Cs2skin Privacy Policy – Data Protection

The cs2skin is a Sports Betting and online casino platform available at cs2skin.my, developed and operated to serve users in Brazil. We offer betting on football — Brasileirão Série A, Copa do Brasil, Libertadores, Sul-Americana —, MMA and UFC, E-sports such as CS2 and League of Legends, live casino, crash games like Aviator and Spaceman, and much more.

This Privacy Policy applies to all services available at cs2skin.my and to any app or extension cs2skin may release. By creating an account, making a deposit via Pix, or simply browsing the platform, you confirm that you have read and understood these terms.

For the purposes of this Policy, cs2skin is the controller of your personal data, as defined by the LGPD. This means we are responsible for deciding how and why your data is processed.

The data collected by cs2skin varies depending on how you interact with the platform. We organize data collection into three main categories:

Data you provide directly:

• Full name, CPF, date of birth;
• Email address and mobile phone number;
• Residential address (for proof of residence verification where applicable);
• Identity documents (RG, CNH, or passport) — requested during the KYC verification process;
• Banking details required for withdrawals — Pix key, account information for TED;
• Communications you send to support via live chat or email.

Data generated through platform use:

• Full betting, deposit, and withdrawal history;
• Games accessed and session time per game;
• Betting preferences and behavioral patterns on the platform;
• Records of interactions with customer support.

Technical data collected automatically:

• IP address and approximate geolocation data;
• Browser type and version, operating system, and device model;
• Device identifiers and session cookies;
• In-platform browsing data (pages visited, clicks, time spent).

Every piece of data collected by cs2skin has a specific and legitimate purpose. We use your information to:

• Account management: creating, maintaining, and operating your account on the platform, including authentication and account recovery;
• Payment processing: process deposits via Pix, credit/debit card, PicPay, Mercado Pago, boleto bancário, and TED, and execute withdrawals via Pix or TED to your bank account;
• Service delivery: enable Sports Betting, Live Casino, crash games, e-sports, and all other products available on cs2skin;
• Identity verification (KYC): verify your identity and age (18+), in compliance with legal and anti-money laundering requirements;
• Fraud prevention: detecting and preventing fraudulent activity, bonus abuse, unauthorized access, and money laundering;
• Responsible Gambling: monitoring gambling patterns that may indicate problematic behavior and proactively offering control tools;
• Communication: send transactional communications (bet confirmations, withdrawal notifications) and, with your consent, promotional communications about bonuses and offers;
• Platform improvement: analyze aggregated and anonymized data to improve the user experience, fix bugs, and develop new features;
• Compliance with legal obligations: comply with regulatory requirements, court orders, and requests from competent authorities.

The LGPD requires that all personal data processing have a valid legal basis. cs2skin processes your data under the following legal grounds set out in Law No. 13,709/2018:

• Contract performance (art. 7, V): the processing required to operate your account and handle bets and payments — the basis for most platform operations;
• Consent (art. 7, I): for sending marketing communications and promotions — you can withdraw this consent at any time through your account settings or by email;
• Compliance with a legal obligation (art. 7, II): for KYC verification, financial record retention, and compliance with requests from competent authorities;
• Legitimate interest (Art. 7, IX): for fraud prevention, platform security, and service improvement, always respecting your rights and expectations as a user;
• Credit protection (Art. 7, X): where applicable in financial transaction analysis processes.

Cs2skin does not sell your personal data. Sharing only occurs in the following situations, and always with contractual guarantees of confidentiality and security:

• Game providers: Spribe (Aviator), Pragmatic Play (Spaceman, live casino), Evolution Gaming, SmartSoft Gaming, and others — the minimum data required to operate each game is shared with the respective provider;
• Payment processors: gateways that enable transactions via Pix, credit/debit card, PicPay, Mercado Pago, and TED — receive only the financial data necessary to process each transaction;
• Infrastructure providers: hosting, CDN, and security services that process data as operators under a confidentiality agreement;
• Analytics and anti-fraud tools: systems that help detect suspicious patterns and protect the integrity of the platform;
• Public authorities: when required by law, court order, or request from a competent authority (such as the Receita Federal, COAF, or financial crimes units).

Under no circumstances is your data shared with external advertisers, data brokers, or any company without a direct connection to the operation of cs2skin's services.

Cs2skin uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and, with your consent, personalize content and communications. See the types of cookies we use:

• Essential cookies: required for the platform to function — session authentication, security, and basic preferences. They cannot be disabled.
• Performance cookies: collect aggregated data on how users navigate cs2skin, helping identify issues and improve the experience. They do not identify you individually.
• Functional cookies: remember your preferences — language, preferred betting limits, display settings — to personalize your experience so you don't have to reconfigure anything each time you log in.
• Marketing cookies: used to display relevant communications about cs2skin promotions and bonuses. Activated only with your consent.

You can manage your cookie preferences at any time through the account settings panel. For third-party cookies used in analytics tools, you may opt out via your browser settings.

Cs2skin retains your personal data for as long as necessary to fulfill the purposes described in this Policy and to meet applicable legal obligations. Retention periods vary depending on the type of data:

• Registration and account data: retained for the entire active life of the account;
• Financial history (deposits, withdrawals, bets): retained for a minimum of 5 years after each transaction, as required by anti-money laundering legislation and federal tax regulations;
• KYC verification documents: retained for a minimum of 5 years after account closure;
• Access logs and technical data: retained for up to 12 months for security purposes and incident investigation;
• Communications with support: retained for 2 years for quality assurance and dispute resolution.

After your account is closed and the applicable legal retention periods have elapsed, your data is securely deleted or anonymized so that you can no longer be identified from the remaining information.

Cs2skin applies robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or accidental or unlawful destruction. Measures in place include:

• 256-bit SSL/TLS encryption on all communications between the user and the platform;
• Password storage using cryptographic hashing — no cs2skin employee has access to your password in plain text;
• Two-factor authentication (2FA) is available and encouraged for all users;
• Internal access controls based on the principle of least privilege — staff can only access the data necessary to perform their specific functions;
• Continuous monitoring of suspicious activity and a security alert system;
• Periodic security audits conducted by internal teams and specialized third parties;
• A documented security incident response plan, with notification timelines as required by the LGPD.

Despite all these efforts, no system is completely invulnerable. If you suspect your account has been compromised, contact support immediately via live chat or at suporte@cs2skin.my.

The Lei Geral de Proteção de Dados (LGPD) grants you a set of rights over your personal data. cs2skin is committed to making it easy to exercise those rights, without unnecessary red tape:

• Access: you may request a copy of the personal data cs2skin holds about you;
• Correction: if any data is outdated or incorrect, you may request a correction — many details can be updated directly from your account dashboard;
• Anonymization, blocking, or erasure: unnecessary, excessive, or non-LGPD-compliant data may be anonymized, blocked, or deleted;
• Data portability: you may request your data in a structured format for transfer to another service, subject to technical and legal feasibility;
• Withdrawal of consent: for processing based on consent (such as marketing communications), you may withdraw it at any time through the settings panel or by email;
• Right to object: in certain situations, you may object to data processing even without formally revoking your consent;
• Information on data sharing: you have the right to know which entities cs2skin shares your data with;
• Filing a complaint with the ANPD: you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) if you believe your rights have been violated.

To exercise any of these rights, contact us at suporte@cs2skin.my with the subject line "LGPD Request — [your right]". The response time is up to 15 business days. In cases requiring more complex review, we may extend this period by an additional 15 days, with prior notice to you.

Cs2skin is a platform exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. If you have reason to believe that someone under 18 has created an account on cs2skin, please contact us immediately at suporte@cs2skin.my.

If we discover that data from a minor has been inadvertently collected, we will take the following steps immediately:

• Immediate account suspension;
• Deletion of all personal data belonging to the minor from our systems;
• Refund of any real balance deposited to the original payment source;
• Notifying the relevant authorities, when required.

To operate the platform, some of the service providers we work with — such as cloud infrastructure providers, international game providers like Spribe, Pragmatic Play, and Evolution Gaming, and security tools — may process data on servers located outside Brazil.

When this occurs, cs2skin ensures that the transfer is carried out in compliance with LGPD requirements, using mechanisms such as:

• Standard data protection contractual clauses in agreements with suppliers;
• Verification that the destination country provides an adequate level of personal data protection;
• Specific Data Processing Agreements (DPA) with each international vendor.

Cs2skin does not transfer data internationally for any purpose beyond what is strictly necessary to operate the services you use.

Cs2skin may update this Privacy Policy periodically to reflect changes in the services offered, adaptations to current legislation, or improvements to data protection practices. Whenever a significant update occurs, you will be notified by email and via a prominent notice on the platform at least 7 days in advance, except in cases requiring immediate implementation due to a legal or regulatory requirement.

The date of the last update is shown at the top of this page. We recommend reviewing this Policy periodically. Continued use of cs2skin after any changes take effect constitutes acceptance of the updated terms.

Cs2skin has a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and the LGPD. For any questions, rights requests, or privacy-related complaints, please use the channels below:

• Privacy email: suporte@cs2skin.my (subject: "Privacy / LGPD")
• Live chat: available 24/7, directly on the platform
• Response time: up to 15 business days for formal requests

If you are not satisfied with our response, you have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD), the regulatory authority responsible for enforcing the LGPD in Brazil.