LGPD · SSL Encryption · Protected Data · Brazil

H2poker Privacy Policy — Your Data Always Protected

H2poker takes the privacy of its users very seriously. This document clearly and transparently explains what data we collect, how we use it, who we share it with and what your rights are as a data subject under Brazil's General Data Protection Law (LGPD — Law No. 13,709/2018).

Last updated: January 2026

Privacy First

Your personal data is never sold. h2poker fully complies with the LGPD and the highest international data protection standards.

How h2poker Protects Your Privacy

The six pillars of h2poker's privacy policy for Brazilian players

256-bit SSL encryption

All information exchanged between your device and h2poker's servers is protected by 256-bit SSL encryption — the same standard used by Brazil's leading banks, such as Itaú, Bradesco, and Nubank. No data travels in plain text.

Your Data Is Never Sold

H2poker does not sell, rent, exchange or transfer users' personal data to third parties for commercial or marketing purposes. Your data is used exclusively to provide the contracted services and to fulfill legal obligations.

LGPD Compliance

H2poker operates in full compliance with the General Data Protection Law (Lei nº 13.709/2018). This includes a legal basis for each data processing activity, a designated Data Protection Officer (DPO), and internal processes for periodic review of privacy practices.

You're in Control

You have the right to access, correct, port, and request deletion of your personal data at any time. h2poker provides clear channels to exercise all rights guaranteed by the LGPD, without unnecessary red tape.

Data Minimization

H2poker collects only the data strictly necessary for each specific purpose. We do not request information we do not need, we do not retain data beyond the required period, and we regularly review which data remains relevant to the platform's operation.

Incident Notification

In the event of any security incident that may affect your personal data, h2poker will notify the National Data Protection Authority (ANPD) and the affected users within the legally required timeframes, as stipulated by the LGPD, with clear information about what happened and what steps were taken.

1

Data Controller

The controller of personal data collected through the platform h2poker — accessible via the h2poker.best website, the Android and iOS app, and any other official brand channels — is the operating company of h2poker, duly registered in accordance with the Brazilian legislation applicable to the Sports Betting and online gaming sector.

For the purposes of this Privacy Policy, "personal data" means any information that identifies or renders identifiable a natural person, as defined in Article 5 of Law No. 13,709/2018 (LGPD). The h2poker acts as controller when determining the purposes and means of processing that data.

To contact the controller or exercise any right set out in this policy, please use the channels listed in Section 14 of this document. The h2poker has appointed a Data Protection Officer (DPO) to ensure LGPD compliance and handle data subject requests.

When creating an account on h2poker, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. Your consent may be withdrawn at any time, subject to applicable legal limitations.

2

Data We Collect

The h2poker collects different categories of personal data depending on how you interact with the platform. The main types of data we may collect and process are listed below:

Category Data Examples Mandatory
Identification Data Full name, CPF, date of birth, RG, CNH Mandatory
Contact Information Email, mobile number, residential address Mandatory
Financial Data Pix key, card details (tokenized), transaction history Required for withdrawals
Usage Data Betting history, games accessed, session duration Automatic
Technical Data IP address, device type, operating system, browser Automatic
Location Data Country and state of access (inferred from IP) Automatic
Communications Chat history with support, emails exchanged with the team When applicable

The h2poker does not collect sensitive personal data — such as racial origin, religious beliefs, health data or biometrics — beyond what is strictly necessary for identity verification (document photo and selfie, when requested during the KYC process).

3

How We Collect Your Data

The h2poker collects personal data through the following means:

  • Directly from you: Information provided at registration, during the identity verification process (KYC), when contacting support, or when taking part in promotions.
  • Automatically: Technical and usage data collected as you browse and interact with the h2poker platform — via cookies, tracking pixels, and server logs.
  • From payment partners: Transaction information provided by the payment processors we use (such as payment confirmation via Pix, boleto bancário, Mercado Pago, or PicPay), required to confirm deposits and process withdrawals.
  • From game providers: Game session data provided by partner casino providers, used for maintaining history and resolving disputes.
  • From public sources: Data available in public registries (such as the Federal Revenue Service for CPF validation) used exclusively for identity verification and fraud prevention.

The h2poker never asks for your password by email, SMS or chat. No support agent will ever ask for your password to access your account. If you receive any communication of this kind, disregard it and notify us immediately through support.

4

Purposes of Data Processing

The h2poker processes your personal data for specific, legitimate purposes, all of which are described below. We do not use your data for purposes other than those listed without notifying you in advance and, where required, obtaining your consent:

  • Account creation and management: Eligibility verification, registration, login authentication and account management on h2poker.
  • Service provision: Process Sports Betting, casino games, Pix and boleto deposits, withdrawals, and all platform features.
  • Identity verification (KYC): Confirm that you are 18 or older, that you are who you claim to be, and that you are eligible to use the platform under Brazilian law.
  • Fraud and money laundering prevention: Monitoring of atypical usage patterns and compliance with legal anti-money laundering obligations (Law No. 9,613/1998).
  • Customer support: Log and resolve your requests, complaints, and inquiries through h2poker's support channels.
  • Account communications: Send transactional notifications about your account — deposit and withdrawal confirmations, bet results, and security alerts.
  • Marketing (with consent): Send promotions, bonuses and marketing communications to users who have opted in to receive them. You can unsubscribe at any time.
  • Responsible gambling: Monitor behavioral patterns to identify situations that may indicate gambling difficulties and trigger responsible gambling protocols when necessary.
  • Platform improvement: Aggregated and anonymized usage analysis to improve the user experience, fix bugs, and develop new features.
  • Compliance with legal obligations: Comply with requests from competent Brazilian authorities when legally required, such as the Financial Activities Control Council (COAF) and the Federal Revenue Service.
5

Legal Basis for Processing (LGPD)

The LGPD requires that all personal data processing have a legal basis as set out in Article 7 of the law. The h2poker bases its data processing on the following legal grounds:

  • Contract performance (art. 7, V): Most of the data processing carried out by h2poker is necessary to fulfill the contract entered into with you at registration — providing Sports Betting and casino services, and processing payments via Pix, boleto, and card.
  • Compliance with a legal obligation (art. 7, II): Data processed to comply with legally imposed obligations — such as KYC requirements, anti-money laundering rules, and financial record retention.
  • Legitimate interest (art. 7, IX): Processing necessary for platform security, fraud prevention, and continuous service improvement, always respecting users' rights and reasonable expectations.
  • Consent (art. 7, I): For optional processing activities such as sending marketing communications and analyzing preferences for content personalization. Consent may be withdrawn at any time without affecting access to essential services.
6

Data Sharing with Third Parties

The h2poker does not sell personal data. Sharing only occurs in the situations described below, always limited to the minimum necessary and backed by contractual guarantees of confidentiality and security:

  • Payment processors: To confirm deposits and process withdrawals via Pix, boleto bancário, credit/debit card, Mercado Pago, and PicPay. Only the data required for the transaction is shared.
  • Casino game providers: To operate live casino games, slots, roulette, blackjack, and other games available on the platform. Providers receive only session identifiers, not full personal data.
  • Identity verification services: To validate CPF, verify documents, and process KYC as required by Brazilian regulations.
  • Security and anti-fraud tools: For monitoring atypical patterns, detecting duplicate accounts and preventing platform misuse.
  • Competent authorities: When required by court order, COAF request, Federal Revenue Service or another public authority with legal jurisdiction. In such cases, h2poker discloses only the minimum required.

All partners and suppliers of h2poker that access users' personal data sign data processing agreements containing confidentiality clauses and security obligations consistent with the LGPD.

Guarantee: h2poker never shares personal data with third-party marketing companies, commercial email lists or advertising networks. Your email and phone number will not be sold to anyone.

