Last updated: September 29, 2026
This Privacy Policy explains how SUPREMA POKER processes personal data in connection with its Services, including what data is processed, for what purposes, the applicable legal bases, with whom it may be shared, the retention criteria and how data subjects can exercise their rights.
This Policy was prepared taking into account the Brazilian General Data Protection Law (Law No. 13.709/2018, "LGPD"), the Brazilian Internet Civil Rights Framework (Marco Civil da Internet, Law No. 12.965/2014), where relevant, and, where applicable to the processing of personal data falling within its scope, the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").
This Policy is a transparency notice and not a consent form. Each processing activity relies on the legal basis indicated in section 5. Where consent is the appropriate legal basis, it will be requested specifically and may be withdrawn at any time.
1.1. The controller of the personal data is SUPREMA PROMOCAO DE EVENTOS LTDA, registered with the Brazilian National Register of Legal Entities (CNPJ) under No. 37.684.385/0001-63, trading as SUPREMA ("SUPREMA POKER").
1.2. This Policy applies to the SUPREMA POKER app, the website supremapoker.com.br and the customer service channels (together, the "Services").
1.3. This Policy should be read together with the SUPREMA POKER Terms of Service and General Rules.
3.1. The Services are intended exclusively for persons aged 18 or over. Registration and use by persons under 18 are prohibited. There is no exception based on authorization from parents or guardians.
3.2. For users in Brazil, SUPREMA POKER requests the CPF (Brazilian individual taxpayer registry number) and date of birth to verify age and prevent use of the Services by persons under 18. This information undergoes a verification procedure, and access to or continued use of the Services may be prevented when the verification is not completed or indicates an age under 18.
3.3. Outside the Brazilian context, information may be requested for age verification, in accordance with applicable law and the mechanisms actually made available.
3.4. The same CPF may also be used to link more than one Account belonging to the same data subject.
3.5. If SUPREMA POKER identifies that an Account belongs to a person under 18, the Account may be blocked or closed, as applicable. The data will be deleted or retained only where there is a legal basis for its retention, including for compliance with legal obligations, security, fraud prevention and the regular exercise of rights.
3.6. Any content or conduct involving the abuse or exploitation of children and adolescents, including child sexual abuse and exploitation (CSAE), is prohibited in the Services. A violation may result in the adoption of appropriate measures and, where applicable, in a report to the competent authorities. Reports may be sent to security@suprema.group.
| Category | Data | Source |
|---|---|---|
| Registration and access data | Username and password | You |
| Age verification in Brazil | CPF and date of birth | You |
| Account security and recovery | Email address and information related to its verification | You and the Services |
| Gameplay activity | Participation in tables, tournaments and Clubs, hand history, results, ranking positions and Virtual Item transactions | Generated by use of the Services |
| Communications | Messages sent through the Services, reports and conversations with customer service | You and other users |
| Device, security and fraud prevention data | IP address; technical information about the device, app and connection; technical identifiers; signals associated with the device and with use of the Services; device identifiers or device fingerprints (device fingerprinting) | Collected automatically |
| Access logs | IP address, date and time of access to the Services | Collected automatically |
| Cookies and similar technologies | Information collected by these technologies (section 11) | Collected automatically |
4.1. When using the chat or the customer service channels, provide only the personal data necessary for your identification and to handle your request. Avoid sharing sensitive personal data or other information that is not necessary for this purpose.
4.2. Linking and verifying an email address are necessary for normal use of the Services. The email address is used for authentication, security, Account recovery and changing credentials.
| Purpose | Main data | LGPD | GDPR, where applicable (Art. 6(1)) |
|---|---|---|---|
| Create and maintain your Account and enable use of the Services | Registration and access data, gameplay activity | Performance of a contract (Art. 7, V) | Performance of a contract (point (b)) |
| Verify age and prevent use of the Services by persons under 18 | CPF and date of birth | Preliminary procedures related to the contract, at the request of the data subject (Art. 7, V, of the LGPD) | Not applicable: data requested from users in Brazil |
| Link Accounts belonging to the same data subject | CPF | Performance of a contract or of preliminary procedures related to the contract, at the request of the data subject (Art. 7, V, of the LGPD) | Not applicable: data requested from users in Brazil |
| Link and verify the email address for authentication, security, Account recovery and changing credentials | Email address and verification information | Performance of a contract (Art. 7, V) and legitimate interest in Account security (Art. 7, IX) | Performance of a contract (point (b)) and legitimate interests in Account security (point (f)) |
| Security, fraud prevention and game integrity | Device, security and fraud prevention data; access logs; gameplay activity | Legitimate interest (Art. 7, IX) and regular exercise of rights (Art. 7, VI) | Legitimate interests in security and game integrity (point (f)) |
| Display gameplay information to other players and enable Clubs to operate | Username, gameplay activity | Performance of a contract (Art. 7, V) | Performance of a contract (point (b)) |
| Provide Virtual Items | Registration and access data, gameplay activity | Performance of a contract (Art. 7, V) | Performance of a contract (point (b)) |
| Retain application access logs | IP address, date and time | Compliance with a legal obligation (Art. 7, II, and Art. 15 of the Marco Civil da Internet) | Legitimate interests (point (f)) |
| Send service communications (security, account verification, changes to terms) | Email address | Performance of a contract (Art. 7, V) | Performance of a contract (point (b)) |
| Provide customer service | Registration and access data, communications | Performance of a contract (Art. 7, V) | Performance of a contract (point (b)) |
| Moderate chat and investigate reports | Communications | Legitimate interest (Art. 7, IX) and regular exercise of rights (Art. 7, VI) | Legitimate interests (point (f)) |
| Organize tournaments and promotions | Registration and access data, gameplay activity | Performance of a contract (Art. 7, V) | Performance of a contract (point (b)) |
| Send promotional or marketing communications by email | Email address | Legitimate interest (Art. 7, IX), with the option to stop receiving them at any time | Consent (point (a)) or legitimate interests, where permitted by local law, with an opt-out option (point (f)) |
| Comply with court orders and requests from authorities | Data necessary to comply | Compliance with a legal obligation (Art. 7, II) | Legal obligation (point (c)) |
| Defend rights in judicial, administrative or arbitration proceedings | Data necessary for the defense | Regular exercise of rights (Art. 7, VI) | Legitimate interests (point (f)) |
5.1. Legitimate interest. When relying on this legal basis, SUPREMA POKER considers the necessity of the processing, your legitimate expectations and your rights. In processing subject to the GDPR, legitimate interests are balanced against your rights and freedoms. You may object to this processing through the Data Protection Officer channel, in accordance with applicable law.
5.2. Communications. Service communications are necessary for the operation and security of the Account. SUPREMA POKER sends promotional communications by email, and you may stop receiving them at any time, without affecting service communications or your use of the Services.
6.1. SUPREMA POKER processes device and usage data to protect Accounts, identify devices, prevent and investigate fraud, detect misuse and, where applicable, related accounts, protect the integrity of the poker environment, detect violations of the Terms of Service and maintain the security of the platform and its users. This processing is limited to what is necessary for these purposes. For security reasons, the criteria and methods used are not disclosed.
6.2. If a decision made solely on the basis of automated processing affects your interests, you may request its review and information about the criteria used, subject to commercial and industrial secrecy (Art. 20 of the LGPD).
6.3. In processing subject to the GDPR, if a decision based solely on automated processing produces legal effects or significantly affects you, you may obtain human intervention, express your point of view and contest the decision (Art. 22 of the GDPR).
7.1. Other players. Information such as username, table actions, chat messages and results may be visible to other players in the context of tables, games, hand replays, rankings and Clubs.
7.2. Club Administrators. Administrators may have access to information related to members' participation and activity in the respective Club, to the extent necessary for the Club to operate.
7.3. Service providers. SUPREMA POKER shares data, to the extent necessary, with providers acting on its behalf, such as providers of technology infrastructure, hosting and storage, information security and fraud prevention, and customer service and communications. They must process the data in accordance with SUPREMA POKER's instructions and applicable law.
7.4. Group companies. Companies in the same economic group that support the operation of the Services may receive data exclusively for that purpose.
7.5. Authorities. SUPREMA POKER shares data with public authorities when there is a legal basis, such as a court order or a request from a competent authority.
7.6. Corporate transactions. In the event of a merger, acquisition or corporate reorganization, the data may be transferred to the successor, who must comply with this Policy and applicable law.
8.1. Personal data processed by SUPREMA POKER may be stored, accessed or made available outside Brazil in connection with the provision of the Services and the support of their operation.
8.2. These transfers are handled in compliance with the requirements of applicable data protection law. In processing subject to the LGPD, the rules on international data transfers set out in the LGPD and in ANPD regulations are taken into account. In processing subject to the GDPR, the requirements on international transfers set out in that regulation are taken into account.
8.3. You may request information about international transfers through the Data Protection Officer channel (section 13).
9.1. SUPREMA POKER retains personal data for the period necessary to fulfill the purposes described in this Policy, taking into account:
9.2. Where the Marco Civil da Internet applies, application access logs are retained for a minimum period of 6 months, in accordance with its Art. 15.
9.3. Once processing has ended, the data will be deleted or anonymized, except for the retention cases provided for in applicable law, such as those in Art. 16 of the LGPD.
Under the LGPD and, where applicable, the GDPR, you may exercise the rights listed below. The scope of each right depends on the applicable law and the circumstances of the processing.
| Right | What it means |
|---|---|
| Confirmation and access | Know whether SUPREMA POKER processes your data and access it |
| Correction or rectification | Correct incomplete, inaccurate or outdated data |
| Anonymization, blocking or deletion | For unnecessary or excessive data, or data processed in breach of the LGPD, where applicable |
| Erasure | Request erasure of the data, where applicable, unless there are grounds to retain it |
| Restriction of processing | Request restriction of processing in certain situations, where applicable |
| Portability | Portability of your personal data to another provider of services or products, upon express request, in accordance with applicable ANPD regulations and subject to commercial and industrial secrecy, or, where applicable, under the GDPR |
| Information about sharing | Know with which public and private entities SUPREMA POKER shares your data |
| Information about consent | Know that you may refuse consent and the consequences of refusal |
| Revocation or withdrawal of consent | Withdraw consent at any time, without affecting prior processing |
| Objection | Object to processing carried out on other legal bases in the event of non-compliance with the LGPD and, where the GDPR applies, to processing based on legitimate interests and to direct marketing |
| Automated decisions | Request review of decisions made solely on the basis of automated processing that affect your interests (Art. 20 of the LGPD) and, where applicable, exercise the rights provided for in Art. 22 of the GDPR |
| Complaint or petition | File a complaint or petition with the competent data protection authority, such as the ANPD |
10.1. How to exercise your rights. Send your request to the Data Protection Officer channel (section 13). To protect your Account, SUPREMA POKER may request information to confirm your identity.
10.2. Deadlines. Requests subject to the LGPD will be handled within the deadlines set out in applicable Brazilian law: confirmation of the existence of processing and access in simplified format are provided immediately, and the complete statement is provided within 15 days of the request (Art. 19 of the LGPD). Requests subject to the GDPR will be handled within the deadlines set out in the GDPR.
10.3. Account deletion. You may request closure of your Account. Data whose retention is permitted by law will be kept only for the necessary period, in accordance with section 9.
11.1. SUPREMA POKER uses cookies and similar technologies that are necessary for the operation of the Services, authentication, security and fraud prevention.
11.2. When non-essential technologies are used, such as audience measurement or advertising technologies, the data subject's choices and consent requirements will be observed, where required by applicable law. You may also manage cookies in your browser settings.
12.1. SUPREMA POKER adopts technical and administrative or organizational measures proportionate to the risks and to the nature of the data processed, to protect it against unauthorized access and accidental or unlawful destruction, loss, alteration or disclosure.
12.2. No system is completely immune to incidents. In the event of a security incident, SUPREMA POKER will take appropriate measures and will make the notifications to the competent authorities and to data subjects in the cases required by applicable law.
12.3. You also contribute to security by keeping your password confidential and logging out of shared devices. SUPREMA POKER will never ask for your password by email, message or phone.
13.1. Pursuant to Art. 41 of the LGPD and applicable ANPD regulations, SUPREMA POKER provides the following channel to contact the Data Protection Officer (Encarregado):
Email: dpo@suprema.group
13.2. The Data Protection Officer acts as the communication channel between SUPREMA POKER, data subjects and the ANPD, including receiving complaints, communications and requests related to personal data protection. The same channel handles matters related to data protection and the exercise of the rights provided for in applicable law, including the GDPR, where applicable.
13.3. Other channels: general customer service by email at sac@suprema.group; reports related to children and adolescents by email at security@suprema.group.
14.1. Third-party services. Third-party websites and services accessed through links made available in the Services have their own policies, which we recommend you read.
14.2. Deceased users. Family members or legal representatives may contact the Data Protection Officer. SUPREMA POKER may request documents proving the death and the relationship.
15.1. This Policy may be updated to reflect changes in the Services or in the law. The date of the last update is indicated at the beginning of the document.
15.2. Material changes will be communicated in advance through the app or by email. When a change affects processing based on consent, SUPREMA POKER will request new consent.
16.1. This Policy is governed by Brazilian law. Where the GDPR applies to a given processing of personal data, its provisions will also be observed.
16.2. The courts of the data subject's place of domicile are elected as the venue, pursuant to Art. 101, I, of the Brazilian Consumer Protection Code.