P8pg Privacy Policy – LGPD Data Protection

This document explains how p8pg collects, uses, stores, and protects your personal data in accordance with the General Data Protection Law (LGPD — Law No. 13.709/2018). Please read it carefully to understand your rights as a data subject and how to exercise them.

Last updated: January 1, 2026
Official language: Portuguese (pt-BR)
Applicable law: LGPD — Brazil

How p8pg protects your data

A summary of the key pillars of our privacy approach — straight to the point, no unnecessary legal jargon.

256-bit SSL Encryption
All traffic between your phone or computer and p8pg's servers is protected by 256-bit SSL encryption — the same standard used by Brazil's largest banks, including Itaú, Bradesco, and Nubank. Your registration details, passwords, and payment information are never transmitted in plain text.
Full LGPD Compliance
p8pg processes your personal data in strict compliance with Brazil's General Data Protection Law (Lei nº 13.709/2018). Every processing activity has an explicit legal basis — consent, legal obligation, or legitimate interest — and you may challenge any of them at any time through the DPO contact channel.
Your Guaranteed Data Subject Rights
You have the right to access, correct, port, anonymize, and request the deletion of your data at any time. p8pg responds to data subject requests within 15 calendar days by email or chat, as required by the LGPD. The process is straightforward with no unnecessary red tape.
No Sale of Data to Third Parties
p8pg does not sell, rent, or transfer your personal data to third parties for commercial or marketing purposes. Data shared with partners — such as Pix payment processors and game providers — is strictly limited to what is necessary for service delivery and is covered by confidentiality agreements.
Secure and Minimized Storage
p8pg collects only the data necessary to operate the platform and meet legal obligations — in line with the LGPD's data minimization principle. Financial data from transactions via Pix, boleto, or card is stored with additional encryption in a database layer separate from the rest of the user profile.
Incident Notification
In the event of a security incident that could pose a significant risk or harm to data subjects, p8pg notifies the National Data Protection Authority (ANPD) and the affected users within the legally required timeframe, providing clear information about what occurred, which data was involved, and the measures taken.

1

Data Controller

For the purposes of the General Data Protection Law (LGPD — Law No. 13.709/2018), the controller of the personal data processed within the p8pg platform is the operating company of the p8pg.best website, hereinafter referred to simply as "p8pg".

P8pg is responsible for all decisions regarding the processing of users' personal data — including defining the purposes of collection, the means used in processing, retention periods, and the security measures implemented to protect that information.

P8pg's Data Protection Officer (DPO) can be reached by email at privacidade@p8pg.best for matters related to this Policy, the exercise of data subject rights, or any questions about the processing of your personal data.

2

Data We Collect

P8pg collects personal data at various points during your interaction with the Platform. Collection follows the principle of minimization — we only gather what is necessary for the purposes described in this Policy. Below are the main categories of data we process:

Category Data Collected When
Registration Full name, CPF, date of birth, email, mobile number with area code, residential address At the time of registration
KYC Verification Government-issued photo ID (national ID, driver's license, or passport), proof of address, selfie for biometric validation Before the first withdrawal
Financial Pix key, credit/debit card details (tokenized), deposit and withdrawal history, payment method used On each financial transaction
Platform Activity Betting history, games accessed, gaming sessions, bonus usage, betting preferences While using the Platform
Technical & Device IP address, device type, operating system, browser, approximate geolocation data, session identifiers On each visit to the Platform
Communications Chat support conversation history, emails exchanged with the p8pg team, formal complaint records When contacting support

p8pg does not collect sensitive data as defined under the LGPD (data relating to health, racial origin, religious belief, political opinion, or sexual orientation) except where strictly necessary to fulfill a legal obligation or to protect the life of the data subject or of third parties.

