Xp999 takes the privacy of its users seriously. This document provides a clear, straightforward overview of how your data is collected, used, stored, and protected — no unnecessary legal jargon.
Six real commitments to protecting your data — not just fine words on paper
Quick summary for those in a hurry: xp999 collects only the data needed to operate the platform, never sells your information to anyone, protects everything with encryption, and fully respects your rights under the LGPD. To exercise any right or get answers to your questions, access the live chat or send an email to contato@xp999.best.
Xp999 is a Sports Betting and online casino platform available at xp999.best, built with an exclusive focus on the Brazilian market. For the purposes of this Privacy Policy, xp999 acts as the controller of personal data collected from platform users, as defined by the LGPD — Lei Geral de Proteção de Dados (Law No. 13.709/2018).
This Privacy Policy clearly describes how xp999 collects, uses, stores, shares, and protects the personal data of its users in the context of using the platform — whether for Sports Betting on the Brasileirão, Copa do Brasil, UFC, and other competitions, or for the online casino, including slots, crash games, progressive jackpots, and Live Casino. The practices described in this document apply to all registered users and visitors of the platform.
By registering with xp999, using the platform, or interacting with any of its services, you confirm that you have read and agree to the terms of this Privacy Policy. If you have any questions, our Portuguese-speaking support team is available 24 hours a day via live chat.
Xp999 collects only the data strictly necessary to operate the platform securely, meet legal obligations, and deliver the best possible experience to Brazilian users. Data collection is divided into the following categories:
Data provided directly by you:
Data collected automatically during platform use:
Xp999 does not collect or store sensitive data such as racial or ethnic origin, religious beliefs, political opinions, health data, or sexual orientation. If you inadvertently include such information in messages to support, it will be treated with additional confidentiality and will not be used for any purpose other than resolving the reported issue.
Data collected by xp999 is used exclusively for the purposes listed below. No data is used for purposes incompatible with those that justified its original collection:
Under the LGPD, all personal data processing must be grounded in one of the legal bases set out in the law. xp999 relies on the following legal bases to process your data:
| Processing Purpose | Legal Basis (LGPD) |
|---|---|
| Account creation and platform operation | Contract performance (art. 7, V) |
| Payment processing (Pix, card, TED) | Contract performance (art. 7, V) |
| KYC verification and anti-money laundering | Compliance with legal obligation (art. 7, II) |
| Fraud detection and prevention | Legitimate interest (art. 7º, IX) |
| Marketing communications and promotions | Consent (art. 7, I) |
| Platform experience personalization | Legitimate interest (art. 7º, IX) |
| Compliance with legal and judicial orders | Compliance with legal obligation (art. 7, II) |
Where processing is based on consent — particularly for marketing communications — you may withdraw that consent at any time without affecting the operation of your account. Withdrawal can be done through your profile settings or by emailing contato@xp999.best.
Xp999 does not sell your personal data. Full stop. Data is shared with third parties only in the strictly necessary situations listed below, always with contractual protections equivalent to those in this Policy:
No identifiable personal data is shared with advertising networks, data brokers, social media platforms, or any external entity for third-party marketing purposes. Behavioral analytics for personalization are carried out internally by the xp999 team using anonymized or pseudonymized data.
Xp999 uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and collect aggregated analytical data. See the types of cookies used:
You can manage your cookie preferences directly in your browser settings. Disabling non-essential cookies does not affect access to your account or the platform's core features — it may only reduce the personalization of some interface elements. For most mobile users, cookie settings are accessible in the browser app menu.
Xp999 implements robust technical and organizational measures to protect your personal data against unauthorized access, accidental loss, improper disclosure, or destruction. The main measures in place include:
Despite all these precautions, no system is 100% immune to risk. xp999 is committed to acting with transparency and promptness in communicating any incident that could affect the security of users' data. If you notice any suspicious activity on your account, contact us immediately via the 24-hour live chat on the platform.
Xp999 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected or to meet applicable legal obligations. The retention criteria are as follows:
Once the applicable retention period expires, data is securely and irreversibly deleted or anonymized in a way that makes it impossible to associate with a specific individual. Data retained for mandatory legal purposes is kept in an isolated environment with restricted access and is not used for any other purpose during that period.
The LGPD grants you, as a personal data subject, a set of rights that xp999 is fully obligated to respect. See what you can request and how to exercise each right:
| Right | What it means | Response Timeframe |
|---|---|---|
| Access | Know what personal data xp999 holds about you and how it is used | 15 business days |
| Correction | Correct incomplete, inaccurate, or outdated data | 15 business days |
| Anonymization / Blocking / Deletion | Request the anonymization, blocking, or deletion of unnecessary data or data processed in violation of the LGPD | 15 business days |
| Portability | Receive your data in a structured format for transfer to another service provider | 30 business days |
| Consent withdrawal | Withdraw consent given for processing based on this legal basis (e.g., marketing) | Immediate |
| Objection | Object to processing carried out on the basis of legitimate interest, where there is a legal basis to do so | 15 business days |
| Sharing information | Find out which public or private entities your data has been shared with | 15 business days |
To exercise any of the rights listed above, contact xp999 via 24-hour live chat or by email at contato@xp999.best. Requests are processed free of charge. In some cases, we may need to verify your identity before proceeding — this is a security measure to protect you from third parties attempting to access or modify your data without authorization.
If you believe your rights have not been properly upheld, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the body responsible for enforcing the LGPD in Brazil.
Some service providers used by xp999 — particularly cloud infrastructure and casino game providers — may process data on servers located outside Brazil. When this occurs, xp999 ensures that international data transfers meet at least one of the criteria below, as required by the LGPD:
Xp999 does not transfer data to jurisdictions without adequate protection. If you would like information about the specific countries to which data may be transferred and the applicable safeguards, please contact us at contato@xp999.best.
Xp999 is an online betting and casino platform exclusively for users aged 18 and over. We do not intentionally collect, process, or store personal data from anyone under 18. Creating an account on xp999 requires age verification and a valid CPF — both are checked during the KYC process.
If xp999 identifies that data from a user under 18 was inadvertently collected, the account will be closed immediately, the data will be deleted as quickly as possible in accordance with applicable legal obligations, and any deposited balance will be returned to the CPF holder linked to the originating bank account. Legal guardians who discover that a minor has used the platform should contact us immediately via live chat or at contato@xp999.best.
Xp999 may update this Privacy Policy periodically to reflect changes in its data processing practices, Brazilian legislation — especially ANPD regulations — or its services. The date of the last update is always shown at the top of this page.
When changes are significant — particularly those that expand data collection or materially alter the purposes of processing — xp999 will notify users by email at least 15 days in advance. The email will be sent to the address registered on the account, which is why keeping it up to date is important.
Continued use of the platform after a revised version of this Policy takes effect constitutes tacit acceptance of the changes made. If you disagree with any change, you may close your account as set out in Section 12 of the Terms and Conditions, and your data will be handled as described in Section 8 of this Policy.
For any questions regarding this Privacy Policy, the processing of your personal data, or the exercise of your rights under the LGPD, please contact xp999 through the channels below:
Xp999 has appointed a Data Protection Officer (DPO) responsible for overseeing LGPD compliance and serving as the communication channel between users and the National Data Protection Authority (ANPD). The DPO can be reached at the email address above with the subject line "DPO — xp999".
Xp999 believes privacy is a right, not a privilege. If you have any questions about how your data is handled or would like to exercise any of your rights under the LGPD, reach out to us — we're here to help. You can also check our Terms and Conditions and our Responsible Gambling.