The summary that matters
The ff11 only collects the data necessary for you to use the platform safely. We never sell your data. You can access, correct, or delete your information at any time. Every detail is explained in the sections below — in plain language, with no legalese designed to confuse.
1. Who Is Responsible for Processing Your Data
The controller of the personal data collected and processed within the platform ff11 is the operating company of the ff11.best website. For the purposes of this Privacy Policy, "ff11", "we", "our", and "platform" refer to this entity.
Ff11 has appointed a Data Protection Officer (DPO) responsible for ensuring LGPD compliance and handling data subject requests. You can contact the DPO directly at privacidade@ff11.best. All communications related to personal data sent to this address receive a response within 5 business days.
2. What Data We Collect and When
Ff11 collects personal data at different points during your interaction with the platform. See the breakdown by category below:
2.1 Data you provide directly
During registration and verification
- Full name, CPF, date of birth, and gender
- Full residential address (ZIP code, street, number, city, state)
- Email address and mobile phone number
- Photo ID (national ID card, driver's license, or passport) — for KYC verification
- Proof of residence issued within the last three months
- Selfie with ID document (when requested during the KYC process)
In financial transactions
- Pix key and bank account details used for deposits and withdrawals
- Partial credit or debit card details (masked number, expiry date, card brand) — the full card number is never stored
- Deposit and withdrawal history including amounts, dates, and payment methods used
2.2 Automatically collected data
During platform use
- IP address and approximate geographic location (state/city)
- Device type, operating system, and browser version
- Pages visited, session duration, clicks, and navigation within ff11
- Full betting history: type, market, amount, odds, and outcome
- Access logs with the date, time, and IP address of each session
- Cookie and similar technology data (detailed in section 8)
2.3 Data received from third parties
In some cases, ff11 may receive data from third parties for specific purposes: identity verification providers that confirm document authenticity, payment processors that confirm bank account ownership, and exclusion lists from regulated responsible gambling programs in Brazil. This data is used solely for the purposes for which it was obtained.
3. How and Why We Use Your Data
Ff11 uses collected data exclusively for the purposes listed below. No data is used for purposes not covered by this policy without the data subject's renewed consent:
- Account creation and management: user identification, secure login, password recovery, and access to platform services
- Service provision: bet processing, results settlement, access to the live casino, and the VIP Program
- Payment processing: deposits via Pix, boleto bancário, credit/debit card, Mercado Pago, PicPay, and TED; withdrawal processing to the registered bank account
- Identity verification (KYC): compliance with legal anti-money laundering obligations and age verification
- Fraud prevention and security: detection of multiple accounts, unusual betting patterns, and unauthorized access attempts
- VIP Program: points calculation, tier assignment, cashback processing, and tier benefit communications
- Responsible gambling: monitoring of gameplay patterns to proactively identify at-risk behaviors and trigger protective tools
- Customer support: handling questions, complaints, and requests submitted via chat, email, or VIP WhatsApp
- Marketing communications (with consent only): sending promotions, news, and personalized offers to users who have opted in to receive this type of communication
- Platform improvement: aggregated and anonymized usage analysis to identify experience improvements, without individual identification
4. Legal Basis for Data Processing
The LGPD requires that every data processing operation have a defined legal basis. At ff11, the applicable legal bases are:
Legal bases used by ff11
- Contract performance (art. 7, V): processing necessary to provide the platform's services — registration, betting, payments, and support
- Compliance with a legal obligation (art. 7, II): KYC identity verification, anti-money laundering compliance, and financial record retention as required by Brazilian law
- Legitimate interest (art. 7, IX): fraud prevention, platform security, service improvement — always with respect for data subjects' rights and expectations
- Consent (art. 7, I): marketing communications and use of non-essential cookies — consent may be withdrawn at any time
5. Sharing Data with Third Parties
Ff11 does not sell, rent, or transfer personal data of users for commercial purposes. Data is only shared with third parties in the following specific situations:
5.1 Contracted service providers
Ff11 works with specialized partners to operate parts of the platform. These partners have restricted access only to the data needed to perform the contracted services, and are contractually required to uphold the same security and privacy standards as ff11. Partner categories include:
- Payment processors (intermediation of Pix, boleto, cards, Mercado Pago, PicPay)
- Identity verification providers (KYC and document analysis)
- Live Casino and slots providers (receive an anonymous identifier, not personal data)
- Cloud infrastructure and server providers
- Customer support tools (live chat and ticketing system)
- Transactional email delivery and notification platforms
5.2 Legal obligations
Ff11 may be required to share personal data with competent authorities — the Receita Federal, Banco Central, Ministério Público, Polícia Federal — when there is a court order, police inquiry, or specific legal obligation. In such cases, sharing is limited to the minimum necessary as required by the requesting authority.
