Privacy Policy of 22jj — LGPD & Data Protection

This Privacy Policy describes how 22jj collects, uses, stores, shares, and protects the personal data of users of the platform available at 22jj.best. This document was written in plain language with the goal of being clear and straightforward — not an inaccessible legal text.

By creating an account at 22jj or using any of the platform's services — whether betting on the Brasileirão, playing Aviator, accessing the live casino, or making a deposit via Pix — you are consenting to the processing of your data as described here.

22jj operates in compliance with the General Personal Data Protection Law (LGPD — Law No. 13.709/2018), which is the Brazilian law governing the processing of personal data. If you do not agree with this policy, you should stop using the platform and request account closure through support.

The controller of the personal data covered by this policy is the company responsible for operating the 22jj platform. For the purposes of this policy, "22jj," "we," or "our platform" refer to the data controller.

To exercise your rights as a data subject or for any privacy-related matter, you can contact 22jj's Data Protection Officer (DPO) directly by email at privacidade@22jj.best or through general support at suporte@22jj.best.

22jj collects different categories of personal data depending on how you use the platform:

Data provided directly by the user at registration:

• Full name as it appears on an official ID document.
• CPF (Brazilian Individual Taxpayer Registration number).
• Date of birth.
• E-mail address.
• Mobile phone number.
• Residential address (requested during identity verification).

Payment and financial transaction data:

• Pix key registered for withdrawals (CPF, email, phone number, or random key).
• Banking details for wire transfers (bank, branch, checking account — Nubank, Itaú, Bradesco, Banco do Brasil, Caixa, and others).
• Deposit and withdrawal history in BRL.
• Partial credit or debit card details (we do not store the full card number or CVV).

Data automatically generated through platform usage:

• IP address and approximate location data.
• Browser type and version, and operating system.
• Device identifier (mobile or desktop).
• Sports betting and casino game history.
• Access logs, session duration, and pages visited.
• Cookie and similar technology data (detailed in section 9).

Identity document data (KYC verification):

• Official photo ID (RG or CNH) — requested for identity verification on withdrawals above certain amounts.
• Selfie for identity confirmation when required.

22jj uses your personal data exclusively for the following purposes:

The LGPD requires every instance of personal data processing to have a legal basis that justifies it. 22jj relies on the following legal bases set out in Article 7 of the law:

• Contract performance (art. 7, V): processing required to fulfill the contract established with you when you created your account — handling deposits, withdrawals, and bets.
• Compliance with legal obligation (art. 7, II): identity verification, anti-money laundering compliance, and adherence to Brazilian financial regulations.
• Legitimate interest (art. 7, IX): platform security, fraud prevention, detection of multiple accounts, and service improvement — provided this does not prejudice your fundamental rights.
• Consent (art. 7, I): sending marketing communications and use of non-essential cookies. You may withdraw this consent at any time.

22jj does not sell users' personal data. Data sharing occurs only in the following situations and with the following categories of recipients:

• Payment processors: Pix, Mercado Pago, PicPay, card processors, and partner banks receive only the data required to process each transaction. These partners are subject to their own privacy policies and to the regulations of the Banco Central do Brasil.
• Game providers: Pragmatic Play, Evolution, Spribe, SmartSoft, NetEnt, and other catalog providers receive anonymized identifiers necessary to operate the games. These providers do not receive users' full names or CPF.
• Technology service providers: companies that provide cloud infrastructure, security, data analytics, and technical support — bound by contracts requiring equivalent data protection standards.
• Competent authorities: when required by law, court order, or regulatory authority directive, 22jj may share data with government bodies, including the Federal Revenue Service, Central Bank, and law enforcement agencies.
• Fraud prevention: in cases of suspected money laundering or illegal activity, data may be shared with fraud prevention and financial compliance organizations, as required by law.