7

Cookies and Tracking Technologies

The h2poker uses cookies and similar technologies to ensure the platform works correctly, enhance the user experience, and collect analytical data. The first time you access h2poker, you will see a cookie notice and can manage your preferences.

The types of cookies used by h2poker are:

  • EssentialStrictly necessary cookies: Required for the platform's basic operation — maintaining login sessions, security, and language preferences. They cannot be disabled.
  • PerformanceAnalytical cookies: Collect anonymized data on how users navigate h2poker — which pages are visited most, session duration, and traffic sources. They help improve the platform and can be disabled.
  • FunctionalityFunctionality cookies: Remember your personal preferences, such as displayed odds, favorites, and account settings. They improve personalization and can be disabled.
  • SecuritySecurity cookies: Used to detect fraudulent behavior, bots, and unauthorized access attempts. Cannot be disabled.

You can manage your cookie preferences through your browser settings or via the cookie preference panel available on the platform h2poker. Disabling essential cookies may compromise your account functionality.

8

Data Security

The h2poker implements appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental destruction, loss, alteration, or improper disclosure. The main security measures in place include:

  • 256-bit SSL/TLS encryption on all communications between the user's device and h2poker's servers.
  • Password storage using computationally intensive cryptographic hashing — not even h2poker's team can view your password in plain text.
  • Two-factor authentication (2FA) available to all users and mandatory for withdrawal operations above a certain amount.
  • Strict access controls — h2poker staff can only access the data required for their specific roles.
  • Continuous security monitoring and intrusion detection systems across production environments.
  • Periodic penetration testing (pentests) conducted by specialized, independent security firms.
  • Regular encrypted backups stored in geographically separate environments.

Despite all these measures, no security system is 100% foolproof. For this reason, the h2poker recommends that you also adopt good security practices: use a strong, unique password for your account, enable 2FA, and never share your credentials with third parties.

If you suspect your account has been accessed by a third party or notice any unusual activity, contact h2poker support immediately. h2poker via live chat. We may preventively lock the account while we investigate.

9

Data Retention

The h2poker retains personal data only for as long as necessary for the purposes for which it was collected, taking into account the applicable legal retention obligations in Brazil.

Data Type Retention Period Legal Basis
Registration data While the account is active + 5 years Legal obligation
Financial transaction history 5 years after the transaction Lei nº 9.613/1998 (anti-money laundering)
KYC Documents 5 years after account closure Regulatory obligation
Betting history While the account is active + 2 years Contractual performance
Access logs and IP 12 months Marco Civil da Internet
Support communications 3 years after closure Defense in legal proceedings
Marketing Data Until consent is withdrawn Consent

Once retention periods expire, data is securely deleted or anonymized so that the individual can no longer be identified. Anonymized data may be used for analytical purposes indefinitely.

10

Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the holder of personal data processed by the h2poker, the following rights, which may be exercised at any time through the contact channels listed in section 14:

Access

Request confirmation of whether your data is being processed and obtain a copy of the personal data h2poker holds about you.

Correction

Request the correction of incomplete, inaccurate, or outdated data in your h2poker account.

Deletion

Request the deletion of data processed on the basis of consent, subject to mandatory legal retention periods.

Portability

Request the portability of your personal data to another service or product provider, in a structured format.

Objection

Object to processing carried out on the basis of legitimate interest when you disagree with the specific purpose presented.

Information on data sharing

Request information about which public and private entities h2poker has shared your data with.

Review of automated decisions

Request human review of decisions made solely through automated data processing that affect your interests.

Withdrawal of consent

Withdraw any consent you have previously given at any time, without affecting your access to h2poker's core services.

The h2poker is committed to responding to rights requests within 15 business days. In complex cases, this period may be extended by a further 15 days, with prior notice and justification provided to the data subject.

11

International Data Transfers

In some cases, the h2poker may transfer personal data to countries outside Brazil — specifically when using cloud infrastructure providers, security services, or casino game suppliers headquartered abroad.