5.3 Protection of rights
In cases of suspected fraud, money laundering, match-fixing, or other conduct that violates these Terms or Brazilian law, ff11 may share relevant data with industry fraud prevention entities or with competent authorities for investigation.
6. Data Storage and Security
Ff11 users' personal data is stored on servers protected by the following technical and organizational security measures:
Security measures in place
- Data encryption in transit (SSL/TLS 256-bit) and at rest
- Role-based access control (RBAC) — only authorized staff access personal data based on their role requirements
- Multi-factor authentication for access to internal systems containing user data
- Continuous access monitoring and intrusion detection (SIEM)
- Encrypted backups with geographic redundancy
- Regular vulnerability and penetration testing (pentests)
- Security incident response plan with a notification protocol for the ANPD and affected data subjects within 72 hours
No security system is 100% breach-proof. In the event of a security incident resulting in unauthorized access to personal data, ff11 will notify the Autoridade Nacional de Proteção de Dados (ANPD) and the affected data subjects within the timeframe set by the LGPD, providing details of what occurred and the measures taken.
7. How Long We Retain Your Data
Ff11 retains personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum legal retention periods established under Brazilian law:
- Registration and identity data: retained for the period the account is active plus 5 years after closure, in accordance with compliance obligations and anti-money laundering requirements
- Financial records (deposits, withdrawals, bets): retained for 5 years after the transaction, in accordance with tax and Central Bank requirements
- Access logs (IP, date, time): retained for 6 months in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014)
- KYC verification documents: retained for 5 years after account closure
- Support communications: retained for 2 years for dispute resolution and service improvement purposes
- Non-essential cookie data: retained for the period indicated in the cookie settings, generally between 30 days and 12 months
Once the applicable retention periods expire, data is securely deleted or anonymized so that individual users can no longer be identified.
8. Cookies and Tracking Technologies
Ff11 uses cookies and similar technologies to keep the platform running smoothly, enhance the user experience, and — with your consent — personalize communications. See the types of cookies used below:
8.1 Essential cookies (no consent required)
Required for the platform's basic operation. Without them, functions such as login, session maintenance, and bet processing will not work. They cannot be disabled without compromising your use of the platform.
8.2 Performance and analytics cookies
They collect aggregated, anonymized information about how users navigate the platform — which pages are most visited, average session duration, and browsing flow. They are used exclusively to improve the platform experience. They require consent.
8.3 Functionality cookies
They remember user preferences — language, interface settings, and your favorite sport on the home screen. They improve your experience without collecting data for advertising purposes. They require consent.
8.4 Communication personalization cookies
Used to personalize VIP Program promotions and offers displayed on the platform based on the user's usage profile. Explicit consent is required and can be withdrawn at any time in the cookie settings accessible in the platform footer.
You can manage, block, or delete cookies at any time through your browser settings. Disabling non-essential cookies does not prevent you from using the platform for betting, deposits, and withdrawals.
9. Payment Data & Financial Transactions
Ff11 handles payment data with additional layers of security given its sensitivity. Pix transactions are processed directly through the Central Bank system — ff11 receives payment confirmation, not the sender's full banking details beyond what is necessary for the transaction.
Credit and debit cards are processed by PCI-DSS (Payment Card Industry Data Security Standard) certified partners. Your full card number is never stored on ff11's servers — only the masked number (e.g., **** **** **** 1234), the card brand, and the expiration date are kept for your reference.
Your complete deposit and withdrawal history is accessible in the "My Account" area on ff11, including dates, amounts, and payment methods used. This history is retained for 5 years as required by law and can be requested as proof at any time.
10. Data of Minors
Ff11 is a platform strictly restricted to users aged 18 and over. We do not intentionally collect personal data from minors. If we identify that an account was created by a minor, it will be immediately closed, the data will be deleted, and any real BRL balance deposited will be returned to the legal guardian upon verification.