22jj retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by Brazilian law:

• Registration and identity data: retained for as long as the account is active and for a minimum of 5 years after closure, in accordance with anti-money laundering obligations (Law No. 9.613/1998).
• Financial transaction history (deposits and withdrawals via Pix, boleto, and card): retained for a minimum of 5 years in accordance with Brazilian Central Bank regulations and tax legislation.
• Betting and gaming history: retained for up to 5 years for dispute resolution and internal audit purposes.
• Access logs and security data: retained for 6 months, unless required for an ongoing incident investigation.
• Marketing communication data: deleted immediately upon withdrawal of consent for that specific purpose.

Once the applicable retention periods have expired, data is securely deleted or irreversibly anonymized.

22jj implements appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Measures in place include:

• SSL/TLS encryption: all communication between your browser or mobile device and 22jj's servers is encrypted using SSL/TLS, ensuring that transmitted data — including payment information via Pix — cannot be intercepted.
• Secure password storage: user passwords are stored in hashed format using modern algorithms — never as plain text. 22jj has no access to your password.
• Card details: we do not store the full credit or debit card number or the CVV code. Card transactions are processed directly by our partner payment operators in a certified environment.
• Internal access control: only employees with a verified operational need are granted access to users' personal data, with full logs kept of every query made.
• Continuous monitoring: automated systems monitor the platform in real time to detect suspicious access, intrusion attempts, and abnormal behavior.
• Two-factor authentication: available to all users as an additional layer of account protection.

22jj uses cookies and similar technologies to ensure the platform works correctly and to improve the user experience. There are three categories of cookies in use:

• Essential cookies: required for the platform's basic operation — authentication, session management, CSRF protection, and transaction processing. These cannot be disabled without impairing your use of the platform.
• Functional cookies: remember user preferences such as language, game settings, and layout. These can be disabled without affecting the platform's core functionality.
• Analytical and performance cookies: collect anonymized information about how users navigate the platform — most visited pages, loading times, errors — to help improve the experience. These require consent and can be declined.

You can manage cookie settings through the platform's privacy panel or through your browser settings. Declining non-essential cookies does not affect your ability to play, deposit, or withdraw at 22jj.

The LGPD grants you, as a data subject, the following rights regarding how 22jj processes your data. All of them can be exercised through support via chat, email, or WhatsApp:

The 22jj platform is strictly intended for users aged 18 and over. 22jj does not knowingly collect, store, or process personal data belonging to minors.

If 22jj determines that it has collected data from a minor — for example, through a fraudulent registration — the data will be deleted immediately and the account will be closed. If you are a parent or guardian and believe a minor has used the platform, please contact us immediately via support or by emailing privacidade@22jj.best.

Some of 22jj's technology providers and game partners operate servers outside Brazil. Where personal data is transferred to other countries, 22jj ensures that:

• Transfers occur only to countries or organizations that offer a level of data protection adequate or equivalent to that of the LGPD.
• Specific data transfer agreements are signed with each international partner, including clauses that guarantee you the same rights you have in Brazil.
• Sensitive financial data — such as Pix details and banking transactions — is processed exclusively by partners operating in Brazil, subject to Banco Central regulations.

The international game providers in the 22jj catalog — such as Pragmatic Play, Evolution, and NetEnt — are companies licensed in jurisdictions with strict privacy regulations and are bound by data protection agreements with 22jj.

22jj may update this Privacy Policy periodically to reflect changes in platform operations, applicable legislation, or data processing practices. Material changes will be communicated via:

• Email notification sent to the address on file, at least 7 days before the changes take effect.
• A banner or visible notification on the platform on the date of the update.
• Update of the "Last updated" date at the top of this page.

Continued use of the 22jj platform after an updated policy takes effect constitutes acceptance of the changes. If you do not agree with the new policy, you must close your account and request data deletion before the effective date.

To exercise your rights as a data subject, report a privacy concern, or ask any question about how 22jj handles your personal data, reach out through one of the channels below: