Surga88 Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how Surga88 ("we", "us", "our", or "the Platform") — operating the website at surga88.cam — collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "Member", or "User") who register, access, or interact with our online casino and sports betting services.

Surga88 is committed to protecting the privacy and personal data of all users, including those based in Malaysia, in a manner consistent with applicable data protection laws and our obligations under international licensing standards. We operate transparently: this Policy is written in plain, readable language so that every Member understands precisely how their information is handled.

By creating a Surga88 account, using our services, or submitting information through the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree, you must not use the Surga88 Platform.

This Policy is to be read alongside our Terms & Conditions and our Responsible Gambling Policy, all of which together govern your relationship with Surga88.

Definitions

The following terms carry the meanings set out below throughout this Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, email address, IP address, transaction history, and device identifiers.
• "Processing" — Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — Surga88, which determines the purposes and means of processing your personal data.
• "Data Processor" — A third party that processes personal data on behalf of Surga88 under a data processing agreement, such as KYC verification providers and payment processors.
• "Cookies" — Small text files placed on your device by the Platform to facilitate session management, analytics, and personalised user experience features.
• "KYC" — Know Your Customer — the mandatory identity and age verification process required under our licensing obligations before withdrawals are processed.
• "Special Category Data" — Personal data that by its nature requires heightened protection, such as information revealing racial or ethnic origin, health data, or financial vulnerability indicators.

Data We Collect

Surga88 collects only the categories of personal data that are necessary for the specific purposes described in Section 5. The table below summarises the principal categories:

Surga88 does not intentionally collect special category data. Where such data is inadvertently provided — for example, health information shared in a responsible gambling self-exclusion request — it is used solely for the specific welfare purpose and is not processed for any other purpose.

How We Collect Data

Personal data is collected through the following principal means:

• Direct provision by you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a promotional communication, you provide personal data directly to Surga88.
• Automated technical collection: When you access the Platform, our servers automatically record technical data including your IP address, browser type, pages visited, session duration, and device identifiers. This collection occurs via server logs, cookies, and similar tracking technologies.
• Payment processing partners: When you transact via Malaysian payment channels — including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, or Hong Leong Bank — our payment processing partners transmit transaction confirmation data, including the payment method reference, amount, and timestamp, to Surga88 for account crediting and fraud monitoring purposes.
• KYC and identity verification providers: Third-party identity verification services engaged by Surga88 return verification outcomes and, where required, document data to our systems to complete the KYC process.
• Analytics platforms: Aggregate, anonymised usage analytics are collected through platform analytics tools to improve user experience and optimise platform performance. These tools are configured to respect user privacy and do not generate individual-level tracking profiles for commercial resale.

Purposes of Processing

Surga88 processes personal data for the following defined purposes only:

• Account creation and management — Registering your account, maintaining accurate records, and providing access to the Platform's services.
• Identity and age verification (KYC) — Confirming that you meet the 21+ minimum age requirement and verifying your identity in compliance with our licensing obligations and anti-money laundering requirements.
• Transaction processing — Processing deposits, withdrawals, bonus credits, and refunds in MYR across all accepted Malaysian and international payment methods.
• Fraud prevention and security — Detecting, investigating, and preventing fraudulent activity, money laundering, multi-accounting, and other prohibited conduct on the Platform.
• Customer support — Responding to your queries, resolving disputes, and maintaining records of support interactions for quality assurance purposes.
• Responsible gambling — Monitoring account activity for indicators of problem gambling behaviour and enforcing deposit limits, loss limits, session limits, and self-exclusion requests in accordance with our Responsible Gambling Policy.
• Legal and regulatory compliance — Fulfilling our obligations under applicable licensing terms, including record-keeping requirements, audit cooperation, and responding to lawful requests from competent authorities.
• Platform improvement and analytics — Analysing aggregated usage patterns to improve platform functionality, user experience, and product offerings.
• Marketing communications — Sending promotional messages, bonus offers, and platform updates to Members who have opted in to receive such communications. You may withdraw consent at any time.

Legal Basis for Processing

Surga88 processes personal data only where a valid legal basis exists. The principal legal bases we rely upon are:

• Performance of a contract: Processing necessary to register your account, execute your bets, process your deposits and withdrawals, and deliver the services you have requested from Surga88.
• Legal obligation: Processing required to comply with applicable laws, including KYC obligations under our licensing conditions, anti-money laundering record-keeping requirements, and responses to lawful authority requests.
• Legitimate interests: Processing for fraud detection, security monitoring, platform analytics, and responsible gambling enforcement — where these interests do not override your fundamental rights and freedoms.
• Consent: Processing for optional marketing communications, where you have freely and clearly opted in. Consent may be withdrawn at any time without affecting your account access or service quality.

Data Sharing & Disclosure

Surga88 does not sell or commercially share your personal data with third parties. We may disclose your data only in the following limited circumstances:

• Service providers and data processors: Third-party vendors engaged under data processing agreements to perform specific functions on our behalf, including KYC verification providers, payment processors (covering DuitNow, FPX, and e-wallet gateways), fraud detection services, cloud infrastructure providers, and customer support platform operators. All processors are contractually bound to process data solely on Surga88's instruction and to maintain appropriate security standards.
• Regulatory and licensing authorities: Where required by our licensing terms or by law, we may disclose data to the relevant regulatory authority, financial intelligence unit, or law enforcement agency. Such disclosures are made only to the extent required and are logged internally.
• Legal proceedings: Where Surga88 is required to disclose personal data in response to a valid court order, subpoena, or equivalent legal process issued by a competent jurisdiction, we will comply whilst notifying you to the extent permissible by law.
• Corporate transactions: In the event of a merger, acquisition, restructuring, or sale of substantially all of Surga88's assets, Member personal data may be transferred to the acquiring entity, subject to equivalent privacy protections and advance notification to affected Members.
• Consent-based disclosures: We will share your data with any third party that you explicitly and specifically authorise, for the purpose you have authorised.