If you believe a minor's data has been collected through the platform, please contact us immediately at privacidade@ff11.best so we can treat it as a priority.
11. Your Rights as a Data Subject (LGPD)
Brazil's General Data Protection Law guarantees you, as a data subject, the following rights regarding your personal data processed by ff11:
Rights guaranteed under the LGPD
- Access: know what data ff11 holds about you and how it is used
- Correction: correct incomplete, inaccurate, or outdated data
- Anonymization or erasure: request that unnecessary or excessive data be anonymized or deleted, where technically feasible and not in conflict with legal obligations
- Portability: receive your data in a structured format for transfer to another service provider
- Consent withdrawal: withdraw consent for processing based on that legal basis (e.g., marketing, non-essential cookies)
- Objection: object to processing carried out on the basis of legitimate interest that has a disproportionate impact on you
- Information on data sharing: know which entities your data has been shared with
- Review of automated decisions: request human review of automated decisions that affect your account (e.g., a block triggered by suspected fraud)
12. How to Exercise Your Rights at ff11
To exercise any of the rights described in the previous section, you can:
- Submit a request by email to privacidade@ff11.best with the subject line "LGPD Request – [right type]"
- Reach out via the platform's live chat, available 24 hours a day, and let us know you wish to exercise a data subject right
- Access the "My Account" area on ff11, where certain features — such as exporting your betting history, updating your registration details, and managing communication preferences — are available directly
The response time is up to 15 business days from the date the request is received. For requests requiring additional identity verification — such as account deletion or data portability — the deadline may be extended by up to 15 additional business days, with notice to the data subject explaining the reason for the extension.
If ff11 is unable to fulfill a data deletion request due to a legal obligation (e.g., retention of financial records for 5 years), you will be informed of the reason and the expected timeline for deletion once the legal obligation has been fulfilled.
If you are not satisfied with ff11's response, you have the right to file a complaint with the National Data Protection Authority (ANPD) through the authority's official website.
13. International Data Transfers
Some services used by ff11 — such as cloud infrastructure providers and analytics tools — may involve transferring data to servers located outside Brazil. When this occurs, ff11 ensures that all transfers are carried out in compliance with LGPD requirements, specifically:
- For countries that offer a level of data protection equivalent to Brazilian law, as assessed by the ANPD
- Through specific contractual data protection clauses with recipient partners
- With appropriate safeguards in place to ensure your rights as a data subject remain protected regardless of where the server is located
All data used for bet processing, account management, and financial transactions is stored primarily on servers located in Brazil or Latin America.
14. Changes to This Privacy Policy
Ff11 may update this Privacy Policy periodically to reflect changes in services, legislation, or data processing practices. Material changes will be communicated by email to your registered address at least 7 days before taking effect.
The date of the last update is shown at the top of this page. For lower-impact revisions — text corrections, clarifications, or contact detail updates — changes may be published without prior notice, but the update date will always be adjusted accordingly.
If you disagree with any published changes, you may exercise your right to request account closure and data deletion as described in section 12. Continued use of the platform after the effective date of the new terms constitutes tacit acceptance of the changes.
15. Contact, Inquiries, and Data Protection Officer (DPO)
For privacy and data protection matters, ff11 offers the following contact channels:
Privacy contact channels
- DPO email: privacidade@ff11.best (formal LGPD rights requests, response time: 15 business days)
- General support: contato@ff11.best (general privacy inquiries)
- Live chat: available 24 hours a day, 7 days a week, in Portuguese
- VIP WhatsApp: available to Gold and Diamond members of the VIP Program
Ff11 is committed to handling all privacy-related communications with priority and respect. No legitimate data subject request will be ignored or left unanswered indefinitely. If you do not receive a response within the expected timeframe, please reach out again via live chat for immediate escalation.
Your data, your rules — that's what ff11 believes in
Privacy is not a legal formality for ff11 — it is part of how we build trust with every Brazilian bettor. You entrust your personal and financial data to the platform when you deposit via Pix, place a bet on the Brasileirão, or access the live casino. We take that trust seriously: data collected with a clear purpose, protected with cutting-edge technology, and always under your control whenever you choose to exercise it.