1 Introduction and Data Controller
This Privacy Policy describes how 98a98 ("Platform", "we", "our"), operator of the website 98a98.best, collects, uses, stores, and protects the personal data of users ("you", "your") who access or use our sports betting, live casino, poker, jackpot, and other products available on the platform.
98a98 acts as the data controller under the terms of the General Personal Data Protection Law (LGPD — Law No. 13.709/2018). This means we are responsible for decisions regarding the processing of your personal data and for upholding the rights established under Brazilian law.
This Policy applies to all 98a98 users, regardless of how they access the platform — desktop, mobile, tablet, or any other device. By creating an account or using our services, you confirm that you have read and understood this Policy and agree to the processing described herein.
98a98's commitment: We treat your personal data with the same care we give your money — with security, transparency, and respect. If you have any questions about how your data is used, our team is available 24 hours a day at contato@98a98.best.
2 Personal Data We Collect
The 98a98 collects only the data strictly necessary to operate the platform securely, meet legal obligations, and deliver the best possible experience to Brazilian users. The main data collected includes:
| Category |
Data Collected |
Mandatory |
| Identification |
Full name, CPF, date of birth, RG (when required) |
Required |
| Contact |
Email address, mobile number, residential address |
Required |
| Financial |
Pix key, credit/debit card details (tokenized), transaction history |
Required for transactions |
| Platform Usage |
Betting history, game sessions, preferences, events accessed |
Automatic |
| Technical |
IP address, device type, operating system, browser, session cookies |
Automatic |
| Verification |
Selfie with ID document, proof of address (KYC process) |
Required for withdrawals |
Sensitive data — such as racial origin, religious beliefs, health data, or sexual orientation — is not collected by 98a98 and plays no part in any registration or verification process on the platform.
3 How We Collect Your Data
The personal data of users of 98a98 are collected through the following means:
- Direct registration: information you provide when creating your account, such as name, CPF, email, date of birth, and mobile number;
- Platform usage: data automatically generated as you browse, place bets, access the live casino, play poker, or carry out financial transactions;
- Identity verification (KYC): documents voluntarily submitted by you to enable withdrawals and advanced account features;
- Financial transactions: payment data provided during deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, or TED transfer;
- Cookies and similar technologies: information collected automatically during browsing, as detailed in Section 9 of this Policy;
- Support communications: messages sent to our team via live chat or email, including the content of interactions for quality assurance and dispute resolution purposes.
Data Minimization Principle: 98a98 follows the principle of data minimization — we collect only what is necessary for each specific purpose. We do not ask for information we don't use.
4 Purpose of Data Processing
The 98a98 uses your personal data exclusively for the following purposes:
- Account operation: create, manage, and authenticate your account on the platform, and process deposits and withdrawals via Pix and other Brazilian payment methods;
- Service provision: place sports bets on Brasileirão, Copa do Brasil, Libertadores, UFC, volleyball, basketball (NBB), e-sports, and other competitions; access Live Casino, poker, slots, crash games, and jackpots;
- Identity verification and fraud prevention: confirm that you are who you say you are and protect your account from unauthorized access and fraudulent activity;
- Legal compliance: comply with obligations set out in the LGPD, Brazilian anti-money laundering legislation (Law No. 9.613/98), and the regulatory standards applicable to the online betting sector;
- Responsible gambling: monitor gameplay behavior patterns to identify signs of problem gambling and activate the protection tools available on the platform;
- Operational communications: send transaction confirmations, security alerts, account updates, and relevant notifications about bets and tournaments;
- Platform improvement: analyze aggregated and anonymized usage data to improve the experience, identify technical issues, and develop new features;
- Marketing communications: send promotions, bonuses, and updates from 98a98, exclusively to users who have explicitly consented to receive them. You may opt out at any time.
5 Legal Basis for Processing (LGPD)
All personal data processing carried out by 98a98 is grounded in one of the legal bases set out in article 7 of the LGPD. The main legal bases we rely on are:
- Contract performance (art. 7, V): processing necessary for the provision of contracted services — account operation, bet processing, deposits, and withdrawals. This is the primary legal basis for most processing carried out by 98a98;
- Legal or regulatory obligation (art. 7, II): processing required by law, such as identity verification (KYC) for anti-money laundering compliance and retention of financial records as required by the relevant authorities;
- Legitimate interest (art. 7, IX): fraud prevention, platform security, and service improvement, provided these do not override your fundamental rights and freedoms;
- Consent (art. 7, I): sending marketing communications and using non-essential cookies. You may withdraw your consent at any time without any consequences for your use of the platform.
