LGPD Compliance — Law No. 13.709/2018

38wim Privacy Policy – Your Data Protected

The 38wim respects every user's privacy and handles personal data with full transparency, in compliance with the General Data Protection Law. Here you'll find everything about how your information is collected, used, and protected.

LGPD Compliance SSL 256-bit Account holder data only No data selling Right to deletion Accessible DPO
Last updated: January 2026

This Privacy Policy describes how the platform 38wim, operated at 38wim.best, collects, stores, uses, and protects the personal data of its users. By creating an account or using any service of 38wim, you confirm that you have read and understood this Policy. If you have any questions about any part of it, please contact our team before proceeding.

1. Data Controller

The 38wim is the controller of personal data collected through the 38wim.best platform. The Data Protection Officer (DPO) at 38wim can be reached directly by email at privacidade@38wim.best to exercise any right provided under the LGPD or to clarify questions about how your information is processed.

Controller contact details
Platform38wim
Email address38wim.best
General emailcontato@38wim.best
DPO emailprivacidade@38wim.best
Applicable lawLGPD — Law No. 13,709/2018

2. What Data We Collect

The 38wim collects personal data at different points during your interaction with the platform. Collection is limited to what is strictly necessary for each stated purpose — the data minimization principle set out in the LGPD.

Category Data collected Collection moment
Identification Full name, CPF, date of birth, email, mobile phone number Platform registration
Address Street, number, complement, neighborhood, city, state, ZIP code Registration or KYC verification
Documents Official photo ID (RG, CNH, or passport) and proof of address Identity verification (KYC)
Financial Deposit and withdrawal data, Pix key, transaction history Financial account operations
Browsing IP address, device type, browser, operating system, pages visited, session duration Platform access (automatic)
Behavior Games played, bets placed, amounts, access frequency, gaming preferences Use of platform services
Communication History of support interactions, open tickets, message content Support contact

38wim does not collect data in sensitive categories such as racial or ethnic origin, political opinion, religious belief, or genetic or biometric data used to identify a natural person, except where required by a specific legal obligation.

3. How We Use Your Data

The data collected by 38wim are used exclusively for the purposes listed below. No information is used for purposes other than those stated without a new express consent from the data subject.

  • Account creation and management: enable registration, authentication, profile management, and account recovery.
  • Service delivery: process Sports Betting on the Brasileirão, Copa do Brasil, and Libertadores, and offer slots, crash games, live casino, roulette, poker, and jackpot.
  • Financial processing: process deposits via Pix, boleto bancário, credit and debit card, PicPay, and Mercado Pago; process withdrawals via Pix and TED transfers to Nubank, Itaú, Bradesco, Banco do Brasil, and other Brazilian banks.
  • Identity verification (KYC): verify the user's identity and age, prevent fraud, and fulfill anti-money laundering obligations.
  • Platform security: detect and prevent unauthorized access, fraud, multiple account creation, and other conduct that violates the Terms and Conditions.
  • Communication: send account notifications, service updates, transaction confirmations, and promotions — with the option to unsubscribe at any time.
  • Responsible gaming: monitor behavioral patterns to identify signs of problem gambling and provide users with control tools.
  • Legal compliance: meet requirements from competent Brazilian authorities and regulatory obligations applicable to the online entertainment sector.
  • Service improvement: analyze aggregated and anonymized usage data to improve the platform experience — without identifying individual users in the process.

4. Legal Basis for Processing

All personal data processing carried out by 38wim is grounded in at least one of the legal bases set out in the LGPD (art. 7 and art. 11):

  • Contract performance (art. 7, V): processing necessary to deliver the services contracted by the user when creating their 38wim account.
  • Compliance with a legal obligation (art. 7, II): identity verification, anti-money laundering compliance, and responding to requests from competent authorities.
  • Legitimate interest (art. 7, IX): fraud prevention, platform security, and service improvement based on anonymized data.
  • Consent (art. 7, I): sending promotional communications and direct marketing. Consent may be withdrawn by the user at any time without affecting their other relationship with 38wim.

Important note: withdrawing consent for marketing communications does not affect data processing carried out on other legal grounds — such as service delivery or compliance with legal obligations. You will continue using the platform normally after unsubscribing from promotional emails or SMS.

5. Data Sharing with Third Parties

The 38wim does not sell personal data. Sharing with third parties occurs only in the situations described below, all with a legitimate justification and, where applicable, with contractual safeguards protecting the shared data:

  • Payment processors: financial institutions and payment processors (such as those involved in handling Pix, boleto, credit, and debit card transactions) receive only the data strictly necessary to process the transaction requested by the user.
  • Identity verification providers: specialized KYC and fraud prevention companies may receive identification documents and data to verify user identity, under confidentiality agreements.
  • Game providers: game providers integrated into the platform (such as slots, crash games, and live casino providers) may receive session identifiers to personalize the gaming experience — without access to full financial data or user documents.
  • Technology infrastructure: hosting providers, cloud storage, and security services operate under contracts that prohibit them from using the data for their own purposes.
  • Authorities and legal obligation: 38wim may share data with Brazilian government, judicial, or regulatory authorities when required by law, court order, or valid legal process.