3

How We Use Your Data

Personal data collected by p8pg is used exclusively for the following purposes:

  • Provision of Platform services: account creation and management, processing deposits via Pix, boleto, and card, settling bets, crediting winnings, and processing withdrawals.
  • Identity verification (KYC): confirmation of the User's identity for fraud prevention, compliance with applicable regulations, and protection against unauthorized account use.
  • Anti-money laundering (AML): transaction monitoring to identify suspicious patterns, as required by applicable Brazilian legislation.
  • User Communication: sending notifications about bets, withdrawals, bonuses, changes to the Terms and Conditions, security alerts, and responses to support requests.
  • Experience personalization: displaying relevant games and bets based on usage history, and suggesting promotions suited to the User's profile.
  • Responsible gambling: monitoring of usage patterns to identify at-risk behavior and trigger responsible gaming tools where applicable.
  • Platform Improvement: analysis of aggregated and anonymized data to identify issues, improve performance, and develop new features.
  • Compliance with legal obligations: responding to requests from judicial, regulatory, or tax authorities as required by law.

P8pg does not use personal data for third-party marketing purposes or share it with external advertisers. Marketing communications from p8pg itself are sent only to Users who have not opted out of the communications list.

4

Legal Bases for Processing (LGPD)

The LGPD requires that all personal data processing have a specific legal basis. p8pg carries out its processing activities based on the following grounds set out in art. 7 of Law No. 13,709/2018:

  • Contract performance (art. 7, V): processing is necessary for the performance of the service agreement between p8pg and the User — including registration, bet processing, Pix payments, and withdrawals. This is the primary legal basis for most processing operations.
  • Compliance with a legal obligation (art. 7, II): certain processing operations are required to fulfill legal obligations applicable to p8pg, such as anti-money laundering rules, identity verification, and reporting to regulatory authorities.
  • Consent (art. 7, I): for processing not covered by the bases above — such as sending marketing communications and using non-essential cookies — p8pg requests the User's express consent, which may be withdrawn at any time.
  • Legitimate interest (Art. 7, IX): for activities such as fraud prevention, Platform security, and service improvement based on anonymized data — always respecting Users' rights and reasonable expectations.
  • Protection of life and health (art. 7, VII): in situations related to responsible gambling that may pose a risk to the User's wellbeing, p8pg may process data to activate protective measures.

You may ask p8pg's DPO at any time about the specific legal basis for any processing operation carried out with your data. Get in touch at privacidade@p8pg.best.

5

Data Sharing

P8pg may share Users' personal data with third parties in the following situations, always limited to what is strictly necessary:

  • Payment processors: data required to process transactions via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago is shared with the respective financial institutions and payment platforms. These partners act as data processors and are bound by confidentiality agreements.
  • Game providers: minimum session data (anonymized user identifier, session balance) is shared with certified providers such as Microgaming, NetEnt, Play'n GO, Pragmatic Play, and Spribe to enable casino games. No personally identifiable data is transmitted beyond what is strictly necessary.
  • Identity verification services: documents submitted during the KYC process are handled by partners specialized in biometric and document verification, bound by strict data protection agreements.
  • Authorities and public bodies: data may be shared with the Brazilian Central Bank, Federal Revenue Service, Federal Police, the Judiciary, and other competent authorities when required by law, court order, or regulatory mandate.
  • Auditors and consultants: in legal or financial compliance audits, anonymized or aggregated data may be accessed by external auditors under strict confidentiality terms.

P8pg does not share personal data with advertising companies, data brokers, social media platforms, or any third party for those parties' own commercial purposes. All data transfers are documented and auditable as required by the LGPD.

p8pg does not transfer personal data internationally to countries that do not offer an adequate level of protection, as assessed by the ANPD. When operationally necessary, transfers are supported by appropriate safeguards provided for under the LGPD.

6

Data Storage & Security

Users' personal data is stored on servers protected by the following technical and organizational security layers:

  • Encryption in transit: all communication between Users' devices and p8pg's servers uses the TLS (Transport Layer Security) protocol with a 256-bit SSL certificate.
  • Encryption at rest: financial data, KYC documents, and sensitive information are stored with additional encryption in the database, logically separated from other profile data.
  • Access control: internal access to User data is restricted by role and necessity — only staff with a legitimate need have access, and all access is recorded in audit logs.
  • Continuous monitoring: automated intrusion detection and anomaly monitoring systems operate around the clock to identify unauthorized access attempts.
  • Secure backups: security backups are performed regularly and stored with encryption at a location geographically separate from the primary servers.
  • Penetration testing: p8pg conducts regular security tests (pentests) to identify and fix vulnerabilities before they can be exploited.

In the event of a security incident resulting in unauthorized access to personal data, p8pg will notify the National Data Protection Authority (ANPD) and the affected Users within the legally required timeframe — with clear information about the nature of the incident, the data involved, and the corrective measures taken.

7

Cookies & Tracking Technologies

P8pg uses cookies and similar technologies to improve the experience of using the Platform. The types of cookies used are:

  • Essential cookies: required for the basic operation of the Platform — session authentication, bet slip management, language and currency preferences. These cookies cannot be disabled without affecting Platform functionality.
  • Performance cookies: collect anonymized data on how Users navigate the Platform — pages visited, session duration, errors encountered. Used exclusively to improve p8pg's performance and usability.
  • Functionality cookies: store personalized User preferences — such as favorite games, betting settings, and preferred payment method — to streamline your experience in future sessions.
  • Analytical cookies: used for aggregated User behavior analysis, usage trend identification, and improvement planning. Data is anonymized prior to any analysis.

Third-party advertising cookies not used by p8pg. The Platform does not integrate tracking pixels from social networks or external advertising platforms.

You can manage your cookie preferences through the banner displayed on your first visit to the Platform or through your browser settings. Disabling non-essential cookies may affect some personalization features but will not prevent you from using p8pg's core functions.

8

Your Rights as a Data Subject

The LGPD grants personal data subjects a set of rights that p8pg is fully committed to upholding. See each right and how to exercise it below:

Right of Access
Request a full copy of all personal data p8pg holds about you, including the purpose of processing and with whom it has been shared.
Right to Correction
Request the correction of incomplete, inaccurate, or outdated data. Updates to your email, mobile number, and address can be made through the chat support.
Right to Erasure
Request the deletion of your personal data when processing is based on consent or when the data is no longer needed for its original purpose.
Right to Data Portability
Receive your personal data in a structured, machine-readable format to transfer it to another controller, in accordance with ANPD regulations.
Right to Object
Object to processing based on legitimate interest when you have grounds related to your particular situation. p8pg will review your request and provide justification for either continuing or discontinuing the processing.
Right to Information
Request information about the public and private entities with which p8pg has shared your data, and get clarity on any processing that has taken place.

To exercise any of the rights listed above, contact p8pg's DPO by email at privacidade@p8pg.best or via the support chat available 24 hours a day on the website and app. p8pg responds to data subject rights requests within 15 calendar days from the date the request is received, as established by the LGPD.

If you believe your rights have not been adequately addressed, you may file a complaint directly with the National Data Protection Authority (ANPD) through the gov.br/anpd portal.

9

Data Retention

P8pg retains Users' personal data for as long as needed for each purpose, in compliance with applicable legal retention periods:

  • Registration and KYC data: retained for the duration of the account and for a minimum of 5 years after account closure, in compliance with anti-money laundering obligations and any potential need to defend against administrative or legal proceedings.
  • Financial transaction history: retained for a minimum of 5 years after each transaction, in compliance with Brazilian tax legislation and financial sector regulations.
  • Betting and gaming history: maintained by 2 years after the last account activity, after which data is anonymized or deleted, unless retention is required by a legal obligation.
  • Support communications: retained for 2 years after each ticket is closed, for quality assurance and future reference purposes.
  • Technical data and access logs: retained for 6 months for security and incident investigation purposes, after which they are deleted or anonymized.

Once retention periods expire, data is securely and irreversibly deleted or anonymized so that it can no longer be linked to a specific individual.

A request to delete data submitted by the data subject may not be fulfilled in full during the period in which p8pg is legally required to retain the data (for example, for anti-money laundering purposes). In such cases, p8pg will inform the data subject of which data cannot be deleted and the applicable retention period.