International Data Transfers

As an internationally licensed online platform, Surga88 may transfer personal data to servers and service providers located outside Malaysia. Where such transfers occur, we apply appropriate safeguards to ensure your data receives a level of protection consistent with the standards described in this Policy.

Safeguards applied to international transfers may include:

• Standard contractual clauses approved by recognised data protection authorities, incorporated into agreements with all data processors handling personal data in jurisdictions outside Malaysia;
• Data processing agreements requiring processors to implement technical and organisational security measures equivalent to those applied by Surga88 itself;
• Transfer exclusively to jurisdictions that maintain adequately comparable data protection frameworks.

You may request information about the specific safeguards applied to any international transfer of your data by contacting our support team at the details provided in Section 15.

Data Retention

Surga88 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to any longer retention period required by law or by our licensing obligations. The following general retention principles apply:

• Active account data: Personal and account data is retained for the duration of your membership and for a defined period following account closure to allow for the resolution of any outstanding transactions, disputes, or regulatory queries.
• KYC and identity verification records: Identity documents and KYC outcomes are retained for the minimum period required under our licensing conditions, typically five (5) years from the end of the business relationship, to comply with anti-money laundering record-keeping obligations.
• Financial transaction records: Transaction histories, deposit and withdrawal records, and associated payment data are retained for at least five (5) years to comply with applicable financial record-keeping requirements.
• Support communications: Customer support transcripts are retained for a period sufficient to resolve disputes and maintain quality assurance, and are deleted thereafter unless a longer period is required for an ongoing matter.
• Marketing data: Marketing preference data and related communications are retained until you withdraw consent, at which point they are removed from active marketing systems within a reasonable operational timeframe.

Upon expiry of the applicable retention period, personal data is securely deleted from our active systems or permanently anonymised so that it can no longer be associated with any individual.

Cookies & Tracking Technologies

Surga88 uses cookies and similar technologies on the Platform for the following purposes:

• Strictly necessary cookies: Essential to the operation of the Platform, including session authentication, security tokens, and load balancing. These cookies cannot be disabled without preventing access to core Platform features.
• Functional cookies: Remember your preferences such as language settings, display options, and previously entered form fields to improve your experience on subsequent visits.
• Analytics cookies: Collect aggregated, anonymised data about how users interact with the Platform — pages visited, time on page, navigation paths — to inform improvements to the user experience.
• Security and fraud prevention cookies: Help detect anomalous activity patterns consistent with fraud, bot access, or account takeover attempts.

Surga88 does not deploy third-party advertising or retargeting cookies that track your browsing behaviour across other websites for commercial profiling purposes.

Your Rights

Subject to applicable law and our legitimate operational and legal obligations, you hold the following rights in relation to your personal data held by Surga88:

To exercise any of the above rights, please contact Surga88's support team through the channels described in Section 15. We will acknowledge your request within five (5) business days and aim to fulfil it within thirty (30) calendar days. Complex requests or where a large volume of data is involved may take longer, in which case we will notify you of the extended timeframe.

Please note that certain rights may be limited where Surga88 is required to retain data to comply with legal obligations — such as KYC records mandated under our licensing terms — or where processing is necessary to defend or exercise legal claims.

Children's Privacy

Surga88 strictly prohibits access to its services by any person under the age of 21. We do not knowingly collect personal data from individuals below this age threshold.

Identity verification checks are applied during the account registration process, and further KYC verification — requiring government-issued identification confirming age — is mandatory before any withdrawal is processed. These measures are designed specifically to prevent underage access to gambling services.

If we become aware that personal data has been collected from an individual who is under 21 years of age, we will immediately suspend the relevant account, delete the associated personal data to the extent not required for regulatory purposes, and retain records solely to support any compliance or fraud investigation that may follow.

Parents or guardians who believe that a minor may have accessed or registered on the Surga88 Platform are urged to contact our support team immediately at the details provided in Section 15.

Security Measures

Surga88 implements a layered set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• TLS/HTTPS encryption for all data in transit between your device and Surga88 servers;
• AES-256 encryption applied to sensitive data fields stored at rest, including identity documents and payment information;
• Multi-factor authentication options for Member accounts, and mandatory multi-factor authentication for administrative access to systems handling personal data;
• Role-based access controls limiting internal access to personal data to those employees and contractors with a legitimate operational need;
• Regular penetration testing and security audits conducted by qualified third-party security professionals;
• Intrusion detection and anomaly monitoring systems operating continuously across the Platform infrastructure;
• Secure data destruction protocols applied when personal data reaches the end of its retention period.

Whilst Surga88 applies commercially reasonable security measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. Members are encouraged to use strong, unique passwords for their Surga88 accounts and to report any suspected unauthorised access immediately via our 24/7 support team.

Policy Amendments

Surga88 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, licensing requirements, or the scope of services we offer. When material changes are made, we will:

• Update the "Last updated" date displayed at the top of this page;
• Display a prominent notice on the Platform or send a notification to your registered email address, where the changes are material to how your data is used.

Your continued use of the Surga88 Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised terms. We encourage you to review this page periodically to remain informed. Archived versions of previous policies are available upon request.

Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by Surga88, please contact us through the following channels. All communications relating to data privacy rights will be treated with priority:

If you are dissatisfied with Surga88's response to a privacy complaint, you have the right to escalate the matter to the supervisory authority relevant to your jurisdiction. Surga88 will cooperate fully with any such regulatory inquiry.