Does 36tbet share my CPF with third parties?

36tbet uses your CPF solely for identity verification (KYC), to confirm that each user holds only one account, and to comply with Brazilian legal obligations. It is not shared with game providers, marketing partners, or any third parties unrelated to the direct operation of the platform. The only instances where your CPF may be shared are with payment processors to validate Pix transactions (which require that the account holder's CPF matches the CPF linked to the Pix key) and with public authorities when required by law. Neither of these situations involves any commercial exposure of your CPF.

How can I find out what data 36tbet holds about me?

You can exercise your right of access by emailing contato@36tbet.best with the subject line "LGPD Rights – Access Request". 36tbet will provide a report containing the personal data stored in your account, including registration details, transaction history, and identity verification data. The response deadline is up to 15 business days. Delivery is made by email in a readable format. To verify your identity and ensure the report is sent to the correct data subject, additional authentication may be requested before the report is dispatched.

Can I ask 36tbet to delete all my data?

Yes, you can request deletion of your data. However, not all data can be deleted immediately: 36tbet has legal obligations that require retaining certain records for defined periods — primarily financial and identity data, which must be kept for at least 5 years to comply with anti-money laundering regulations (Law 9.613/1998) and tax obligations. Data processed on the basis of consent (such as communication preferences) can be deleted without restriction. When you submit a deletion request, 36tbet will inform you which data can be deleted immediately and which must be retained, along with the retention period and legal justification for each case.

Does 36tbet send me marketing emails? Can I opt out?

Promotional communications (promotions, weekly crash game tournaments, reload bonuses) are sent only to users who gave their consent during registration or through their account settings. If you prefer not to receive these emails, you can withdraw your consent at any time in two ways: by clicking the unsubscribe link included in every 36tbet promotional email, or by updating your notification preferences in your account dashboard. Transactional emails (withdrawal confirmations, security alerts, account notifications) are not marketing emails and will continue to be sent regardless of your preferences, as they are necessary for the provision of the service.

What happens to my data if I close my 36tbet account?

When you request account closure, access to the platform is blocked once the process is complete. Your data is not deleted immediately due to legal obligations — financial records, betting history, and identity data must be retained for the applicable regulatory periods (generally between 2 and 5 years depending on the category). Once those periods have elapsed, your data is securely deleted or anonymized. You will receive a confirmation email detailing which data will be retained, for how long, and the legal justification for each item, so you have full visibility into what happens to your information after your account is closed.

How do I disable 36tbet's cookies?

36tbet displays a cookie management panel on your first visit to the site. You can choose to accept only essential cookies (required for the platform to function) and decline functionality and analytics cookies. Your preferences can be updated at any time via the cookie manager in the platform footer. Disabling non-essential cookies may affect certain convenience features, such as remembering your game preferences, but will not prevent you from using core functions like placing bets, making Pix deposits, or withdrawing funds. Essential cookies cannot be disabled, as they are required for account authentication and security.

36tbet | Privacy Policy – How We Keep Your Data Safe

By using the services of the 36tbet, you confirm that you have read and understood this Privacy Policy. Continued use of the platform following any changes to this document constitutes acceptance of the updated terms.

1 Introduction and Controller Identification

This Privacy Policy describes how 36tbet, operator of the Sports Betting and online casino platform available at 36tbet.best, collects, stores, uses, and protects the personal data of registered users, in accordance with Brazil's General Data Protection Law (LGPD — Lei 13.709/2018) and other applicable regulations in Brazil.

The 36tbet acts as the controller of the personal data processed under this policy. This means it determines the purposes and means of processing, taking on the responsibilities set out by the LGPD toward data subjects and the National Data Protection Authority (ANPD).

This policy applies to all users of the platform 36tbet, including unregistered visitors (for browsing data collected via cookies), users in the registration process, and active account holders using Sports Betting, crash games such as Aviator and Spaceman, slots, live roulette, and other products available on the platform.

For questions, exercising your rights, or any matter related to personal data processing, please contact us at contato@36tbet.best with the subject line "Data Privacy".

