Before you start: This Privacy Policy describes how 22nn collects, uses, stores, and protects your personal data. By creating an account or using the platform, you confirm that you have read and agreed to these terms. Questions? Our live chat in Portuguese is available 24 hours a day.
1Data Controller
For the purposes of the General Data Protection Law (LGPD — Law No. 13.709/2018), the controller of your personal data is 22nn, operator of the platform available at 22nn.click. The controller is responsible for decisions regarding data processing — what data to collect, for what purpose, and how long to retain it.
22nn has a Data Protection Officer (DPO) appointed, responsible for receiving and responding to data subject requests and serving as the communication channel with the Autoridade Nacional de Proteção de Dados (ANPD). The DPO's contact details are available in section 15 of this policy.
Jurisdiction: 22nn processes data from Brazilian users in Brazil or in countries that offer an equivalent level of protection, in accordance with Article 33 of the LGPD.
2Data We Collect
22nn collects only the data necessary to operate the platform securely, process financial transactions, and meet legal obligations. See the breakdown by category below:
| Category |
Data collected |
When collected |
| Identification |
Full name, CPF, date of birth, email, mobile phone number |
Sign Up |
| KYC Documents |
National ID or driver's license, proof of address, selfie with document |
Identity verification |
| Financial |
Pix key, card details (tokenized), transaction history |
Deposit / Withdrawal |
| Platform usage |
Betting history, games accessed, sessions, preferences |
Ongoing use |
| Technical |
IP address, device type, browser, operating system |
Platform access |
| Communications |
Messages exchanged with support, emails, chat records |
Contact Support |
Credit and debit card data is tokenized by our PCI-DSS certified payment partners. 22nn does not store full card numbers on its servers.
Sensitive data: 22nn does not intentionally collect data considered sensitive under the LGPD (such as racial origin, political opinions, health data, or biometrics), except where strictly required by law and with your explicit consent.
3Processing Purposes
Every piece of data collected by 22nn has a specific and legitimate purpose. We do not use data for purposes incompatible with those described below:
- Registration and authentication: create and manage your account, verify your identity at each login, and protect access against unauthorized use;
- Eligibility verification (KYC): confirm that you are over 18, hold a valid CPF, and reside in Brazil, in compliance with the platform's legal obligations;
- Payment processing: receive deposits via Pix, boleto bancário, credit/debit card, PicPay, or Mercado Pago, and process withdrawals via Pix to your registered account;
- Fraud and money laundering prevention: monitor transactions and usage patterns to identify and prevent unlawful activity, in accordance with applicable Brazilian law;
- Customer support: answer questions, resolve complaints, and maintain service records to ensure quality and traceability;
- Experience personalization: suggest relevant games, bets, and promotions based on your usage history, always within the limits of the consent you have given;
- Service communications: send transactional notifications about deposits, withdrawals, bonuses, and important platform updates;
- Compliance with legal obligations: maintain records required by Brazilian law, respond to requests from competent authorities, and cooperate with judicial investigations when legally required.
4Legal Basis for Processing (LGPD)
Every data processing operation carried out by 22nn is grounded in at least one of the legal bases set out in Article 7 of the LGPD:
- Contract performance (art. 7º, V): we process the data needed to create and maintain your account, process bets, and manage payments — this is essential for delivering the contracted service;
- Compliance with a legal obligation (art. 7º, II): KYC verification, transaction monitoring for anti-money laundering purposes, and retention of tax records are legal requirements that do not depend on your consent;
- Legitimate interest (art. 7, IX): fraud monitoring, platform security, and continuous improvement of the user experience are processing activities based on legitimate interest, provided they do not infringe on your fundamental rights;
- Consent (art. 7º, I): for marketing communications, advanced personalization, and optional data collection, we request your consent freely, informedly, and unambiguously — and you may withdraw it at any time.
Consent withdrawal: To withdraw any consent you have given, go to your account settings or contact support via chat. Withdrawal does not affect processing carried out before the request, nor does it prevent processing based on other legal grounds.
5Data Sharing with Third Parties
22nn does not sell users' personal data. Sharing only occurs in the situations described below, always under data protection agreements that hold partners to the same security standards adopted by 22nn:
- Payment providers: PCI-DSS certified companies responsible for processing transactions via Pix, boleto, credit/debit card, PicPay, and Mercado Pago receive only the minimum data required to complete the transaction;
- Game providers: companies such as Pragmatic Play, Evolution Gaming, Playtech, Spribe, and others may receive an anonymous user identifier to personalize the gaming experience and calculate progressive jackpots — never full identity data;
- KYC verification services: specialized partners in identity verification and fraud prevention receive the documents required for the validation process. These partners are contractually prohibited from using the data for any other purpose;
- Legal authorities: data may be shared with Brazilian governmental, judicial, or regulatory authorities when required by law, court order, or formal investigation. 22nn only complies with legally substantiated requests;
- Independent auditors: certifiers such as eCOGRA and iTech Labs may have access to aggregated, anonymized technical data for the purpose of auditing gaming systems.
Partners under contract: All third parties that receive 22nn user data sign data processing agreements requiring security standards equivalent to those adopted by the platform, and are expressly prohibited from using the data for their own purposes.
6International Data Transfers
Some of the game providers and technical service providers used by 22nn are based outside Brazil. When personal data of Brazilian users is transferred to other countries, 22nn adopts the following safeguards in compliance with Article 33 of the LGPD:
- Transfers only to countries with a level of protection recognized as adequate by the ANPD;
- Adoption of standard contractual clauses for data protection when transferring to destinations without an adequacy recognition;
- Minimized data sharing — only technical identifiers, never full identity or financial data, wherever possible;
- Contractual requirement for the recipient to maintain security standards equivalent to those required under the LGPD.
In cases where a game provider requires data for personalization or jackpot management, we transmit only an anonymous internal identifier — one that cannot be directly linked to your identity outside of 22nn's systems.
7Data Retention & Deletion
22nn retains personal data for as long as necessary to fulfill the purposes for which it was collected or to meet legal obligations. General retention periods are:
- Active account data: retained for as long as the account is active and for the additional period required by law after closure;
- Financial records: retained for a minimum of 5 (five) years after the transaction, in accordance with Brazilian tax and anti-money laundering compliance requirements;
- KYC documents: retained for a minimum of 5 (five) years after account closure, as required by regulatory obligations;
- Support records: retained for 2 (two) years after the ticket is closed for quality management and dispute resolution purposes;
- Browsing data and technical logs: retained for up to 12 (twelve) months for security and fraud prevention purposes.
Once the applicable retention periods expire, data is securely deleted or anonymized so it can no longer be linked to any individual. You may request early deletion of your data, subject to mandatory legal retention requirements.
Anonymization: Data used for statistical analysis and platform improvement is anonymized before processing — meaning it is stripped of any personal identifiers and cannot be linked to any specific user.
8Data Security
22nn implements technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Key safeguards include:
- SSL/TLS Encryption: all traffic between your device and 22nn's servers is encrypted with a bank-grade SSL certificate (TLS 1.2 or higher);
- Encrypted storage: sensitive data — documents, financial information, and passwords — is stored in encrypted form. Passwords are never stored as plain text;
- Access control: internal access to user data is restricted by role, with multi-factor authentication required for teams with access to critical systems;
- Continuous monitoring: intrusion detection systems and 24/7 monitoring identify and block suspicious activity in real time;
- Security testing: the platform undergoes periodic penetration testing conducted by independent specialized firms;
- Payment tokenization: credit and debit card data is tokenized by PCI-DSS certified partners — 22nn never stores full card numbers.
Despite all measures in place, no system is 100% invulnerable. 22nn is committed to acting with the utmost diligence and to promptly notifying you of any security incident that may affect your data.
9Cookies & Tracking
22nn uses cookies and similar technologies to ensure the platform functions correctly, personalize your experience, and analyze aggregated usage. The types of cookies used are:
Essential
Analytics
Preferences
Security
- Essential cookies: required for the basic operation of the platform — session management, authentication and security. They cannot be disabled without compromising use of the platform;
- Analytical cookies: collect aggregated and anonymized data on how users navigate the platform — pages visited, session duration, errors encountered. They help improve the experience and can be disabled in account settings;
- Preference cookies: remember language settings, preferred layout, and other personalization adjustments. They can be disabled without affecting core functionality;
- Security cookies: help detect suspicious behavior and prevent fraud, such as logins from unrecognized devices.
You can manage your cookie preferences at any time through your browser settings or in the privacy section of your 22nn account. Disabling non-essential cookies does not affect access to the platform's core features.
No cross-site tracking: 22nn does not use third-party cookies to track you across other sites outside the 22nn.click platform. Usage monitoring takes place exclusively within the platform's own domain.
10Data Subject Rights
The LGPD grants you, as the data subject, a set of rights that 22nn is fully committed to upholding. Here is what you can request at any time:
Right of Access
Request a complete copy of all your personal data processed by 22nn, including information on the purpose and retention period.
Right to Correction
Request the correction of inaccurate, incomplete, or outdated data. Account details can be updated directly within your account.
Right to Erasure
Request the deletion of data that is unnecessary or processed in violation of the LGPD, subject to legally mandated retention periods.
Right to Data Portability
Receive your data in a structured, machine-readable format for transfer to another controller, where technically feasible.
Consent Withdrawal
Withdraw consent given for processing activities based on this legal ground — such as marketing communications — at any time and at no cost.
Right to Information
Find out which third parties your data has been shared with and the legal basis for each processing operation carried out by 22nn.
To exercise any of these rights, contact 22nn support via live chat or by emailing privacidade@22nn.click. The response deadline is up to 15 business days, as provided under the LGPD. In complex cases, the deadline may be extended by an equal period with justification.
11Minors' Data
22nn is a platform exclusively for users aged 18 and over. We do not intentionally collect data from minors. If we identify that an account was created by a minor, we close the account immediately, delete the collected data, and return any deposited funds to the original payment method following an investigation.
Age verification is carried out during the registration process and must be confirmed during KYC verification before the first withdrawal. Legal guardians who become aware that a minor is using the platform should contact us immediately via support.
Minor protection: If you are responsible for a minor and suspect they may have accessed 22nn, contact support immediately via live chat or email at suporte@22nn.click. We treat these cases as a priority.
12Marketing Communications
22nn may send promotional communications — emails about bonuses, special Brasileirão promotion notifications, jackpot alerts, casino news and crash games updates — only to users who have given express consent during registration or in their account settings.
Every marketing communication includes a one-click unsubscribe link. Once you opt out, you will no longer receive promotional messages — only transactional communications essential to the service (deposit confirmations, security alerts, account updates).
Transactional communications — such as bet confirmations, withdrawal notifications, or login alerts on a new device — are not marketing communications and cannot be disabled, as they are part of service delivery and account security.
Preference management: You can update your communication preferences at any time in the "Notification Settings" section of your account — no need to contact support.
13Security Incidents
22nn maintains a formal security incident management process. In the event of a data breach that could pose a risk to data subjects' rights, we take the following steps:
- Immediate containment: isolation of the affected system and containment of the incident as soon as it is identified;
- Impact assessment: determining the data affected, the number of data subjects impacted, and the potential risk involved;
- ANPD Notification: notification to the National Data Protection Authority within 72 hours of confirming the incident, as required by the LGPD;
- Notification to data subjects: direct email communication to affected users describing the incident, data involved, and recommended protective measures;
- Remediation: remediation of the vulnerability that enabled the incident and review of the affected security controls.
22nn will never ask you to confirm your password or financial details by email following an incident. All official communications will come exclusively from the 22nn.click domain. Be wary of any message requesting sensitive information after an alleged security alert.
14Changes to This Policy
22nn may update this Privacy Policy periodically to reflect changes in Brazilian law, our data processing practices, or the services offered. Updates follow these rules:
- Material changes are communicated with a minimum advance notice of 15 days by registered email;
- A notice is prominently displayed on the platform on the first visit after the new version is published;
- The current version of this policy and its publication date are always displayed at the top of this page;
- Previous versions are archived and made available upon request to support.
Continued use of the platform after changes take effect constitutes acceptance of the updated privacy practices. If you do not agree with the changes, you may close your account and request data deletion before the effective date, as described in section 10.
The current version of this Privacy Policy was published on January 1, 2026. 22nn recommends reviewing this document periodically to stay informed about how your data is handled.
15Contact & DPO
To exercise your rights as a data subject, ask questions about this policy, or report any privacy concern, you can reach us through the following channels:
- Live chat: available 24 hours a day, 7 days a week, on the 22nn.click platform — the fastest channel for urgent requests;
- Privacy email: privacy@22nn.click — for formal requests to exercise LGPD rights;
- General support email: support@22nn.click — for general questions about the platform;
- Data Protection Officer (DPO): available at dpo@22nn.click for specific LGPD compliance matters and requests requiring in-depth review.
The standard response time for personal data requests is 15 business days, which may be extended by an equal period with justification when the complexity of the request requires more detailed analysis.
If you believe your rights as a data subject have not been adequately addressed by 22nn, you have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD), through the channels available on the authority's official website.