LGPD · Protected Data · Updated Version

Privacy Policy of 66br — Your Data in Good Hands

66br takes the protection of your personal data seriously. This document clearly explains what we collect, how we use it, who we share it with — and, most importantly, your rights as a data subject under the Lei Geral de Proteção de Dados (LGPD).

Last updated: January 1, 2026 LGPD Compliant
256-bit SSL
All transmission encrypted
LGPD Compliant
Law No. 13,709/2018
Data Not Sold
No commercial sharing
DPO Available
Data Protection Officer

How 66br Protects Your Data

Six pillars of our privacy policy — the key things you should know before continuing.

End-to-End Encryption

All data transmitted between your device and 66br's servers is protected by 256-bit SSL encryption. This covers registration details, passwords, financial information, and transaction history via Pix, card, and other payment methods.

Data Is Never Sold

66br does not sell, rent, or share your personal data with marketing companies, data brokers, or any third party for commercial purposes. Your data is used exclusively to operate the platform and fulfill legal obligations.

LGPD Compliance

66br operates in full compliance with the Lei Geral de Proteção de Dados (Law No. 13.709/2018). You have the right to access, correct, export, and request deletion of your personal data at any time through our privacy channel.

Internally Restricted Access

Only 66br employees who need data to perform their job functions have access to user information. Access is controlled through permission levels, logged in auditable records, and periodically reviewed by the security team.

Secure Storage

66br user data is stored on servers with restricted physical and logical access, continuous monitoring, and encrypted backups. Passwords are stored exclusively as irreversible hashes — not even the 66br team has access to your password.

Incident Notification

If any security incident occurs that may impact your data, 66br will notify affected users and the ANPD (Autoridade Nacional de Proteção de Dados) within the timeframes established by the LGPD, including a description of what happened and the measures taken.

Quick summary: 66br collects only the data needed for you to use the platform securely, receive payments in BRL via Pix, and get support in Portuguese. We do not sell your data. You can access, correct, or request deletion of your information at any time. The full document is below.

1. Data Controller

For the purposes of the General Data Protection Law (LGPD — Law No. 13.709/2018), the controller of personal data collected on the 66br platform is the company operating the site 66br.best, reachable via email at suporte@66br.best and through the 24-hour live chat available on the platform.

66br's Data Protection Officer (DPO) can be reached directly at privacidade@66br.best for specific questions about personal data processing, the exercise of data subject rights, and LGPD-related communications.

This Privacy Policy applies to all registered users and visitors of the 66br platform, including the main website, the mobile app, and any subdomain or associated service operated by 66br in Brazil.

2. Data We Collect

66br collects different categories of personal data depending on how you interact with the platform. Below is a clear breakdown of what is collected and at what point:

Data you provide directly

  • Registration: full name, CPF, date of birth, email address, mobile number, residential address, and password;
  • KYC verification: identity document image (national ID, driver's license, or passport), proof of address, and, when required, a selfie with the document;
  • Financial: Pix key, credit/debit card data (token only — 66br does not store the full card number), bank account details for wire transfers, PicPay and Mercado Pago information;
  • Communications: messages exchanged with support via live chat, emails, and any other communication sent to the 66br team.

Automatically collected data

  • IP address and approximate geolocation;
  • Device type, operating system, and browser used;
  • Pages visited, session duration, and interactions with the platform;
  • Betting history, games accessed, and transactions made;
  • Cookies and session identifiers (detailed in Section 6).
Data Category Examples When It Is Collected
Identification Full name, CPF, date of birth At registration
Contact Email, phone number, address On registration and updates
Documents National ID, driver's license, proof of address During KYC verification
Financial Pix key, card token On deposits and withdrawals
Behavioral Games accessed, bets placed, time spent on platform While using the platform
Technical IP, device, browser On each visit

3. How We Use Your Data

66br uses the personal data collected solely for the following purposes, all of which are necessary for the legitimate operation of the platform:

  • Account management: creating, maintaining, and securing your 66br account, including access authentication and password recovery;
  • Payment processing: validation and processing of deposits via Pix, boleto bancário, credit and debit cards, PicPay, Mercado Pago, and TED; processing of withdrawals to your bank account at Nubank, Itaú, Bradesco, Banco do Brasil, or any other Brazilian institution;
  • Compliance with legal obligations: identity verification (KYC), anti-money laundering compliance, communication with competent authorities when required by law, and adherence to the LGPD and other applicable regulations in Brazil;
  • Game operation: records of betting history, slots activity, and transactions for user support, dispute resolution, and compliance auditing;
  • Customer support: support via live chat, email, and any other Portuguese-language communication channel used by the 66br team;
  • Security and fraud prevention: monitoring usage patterns to detect suspicious activity, duplicate accounts, and behavior that violates the Terms and Conditions;
  • Responsible gambling: monitoring of risk behavior signals to identify users who may need support and to activate responsible gambling tools;
  • 66br communications: sending account notifications, relevant promotions, Terms updates, and security information — you can manage your communication preferences in your account settings.

No third-party marketing: 66br does not use your data to display third-party advertising on the platform or share it with external advertisers. Any promotional communications you receive are exclusively about 66br's own products and offers.

4. Legal Basis for Processing (LGPD)

Every personal data processing operation carried out by 66br is grounded in one or more legal bases provided for under the LGPD. The applicable bases for each category of processing are listed below:

  • Contract performance (Art. 7, V): processing required to deliver the services contracted when you created your 66br account — payment processing in BRL, access to games, bonus management, and support;
  • Compliance with a legal obligation (Art. 7, II): KYC verification, retention of financial transaction records, and communication with competent authorities, in accordance with anti-money laundering legislation and sector regulations;
  • Legitimate interest (Art. 7, IX): security monitoring, fraud prevention, behavioral analysis for responsible gambling, and continuous platform improvement — always balanced against users' rights and expectations;
  • Consent (Art. 7, I): marketing communications and use of non-essential cookies — you can withdraw consent at any time in your account settings or through 66br's privacy channel.

For sensitive data that may be collected during the identity verification process, the applicable legal basis is compliance with a legal obligation and, where applicable, the data subject's explicit consent obtained at the time of collection.

5. Data Sharing

66br shares users' personal data only in the following situations, all limited to the minimum necessary for each purpose:

Required operational partners

  • Payment processors: to process transactions via Pix, boleto, card, PicPay, and Mercado Pago — financial data is transmitted exclusively for transaction validation and is fully encrypted;
  • Game providers: Pragmatic Play, Play'n GO, NetEnt, Microgaming, and other partners receive an anonymized user identifier to record bets and gaming sessions — they do not receive full personal identification data;
  • Identity verification services: KYC platforms that validate documents submitted during the verification process, operating under data processing agreements with 66br;
  • Technology infrastructure: cloud, hosting, and security service providers that maintain the platform's technical operations, bound by confidentiality agreements and LGPD compliance obligations.

Legal obligations

66br may share data with public authorities — such as the Ministério da Fazenda, Banco Central do Brasil, Receita Federal, Polícia Federal, or the Ministério Público — when required by law or court order, strictly to the extent necessary to fulfill the demand.

66br never sells, rents, or transfers users' personal data to marketing companies, ad platforms, data brokers, or any third party for commercial purposes. Any contact claiming to have acquired your data from 66br should be treated as suspicious.

6. Cookies & Tracking

66br uses cookies and similar technologies to ensure the platform works correctly and to enhance your experience. Below are the categories of cookies used:

Essential cookies

Required for the platform's core functionality — session authentication, language preferences, and temporary bet cart. These cannot be disabled without affecting your ability to use 66br.

Performance cookies

These collect anonymous information about how you use the platform — which pages you visit, how long you stay, and where your session originated. This data is used to improve 66br's usability and identify technical issues. It does not identify you personally.

Functional cookies

These allow 66br to remember your preferences — favorite bet type, display settings, language. They improve personalization without collecting sensitive data.

Marketing cookies (with consent)

Used exclusively to measure the effectiveness of 66br's own campaigns — for example, to identify whether a user arrived from a specific ad in order to calculate media ROI. They are not used to display third-party advertisements. You can decline these cookies without any impact on your use of the platform.

