Ok08 Privacy Policy — Your Data, Protected with Encryption and LGPD

Who We Are — Data Controller

Ok08 is the data controller for all personal data processed under this Privacy Policy. The ok08 platform, accessible at ok08.net, is responsible for defining the purposes and means of processing personal information collected from Brazilian users who use its Sports Betting, live casino, slots, and crash games services.

This Privacy Policy applies to all ok08 users — including unregistered visitors, registered users, and former users whose data ok08 still holds under legal obligation.

For the purposes of the LGPD (Law No. 13,709/2018), ok08 acts as controller of the personal data you provide during registration, platform use, and interactions with support. Any game providers and payment partners act as operators, processing data solely in accordance with ok08's instructions and within the defined purposes.

Data We Collect

Ok08 collects different categories of data depending on how you interact with the platform:

Data provided directly by you during registration:

• Full name
• CPF (Cadastro de Pessoa Física)
• Date of birth
• Email address
• Mobile phone number
• Full residential address (zip code, street, city, state)
• Account password (stored in encrypted format — ok08 never has access to your password in plain text)

Financial data collected in transactions:

• Pix key used for deposits and withdrawals
• Bank details for TED transfers (bank, branch, account number — from Nubank, Itaú, Bradesco, Banco do Brasil, and others)
• Deposit, withdrawal, and betting history on the platform
• Partial credit or debit card details (last 4 digits and card brand only — full card data is processed by the payment gateway and never stored by ok08)

Data collected automatically during platform use:

• IP Address
• Browser type and version
• Operating system and device model
• Pages visited, session duration, and interface interactions
• Approximate geolocation data (based on IP — we do not collect GPS data without explicit consent)
• Cookies and session identifiers (detailed in Section 6)

Identity verification documents (when requested):

• Photo ID document (CNH, RG, or passport)
• Recent proof of address
• Selfie with ID document (in specific anti-fraud verification cases)

How We Use Your Data

The personal data collected by ok08 is used exclusively for the following purposes:

Ok08 never uses your personal data for purposes other than those listed above without prior notice and, where applicable, renewed consent from the data subject.

Legal Basis for Processing (LGPD)

The LGPD requires that all personal data processing have a defined legal basis. ok08 classifies each processing activity under one of the following bases:

• Contract performance (art. 7º, V): processing necessary to operate your account, handle bets, deposits, and withdrawals — the primary basis for most operations;
• Legal or regulatory obligation (art. 7, II): identity verification (KYC), anti-money laundering compliance (Law No. 9,613/1998), and financial record retention;
• Legitimate interest (Art. 7º, IX): fraud prevention, platform security, and risk analysis — always balanced against the rights and expectations of the data subject;
• Consent (Art. 7º, I): sending marketing communications, using non-essential cookies, and personalizing offers — you may withdraw your consent at any time.

Ok08 maintains internal records of the legal bases applicable to each data processing operation and keeps those records updated in accordance with ANPD (Autoridade Nacional de Proteção de Dados) requirements.

Data Sharing with Third Parties

Ok08 shares personal data only in the situations below, always with contractual protection guarantees equivalent to those in this Policy:

Payment providers: when depositing via Pix, boleto, PicPay, Mercado Pago, card, or TED bank transfer through Nubank, Itaú, Bradesco, Banco do Brasil, and others, your relevant financial data is transmitted to the corresponding payment processor to complete the transaction. These providers act as operators and only process the data required for the transaction.

Game providers: Pragmatic Play, NetEnt, Spribe, Play'n GO, Nolimit City, Hacksaw Gaming, and other providers in the ok08 catalog receive an anonymous session identifier to load games. These providers never receive your name, CPF, email, or banking details.

Technology service providers: cloud servers, transactional email systems, and security analytics tools — all engaged under confidentiality and data protection clauses.

Legal authorities: ok08 may disclose personal data to the relevant authorities (Receita Federal, COAF, Polícia Federal, Ministério Público) when required by law, court order, or in connection with investigations into money laundering, fraud, or criminal activity.

Cookies and Tracking Technologies

Ok08 uses cookies and similar technologies to ensure platform functionality, improve user experience, and — with your consent — personalize content and offers. See the types of cookies used:

You can manage your cookie preferences at any time in your browser settings — Chrome, Firefox, Safari, Edge, and others allow you to block or delete cookies by category. Blocking essential cookies will affect platform functionality; blocking analytics and marketing cookies will not impact your gaming experience.

Ok08 cookies are not used for tracking outside the ok08.net domain.

Information Security

Ok08 adopts technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. Key measures include:

• SSL/TLS Encryption: all communication between your device and ok08's servers is encrypted in transit;
• Password encryption: your login credentials are stored with bcrypt hashing — even if someone gains access to the database, they cannot read your password;
• Access control: only staff with a functional need have access to personal data, with mandatory multi-factor authentication for internal systems;
• Continuous monitoring: intrusion detection and anomaly monitoring systems operate 24 hours a day to identify suspicious activity;
• Security testing: ok08 conducts periodic penetration testing and security audits on the platform's systems;
• Data segmentation: financial data is stored in systems separate from account data, with even more restricted access.

In the event of a security incident affecting personal data, ok08 will follow the procedures set out in the LGPD: notifying the ANPD within 2 business days of becoming aware of the incident, and informing affected data subjects when there is relevant risk or harm.

Data Retention and Deletion

Ok08 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by law:

• Active account data: retained for the entire duration of the account on the platform;
• Financial transaction history: minimum of 5 years after the transaction, as required by tax and anti-money laundering legislation (Law No. 9.613/1998);
• Identity verification documents (KYC): minimum of 5 years after account closure;
• Betting and gaming records: minimum of 5 years — required for dispute resolution and regulatory compliance;
• Marketing and consent data: deleted within 30 days of consent withdrawal, with no impact on account operation;
• Access and security logs: 6 months to 2 years, depending on the nature of the record.

Once retention periods expire, data is securely and irreversibly deleted or anonymized for use in aggregate analyses with no individual identification.

Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a data subject, the following rights with respect to ok08: