Cookie and Similar Technologies Policy

1. What this policy covers and who it applies to

This policy explains which cookies and similar technologies are used on the jogodobicho.com website and in the jogodobicho applications, for what purpose, how long they remain on your device, and how you can accept or refuse them.

The controller of that data is [to be provided], registered under CNPJ nº [to be provided], with its seat at [to be provided], authorised by the Secretariat of Prizes and Betting of the Brazilian Ministry of Finance to operate the fixed-odds betting lottery under authorisation [to be provided].

It applies to the jogodobicho.com domain and its subdomains. Third-party sites you reach from here have their own policies, and this one does not apply to them.

Legal basis: Lei 13.756/2018, art. 29 (creation of the fixed-odds betting lottery) · Lei 14.790/2023, art. 2, VIII, and art. 3, II · Portaria SPA/MF nº 827/2024 (operating authorisation) · Portaria SPA/MF nº 1.475/2024 (.bet.br domain) · Lei 13.709/2018 (LGPD), arts. 6 and 9

2. What a cookie is, in plain words

A cookie is a small text file that a website asks your browser to store. On your next visit, the browser hands that file back to the site. That is how a page remembers that you have already signed in, which language you chose, or that you have already seen a particular notice.

A cookie is not a program: it does not run anything on your device, it does not read your files, and it does not install viruses. It holds a short value — usually a code that means nothing outside our system.

Alongside cookies there are technologies that do a similar job. This policy treats them all the same way, under the same consent rules:

We do not use device fingerprinting, nor any other technique meant to recognise you without your knowledge and without leaving a trace in the browser.

• Local storage (localStorage): keeps information in the browser until you or the site erase it. This is where your account access lives.
• Session storage (sessionStorage): the same as the above, but it disappears when you close the tab.
• Tags and pixels: small pieces of code or invisible images that record that a page was opened.
• Server logs: data the site receives simply by being visited, such as the IP address and browser type, which do not depend on anything stored on your device.

Legal basis: Lei 13.709/2018 (LGPD), art. 5, I and X · Lei 12.965/2014 (Brazilian Internet Civil Framework), art. 7, VIII

3. What we use these technologies for

We use cookies and storage only for specified purposes, disclosed in advance. No category is used for anything other than what is described here.

In short, these technologies serve to:

Each of those purposes belongs to one of the four categories described in sections 4 to 7. It is the category that determines whether or not we ask for your consent.

• keep you signed in to your account while you browse;
• protect the account and detect attempts at fraud, unauthorised access, or the use of several accounts by the same person;
• remember preferences you have chosen, such as the language;
• understand which pages are used and where people run into difficulty, so that it can be fixed;
• comply with legal record-keeping, anti-money-laundering and responsible gaming obligations;
• measure campaigns and, only where you authorise it, personalise marketing communications.

Legal basis: Lei 13.709/2018 (LGPD), art. 6, I, II and III · Lei 13.709/2018 (LGPD), art. 9

4. Category 1 — Strictly necessary cookies

These are the ones the site cannot do without. Without them it is not possible to sign in, keep the session open securely, record a bet, or apply the responsible gaming limits you yourself have set.

We do not ask for consent for this category, and it cannot be switched off in the preferences panel. The legal basis is not your authorisation, but the performance of the contract between you and the operator and compliance with legal obligations to which we are subject.

Specifically, this category covers:

Part of that information must be retained even after you leave the site, because anti-money-laundering legislation and the rules of the Secretariat of Prizes and Betting require bets, sessions and transactions to be recorded for a set period. That record is kept on our servers, not in your browser, and it does not disappear when you delete cookies.

• the identifier of your session, which proves to the system that it is you requesting each operation;
• the minimum account data the screen needs to display, such as username and balance;
• the identifier of the site or brand you are using, where the same platform serves more than one operator;
• technical security markers, used to detect automation, abnormal repetition of requests, and attempted fraud;
• the record that you have already acknowledged mandatory notices, such as the minimum age and responsible gaming warnings, so that they are not repeated on every page.

Legal basis: Lei 13.709/2018 (LGPD), art. 7, II, V and IX, and art. 10 · Lei 12.965/2014 (Internet Civil Framework), art. 15 (retention of application access logs) · Lei 9.613/1998, art. 10 (customer identification and record keeping) · Portaria SPA/MF nº 1.143/2024 (AML/CFT) · Portaria SPA/MF nº 722/2024 (information security) · Portaria SPA/MF nº 1.231/2024 (responsible gaming and player registration)

5. Category 2 — Preference cookies

These store choices you made deliberately, so that the site does not ask again on every visit. Today the only preference stored this way is the language.

When you switch language, that choice is recorded in a cookie called jdb_lang, valid for one year. If it is absent, the site tries to infer the language from your browser settings — which works, but gets it wrong more often.

Because this cookie merely records a decision of yours, and is used neither for measurement nor for advertising, it is handled together with the necessary ones: we do not display a separate consent request for it. You may delete it at any time through your browser (section 12), and the only consequence will be that the site goes back to choosing the language on its own.

Legal basis: Lei 13.709/2018 (LGPD), art. 6, II and III · Lei 13.709/2018 (LGPD), art. 7, V

6. Category 3 — Performance and analytics cookies

These tell us how the site is used: which pages are opened, how long they take to load, at which step people abandon a form, and which errors appear. Without them, we fix things blind.

We use Google Analytics 4. The reports we see are aggregated: they state how many people opened a page, not who you are. Even so, the cookies that tool writes contain a browser identifier, and for that reason we treat them as personal data.

This category depends on your consent. Until you accept, the tool is not loaded and its cookies are not written. If you accept and later change your mind, it is enough to withdraw consent in the preferences panel: measurement stops, and cookies already written can be deleted through your browser.

Refusing analytics changes nothing in how the site works, in your bets, or in your prizes.

Legal basis: Lei 13.709/2018 (LGPD), art. 7, I · Lei 13.709/2018 (LGPD), art. 8, §4 · Lei 13.709/2018 (LGPD), art. 9 · Lei 12.965/2014 (Internet Civil Framework), art. 7, IX

7. Category 4 — Advertising and marketing cookies

These serve to measure campaign results and to display advertisements chosen on the basis of what you have viewed. It is the most intrusive category and the one we handle most strictly.

As at the date of this version, the site writes no advertising or social network cookies. The advertising spaces that exist display only our own material, with no tracking and no profiling. The table in section 9 reflects exactly that.

Should that change, three things happen before a single cookie is written: the table in this policy is updated, the preferences panel starts listing the category, and your consent is requested specifically. Generic consent, or consent given in the past for a different purpose, does not count.

Betting advertising is subject to its own rules, which we follow irrespective of cookies: it is not directed at persons under 18, it does not promise certain winnings, it does not present betting as a source of income or as a solution to financial problems, and it is not sent to anyone who is self-excluded or who has asked not to receive communications.

Legal basis: Lei 13.709/2018 (LGPD), art. 7, I, and art. 8, §§ 4 and 5 · Lei 13.709/2018 (LGPD), art. 18, caput · Portaria SPA/MF nº 615/2024 (advertising and commercial communication) · Portaria SPA/MF nº 1.231/2024 (responsible gaming and self-exclusion)

8. How you give consent and how you withdraw it

On your first visit a notice appears with three equally visible options: accept everything, refuse everything that is not necessary, or choose category by category. Refusing takes no more clicks than accepting.

Your choice is recorded together with the date, time and version of this policy. It is that record which later proves what was consented to, and when.

You may change your mind whenever you wish, through the cookie preferences panel available in the footer of every page. Withdrawing consent is as simple as giving it, is free of charge, and requires no justification.

Withdrawal takes effect from that point forward: what was collected while consent was valid does not become unlawful, but collection stops immediately. If you want the data already collected to be erased, ask through the channels in section 15.

We use none of the following devices:

• acceptance boxes pre-ticked in advance;
• scrolling the page, continuing to browse, or closing the notice treated as acceptance;
• a refuse button that is hidden, greyed out, or one click further away than the accept button;
• repeating the request on every visit after a refusal, in order to wear you down.

Legal basis: Lei 13.709/2018 (LGPD), art. 8, caput and §§ 1 to 6 · Lei 13.709/2018 (LGPD), art. 9, §1 · Lei 13.709/2018 (LGPD), art. 18, IX · Lei 12.965/2014 (Internet Civil Framework), art. 7, IX

9. Which cookies and storage we use today

The list below is the inventory of what is in use as at the date of this version. When something is added or removed, this list changes with it — if you find any item from this site in your browser that is not listed here, tell us through the channels in section 15.

The format of each line is: name — where it lives — category — what it is for — how long it lasts.

Items held in local storage have no fixed expiry: they remain until you sign out, clear your browser data, or the system ends the session through inactivity or expiry of the access credential.

• jdb_lang — first-party cookie — preference — stores the chosen language so the site opens in it on your next visit — 365 days.
• jdb_token — local storage — strictly necessary — session credential; it is what proves to the server that the account is yours on every request — until you sign out or clear the browser.
• jdb_user — local storage — strictly necessary — basic account data shown on screen, such as the username — until you sign out or clear the browser.
• rf_token, rf_refresh, rf_user_id — local storage — strictly necessary — renew the session without making you type your password again, and support single sign-on across the group sites — until you sign out or clear the browser.
• jdb_op_slug — session storage — strictly necessary — identifies which brand of the platform you are using, so that accounts and balances of different operators are not mixed — erased when the tab is closed.
• _ga — Google cookie — analytics, consent required — distinguishes one browser from another in order to count visitors — 2 years.
• _ga_<property identifier> — Google cookie — analytics, consent required — maintains the measurement state during the visit — 2 years.
• Demonstration session — local storage, under the same jdb_token key — strictly necessary — allows the games to be tried in fun mode, with no economic value, before creating an account — until you leave, clear the browser, or create an account.
• Server logs (IP address, date and time, pages accessed, browser and device type) — not stored on your device — strictly necessary and a legal obligation — security, fraud prevention and compliance with record retention requirements — for the legal periods indicated in section 4.

Legal basis: Lei 13.709/2018 (LGPD), art. 9, I to VI (purpose, form and duration of processing) · Lei 12.965/2014 (Internet Civil Framework), art. 15 · Portaria SPA/MF nº 1.207/2024 (recording and traceability of betting system operations)

10. Third parties and transfers of data outside Brazil

The only third party that writes cookies on this site is Google, through Google Analytics 4, and only after your consent. It acts as a processor of the data: it handles it under our instructions and for the purposes of this policy.

Google measurement may involve an international transfer of data. It is carried out only where supported by a mechanism provided for in the LGPD, with contractual guarantees of protection equivalent to that of Brazilian law.

This does not apply to the data of your account and your bets: registration, financial transactions and betting system records are held on infrastructure located in Brazil, under the information security requirements applicable to the sector.

We do not sell personal data. We do not share data collected through cookies with data brokers or with third parties for purposes of their own.

Legal basis: Lei 13.709/2018 (LGPD), art. 33 (international transfer) · Lei 13.709/2018 (LGPD), art. 39 and art. 46 · Portaria SPA/MF nº 722/2024 (information security)

11. These technologies do not influence the outcome of any game

No cookie, tag or item stored in your browser plays any part in determining outcomes, draws, prizes or odds. Accepting or refusing analytics neither improves nor worsens your chances, and deleting cookies does not reset anything in your favour.

Outcomes are generated and verified exclusively on our servers, by a random number generator subject to certification by a recognised body, with an auditable record of every operation.

If anyone promises otherwise — an extension, an application, or a method that alters cookies in order to force wins — it is a fraud, and nothing that tool does in your browser alters the outcome. Please tell us through the channels in section 15.

Legal basis: Portaria SPA/MF nº 1.207/2024 (technical requirements and random number generator) · Portaria SPA/MF nº 300/2024 (certification by an accredited body) · Lei 14.790/2023, art. 2, VIII

12. How to control cookies from the browser itself

Besides our panel, the browser gives you control over all cookies, including the necessary ones. The paths are usually found at:

You may also browse in an incognito or private window: in that mode, everything written is erased when the window is closed.

Two honest warnings. First: blocking all cookies and local storage prevents signing in and betting — that is not a restriction of ours, it follows from the browser not storing the session credential. Second: deleting the browser cookies also deletes your preference choices, and the initial notice will appear again.

Deleting cookies does not delete what is recorded on our servers under legal obligation, such as your registration, your bets and your self-exclusion requests. For that data, the rights in section 15 apply.

• Google Chrome: Settings, Privacy and security, Cookies and other site data.
• Mozilla Firefox: Settings, Privacy and Security, Cookies and Site Data.
• Safari: Preferences or Settings, Privacy.
• Microsoft Edge: Settings, Cookies and site permissions.
• Mobile browsers: the same options appear in the settings menu of the browser application.

Legal basis: Lei 13.709/2018 (LGPD), art. 18, caput and its items · Lei 13.709/2018 (LGPD), art. 8, §5

13. Refusing non-essential cookies does not prevent you from using the site

There is no cookie wall here. Anyone who refuses everything that is not necessary can still browse, check results, read the rules, open an account, deposit, bet and withdraw. Nothing sits behind an accept button.

There is only one practical effect of refusal, and it falls on us rather than on you: without analytics cookies we stop seeing usage problems that show up only in the numbers, and we take longer to fix them.

On playing: the demonstration mode, which has no economic value, may be used without registering, so that any visitor can try the games before deciding. In that mode there is no deposit, there is no cash prize, and the balance displayed is not convertible into any value.

Betting with a financial stake is a different matter and always requires your own verified account, with the bettor identified and checked before the first bet, in the manner required by the regulation. That is not a cookie preference and cannot be waived, either by your choice or by ours.

Legal basis: Lei 13.709/2018 (LGPD), art. 9, §3 · Lei 13.709/2018 (LGPD), art. 8, §§ 4 and 5 · Lei 14.790/2023 (identification and registration of the bettor) · Portaria SPA/MF nº 1.231/2024 (registration rules and responsible gaming)

14. Persons under 18

The site is not intended for persons under 18, who may neither register nor bet. Nor do we direct advertising at that audience, and we do not use cookies to build profiles of people we identify as minors.

If a parent or guardian notices that a minor has used the site, they may tell us through the channels in section 15. We close the access and erase the data collected, except for what the law requires us to retain.

Parental control tools installed on the device help to block access to betting sites. We recommend using them on computers and phones shared with children and adolescents.

Legal basis: Lei 13.709/2018 (LGPD), art. 14 (data of children and adolescents) · Lei 14.790/2023 (prohibition of betting by persons under 18) · Portaria SPA/MF nº 615/2024 (advertising) · Portaria SPA/MF nº 1.231/2024 (responsible gaming)

15. Your rights, the data protection officer, and how to complain

In relation to data processed through cookies, you may request:

Requests may be made through the customer service channel [to be provided] or directly to the officer in charge of personal data processing, at [to be provided]. Complaints not resolved through those channels may be escalated to the ombudsman, at [to be provided].

If you still consider that your rights have not been honoured, you may lodge a complaint with the Brazilian National Data Protection Authority (ANPD).

This policy supplements the Privacy Policy, which describes all processing of personal data and not only that carried out through cookies, and it should be read together with the Terms of Use and the Responsible Gaming Policy.

• confirmation that we process data about you, and access to that data;
• correction of incomplete, inaccurate or out-of-date data;
• anonymisation, blocking or erasure of unnecessary or excessive data, or data processed unlawfully;
• portability of the data, under the terms of the regulation;
• information about the parties with whom we share your data;
• withdrawal of consent, and information about the consequences of not giving it.

Legal basis: Lei 13.709/2018 (LGPD), art. 18 (rights of the data subject) · Lei 13.709/2018 (LGPD), art. 19 (deadlines and form of response) · Lei 13.709/2018 (LGPD), art. 41 (data protection officer) · Lei 12.965/2014 (Internet Civil Framework), art. 7, VIII

16. Version, effective date and changes

This is version 1.0, effective from 5 August 2026. The version and the date are always visible at the top of the document.

We may amend this policy when the technologies used, the third parties involved, or the applicable legislation change. Material changes — a new cookie in a category requiring consent, a new third party, a new purpose — are announced before they take effect, and consent is requested again. Drafting corrections that do not alter the substance do not reset consents.

Previous versions remain available for consultation, so that it can be verified what was in force on any given date.

Legal basis: Lei 13.709/2018 (LGPD), art. 6, VI (transparency) · Lei 13.709/2018 (LGPD), art. 8, §6 · Lei 13.709/2018 (LGPD), art. 9, §2