You can manage and withdraw consent for non-essential cookies in your browser settings or in your 66br account privacy settings. Revoking marketing cookies does not affect gameplay, payments, or support.

7. Data Retention

66br retains users' personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations. The main retention criteria are:

  • Active account data: retained for as long as the account is active and for up to 5 years after closure, in accordance with financial compliance obligations and anti-money laundering legislation;
  • Financial transaction records: retained for 5 years from the transaction date, as required by the Brazilian Federal Revenue Service and Central Bank;
  • KYC documents: retained for up to 5 years after account closure, and may be extended by court or regulatory order;
  • Access and security logs: retained for 12 months for incident investigation purposes;
  • Support communications: retained for 2 years for support history and dispute resolution;
  • Non-essential cookie data: retained only for the validity period of each cookie, as configured.

After the applicable retention period, data is securely deleted or irreversibly anonymized. Deletion requested by the user may be carried out immediately for data not subject to legal retention obligations — for all other data, the legal retention period is observed before permanent deletion.

8. Your Rights as a Data Subject

The LGPD grants you, as the data subject whose personal data is processed by 66br, the following rights, which can be exercised at any time through the platform's privacy channel:

Access

Request a copy of all personal data 66br holds about you, including how it was collected and how it is used.

Correction

Request the update or correction of inaccurate or outdated data directly in your account settings or through 66br support.

Deletion

Request the deletion of your personal data, except where retention is required by law — such as financial records mandated by the tax authorities.

Portability

Receive your data in a structured, machine-readable format for transfer to another controller, in accordance with ANPD regulations.

Consent Withdrawal

Withdraw consent given for processing based on this legal ground, such as marketing communications or non-essential cookies, without penalty.

Sharing Information

Find out which public and private entities 66br has shared your personal data with, and for what purpose.

To exercise any of these rights, contact 66br's DPO at privacidade@66br.best or via the platform's live chat. Requests are processed within 15 business days. If you are not satisfied with the response, you have the right to file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados).

9. Information Security

66br applies a comprehensive set of technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

Technical measures

  • 256-bit SSL/TLS encryption on all communications between your device and 66br's servers;
  • Passwords stored exclusively as bcrypt hashes — irreversible even in the event of a database breach;
  • Two-factor authentication (2FA) available to all 66br users, strongly recommended;
  • Credit card data tokenization — 66br does not store the full card number, only the token generated by the payment processor;
  • Continuous monitoring of unauthorized access attempts, with automatic blocking and alerts to the security team;
  • Encrypted backups retained at physically separate locations.

Organizational measures

  • Access to user data is restricted to employees with a verified operational need;
  • All staff with access to personal data undergo security and privacy training;
  • Data processing agreements (DPAs) in place with all vendors that handle personal data on behalf of 66br;
  • Regular security reviews and penetration testing to identify vulnerabilities before they can be exploited.

No system is 100% breach-proof. In the event of a security incident that may affect your data, 66br commits to notifying impacted users and the ANPD within the legal deadline of 2 business days after becoming aware of the incident, as required by the LGPD.

10. Data of Minors

66br does not intentionally collect, store, or process personal data from users under 18. Registration is strictly for users aged 18 and over, and the identity verification (KYC) process includes confirmation of date of birth and CPF.

If we identify that an account was created by someone under 18, the account is closed immediately, the collected data is deleted, and any balance is returned to the original payment source. A legal guardian may contact 66br at privacidade@66br.best to address any matter related to a minor's data.

Parents and guardians who suspect that a person under 18 has used the 66br platform should contact support immediately. The team will act swiftly and confidentially to close the account and delete any collected data.

11. International Data Transfers

Some of 66br's technology partners — such as cloud infrastructure providers and security services — may maintain servers outside Brazil. When personal data of Brazilian users is transferred abroad, 66br applies the safeguards required by the LGPD:

  • Transfers made only to countries with an adequate level of protection recognized by the ANPD, or;
  • Based on standard contractual clauses approved by the ANPD that guarantee a level of protection equivalent to the LGPD, or;
  • Based on global Binding Corporate Rules where applicable to the partner's corporate group.