10

Minors

The p8pg platform is intended exclusively for people who are 18 (eighteen) years of age or older. p8pg does not intentionally collect personal data from minors and does not permit registration or use of the Platform by individuals in that age group.

Age verification is carried out during the KYC process through analysis of the User's official ID document. If p8pg determines that a User is under 18 years of age, the account will be immediately closed, the collected data will be deleted in accordance with applicable security procedures, and any deposits will be refunded to the original payment method.

If you are a parent or guardian of a child or adolescent and believe their data may have been inadvertently collected by the Platform, please contact the DPO immediately at privacidade@p8pg.best. p8pg will handle the request on a priority basis.

11

Changes to This Policy

P8pg may update this Privacy Policy periodically to reflect changes in data processing practices, new legal or regulatory requirements, or improvements to the Platform's services.

Significant changes — especially those that expand the scope of data processing or affect data subjects' rights — will be communicated with a minimum advance notice of 15 calendar days via the email address registered by the User and through a prominent notice on the Platform. For minor changes (text corrections or clarifications that do not affect the substance of processing), updates may be published without prior notice.

The current version of this Policy will always be available at p8pg.best/privacy-policy, with the date of the last update indicated at the top of the document. Continued use of the Platform after a new version takes effect constitutes acceptance of the changes made.

12

Contact & Data Protection Officer (DPO)

For any questions related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, you can reach p8pg through the following channels:

  • DPO (Data Protection Officer): privacidade@p8pg.best — for formal LGPD requests, exercise of data subject rights, security incidents, and compliance matters.
  • General support: contato@p8pg.best — for questions about how the Platform works, your User account, and other matters not specifically related to personal data.
  • Live chat: available 24 hours a day, 7 days a week, on the p8pg website and app — for immediate support inquiries.

P8pg responds to personal data requests within 15 calendar days from the date of receipt. For more complex requests that require additional investigation, p8pg may extend the deadline by up to 15 additional days, with prior notice to the data subject explaining the reason for the extension.

This Privacy Policy is governed by Brazilian law, in particular the General Data Protection Law (Law No. 13.709/2018). In the event of any conflict between this Policy and the LGPD, the provisions of the law shall prevail. The courts of the district of São Paulo, SP, are designated as the exclusive venue for resolving any disputes.


Privacy at p8pg: what it means for you in practice

Data privacy tends to feel like an abstract concept — until something goes wrong. At p8pg, the approach is different: data protection practices exist so that this "moment when something goes wrong" never happens — and so that, even if it does, you know exactly what was affected and what your rights are. This section explains, in plain terms, what p8pg's Privacy Policy means for your day-to-day experience as a platform user.

The first thing worth understanding is what p8pg collects and why. During registration, you're asked for your name, CPF, date of birth, email, and phone number — the minimum required to create a secure account and verify the account holder's identity. No additional data is collected at this stage. Your CPF is required because it is every Brazilian's unique tax identifier, used to confirm that only one account exists per person and to meet the regulatory obligations applicable to this sector. Your phone number is used for two-factor authentication and important security communications — not for marketing campaigns without your consent.

During the KYC process — the identity verification carried out before the first withdrawal — p8pg requests a photo ID and proof of address. This step is required by anti-money laundering regulations applicable to the industry, not out of curiosity on the platform's part. The submitted documents are processed by a partner specialized in document verification, under a confidentiality agreement, and are not accessible to p8pg staff who do not have a direct operational need. After verification, the document image is stored with additional encryption in an environment separate from the rest of the user profile.

For financial transactions — deposits via Pix, boleto, or card, and withdrawals to Nubank, Itaú, Bradesco, Banco do Brasil, or any other Brazilian bank accounts — data travels through encrypted channels and reaches only the payment processors required to complete the transaction. p8pg does not store your full credit or debit card number: this data is tokenized at the time of the transaction, meaning only a token (reference code) is recorded in the platform's systems, never the actual card number.