All third parties with access to personal data of users of 38wim are contractually bound to process such data solely for the authorized purposes and to maintain security standards equivalent to those applied by the platform.

6. Data Retention and Deletion

The 38wim retains personal data for as long as necessary to fulfill the purposes for which it was collected, or for the period required by applicable law, whichever is longer.

  • Active account data: retained for as long as the account is active and for any additional periods required by law after closure.
  • Financial records: retained for a minimum of 5 years after the transaction, in accordance with financial legislation and anti-money laundering requirements.
  • Verification documents (KYC): retained for the period required by sector regulations, generally 5 years after account closure.
  • Access logs: retained for 6 months, in accordance with the Brazilian Internet Act (Law No. 12.965/2014).
  • Communication and support data: retained for 2 years after the interaction ends.

Once legal retention periods have been met, data is securely deleted or anonymized in a way that prevents re-identification of the individual. Early deletion requests are assessed on a case-by-case basis, taking into account any legal obligations that may require certain information to be temporarily retained.

When early deletion is not possible due to a legal obligation, the 38wim will notify the user regarding the legal basis justifying the retention and the expected timeline for permanent deletion of the data.

7. Information Security

The 38wim implements technical and organizational measures to protect users' personal data against unauthorized access, alteration, disclosure, or improper destruction. The key measures in place include:

  • 256-bit SSL encryption across all communications between the user's device and 38wim's servers.
  • Encryption at rest for sensitive data stored on servers, including identity verification documents and financial data.
  • Role-based access control (RBAC): each 38wim team member has access only to the data required to perform their specific role.
  • Continuous security monitoring with anomaly detection and automated alerts for suspicious access patterns.
  • Multi-factor authentication for administrative access to the infrastructure that stores user data.
  • Regular security testing including vulnerability scans and periodic access policy reviews.
  • Incident Response Plan with a protocol for notifying affected users and the National Data Protection Authority (ANPD) in the event of a significant incident.

No system is completely immune to threats. In the event of a security incident that may affect your data, 38wim commits to notifying you by email as soon as possible and informing you of the measures taken to contain the impact.

8. Cookies & Tracking Technologies

The 38wim uses cookies and similar technologies to ensure the platform functions correctly, analyze service performance, and personalize the user experience. The types of cookies used are:

  • Strictly necessary cookies: essential for the platform to function — session authentication, language preferences, betting cart items. They cannot be disabled without affecting your use of the services.
  • Performance and analytics cookies: collect information on how users interact with the platform in an aggregated and anonymous manner, to identify improvements to the user experience. They can be disabled without affecting core functionality.
  • Functionality cookies: store user preferences (such as odds display settings or recent game history) to personalize the experience across sessions.

You can manage cookie settings through the preferences panel on the platform or through your browser settings. Disabling non-essential cookies does not affect access to the core features of the 38wim.

No third-party ad tracking: 38wim does not use behavioral advertising cookies from external platforms to serve ads based on your browsing history on other sites. Usage data collected is used solely to improve 38wim's own services.

9. Your Rights as a Data Subject

The LGPD grants you, as the owner of your personal data, a set of rights that 38wim is committed to respecting and facilitating their exercise. All requests are reviewed by the DPO within 15 business days.

01
Access

Request a complete copy of all personal data 38wim holds about you, including categories, purposes, and with whom it has been shared.

02
Correction

Request the update or correction of incomplete, inaccurate, or outdated data — name, address, contact details, or any other profile information.

03
Deletion

Request the deletion of your personal data when processing is no longer necessary or when consent is withdrawn, subject to legally mandated retention periods.

04
Portability

Receive your data in a structured, machine-readable format for transfer to another controller — in accordance with ANPD regulations.

05
Consent Withdrawal

Withdraw consent for marketing communications at any time, without affecting your use of 38wim's core services.

06
Objection

Object to processing carried out on the basis of legitimate interest when it disproportionately harms your fundamental rights and freedoms.

To exercise any of these rights, send your request to privacidade@38wim.best with the subject line "LGPD Rights — [your right]" and include the details needed to verify your identity. The DPO will respond within 15 business days.

10. Minors

The services of 38wim are intended exclusively for individuals aged 18 and over. The platform does not intentionally collect personal data from minors.

The registration process includes date-of-birth verification, and 38wim may request proof-of-age documents at any time. If it is identified that a minor has created an account on the platform, the data will be immediately deleted, the account will be closed, and any existing balance will be frozen.

If you believe a minor has created an account on 38wim, notify support immediately via the platform chat or by email at contato@38wim.best. We will act immediately to investigate and, if confirmed, close the account.

11. International Data Transfers

Some of the service providers used by 38wim — such as cloud infrastructure providers and some game providers — may be located outside Brazil. When this occurs, 38wim ensures that international data transfers only take place when:

  • The destination country offers a level of data protection equivalent to that provided under the LGPD; or
  • Specific contractual clauses are in place to guarantee the data subject the same rights provided under Brazilian law; or
  • The transfer is necessary for the performance of the contract with the user and is covered by one of the applicable legal bases.

