Data Protection
H2online handles your personal data responsibly and in full compliance with the General Data Protection Law (LGPD — Law No. 13,709/2018). This document clearly explains what we collect, why we collect it, how we use it, and what rights you have as a data subject.
Your rights at a glance
Six concrete privacy commitments to every Brazilian user of the platform
All collection, storage, and use of personal data at h2online strictly follows the General Data Protection Law (Lei nº 13.709/2018). You have rights guaranteed by law, and the platform is built to uphold them at every step.
All communications between your device and h2online's servers are protected by 256-bit SSL encryption. This covers registration data, financial transactions via Pix, boleto, and card, and any personal information transmitted on the platform.
H2online does not sell, rent, or transfer your personal data to third parties for marketing, advertising, or any commercial purpose unrelated to the betting service you signed up for.
You can request the deletion of your personal data at any time through h2online's support. Data required by law — such as financial records mandated by the Banco Central do Brasil and COAF — is retained only for as long as legally required before being securely disposed of.
H2online collects only the data strictly necessary to operate the service — registration, identity verification, payment processing, and fraud prevention. We do not collect sensitive data without a clear need and a defined legal basis under the LGPD.
In the event of any security incident that may affect your data, h2online notifies the National Data Protection Authority (ANPD) and the affected users within the timeframes required by the LGPD, with clear information about what happened and what steps were taken.
This Privacy Policy applies to all users of the h2online platform — by accessing, registering for, or using any h2online service, you confirm that you have read and understood how we handle your personal data as described in this document. If you have questions before creating your account, support is available 24 hours a day in English.
The data controller responsible for processing the personal data collected by the h2online platform is the company operating the h2online brand, which is responsible for the platform available at h2online.best and for all Sports Betting, live casino, Poker, and other services offered to users in Brazil.
H2online's Data Protection Officer (DPO) can be reached by email at contato@h2online.best for any matter related to the processing of personal data, the exercise of data subject rights, or clarification regarding this Privacy Policy.
This Policy applies exclusively to the h2online platform. Links or references to internal pages — such as Terms and Conditions and Responsible Gambling — are governed by this same privacy policy.
At registration and throughout your use of the h2online platform, we collect the following personal data provided directly by you:
| Category | Data Collected | Collection Point |
|---|---|---|
| Identification | Full name, CPF, date of birth, RG or driver's license | Registration and KYC verification |
| Contact | Email address, mobile number, residential address | Sign Up |
| Financial | Pix key, card details (tokenized), transaction history | Deposits and withdrawals |
| Verification | Photo ID, proof of address, selfie | First withdrawal (KYC) |
| Betting | Betting history, preferred markets, amounts wagered | Continued use |
When you access the h2online platform — whether through a desktop browser or on mobile — we automatically collect technical usage data required for the service to function properly and securely:
In specific situations, h2online may receive personal data from external sources for identity verification and fraud prevention purposes — such as queries to Brazilian credit bureaus or checks against politically exposed persons (PEP) lists and sanctions lists, as required by financial regulations.
H2online uses your personal data exclusively for the following purposes, each with a defined legal basis under the LGPD:
h2online does not use your data for third-party advertising, profile segmentation for third parties, or any purpose not listed above without your explicit consent.
The LGPD requires that all personal data processing have a defined legal basis. h2online processes your data under the following legal bases, as set out in Article 7 of Law No. 13.709/2018:
H2online does not sell your personal data to third parties. Data sharing occurs only in the following situations, all with a specific purpose and confidentiality agreements where applicable:
H2online may share data with Brazilian governmental, regulatory, and judicial authorities when legally required — including the Banco Central do Brasil, COAF, Receita Federal, Ministério da Fazenda, and law enforcement agencies when a valid court order is in place.
Cookies are small text files stored in your browser or on your device when you access the h2online platform. They allow the platform to recognize your device between visits, keep your session active, and run more efficiently.
You can manage or block cookies through your browser (Chrome, Safari, Firefox) or your device settings. Blocking essential cookies will prevent the h2online platform from functioning properly — including login and bet processing. Non-essential cookies can be disabled without affecting core features.
h2online does not use third-party cookies for behavioral advertising or user tracking outside the platform.
H2online retains your personal data only for as long as necessary for the purposes described in this Policy or as required by law. The general retention periods are:
Once the applicable retention periods have expired, data is securely deleted or irreversibly anonymized, making it impossible to identify the data subject.
H2online implements appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, and misuse:
In the event of a security incident resulting in unauthorized access, leakage, or destruction of personal data, h2online will notify the National Data Protection Authority (ANPD) and the affected users within the timeframes set out in the LGPD, providing information about what occurred, which data was affected, and the measures taken to mitigate the damage.
The LGPD grants data subjects the following rights, all of which can be exercised with h2online through support or by emailing the DPO:
Request confirmation that h2online processes your data and obtain a complete copy of the information we hold about you.
Request the correction of incomplete, inaccurate, or outdated data — such as a wrong home address, phone number, or email.
Request the deletion of personal data that is unnecessary or processed without an adequate legal basis. Data required by law is retained only for the mandated period.
Request the transfer of your personal data to another controller, in a structured and commonly used format, in accordance with ANPD regulations.
Withdraw consent given for processing based on this legal ground — such as marketing communications — at any time, without affecting your use of the main service.
Obtain information about the public and private entities with which h2online has shared your data, including the identity and purpose of each instance of sharing.
