This document explains, clearly and directly, how 168bet collects, uses, stores, and protects the personal data of Brazilian users — in compliance with the Lei Geral de Proteção de Dados (LGPD). Your data belongs to you, not to us.
A straightforward summary of the key points before the full read. No fluff, no hidden fine print.
168bet does not sell, rent, or share personal data with third parties for commercial purposes. Full stop. The data you provide stays within the platform's operational environment.
View detailsEvery page and transaction on 168bet uses 256-bit SSL encryption. Pix deposits, withdrawals, registration, and account access — everything travels securely and encrypted.
View detailsYou have the right to access, correct, export, and request deletion of your data at any time, as guaranteed by the General Data Protection Law (Law No. 13.709/2018).
View detailsNo credit or debit card data is stored in plain text on 168bet's servers. The tokenization process ensures your financial data remains protected even in the event of an incident.
View details168bet uses cookies to keep your session active, personalize content, and improve platform performance. You can adjust your cookie preferences at any time in your browser settings.
View details168bet has a Data Protection Officer (DPO) responsible for handling LGPD-related requests. Any questions or requests can be sent directly to contato@168bet.express.
View detailsThis Privacy Policy is an integral part of the Terms and Conditions of 168bet. By creating an account and using the platform, you confirm that you have read and agreed to the processing of your data as described here. This policy is governed by the General Data Protection Law – LGPD (Law No. 13.709/2018).
When you create your account at 168bet, you voluntarily provide the information required to operate the platform. This includes your full legal name as it appears on your CPF, your CPF number, date of birth, full residential address (street, number, neighborhood, city, state, and zip code), active email address, Brazilian mobile number with area code, and a password of your choice. All of this information is mandatory for creating and maintaining your account.
For the identity verification process (KYC), required before the first withdrawal, the 168bet requires submission of an official government-issued photo ID (RG, CNH, or passport), proof of address issued within the last 3 months, and a selfie holding the document. These files are stored in an encrypted environment and used exclusively for identity verification and regulatory compliance.
A 168bet records all financial transactions carried out on the platform: deposits via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED transfers (Nubank, Itaú, Bradesco, Banco do Brasil, Caixa, Santander); withdrawals via Pix and TED; Pix keys used; and tokenized card data (never in plain text). Transaction history is retained for accounting, tax, and anti-money laundering purposes, as required by law.
While using 168bet, we automatically collect data about how you interact with the platform: IP address, browser type and version, operating system, device (phone, tablet, or computer), pages visited, session duration, sports and games accessed (Brasileirão, Libertadores, live roulette, poker, slots, crash games), markets and bets placed, and access times. This data is used to improve the platform, detect fraud, and personalize your experience.
| Data category | Examples | Main purpose |
|---|---|---|
| Personal identification | Full name, CPF, date of birth, ID document | Registration, KYC, fraud prevention |
| Contact | Email, phone number, address | Communication, security, notifications |
| Financial | Pix key, transaction history | Payment processing, compliance |
| Behavioral | Bets, games, session duration | Platform improvement, responsible gambling |
| Technical | IP address, device, browser | Security, fraud detection |
| Communication | Chat history with support | Service quality and dispute resolution |
A 168bet does not collect sensitive data such as racial or ethnic origin, religious beliefs, political opinions, trade union membership, health information, or sexual life. Passwords are never stored in plain text — all are stored using cryptographic hashing — and full credit or debit card details are never stored either; only tokens generated by the payment processors.
The primary purpose of data processing at 168bet is running the platform: processing your registration, verifying your identity, handling Pix deposits and withdrawals, recording Sports Betting on the Brasileirão Série A, Copa do Brasil, Libertadores, and other competitions, operating live casino tables, roulette, blackjack, baccarat, poker, and making slots and crash games available. Without this data, the platform simply cannot function.
IP address, device, and usage behavior data are essential to the fraud detection system at 168bet. The system monitors unusual patterns — such as multiple logins from different IPs in a short period, repeated failed login attempts, or atypical betting behavior — to protect your account and the integrity of the platform. If suspicious activity is detected, the account may be temporarily suspended and you will be notified by email or phone.
The email address and mobile number you register are used for mandatory operational communications: account registration confirmations and security verifications, transaction notifications (processed deposits and withdrawals), security alerts (new device login, suspicious access attempts), support responses via live chat and email, and communications related to the VIP Program (cashback credits, tier changes). You may also receive optional promotional communications — but only if you have given explicit consent, and you can withdraw that consent at any time.
Betting behavior data is analyzed internally by 168bet to identify patterns that may indicate problem gambling — a sudden spike in betting volume, frequent attempts to raise deposit limits, or unusually long sessions. This analysis is carried out for user protection purposes, not commercial ones. When risk patterns are identified, our support team may proactively reach out to offer responsible gambling tools available on the Responsible Gambling.
A 168bet maintains financial transaction records and user identification data to meet Brazilian legal obligations, including rules set by the Conselho de Controle de Atividades Financeiras (COAF) related to anti-money laundering, tax obligations to the Receita Federal, and any legitimate requests from competent public authorities pursuant to a formal court or administrative order.
168bet never uses your data for third-party marketing purposes. Your betting data, gameplay behavior, and financial information are never sold or shared with advertisers, brokers, insurance companies, or any other party outside the platform's direct operational scope.
To operate the platform, the 168bet needs to share data with specific technical partners, always under confidentiality agreements and strictly limited to the minimum necessary for each function. These partners include: payment processors responsible for integration with Pix, boleto bancário, Visa and Mastercard cards, PicPay, and Mercado Pago (they receive only the data needed to process the specific transaction); Live Casino providers that supply live roulette, blackjack, and baccarat tables (they receive an anonymized session identifier, not full personal data); identity verification (KYC) services used to authenticate submitted documents (they receive only the documents needed for verification); and cloud infrastructure providers where the platform's systems are hosted (they have technical access to the servers but operate under strict confidentiality agreements).
A 168bet may be legally required to share data with Brazilian public authorities — Receita Federal, Polícia Federal, COAF, Ministério Público, the Judiciary — upon formal request with adequate legal basis. In such cases, we share only the data specifically requested and notify the user whenever legally permitted to do so.
Full transparency: If 168bet needs to add new partners with access to personal data, this policy will be updated at least 15 days in advance and you will be notified by email.
All data transmitted between your device and the servers of 168bet are protected by TLS 1.3 encryption with a 256-bit SSL certificate. This covers access to the platform via phone or computer, data submitted during registration, Pix transactions, and all communications with support. Data stored on servers — including personal information, KYC documents, and financial history — is encrypted at rest using AES-256 standards.
When you make a credit or debit card payment on 168bet, card data is processed directly by the PCI-DSS certified payment gateway. The platform receives only a token (a unique code) representing that card — never the full card number, expiration date, or CVV. This means that even in a hypothetical data breach on 168bet's servers, your card's financial data would remain protected.
Access to users' personal data within the 168bet is governed by the principle of least privilege: each team member accesses only the data strictly necessary for their specific role. Access to internal systems requires multi-factor authentication (MFA). All access to sensitive data is logged in audit trails reviewed regularly by the security team. Employees who handle personal data sign confidentiality agreements and undergo periodic information security training.
A 168bet maintains continuous 24-hour monitoring for detection of unauthorized access, abnormal behavior, and data breach attempts. In the event of a security incident that may affect personal data, the platform will follow the LGPD incident response protocol: notifying the Autoridade Nacional de Proteção de Dados (ANPD) within the legally required timeframe and directly informing potentially affected users with guidance on protective measures.
Personal data is retained for as long as necessary for the purposes described in this policy, or for the minimum period required by law. Financial transaction data is retained for at least 5 years in accordance with tax and anti-money laundering regulations. Following account closure, data is anonymized or deleted within 180 days, except for data that must be retained by legal obligation. KYC documents are securely disposed of after the applicable retention period.
The General Data Protection Law (LGPD – Law No. 13.709/2018) guarantees you, as the data subject, a set of rights over the information that 168bet handles. All of these rights can be exercised at any time via live chat or by emailing contato@168bet.express with the subject line "LGPD Request". Requests are responded to within 15 business days.
| Right | What this means in practice | Response time |
|---|---|---|
| Access | Request a copy of all personal data that 168bet holds about you. | Up to 15 business days |
| Correction | Correct incomplete, inaccurate, or outdated information (address, email, phone number). | Up to 15 business days |
| Deletion | Request the deletion of data that is unnecessary or processed without adequate legal basis. | Up to 30 business days |
| Portability | Receive your data in a structured, machine-readable format (CSV, JSON). | Up to 30 business days |
| Objection | Object to the processing of your data for specific purposes, such as promotional communications. | Immediate for marketing |
| Information | Obtain information about which third parties your data has been shared with. | Up to 15 business days |
| Revocation | Withdraw consent given for any consent-based processing (e.g., marketing). | Immediate |
To exercise any of the rights above, please contact the Data Protection Officer (DPO) of 168bet by email at contato@168bet.express with the subject line "LGPD Request – [request type]" or via live chat, available 24 hours a day. For data access or portability requests, identity verification may be required to ensure your data is not delivered to third parties. Our support team can also guide you through the available options if your request involves data that must be retained by legal obligation.
If you believe your rights as a data subject have not been respected after contacting 168bet, you have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD), the federal body responsible for enforcing the LGPD in Brazil. Information on how to contact the ANPD is available on the official federal government website.
The data deletion period may be longer when 168bet has a legal obligation to retain certain data — such as financial transaction records required under tax and anti-money laundering legislation. In those cases, we will inform you of the applicable legal retention period and why the data cannot be deleted immediately.
Cookies are small text files stored in your browser when you visit 168bet. They allow the platform to "remember" information across pages and sessions — such as the fact that you are logged in, your language preferences, and which sport you last viewed. Without essential cookies, the platform will not function properly.
You can manage or disable non-essential cookies at any time in your browser settings. On Android, go to Settings > Apps > Chrome (or your browser) > Storage > Clear cookies. On iPhone, go to Settings > Safari > Privacy & Security > Block All Cookies. Disabling essential cookies will prevent the 168bet — bets, logins, and Pix transactions may be affected.
A 168bet may use tracking pixels in transactional emails (such as deposit and withdrawal confirmations) to verify whether the email was opened and whether links were clicked. This information is used solely to improve operational communications — for example, resending a confirmation that appears not to have been delivered. You can disable image loading in emails to block tracking pixels.
The platform 168bet is strictly prohibited for users under 18. The collection and processing of minors' data is absolutely forbidden. If we determine that a minor's data was collected by mistake — whether through falsified registration information or any other reason — the account will be immediately closed and all data will be deleted as quickly as possible, except for records necessary to document the incident and meet any applicable legal obligations.
Parents or guardians who discover that a minor has created an account on 168bet should contact support immediately via live chat or at contato@168bet.express. The matter will be handled as a priority and the data deleted promptly upon verification.
This Privacy Policy may be updated periodically to reflect changes in Brazilian law — particularly the LGPD — in our operational practices, or in response to guidance from the ANPD. Significant changes will be communicated by email at least 15 days before they take effect. For minor changes (text corrections or clarifications with no practical impact), the update date at the top of the document will be revised without prior notice.
The most up-to-date version of this policy is always available on this page at 168bet.express/privacy-policy. We recommend reviewing it periodically, especially after receiving notices about changes. Continued use of the platform after a new version takes effect constitutes acceptance of the updates.
For all matters related to privacy, data protection, and the exercise of rights under the LGPD, the official contact channel for the DPO of 168bet is the email contato@168bet.express with the subject line "DPO – [your request]". Support is provided in Brazilian Portuguese on business days, with responses within 15 days. For urgent account security matters, use the live chat available 24 hours a day.
Having a well-written policy is not enough — the measures need to actually exist. Here are the concrete practices 168bet has in place to protect your data.
From the login screen to the moment your Pix withdrawal is confirmed, all communication between your phone or computer and 168bet's servers is encrypted with TLS 1.3 and a 256-bit SSL certificate — the same technology used by digital banks like Nubank and Itaú.
When you deposit with a Visa or Mastercard credit or debit card, the full card number goes directly to the PCI-DSS certified payment processor. 168bet receives only a token — a code with no value outside the context of that transaction. Your card data cannot be stolen from us because we simply do not store it.
The support agent handling your live chat only sees what is needed to resolve your issue. The trading team managing odds has no access to your financial data. Every team at 168bet accesses only the data their role requires — with mandatory multi-factor authentication.
Your KYC documents, betting history, and account data are not stored as plain text in the database. Everything is stored with AES-256 encryption at rest, meaning that even with physical access to the servers, the data would be unreadable without the correct encryption keys.
Your gameplay data is never sold to credit agencies, insurance companies, banks, or any other company. Your Brasileirão betting history, your live roulette sessions, or your Pix deposits do not become a product. 168bet monetizes the service it provides, not its users' data.
The Lei Geral de Proteção de Dados is not just a legal formality at 168bet — it is an operational practice. The Data Protection Officer (DPO) is a real, accessible point of contact, reachable at contato@168bet.express, and handles requests for data access, correction, portability, and deletion within the legally required timeframes.