2 Data We Collect

The 36tbet follows the principle of data minimization: collecting only what is strictly necessary to provide its services and meet legal obligations. The categories of data collected are:

Registration Data (provided by the user):

Full legal name as it appears on your ID;
CPF (Cadastro de Pessoa Física);
Date of birth;
Email address;
Mobile phone number;
Residential address (street, number, complement, neighborhood, city, state, ZIP code);
Pix key for withdrawal processing.

Identity Verification Data (KYC):

Government-issued photo ID image (RG, CNH, or passport);
Selfie with ID document for account ownership verification;
Proof of address;
Proof of ownership of the Pix key used for withdrawals.

Financial and Transaction Data:

Deposit and withdrawal history (method, amount, date, status);
Credit or debit card data (last four digits and card brand only — full card numbers are not stored by 36tbet);
Pix transaction identifiers;
Betting history and results;
Account balance and transaction history.

Usage and Browsing Data (collected automatically):

IP address and approximate location;
Device type, operating system, and browser;
Pages visited, session duration, and clicks;
Session identifiers and cookies;
Connection performance data (for mobile experience optimization).

Communication Data:

Live chat support conversation history;
Emails and messages exchanged with the support team at 36tbet;
Communication preferences declared by the user (whether or not to receive promotional emails).

The 36tbet does not intentionally collect special categories of personal data (sensitive data such as racial origin, religious belief, health information, sexual orientation, etc.). Should such information be voluntarily shared by the user during a support interaction, it will not be stored in a structured manner or used for any purpose.

3 How We Collect Your Data

Data is collected by 36tbet through the following channels:

Registration form: entered directly by the user when creating an account on the platform;
KYC verification process: submission of documents by the user when requested, particularly before the first withdrawal;
Platform usage: automatically collected while accessing pages, placing bets, playing casino games, crash games, and other platform features;
Financial transactions: during Pix deposits, bank slips, credit/debit card payments, PicPay, or Mercado Pago transactions, and during withdrawal requests;
Support contact: information provided during live chat conversations or by email;
Cookies and tracking technologies: while browsing the 36tbet website, as described in section 9 of this policy.

The 36tbet does not purchase third-party data lists for marketing purposes and does not obtain users' personal data from external sources unrelated to direct use of the platform.

4 Purpose of Data Processing

Each piece of data collected by 36tbet has a specific, declared purpose. Processing is carried out only for the purposes described below:

Data	Purpose
Full name, CPF, date of birth	Identity verification, fraud prevention, legal compliance, and age confirmation (minimum 18 years)
Email, phone	Account communications, transaction confirmations, security notifications, and customer support
Residential address	Verification of Brazilian residency and compliance with tax and regulatory obligations
Pix key and financial details	Processing of deposits and withdrawals, anti-money laundering compliance (Law 9.613/1998)
KYC Documents	Identity verification for withdrawals, prevention of multiple accounts, and compliance with regulatory requirements
Betting and game history	Dispute resolution, outcome calculation, detection of abusive behavior, and experience personalization
Browsing data and IP	Account security, unauthorized access detection, performance optimization, and platform usage analytics
Functionality cookies	Keep the session active, remember user preferences, and ensure the platform functions properly

The 36tbet does not use personal data for marketing purposes without explicit consent. Users can opt out of promotional communications at any time, directly through their account settings or by emailing support.

5 Legal Basis for Processing

As required by the LGPD, all personal data processing by 36tbet has an identified legal basis. The legal bases used are:

Contract performance (art. 7, V of the LGPD): processing necessary to provide the services contracted by the user upon creating an account at 36tbet, including bet processing, deposits, and withdrawals via Pix;
Compliance with a legal or regulatory obligation (Art. 7, II of the LGPD): processing required by Brazilian law, including anti-money laundering regulations (Law 9.613/1998), tax obligations, and user identification requirements;
Legitimate interest (art. 7, IX of the LGPD): processing for platform security, fraud prevention, detection of multiple accounts, and service improvement, provided it does not override the data subject's fundamental rights and freedoms;
Consent (art. 7, I of the LGPD): used specifically for sending promotional communications and for non-essential cookies. Consent can be withdrawn at any time without affecting access to the platform.

Where processing is based on legitimate interest, 36tbet has previously conducted an impact assessment to ensure that the legitimate interest does not disproportionately affect the rights of data subjects.