When this occurs, the h2poker ensures that transfers are made only to countries with an adequate level of data protection recognized by the ANPD, or under standard contractual clauses that guarantee protection equivalent to that provided by the LGPD.

The main international transfer scenarios at h2poker are:

  • Cloud server infrastructure providers (such as Amazon Web Services or Google Cloud), which may have data centers outside Brazil but operate under data processing agreements aligned with the LGPD.
  • Casino game providers headquartered in Europe, operating under the General Data Protection Regulation (GDPR) — considered to offer a level of protection equivalent to or greater than the LGPD.
  • Cybersecurity and anti-fraud tools with globally distributed processing.

In all cases, the h2poker contractually requires international partners to provide adequate safeguards for the protection of Brazilian users' data.

12

Minors

The h2poker is a betting and gaming platform exclusively for adults. Creating accounts or using the services is strictly prohibited for anyone under the age of 18. h2poker does not intentionally collect personal data from minors.

Should the h2poker identifies that data from a minor was inadvertently collected — for example, if a minor provided false information during registration — the account will be immediately closed and the data will be deleted as soon as technically possible, in accordance with applicable minimum legal retention periods.

If you are a parent or legal guardian and believe your minor child has created an account on h2poker, please contact us immediately at suporte@h2poker.best so we can take the necessary steps.

Please note: Use of the h2poker platform by anyone under 18 is prohibited by law and by these Terms. h2poker performs age verification checks during registration and KYC. Accounts found to belong to minors will be closed, and the matter may be reported to the relevant authorities.

13

Changes to This Privacy Policy

The h2poker may update this Privacy Policy periodically to reflect changes in our practices, applicable legislation or platform developments. When significant changes are made, we will notify you via your registered email and/or through a prominent notice when you access the platform.

The date of the last update is always displayed at the top of this document. We recommend reviewing this Policy periodically. Continuing to use h2poker after a new version of this Policy takes effect constitutes acceptance of the changes made.

If the changes involve new processing purposes or new types of data that require your consent, we will explicitly request that consent before beginning the new processing.

14

Contact, DPO & Support Channels

To exercise your rights as a data subject, ask questions about this Privacy Policy, or report any data protection concern on h2poker, use the channels below:

  • DPO (Data Protection Officer) email: privacidade@h2poker.best — for formal requests to exercise your rights, LGPD-related complaints, and data protection matters.
  • Live chat: Available 24 hours a day, 7 days a week, directly on the h2poker platform. For general questions and urgent account-related matters.
  • General support email: suporte@h2poker.best — for general account questions, deposits, withdrawals, and other requests.

The h2poker responds to LGPD-related requests within 15 business days. In cases requiring more in-depth review, this deadline may be extended by an additional 15 business days, with prior notice explaining the reason.

If you are not satisfied with the response from h2poker to your request, you have the right to file a complaint with the National Data Protection Authority (ANPD), the federal government body responsible for overseeing LGPD compliance in Brazil.

h2poker — Committed to the privacy of Brazilian players. This Policy is governed by Law No. 13,709/2018 (LGPD) and other applicable regulations in Brazil. All rights reserved. Prohibited for individuals under 18.

Safety and Fun in One Place — Welcome to h2poker

Sign up at h2poker, deposit from R$ 20.00 via Pix and get a 100% bonus on your first deposit — up to R$ 500.00. Your data is protected under the LGPD, with betting on the Brasileirão, live casino and much more. Terms and conditions apply.

Related Documents

Other important documents governing the use of the h2poker platform

Play Responsibly at h2poker

The h2poker is an entertainment platform. Only bet what you can afford to lose without affecting your budget. Use the responsible gambling tools available in your account. Prohibited for users under 18. If you need help, our support team is available 24 hours a day.

Your Data Protected, Your Fun Guaranteed.

H2poker takes your data seriously. Sign up now, deposit via Pix from R$ 20.00, and get up to R$ 500.00 as a first deposit bonus. Brasileirão, Libertadores, live casino, and much more.

+18 | Play responsibly | Terms and conditions apply

Português