Personal data is never transferred to third parties abroad for commercial or behavioral advertising purposes. International transfers are limited to the technical operation of services contracted by the user.

12. Changes to this Privacy Policy

The 38wim may update this Privacy Policy as needed to reflect changes in services, applicable legislation, or data processing practices. Any material change will be communicated by email and through a prominent notice on the platform at least 7 days before it takes effect.

The date of the last update is always shown at the top of this document. We recommend reviewing this Policy periodically. Continued use of the platform after any changes take effect will be treated as acceptance of the new terms.

Previous versions of this Policy may be requested from the DPO by email privacidade@38wim.best.

13. Contact, DPO & Complaints Channel

For any questions, requests, or complaints related to the processing of your personal data by the 38wim, use the channels below:

DPO email

To exercise your LGPD rights or submit access, correction, or deletion requests: privacidade@38wim.best

General Support

For general questions about your account and platform usage: chat available 24 hours or contato@38wim.best

ANPD Channel: if you believe your rights under the LGPD have not been adequately addressed by 38wim after contacting the DPO, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd. 38wim respects and cooperates with the ANPD's regulatory activities.

How 38wim Protects Your Data

Six concrete commitments 38wim makes to every registered user

End-to-End Encryption

All communication between your phone or computer and 38wim's servers uses 256-bit SSL encryption. Your financial data — Pix key, transaction history, card details — is stored with additional encryption at rest. No information travels in plain text.

No Data Selling

38wim does not sell, rent, or monetize users' personal data with third parties for advertising or external marketing purposes. The information you provide stays within the 38wim ecosystem and the operational partners strictly necessary to deliver our services.

You Control Your Data

Access, correction, deletion, portability, and withdrawal of consent — all rights provided under the LGPD are available to every 38wim user, without excessive red tape. Simply send an email to the DPO and your request will be processed within 15 business days.

Minimal and Necessary Collection

38wim collects only the data strictly necessary for each stated purpose. We do not ask for information beyond what is needed at registration, and we do not store data that does not serve a specific, legitimate function within the platform.

Incident Notification

If a security incident affects your data, 38wim will notify you by email as soon as possible, describing what happened, which data was affected, and what steps were taken to protect your account. Transparency even in difficult situations.

Active LGPD Compliance

38wim doesn't treat LGPD compliance as a box-ticking exercise — it maintains a dedicated DPO, regularly reviews its processes, trains staff on data protection, and cooperates with the ANPD. Compliance as a culture, not a checklist.

Privacy FAQs for 38wim Users

The most common user questions about data protection on the platform

No. 38wim does not share your personal data with external advertisers, ad networks, or other websites for behavioral marketing purposes. Data sharing occurs only with the operational partners required to deliver our services — payment processors (involved in Pix, boleto, and card transactions), identity verification providers, and game providers — all bound by contracts that prohibit them from using the data for their own purposes. Your data stays within 38wim's operational environment.

To request account closure and deletion of your personal data, send an email to privacidade@38wim.best with the subject line "Account and data deletion — LGPD". Include the details needed to confirm your identity (full name and registered CPF). The DPO will process your request within 15 business days. Please note: some data may be retained temporarily due to legal obligations — such as financial records that must be kept for 5 years under applicable law — but you will be informed of which data continues to be processed, on what legal basis, and for how long.

Yes. Consent to receive marketing communications is independent of your use of 38wim's services. You can unsubscribe from promotional emails and SMS at any time through the communication preferences panel in your account or via the unsubscribe link in any marketing email. Withdrawing marketing consent does not affect operational communications about your account — such as transaction confirmations, security notifications, and terms updates.

Yes. Documents submitted for identity verification (national ID, driver's license, passport, and proof of address) are stored with encryption at rest on 38wim's servers. Access to these documents is restricted to compliance team members with specific authorization and is recorded in an auditable log. Documents are retained for the period required by applicable sector regulations — generally 5 years after account closure — and securely deleted once the legal retention period ends. No documents are shared with third parties beyond those required for the verification process, all of whom operate under a confidentiality agreement.

38wim complies with court orders and formal requests from competent Brazilian authorities when legally required to do so. Before disclosing any data, the legal team verifies the formal validity of the request — the requesting authority's jurisdiction, proper legal grounds, and whether the scope is proportionate to the request. Data is provided only to the extent required by the order or applicable law. Where legally permitted, 38wim notifies the affected user of such a request, unless the authority expressly prohibits that notification.

Related Documents

Other policies and important information for 38wim users

Terms and Conditions

Complete platform usage rules, user rights and responsibilities, bonus conditions, and game rules.

Read Terms
Responsible Gambling

Control tools, deposit limits, self-exclusion, and guidance to keep gaming a healthy form of entertainment.

Learn More
About 38wim

Who we are, our mission, values, and what sets us apart as a casino and betting platform built for Brazil.

Meet 38wim

Real privacy, not just a promise on paper

The 38wim built data protection into the platform itself, not as an afterthought. Sign up knowing your data is in good hands — and enjoy slots, crash games, Sports Betting on the Brasileirão, and much more with Pix in minutes.

Prohibited for users under 18. Gamble responsibly.

Português