Transparency in Legal Bases: If you'd like to know the specific legal basis for a particular data processing activity by 98a98, simply submit a request by email. We respond within 15 business days with detailed information.
6 Data Sharing with Third Parties
The 98a98 does not sell, rent, or trade users' personal data. Sharing occurs only in the situations below and always limited to the minimum necessary:
- Payment processing partners: financial institutions and payment processors that enable transactions via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers to banks such as Nubank, Itaú, Bradesco, Banco do Brasil, and Caixa. These partners act as data operators and are contractually required to process data solely for that specific purpose;
- Game providers: companies that provide Live Casino content, slots, crash games, and other products receive the minimum data necessary to deliver the service, such as user identifier and session information;
- Identity verification services (KYC): specialized platforms that assist with the document verification process, bound by confidentiality agreements and restricted data processing terms;
- Competent authorities: sharing with regulatory bodies, tax authorities, or law enforcement when required by law, court order, or regulations applicable to the online betting sector in Brazil;
- Infrastructure services: hosting providers, network security, and technical analytics companies that process data as operators, with access strictly limited to what is necessary to deliver the contracted services.
98a98 requires all third parties that receive user data to sign data processing agreements ensuring compliance with the LGPD and equivalent protection standards.
7 Data Retention & Storage
The 98a98 retains your personal data only for as long as strictly necessary to fulfill the purposes described in this Policy or to meet applicable legal obligations. The main retention periods are:
- Registration and account data: retained for the entire period the account remains active. After the account is closed, data is kept for up to 5 years to meet legal obligations and resolve any potential disputes;
- Financial transaction records: retained for a minimum of 5 years as required by Brazilian anti-money laundering legislation and applicable tax regulations;
- Identity verification data (KYC): retained for the period required by industry regulations, generally 5 years after the last use of the data;
- Betting History & Gaming Sessions: retained for up to 3 years for dispute resolution, auditing, and responding to user requests;
- Technical and security logs: retained for up to 12 months for security analysis and incident investigation purposes.
Once the applicable retention period has ended, data is securely deleted or irreversibly anonymized for use in aggregated statistical analysis.
Storage in Brazil: 98a98 users' personal data is preferably stored on servers located in Brazil. When storage occurs in another country, we apply the safeguards set out in Section 12 of this Policy.
8 Data Security
The 98a98 implements robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or improper destruction. The main security measures in place include:
- 256-bit SSL/TLS encryption: all communications between your device and 98a98's servers are encrypted, including login credentials, payment information, and any personal data transmitted;
- Payment data tokenization: credit and debit card data is never stored in plain text — it is converted into encrypted tokens that cannot be reversed to the original data without specific authorization;
- Role-based access control: 98a98 employees have access only to the data required to perform their specific duties. Access to sensitive data is restricted and audited;
- Two-factor authentication: available to all users as an additional layer of account access protection;
- Continuous monitoring: automated systems monitor transactions and access in real time to detect suspicious activity and potential fraud;
- Regular security testing: periodic vulnerability assessments and penetration testing carried out by specialized teams.
In the event of a security incident that may affect your personal data, 98a98 will notify the National Data Protection Authority (ANPD) and the affected users within the legally established timeframe, with information about the nature of the incident and the measures taken.
9 Cookies and Tracking Technologies
The 98a98 uses cookies and similar technologies to ensure the platform functions properly, improve the user experience, and — with your consent — personalize content and analyze service usage. The types of cookies used are:
-
Essential cookies — required for core platform functionality:
Login session
Language preferences
CSRF Security
Bet slip
-
Analytics cookies — help us understand how users interact with the platform (with consent only):
Pages visited
Session duration
Navigation flow
Technical errors
-
Personalization cookies — remember your preferences to personalize your experience (with consent only):
Favorite sports
Recent games
Preferred odds
Essential cookies cannot be disabled without affecting the platform's functionality. For all other cookies, you can manage your preferences at any time through your browser settings or via the privacy panel in your 98a98 account.
No cross-site tracking: 98a98 does not use third-party cookies to track your activity on other sites outside the 98a98.best platform. The analytical cookies we use are configured with IP anonymization enabled.
10 Protection of Minors' Data
The services of 98a98 are intended exclusively for users aged 18 and over. The platform does not intentionally collect personal data from minors. Registration requires age confirmation, and the identity verification process (KYC) detects and prevents the registration of underage users.
If 98a98 determines that personal data from a minor was inadvertently collected, that information will be deleted immediately and the associated account will be closed. If you believe a minor may have created an account on the platform, please contact support at contato@98a98.best so the matter can be addressed urgently.
Accountability of Data Controllers: Parents and legal guardians must take steps to prevent minors from accessing 98a98. If you use shared devices with minors, set up two-factor authentication on your account to prevent unauthorized access.
11 How to Exercise Your Rights (LGPD)
To exercise any of the rights guaranteed by the LGPD regarding your personal data held by 98a98, follow the procedure below:
- Send an email to contato@98a98.best with the subject line "LGPD Rights — [type of request]";
- Enter full name, registered CPF, and the type of request (access, correction, deletion, portability, etc.);
- For deletion or portability requests, you may be asked to verify your identity with an additional document;
- 98a98 will respond to your request within 15 business days, within the timeframes established by the LGPD;
- If a request cannot be fulfilled, you will be informed of the reason and the available alternatives.
If you are not satisfied with 98a98's response, you have the right to file a complaint with the National Data Protection Authority (ANPD), the authority responsible for overseeing LGPD compliance in Brazil.
Response Time: We are committed to responding to all LGPD rights requests within 15 business days. For simple requests — such as updating a phone number or email address — support is typically provided within 24 hours via live chat.
12 International Data Transfers
In exceptional circumstances — such as the use of international cloud infrastructure or partnerships with global game providers — personal data of users of the 98a98 may be transferred outside Brazil. When this occurs, 98a98 applies the following safeguards, in accordance with article 33 of the LGPD:
- Transfers only to countries that provide a level of personal data protection equivalent to that required by the LGPD, as assessed by the ANPD;
- Execution of standard contractual clauses with data recipients, ensuring a level of protection equivalent to that required by Brazilian law;
- Adoption of supplementary measures — such as additional encryption and data minimization — when the level of protection in the destination country is deemed insufficient on its own;
- Documentation and records of all international transfers carried out, available for review by the ANPD upon request.
Users may request specific information about international transfers involving their data by emailing contato@98a98.best.
13 Changes to this Privacy Policy
The 98a98 may update this Privacy Policy periodically to reflect changes in data processing practices, in response to new legal requirements, or to improve the clarity of the information provided. Material changes will be communicated at least 7 days in advance through:
- Email notification to the address registered on the account;
- Prominent notice on the 98a98.best platform homepage;
- Notification in the account dashboard upon your next login after the update.
The last updated date of this Policy is shown at the top of the document and is refreshed with every revision. We recommend visiting this page periodically to stay informed about how 98a98 protects your data.
Continued use of the platform after any changes take effect constitutes acceptance of the revised Policy. If you disagree with the changes, you may close your account before the effective date and receive a refund of your available real balance.
14 Contact, DPO & Privacy Channel
The 98a98 has appointed a Data Protection Officer (DPO) responsible for overseeing LGPD compliance and serving as the point of contact for users and for the Autoridade Nacional de Proteção de Dados (ANPD).
For any questions related to privacy, personal data processing, or exercising your rights under the LGPD, please contact 98a98 through the following channels:
- Privacy email: contato@98a98.best (subject: "Privacy" or "LGPD Rights")
- Live chat: available 24 hours a day, 7 days a week, in Brazilian Portuguese, on the 98a98.best platform
- Response time: up to 15 business days for LGPD requests; up to 3 minutes on live chat for general questions
For complaints that 98a98 has not resolved to your satisfaction, you may contact the National Data Protection Authority (ANPD), whose contact details are available on the official Brazilian federal government website.