How to exercise your rights: send your request to contato@h2online.best or via the in-platform support chat, identifying yourself with your full name and CPF. h2online responds to all requests within 15 business days, in accordance with the retention periods established by the LGPD.
The h2online platform is intended exclusively for users aged 18 and over. h2online does not intentionally collect personal data from minors under 18. Registration is blocked for anyone who declares they are under 18, and identity verification at the time of the first withdrawal confirms the account holder's age.
If you believe a minor has created an h2online account using false information, contact us immediately through support or the DPO's email. h2online will close the account, delete the collected data, and take the appropriate preventive measures.
Access to and use of h2online by anyone under 18 is strictly prohibited. The platform uses both technical and documentary checks to prevent underage access.
Some technical infrastructure services used by h2online — such as cloud servers and fraud detection systems — may involve transferring data to servers located outside Brazil. When this occurs, h2online ensures that:
For payment processing in BRL — including Pix, boleto bancário, TED, PicPay, and Mercado Pago — financial data is processed exclusively by institutions authorized by the Central Bank of Brazil, with no international transfer.
H2online may update this Privacy Policy periodically to reflect changes in legislation, our services, or our data protection practices. Any material change will be communicated to the user via the registered email address and through a prominent in-platform notification at least 7 days before taking effect.
The most current version of this Policy is always available on this page, with the last updated date shown at the top. We recommend reviewing this page periodically. Continued use of the h2online platform after any changes take effect constitutes acceptance of the updated Policy.
Current version: January 2026 | Official language: English | Applicable law: LGPD — Law No. 13,709/2018
To exercise your rights as a data subject, ask questions about this Policy, or report any privacy or data protection concern at h2online, please use the channels below:
If you are not satisfied with h2online's response regarding the processing of your personal data, you have the right to file a complaint with the National Data Protection Authority (ANPD), the federal authority responsible for enforcing LGPD compliance in Brazil.
Common questions from our users about data protection and the LGPD
When you create an account on h2online and deposits via Pix to bet on the Brasileirão or the UFC, you are providing personal data that must be handled responsibly. The LGPD exists precisely to ensure that companies operating in Brazil — whether a betting platform, a digital bank, or an e-commerce site — handle that data with transparency and respect for the data subject. h2online was built from the ground up with LGPD compliance at the core of its platform design, not as an afterthought.
In practice, this means that when you make a BRL 50.00 deposit via Pix on h2online to bet on Flamengo in the Libertadores, the data from that transaction is used to process the payment, update your account balance, and maintain the financial records required by the Banco Central — nothing more. Your bank account number does not go onto a marketing list, is not shared with commercial partners unrelated to the service, and is not sold to any advertising company. This commitment is not a market differentiator — it is a legal and ethical obligation that h2online takes seriously.
The 256-bit SSL encryption protecting every transaction on h2online works the same way it does at Brazil's largest digital banks — Nubank, Itaú, and Bradesco all use the same standard. When you confirm a live bet on your phone during halftime, every communication between your device and h2online's servers is encrypted end to end. This includes the bet amount, the selection made, and any session data transmitted at that moment. Intercepting that communication without the correct decryption key is computationally infeasible.
The identity verification process (KYC) that h2online carries out on the first withdrawal is a common source of questions. Many users feel uneasy about submitting a photo ID and a selfie, and that discomfort is completely understandable. h2online does not require this process by choice — it is a regulatory obligation under the Banco Central do Brasil and the anti-money laundering (AML) rules that apply to all financial and betting platforms operating in the country. Without verification, h2online cannot legally process withdrawals. All submitted documents are stored with encryption and accessed exclusively by the compliance team, with strictly controlled access.
A common question is about cookies: h2online does use cookies, but for a far more limited purpose than most online platforms. There is no tracking of users outside h2online for behavioral advertising — the kind of cookie that shows you a sneaker ad on Instagram after you searched for sneakers on Google. On h2online, cookies are used to keep your session active while you browse the platform, remember your interface preferences, recognize your device as trusted on future logins, and detect unusual behavior that may indicate a fraud attempt. You can manage non-essential cookies through your browser or phone settings without losing access to the core service.
The right to data deletion under the LGPD is real and enforceable at h2online. There is, however, an important distinction users should be aware of: data required by law — such as financial transaction records and identity documents linked to withdrawals — must be retained for 5 years after account closure, as required by the Central Bank and COAF. This is not an exception h2online created to hold onto data longer than necessary — it is a legal obligation that applies to all financial services in Brazil, including traditional banks. Once that period expires, the data is securely and irreversibly deleted. For any questions about how your data is handled at h2online, the DPO is available at contato@h2online.best — no red tape, and a response guaranteed within the legally required timeframe.
Sign up in under 2 minutes, deposit instantly via Pix, and stay fully LGPD-compliant. Brasileirão, UFC, live casino, and much more on h2online — with full transparency from start to finish.
+18 | LGPD Compliance | Brazilian residents only
Beyond protecting your data, h2online offers real tools to keep betting as entertainment. Your well-being matters just as much as your privacy.
Set daily, weekly, and monthly limits in the dashboard to protect your budget.
Time alerts to pause and avoid impulsive betting in high-pressure moments.
Pause your account temporarily at any time, with immediate effect and no red tape.
Age verification is mandatory. Users under 18 are completely blocked from accessing the platform.
Need help? Visit our Responsible Gambling guide or contact COGABS.