I

Identification of the controller

Gabriel Anzolin Cavalheiro – Informática, Individual Entrepreneur (Empresário Individual), enrolled with the CNPJ under No. 51.098.355/0001-04, with its registered office at Avenida das Torres, No. 200, house unit 80, Parque Verde district, ZIP Code (CEP) 85807-845, Cascavel – PR, Brazil (“Tipmarket” or the “Operator”), is the legal entity responsible for the processing of the personal data described in this Privacy Policy.

II

Scope of application

Tipmarket is a provider of technological infrastructure (B2B platform). It does not act as a direct operator of prediction markets, nor does it maintain a direct legal relationship with end-user consumers.

This Privacy Policy governs the processing of personal data carried out by Tipmarket in the context of its activities of:

• Licensing of the whitelabel platform to Operators (Tenants) — companies or legal entities that contract the use of the Tipmarket infrastructure to operate their own instances of prediction markets;
• Performance of the licensing agreements entered into with Operators, including onboarding, technical support, and management of the commercial relationship;
• Access to the administrative panel (Admin Interface) by the Operators’ managers and administrators.

The processing of personal data of the end users of the whitelabel instances is the exclusive responsibility of the respective licensed Operators, who act as independent controllers vis-à-vis their own users and must comply with the applicable data protection legislation. Tipmarket does not determine the purposes or the means of processing of such data.

III

Tipmarket as a data processor

In providing technological infrastructure services, Tipmarket may process personal data of end users of the licensed Operators exclusively in the capacity of processor, pursuant to Article 5, VII, of the LGPD — that is, on behalf of and under the documented instructions of the respective Operators, who remain the controllers of such data.

In this capacity, Tipmarket shall:

• Process personal data solely for the purposes defined by the Operators within the scope of the licensing agreements;
• Adopt appropriate technical and organizational measures to protect the data processed, as described in Section IX of this Policy;
• Promptly inform the Operator of any security incident affecting data under its operational responsibility;
• Ensure the isolation of data between Tenants, preventing one Operator’s information from being accessible by another.

The specific terms of the processing of end users’ personal data by Tipmarket in its capacity as processor will be formalized in a Data Processing Addendum (DPA) entered into with each Operator within the context of the respective licensing agreement.

IV

Personal data processed

4.1 Data of the Operators’ Representatives and Administrators

In the context of the execution and performance of the licensing agreements, Tipmarket processes personal data of the legal representatives and contact persons of the Operators, including:

• Full name and position;
• Corporate e-mail address and telephone number;
• CPF (Brazilian individual taxpayer registry number), when necessary for contractual formalization;
• Access data for the administrative panel (e-mail and authentication credentials).

4.2 Platform Access and Usage Data

In the use of the Admin Interface and the Platform’s management systems:

• Access and audit logs (timestamps, actions performed, session identifiers);
• IP address and device/browser data of the administrators;
• Tenant settings and preferences recorded by the administrators;
• Technical support data and service communications.

V

Purposes and legal bases

The processing of data by Tipmarket is carried out on the basis of the following legal grounds set forth in the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018):

Performance of a contract (Article 7, V): formalization and performance of the licensing agreements with Operators; provisioning, maintenance, and support of the contracted infrastructure; onboarding and management of access to the administrative panel; invoicing and financial management of the commercial relationship.

Compliance with a legal or regulatory obligation (Article 7, II): maintenance of accounting and tax records; compliance with court orders and requests from competent authorities; obligations imposed by corporate and tax legislation.

Legitimate interest (Article 7, IX): information security, fraud prevention, and monitoring of misuse of the Platform; continuous improvement of the infrastructure and of the services provided; operational and technical communications with the Operators.

VI

Data sharing

5.1 Infrastructure Providers

Tipmarket uses cloud infrastructure providers for hosting, storage, transactional e-mail delivery, and support tools. These providers act as processors under Tipmarket’s instructions and are subject to contractual obligations of confidentiality and security.

5.2 Payment Gateways

For the processing of payments related to the licensing of the Platform, data strictly necessary for the transaction may be shared with integrated payment gateways. Such providers act as independent controllers for the purposes of transaction processing and regulatory compliance.

5.3 Competent Authorities

Data may be shared with governmental, judicial, or administrative authorities when required by law, court order, or in the regular exercise of rights.

VII

Data retention and deletion

Personal data is retained for the period necessary to fulfill the purposes for which it was collected, observing the following:

• Contractual and registration data of the Operators: for the term of the agreement and for up to 5 (five) years after its termination, for purposes of legal, tax, and litigation-related obligations;
• Access and audit logs: for up to 6 (six) months, except for extended retention by legal determination or incident investigation;
• Technical support data: for the duration of the ticket resolution and for up to 2 (two) additional years.

VIII

Information security

Tipmarket adopts appropriate technical and organizational measures to protect personal data against unauthorized access, destruction, loss, alteration, or improper disclosure, including:

• Data transmission via TLS/HTTPS;
• Authentication and role-based access control (RBAC);
• Data isolation between Tenants (multi-tenant architecture);
• Monitoring of security events and audit logs;
• Credential management with periodic rotation.

In the event of a security incident with potential impact on data subjects, Tipmarket will notify the Brazilian National Data Protection Authority (ANPD) and the affected data subjects within the time frames and in the manner provided for in the LGPD.

IX

Rights of data subjects

Under the LGPD, the Operators’ representatives and other data subjects whose data is processed by Tipmarket are entitled to:

• Confirmation of the existence of processing and access to the data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance with the law;
• Portability of the data to another service provider;
• Information about the entities with which the data has been shared;
• Objection to processing carried out on the basis of legitimate interest.

To exercise their rights, the data subject must send a request to the contact address indicated in Section XII, identifying themselves appropriately. Tipmarket will respond within up to 15 (fifteen) business days.

X

International transfers

Personal data may be transferred to servers located outside Brazil as a result of the use of cloud infrastructure providers. Such transfers are carried out on the basis of the legal grounds provided for in Article 33 of the LGPD, including the existence of specific contractual clauses on data protection with the providers involved.

XI

Changes to this policy

Tipmarket may amend this Privacy Policy at any time. Amendments will be communicated to the Operators through the means defined in the licensing agreement and published on the Platform with an indication of the date of the update.

XII

Contact

For questions, requests, or complaints related to the processing of personal data: