rights as a Data Subject under the LGPD

The Lei Geral de Proteção de Dados grants you, as the data subject, a set of rights that y559 is committed to respecting and facilitating. Here is what you can request:

10Minors Under 18

Y559 is a Sports Betting and online casino platform intended exclusively for users aged 18 and over. Registration by anyone under 18 is strictly prohibited, and y559 takes active measures to prevent it.

Age verification is carried out via CPF at the time of registration. The system cross-references the CPF provided with the date of birth to confirm the user has reached legal age. Accounts identified as belonging to users under 18 are closed immediately, with the balance held pending investigation and returned to the legal guardians after verification.

Y559 does not knowingly collect personal data from anyone under 18. If you believe a minor has used the platform, please contact support at contato@y559.best so the case can be investigated and resolved as a priority.

Any data from minors inadvertently collected — prior to identification of the irregular registration — is deleted immediately upon discovery, without being stored in y559 systems for longer than strictly necessary for the investigation.

11International Data Transfer

Y559 prioritizes storing and processing data on servers located in Brazil or in countries that offer an adequate level of data protection as defined by ANPD criteria. When technical or operational requirements mean that data must be processed by providers with infrastructure in other countries, y559 ensures that:

• The destination country offers a level of data protection compatible with the LGPD, either through a regulatory decision or a specific contract.
• Standard data protection contractual clauses are incorporated into agreements with international providers, imposing obligations equivalent to those under the LGPD.
• The transfer is limited to the data strictly necessary for the operation of the contracted service.
• Y559 keeps records of all international transfers made and can present them to the ANPD upon request.

Live casino software providers that may operate with infrastructure outside Brazil are selected based on their security certifications and compliance with internationally recognized data protection regulations.

12Changes to This Privacy Policy

Y559 may periodically update this Privacy Policy to reflect changes in internal processes, applicable legislation, or technologies used. Significant changes will be communicated at least 7 days in advance via the registered email address and through a prominent notice on the platform.

The date of the most recent update is always shown at the top of this page. We recommend revisiting this document periodically to stay informed about how y559 handles your personal data. Continued use of the platform after any changes take effect constitutes acceptance of the updated policy.

For any questions about this Privacy Policy, to exercise your rights as a data subject, or to report any privacy-related concern, please contact y559 through the following channels:

• Live chat: available 24 hours a day directly on the y559.best platform
• DPO Email: contato@y559.best

Y559 is committed to responding to data subject requests within 15 business days, in line with the timeframe established by the LGPD.