6 Data Sharing with Third Parties

The 36tbet does not sell, rent, or trade its users' personal data. Data is only shared in the specific situations listed below and always with appropriate safeguards in place:

Payment processors: data required to process transactions via Pix (Banco Central do Brasil), boleto bancário (banking correspondents), credit/debit card (acquirers such as Cielo, Stone, or Rede), PicPay, and Mercado Pago. Only the minimum data necessary for each transaction is shared;
Game providers: providers such as Pragmatic Play, Spribe, SmartSoft, and Evolution receive anonymous session identifiers for the technical operation of casino games and crash games. Full names, CPF, and banking details are not shared with game providers;
IT service providers: companies providing infrastructure services (cloud hosting, CDN, monitoring) have technical access to data as part of contracted services, always under confidentiality and data processing agreements;
Identity verification services (KYC): specialized partners may process identity documents to verify their authenticity, under a data processing agreement with 36tbet;
Public authorities: when required by law, court order, or request from a competent Brazilian authority (Federal Revenue Service, Central Bank, COAF, Public Prosecutor's Office). The 36tbet will notify the user whenever legally permitted prior to complying with such requests;
Independent auditors: RNG auditors and compliance reviewers may access aggregated and anonymized data for game certification purposes.

All third parties that receive personal data from users of 36tbet are contractually required to process data solely for the specified purpose, to apply appropriate security measures, and to comply with the LGPD.

7 Data Security

The 36tbet implements technical and organizational measures to protect users' personal data against unauthorized access, loss, destruction, alteration, or improper disclosure. Key measures in place include:

256-bit SSL/TLS encryption: all communications between the user's browser and the servers of the 36tbet are end-to-end encrypted. HTTPS is mandatory across all pages of the platform;
Encryption of data at rest: sensitive data stored on servers (such as KYC documents and financial data) is encrypted with securely managed keys;
Two-factor authentication (2FA): available for user accounts that want an extra layer of protection when accessing their account;
Internal access controls: only employees with a justified need have access to users' personal data, and all access is logged in auditable records;
Continuous monitoring: intrusion and anomaly detection systems monitor the infrastructure of 36tbet 24 hours a day;
Periodic security testing: the platform undergoes regular security assessments, including penetration testing carried out by specialized teams;
Secure password storage: user passwords are never stored in plain text — the system uses salted hashing in accordance with security best practices.

In the event of a security incident that may affect users' personal data, the 36tbet commits to notifying affected data subjects and the ANPD within the timeframes set by the LGPD (art. 48), with information about the nature of the incident, the data affected, and the measures taken to remediate the situation.

No system is completely invulnerable. The 36tbet encourages users to protect their own credentials, use strong and unique passwords for the platform, and enable two-factor authentication. If you suspect unauthorized access to your account, contact support immediately.

8 Data Retention and Deletion

The 36tbet retains personal data for as long as needed for the stated purposes and to meet legal obligations. General retention periods are:

Registration and KYC data: retained for the duration of the account and for at least 5 years after closure, in compliance with anti-money laundering requirements (Law 9.613/1998) and tax obligations;
Financial transaction history: minimum of 5 years after each transaction, as required by law;
Betting and game history: minimum of 2 years after the transaction, for resolution of any disputes;
Support communication data: 2 years after the ticket is closed;
Browsing data and technical logs: up to 12 months, except where required for an ongoing security incident investigation;
Cookie data: according to the retention periods defined for each cookie category, as described in section 9.

Once the applicable retention period expires, data is securely deleted or anonymized so that the holder can no longer be identified. Secure deletion includes removal from backups within the normal rotation cycle.

Early data deletion requests submitted by users are assessed on a case-by-case basis. Where no legal obligation requires the data to be retained, it will be deleted within 30 days of the request confirmed via contato@36tbet.best.

9 Cookies and Tracking Technologies

The 36tbet uses cookies and similar technologies to ensure the platform functions properly and to improve the user experience. The categories of cookies used are:

Essential cookies: required for the platform to function. These include authentication session cookies, CSRF security tokens, and language preferences. They cannot be disabled without compromising access to 36tbet. Duration: session or up to 30 days;
Functionality cookies: remember user preferences (such as betting settings and favorite games) to personalize the experience. Enabled by default, they can be turned off without affecting basic platform access. Duration: up to 6 months;
Performance and analytics cookies: collect aggregated, anonymous data on how users navigate the platform (pages visited, session duration, device used) for technical optimization purposes. Data is processed in aggregate form, with no individual identification. Duration: up to 12 months;
Security cookies: used for suspicious behavior detection, fraud prevention, and protection against automated attacks. Duration: variable depending on the security event.