Under no circumstances is sensitive financial data — such as Pix keys, banking details, or card tokens — stored on servers outside Brazil. Financial information is processed exclusively by partners operating within Brazilian territory and subject to regulation by the Central Bank of Brazil.

12. Changes to this Privacy Policy

66br may periodically update this Privacy Policy to reflect changes in Brazilian law, data processing practices, or the services offered. The date of the last update is always shown at the top of this document.

When significant changes occur that may affect your rights or how your data is handled, 66br will notify active users by email at least 7 days before the new version takes effect. For minor updates — such as text corrections or clarifications that do not alter the substance of the Policy — changes may be made without prior notice.

Continued use of the 66br platform after any changes to this Policy take effect constitutes acceptance of the updated terms. If you disagree with a change, please contact the DPO before the effective date to discuss your options.

13. Contact & Privacy Channel

To exercise your rights as a data subject, report privacy concerns, ask questions about this Policy, or contact 66br's Data Protection Officer (DPO), please use the following channels:

  • DPO email: privacidade@66br.best (response time: up to 15 business days)
  • General support: suporte@66br.best or 24/7 live chat on the platform
  • Subject: use the subject line "LGPD — [request type]" to help us route your message to the right team faster

Requests for access, correction, deletion, or data portability are handled free of charge. 66br may ask you to verify your identity before processing requests involving access to sensitive personal data, to ensure the request is legitimate and protect you from unauthorized third-party access.

If you are not satisfied with 66br's response to a privacy-related request, you have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) via the authority's official website.

Still have questions? Our support team is available 24/7 via the platform's live chat to answer any questions about this Policy. For specific data protection inquiries, reach the DPO directly at: privacidade@66br.best. You can also consult our Terms and Conditions and the Responsible Gaming.

Frequently Asked Questions about Privacy at 66br

The questions our DPO and support team receive most often about data protection, answered directly.

No, not at all. 66br does not sell, rent, transfer, or share your personal data with other casino or Sports Betting platforms, or with any competing company. Your data is used exclusively to operate 66br's services and meet legal obligations in Brazil. If you are contacted by another platform claiming to have your 66br data, treat it as suspicious and notify us immediately via support — this may indicate a phishing attempt or misuse that our security team needs to investigate.

You can request deletion of your personal data by emailing privacidade@66br.best with the subject line "LGPD — Data Deletion" or via the platform's live chat. To verify your identity, we may ask for a simple confirmation before processing the request. Data subject to legal retention obligations — such as financial transaction records required by the Receita Federal for 5 years — cannot be deleted immediately, but will be removed once the legal retention period expires. For all other data, processing is completed within 15 business days of request confirmation. Please note that deleting your data results in the closure of your 66br account.

The Pix key linked to your account is stored by 66br as a reference for processing future withdrawals — this is necessary to ensure funds are sent to the correct account holder. For credit and debit cards, 66br stores only the token generated by the payment processor, never the full card number. PicPay and Mercado Pago data is used solely at the time of the transaction and is not stored in your profile. For deposits made via boleto and TED, banking details are kept in the transaction history for audit and dispute resolution purposes, with access restricted to 66br's finance team.

Yes, but only when required by law. 66br may share information with Brazilian authorities — such as the Receita Federal, Banco Central, Polícia Federal, or Ministério Público — when there is a valid legal requirement, court order, or regulatory mandate. This is a financial compliance obligation that all platforms operating in Brazil must fulfill, particularly in the context of anti-money laundering prevention. 66br does not share data with foreign authorities without a Brazilian court order. Any such sharing is limited to the minimum extent necessary to meet the legal demand.

You can disable non-essential cookies — marketing and performance — without affecting your main access to the platform. Essential cookies, however, are required for basic functions such as keeping your session active, processing bets, and authenticating payments. Disabling essential cookies in your browser will prevent normal use of 66br. To manage cookies, go to your account's privacy settings on the platform or adjust permissions directly in your browser (Chrome, Safari, Firefox). If you need help, 66br's support team can guide you via live chat in Portuguese.

Play at 66br with Privacy and Security

Your data protected by 256-bit SSL, full LGPD compliance, and a team dedicated to your security. Create your free account and deposit via Pix from R$ 10.00.

Play responsibly. For users 18 and older only. Learn more

Português