Activity data — which games you accessed, which bets you placed, when you logged in — is used by p8pg for two main purposes: improving your experience (by suggesting relevant games and promotions suited to your profile) and monitoring patterns related to responsible gambling. If usage data indicates a risky behavioral pattern — for example, a sudden increase in betting frequency and amounts following a streak of consecutive losses — the system may trigger alerts or suggest self-control tools. This is a user protection feature, not commercial surveillance.

Your rights as a data subject at p8pg are the same rights guaranteed by the LGPD: you can request a copy of all your data, correct outdated information, request the deletion of data that is no longer needed, withdraw previous consents, and challenge any data processing operation. The channel for exercising these rights is privacidade@p8pg.best, with a response time of up to 15 calendar days. There is no bureaucratic form or waiting queue — a simple email with your name and what you need is all it takes to get the process started.

One aspect that sets the p8pg from some other platforms in the industry: the absence of third-party tracking pixels and integration with external advertising networks. The platform does not share your browsing behavior with advertising companies to target you with related ads on other sites. What happens on p8pg stays on p8pg — except where the law requires otherwise, such as mandatory disclosures to tax authorities or anti-money laundering compliance. Even in those cases, p8pg notifies affected users whenever possible and permitted by law. Transparency is the foundation of a long-term trust relationship — and that is exactly what p8pg aims to build with each of its 500,000+ registered users in Brazil.


Summary of Your LGPD Rights

Brazil's General Data Protection Law (LGPD) grants concrete rights that p8pg respects and makes easy for you to exercise.

Access

Find out what data p8pg holds about you, for what purposes, and with whom it has been shared. Requests submitted by email are answered within 15 days.

Correction

Correct incomplete or outdated information at any time — email, phone number, address — through chat support or by contacting the DPO.

Deletion

Request the deletion of your data when processing is based on consent or when it is no longer necessary. Applicable legal retention periods will be communicated.

Portability

Receive your data in a structured format to port it to another service, in accordance with current ANPD regulations.

Withdrawal of Consent

Withdraw previously granted consents — such as receiving marketing communications — at any time, with no penalty.

Complaint to the ANPD

If you believe your rights have not been honored, you may file a complaint directly with the National Data Protection Authority (ANPD) at gov.br/anpd.

To exercise any right: privacidade@p8pg.best — response within up to 15 calendar days.


Financial Data: How We Handle Your Transactions

Each payment method has its own specific data handling — always limited to the minimum necessary to complete the transaction.

Pix – tokenized key, no full banking data stored
Boleto Bancário – generated by a certified partner processor
Credit card – tokenized number, never stored in full
Debit Card – same handling as credit card
PicPay – integrated via secure API, with no access to the user's PicPay account
Mercado Pago – data flows directly between the user and Mercado Pago
TED – Nubank, Itaú, Bradesco, Banco do Brasil, and other Brazilian banks

The holder of the payment method must always be the same person as the p8pg account holder. Third-party transactions are declined and returned to their source.


Usage Data & Responsible Gambling

P8pg uses activity data to protect you — never to exploit at-risk behaviors.

Risk Pattern Monitoring

P8pg monitors usage patterns to identify behaviors associated with problem gambling — such as sudden increases in frequency, chasing losses, and excessively long sessions. When detected, the system triggers suggestions for control tools and may proactively reach out to the User.

Usage Data Is Never Sold

Your betting history, favorite games, and session patterns are never shared with advertisers or used to build commercial behavioral profiles outside p8pg. This data exists to enhance your experience and to protect your financial well-being.

Control in Your Hands

Set deposit, bet, and loss limits in your account settings. Request temporary or permanent self-exclusion with immediate effect. You have full control over the platform's responsible gambling tools — no red tape.

24/7 Support Available

If you need support related to problem gambling, contact CVV at 188. p8pg support is also available 24/7 via live chat to guide you on responsible gaming tools. Platform for users aged 18 and over only.

Learn more about Responsible Gambling

Your data protected. Your privacy respected.

P8pg was built with security and compliance as its foundation — not as an afterthought. Create your account, deposit via Pix from R$ 10.00, and play with the peace of mind of knowing your data is in good hands.

Português