The 36tbet does not use third-party tracking cookies for behavioral advertising. The cookie banner displayed on first access allows users to manage their preferences by category. Settings can be updated at any time through the privacy preferences panel available in the platform footer.

In addition to cookies, the platform may use local storage (localStorage) for game session data and interface preferences. This data is stored directly on the user's device and can be cleared by the browser at any time.

10 Your Rights as a Data Subject (LGPD)

The LGPD grants personal data subjects a robust set of rights. As a user of 36tbet, you have the following rights, all of which can be exercised by emailing contato@36tbet.best with the subject line "LGPD Rights":

11 Minors

The services of 36tbet are intended exclusively for individuals aged 18 and over. The platform does not intentionally collect personal data from minors under 18, nor does it offer any features directed at that audience.

If 36tbet identifies that data has been collected from a user under 18 — whether due to incorrect information provided during registration or any other circumstance — the following procedures are immediately applied:

The account is suspended and blocked from new transactions;
Any remaining balance is returned to the original payment method after verification;
All data belonging to the minor is deleted from the systems of 36tbet as quickly as possible, subject only to the minimum retention periods required by law for investigation purposes;
The situation may be reported to the appropriate authorities in accordance with Brazilian legislation on the protection of children and adolescents (ECA — Law 8,069/1990).

Parents or guardians who suspect that a minor has accessed the platform of 36tbet should contact us immediately at contato@36tbet.best so the matter can be handled as a priority.

12 International Data Transfers

Due to the nature of technology services, some data from the 36tbet may be processed by servers or service providers located outside Brazil, such as cloud infrastructure providers (hosting, CDN, backup) operating across multiple geographic regions.

When international data transfers occur, 36tbet adopts the following safeguards in compliance with art. 33 of the LGPD:

Transfer only to countries or bodies recognized by the ANPD as providing an adequate level of protection;
Where no adequacy decision exists, standard contractual clauses approved by the ANPD or equivalent guarantees shall be used;
Data processing agreements (DPAs) with all international vendors, establishing obligations equivalent to those required by the LGPD.

The most sensitive data of Brazilian users (identity documents, full financial data, detailed betting history) is stored as a priority in infrastructure operating in Brazil or in countries with equivalent data protection legislation.

13 Changes to this Privacy Policy

The 36tbet may update this Privacy Policy periodically to reflect changes in data processing practices, legal requirements, or platform improvements. The date of the most recent update is always shown at the top of this document.

When changes are significant — such as a change in processing purpose, the addition of new data categories, or an update to the legal bases used — 36tbet will notify users by email at least 15 days before the updated terms take effect.

Minor changes (such as wording adjustments, corrections to contact information, or updates to legal references) may be implemented without prior notice, with the document's update date reflecting the change.

Continued use of the platform after the effective date of an updated version of this Policy constitutes acceptance of the new terms. If you disagree with the changes, you may close your account following the procedure described in the Terms and Conditions.

14 Contact, DPO, and Support Channels

The 36tbet has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this policy, responding to data subject requests, and serving as the point of contact with the National Data Protection Authority (ANPD).

To exercise your rights as a data subject, ask questions about how your data is processed, or report any privacy concern, the following channels are available:

Privacy email: contato@36tbet.best (subject: "LGPD Rights" or "Data Privacy");
Live chat: available 24 hours a day, 7 days a week, in Portuguese, accessible directly on the 36tbet;
Response time: up to 15 business days for LGPD rights requests; up to 4 hours for general inquiries via email; immediate response via live chat.

If after contacting 36tbet if you feel your rights have not been adequately addressed, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), as provided under art. 18, §1 of the LGPD.

This Privacy Policy is permanently available in its most current version at 36tbet.best/privacy-policy. Previous versions may be requested through the email channel indicated above.

36tbet Privacy Policy – Protecting Your Data