What This Policy Covers at 40winx
Six key points you need to understand about privacy on the platform
Data We Collect
Full name, CPF, date of birth, email, mobile number, address, and login credentials. For transactions via Pix, boleto, or card, we collect only the information necessary to process the payment — card data is tokenized and never stored in plain text on our servers.
How We Protect Your Data
TLS 1.3 encryption on all communications between your device and our servers. Sensitive data stored with AES-256 encryption. Internal access restricted to authorized staff based on their role — all of whom undergo mandatory data protection training.
Who We Share It With
Only with partners essential to our operations: payment processors, game providers, and, where required by law, Brazilian regulatory authorities. We never sell, rent, or trade your data to third parties for advertising purposes without your explicit consent.
How Long We Retain Your Data
Registration and financial transaction data are retained for the minimum period required by Brazilian law — including regulations from the Central Bank and the Federal Revenue Service. After account closure, data is anonymized or deleted in accordance with the legal retention period applicable to each data category.
Cookies and Tracking
40winx uses essential technical cookies required for the platform to function, analytics cookies to understand how players navigate the site, and preference cookies to save your settings. You can manage your cookie preferences at any time through the account settings panel.
Your Rights Under the LGPD
As a data subject, you have the right to access, correct, port, restrict, and request deletion of your personal data. You may also withdraw consent at any time and request clarification on how your data is used — all through 40winx's support channel.
1 Overview
The 40winx genuinely cares about the privacy of everyone who uses the platform. It is not just a legal matter — it is a matter of respect for the Brazilian player. This Privacy Policy explains exactly what we do with your personal data from the moment you register through to the eventual closure of your account.
This document is written in plain, accessible language in Brazilian Portuguese and was prepared in compliance with the General Personal Data Protection Law (LGPD) — Federal Law No. 13,709 of August 14, 2018 — and other regulations applicable to the financial and digital entertainment sectors in Brazil, including regulations issued by the Central Bank of Brazil.
By creating an account on 40winx, you confirm that you have read and understood this Privacy Policy and agree to the processing of your data as described herein. If you disagree with any part of this policy, please do not use the platform. Feel free to contact our support team if you have any questions before registering.
This Policy applies to all users residing in Brazil who use 40winx services, including registration, deposits via Pix, boleto bancário, credit/debit card, Mercado Pago, and PicPay, as well as betting, withdrawals, and use of support.
2 Personal Data We Collect
The 40winx collects only the data strictly necessary to provide, operate, and improve its services. Below are the categories of data collected and when each is required:
| Category | Data | When It Is Collected |
|---|---|---|
| Identification | Full name, CPF, date of birth, nationality | At registration |
| Contact | Email address, mobile number with area code | At registration |
| Address | ZIP code, street address, city, state | During identity verification |
| Document | Photo of national ID (RG), driver's license (CNH), or passport; proof of address | During KYC verification |
| Financial | Pix key, bank, deposit and withdrawal history in BRL | In financial transactions |
| Behavioral | Games accessed, session duration, betting history | While using the platform |
| Technical | IP address, device type, operating system, browser | On each visit |
Credit and debit card data is never stored directly on the 40winx. This information is tokenized by our partner payment processor before any transmission, in compliance with PCI-DSS Level 1 standards. 40winx receives only a secure token representing the card — never the full card number, CVV, or expiry date.
3 Legal Basis for Processing
Every data processing operation carried out by the 40winx is grounded in at least one of the legal bases set out in the LGPD. Below are the bases applied to each main purpose:
- Contract performance (Art. 7, V of the LGPD) — the primary legal basis for registration, identity verification, processing deposits and withdrawals, and delivering the platform's services. Without this data, operating an account simply isn't possible;
- Legal or Regulatory Obligation (Art. 7, II) — regulations from Brazil's Central Bank, Receita Federal, anti-money laundering legislation (Law No. 9,613/1998), and other regulatory requirements that mandate the retention and reporting of certain financial information;
- Legitimate interest (Art. 7, IX) — behavioral usage analysis for fraud detection, platform security improvements, and bonus abuse prevention, always respecting users' rights and expectations;
- Consent (Art. 7, I) — used for marketing communications, personalized offers, and non-essential cookies. Consent can be withdrawn at any time without affecting your use of the platform.
40winx never uses your personal data for purposes incompatible with those described in this policy. Any significant new purpose will be communicated to you before it is implemented.
4 Purposes of Data Processing
The data collected by 40winx are used exclusively for the following purposes:
- Account creation and management — to verify your identity, prevent duplicate accounts, and ensure that only the account holder can access the account;
- Processing of financial transactions — to process deposits via Pix, boleto bancário, credit/debit card, Mercado Pago, PicPay, and TED transfers, as well as withdrawals in BRL to the bank account registered in your name;
- KYC (Know Your Customer) Verification — verify identity and residency for withdrawal processing and anti-money laundering compliance, as required by Brazilian law;
- Security and fraud prevention — identify suspicious access attempts, detect the use of multiple accounts, track anomalous activity, and protect players' financial assets;
- Customer Support — verify the account holder's identity when responding via live chat and maintain a record of interactions to ensure continuity of service;
- Responsible Gaming — monitor behavioral patterns that may indicate problem gambling and activate protective tools when necessary;
- Platform Improvement — aggregated and anonymized behavioral data is used to understand how players use 40winx and where the experience can be improved;
- Communications (with consent only) — sending offers, promotions, and updates by email or push notification, only to users who have opted in.
The 40winx does not use your data to build automated profiles that lead to decisions with significant legal effects without human oversight, as provided under the LGPD.
5 Data Sharing with Third Parties
The 40winx does not sell, rent, or trade your personal data. Data is shared only in the situations described below, always with a level of protection equivalent to that applied internally:
- Payment processors — to process deposits and withdrawals via Pix, boleto, card, Mercado Pago, and PicPay. Each payment processor signs a data protection agreement with clauses equivalent to those required by the LGPD;
- Game Providers — Evolution Gaming, Pragmatic Play Live, Playtech, and Ezugi receive only the technical session identifier required to run the game. These providers do not receive players' full names, CPF numbers, or financial data;
- Identity verification services — technical partners used to validate documents during the KYC process. Data is transmitted with end-to-end encryption and is not retained by the partner after verification;
- Public and regulatory authorities — the Central Bank of Brazil, Federal Revenue Service, COAF, and the Judiciary when required by law, court order, or financial crime investigation. 40winx does not voluntarily disclose data without a formal legal requirement;
- Companies within the same corporate group — exclusively for operational, security, and regulatory compliance purposes, always under the same data protection guarantees set out in this policy.
All third parties with whom 40winx shares data are contractually required to maintain confidentiality, implement appropriate security measures, and use data only for the purposes authorized by 40winx.
6 Data Storage and Security
The storage infrastructure of the 40winx was designed with multiple layers of security. Brazilian players' data is stored on servers protected by the following measures:
- Encryption at rest (AES-256) for all sensitive data — including identity documents and financial data;
- TLS 1.3 encryption in transit for all communication between client and server;
- Role-based access control (RBAC) — each staff member can only access the data necessary for their specific role;
- Full audit logs of all access to sensitive data, retained for a minimum of 12 months;
- Penetration testing conducted periodically by an independent specialized firm;
- Responsible vulnerability disclosure program for external security researchers.
In the event of a security incident involving personal data, the 40winx will notify the National Data Protection Authority (ANPD) and affected data subjects within the legal timeframes established by the LGPD, describing the nature of the incident, the data involved, and the measures taken to mitigate the impact.
No security measure is entirely foolproof. However, 40winx employs state-of-the-art data protection practices for the online entertainment industry in Brazil and continuously reviews its security measures.
7 Cookies and Tracking Technologies
The 40winx uses cookies and similar technologies to ensure the platform functions correctly, analyze browsing behavior, and personalize the player experience. The types of cookies used are listed below:
- Essential Cookies — required for the platform's basic functionality: maintaining active sessions, processing authentication, and securing transactions. These cannot be disabled without compromising platform use;
- Analytical cookies — gather information about how you navigate 40winx — pages visited, time spent, errors encountered — to help the team improve the experience. Data is aggregated and anonymized;
- Preference Cookies — store your personal settings, such as language, theme, and notification preferences, so you don't have to reconfigure them every time you log in;
- Marketing cookies — used only with your explicit consent to display relevant content and personalized offers. They can be disabled at any time.
You can manage your cookie preferences through the settings panel in your 40winx account. 40winx. Refusing non-essential cookies does not affect access to the platform's core features.
8 International Data Transfer
Some game providers and technical partners of 40winx — such as Evolution Gaming and Pragmatic Play Live — operate infrastructure in other countries. When personal data needs to be transferred outside Brazil to support these services, 40winx applies the safeguards required by the LGPD:
- Contracts with standard data protection clauses equivalent to those required by the LGPD;
- Data is transferred only to countries or organizations that offer a level of data protection adequate to or higher than that required by Brazilian law;
- Data transfer minimization — only the information strictly necessary for the technical operation of the service is shared.
Under no circumstances are complete financial details — such as CPF numbers or banking information — transferred to servers outside Brazil without proper legal justification and the corresponding contractual safeguards.
9 Your Rights as a Data Subject (LGPD)
The LGPD grants you, as a personal data subject, a set of rights that the 40winx is fully committed to upholding. You may exercise any of these rights by contacting our support team via live chat or by emailing contato@40winx.net:
Right of Access
You may request a complete copy of all personal data that 40winx holds about you. We will respond within up to 15 business days from the date of your request.
Right to Correction
If your data is incomplete, outdated, or incorrect, you have the right to request a correction. Identification data may be corrected upon submission of an updated document.
Right to Deletion
You may request deletion of data processed on the basis of consent. Data retained to fulfill a legal obligation — such as financial records — is kept for the period required by law before being deleted.
Right to Data Portability
Upon request, 40winx provides your data in a structured, interoperable format (JSON or CSV) so you can transfer it to another service, in accordance with ANPD regulations.
Withdrawal of Consent
You may withdraw any consent you have given — such as receiving marketing communications — at any time, without providing a reason and at no cost. Withdrawing consent does not affect any processing that was carried out on the basis of that consent prior to its withdrawal.
Right to Information
You have the right to know which entities 40winx shares your data with, how long it is retained, and the legal basis for each processing activity. This policy answers those questions, and our support team can clarify specific cases.
10 Minors
The 40winx is a platform exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. If we identify that an account was created by someone under 18, the account will be immediately closed, all collected data will be deleted, and any balance will be returned to the legal guardian upon verification.
Parents or guardians who believe their underage children may have created an account on the 40winx should contact support immediately via live chat or by emailing contato@40winx.net. We handle these requests with the highest priority.
40winx uses CPF verification and date-of-birth validation at registration, along with document analysis during the KYC process, to prevent underage access to the platform.
11 Data Retention
The 40winx retains personal data only for as long as necessary to fulfill the purposes described in this policy and to comply with applicable legal obligations. The main retention periods are:
- Registration and identity data — retained for the full duration of the account and for 5 years after closure, as required by anti-money laundering legislation;
- Financial records (deposits, withdrawals, transaction history) — minimum of 5 years after the transaction, in accordance with Brazilian Central Bank and Federal Revenue Service regulations;
- Gaming data and betting history — 2 years after the session ends, used for support, dispute resolution, and responsible gambling pattern analysis;
- Access and security logs — 12 months, to support security investigations and fraud prevention;
- Support communications — 3 years, to maintain a record of customer service history and ensure continuity of support.
Once the applicable retention period ends, data is securely deleted or irreversibly anonymized, making it impossible to identify the data subject.
12 Changes to This Privacy Policy
The 40winx may update this Privacy Policy to reflect changes in data processing practices, legal requirements, or platform improvements. All material changes will be communicated at least 15 days in advance by email and through a prominent notice on the platform.
The date of the last update is always shown at the top of this page. Continued use of the platform following notification of changes constitutes acceptance of the updated policy. If you do not agree with an update, you may close your account before the new rules take effect.
We recommend reviewing this policy periodically and keeping your registered email address up to date so you receive notifications about material changes.
13 Data Protection Officer (DPO)
The 40winx has appointed a Data Protection Officer (DPO), as required by the LGPD, to serve as the communication channel between the company, data subjects, and the National Data Protection Authority (ANPD).
To exercise your rights as a data subject, clarify questions about this policy, or file a complaint regarding the handling of your personal data, please reach out through the official channel:
DPO email: privacidade@40winx.net
General support: contato@40winx.net
Live chat: available 24/7 directly on the 40winx platform
The response time for data subject rights requests is up to 15 business days. Complex cases may require up to 30 days, with prior notice to the requester about any extension. If you are not satisfied with 40winx's response, you have the right to submit your complaint directly to the ANPD (National Data Protection Authority) through the official Brazilian government portal.
Privacy Questions at 40winx
The most common questions about how we handle your data
Privacy and Responsible Gaming go hand in hand at 40winx
The gameplay behavior data we collect serves more than just platform improvement — it is also used ethically to identify patterns that may indicate problem gambling and, where appropriate, to trigger the responsible gambling tools available in your profile. We never use this data to encourage more betting — we use it to protect those who need protection.
Read our Responsible Gambling to learn about the tools available. If you're experiencing gambling-related difficulties, CVV offers 24/7 support at 188.
Your data protected. Your winnings on time. Sign up at 40winx.
Now that you know how 40winx handles your data with respect and transparency, take the next step: create your account in under 60 seconds, deposit via Pix, and play with the confidence of someone who chose a platform built for Brazil.
For adults 18 and over residing in Brazil only. Please gamble responsibly.