Surga22 Privacy Policy – User Data Protection

01Introduction

Surga22 is an online sports betting and gaming platform operating for the Malaysian market. We understand that privacy is more than a right — it is the trust you place in us every time you use the surga22 platform. This document explains in detail how we collect, process, store, and protect your personal data.

By registering or using the surga22 platform, you agree to the terms of this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the platform and contact our support team to close your account. This policy should be read together with Terms and Conditions surga22 which forms the complete agreement between you and our platform.

Surga22 acts as the data controller for personal information collected through this platform. We are responsible for ensuring that all data processing is carried out in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international standards.

02Personal Data We Collect

Surga22 collects personal data from various sources to enable us to provide a safe, efficient, and responsible service. The types of data we collect are as follows:

Data Categories	Example Information	Primary Purpose
Personal Identity	Full name, identification card or passport number, date of birth, gender	KYC identity verification, legal compliance
Contact Information	Email address, phone number, mailing address	Account communications, transaction notifications
Financial Data	Bank account number, digital wallet details, transaction records	Deposit and withdrawal processing
Technical Data	IP address, device type, operating system, browser information	Account security, fraud detection
Usage Data	Betting records, game history, user preferences	Responsible gambling monitoring

This data is collected directly from you during registration and platform use, automatically through tracking technologies such as cookies and server logs, and from trusted third parties such as identity verification and payment service providers to meet KYC and AML requirements.

03How We Use Your Data

Every piece of data we collect has a clear and legitimate purpose. surga22 does not process your data beyond what is necessary for the stated purposes. The primary uses of your personal data are as follows:

• Account Management: Create, verify, and maintain your user account, including the KYC process required by law.
• Transaction Processing: Facilitate deposits, withdrawals, and all financial activities related to your surga22 account.
• Platform Security: Detect and prevent fraudulent activity, hacking, or platform abuse that could affect other users.
• Legal Compliance: Meet the reporting and compliance obligations required by Malaysian law, including AML and KYC requirements.
• Service Communications: Send important account-related notifications, promotions you have consented to receive, and platform updates.
• Responsible Wagering: Monitoring wagering patterns to identify users who may need support through our responsible gambling program.
• Platform Improvements: Analyse usage data in aggregated and anonymised form to improve the overall user experience.

We do not use your data to make automated decisions that have a legal or similarly significant effect on you without appropriate human intervention.

04Data Sharing With Third Parties

Surga22 only shares your personal data under the limited circumstances set out below. We never sell or trade your data for commercial gain:

• Payment Service Providers: Required transaction information is shared with payment providers such as FPX, DuitNow, Touch 'n Go, and credit card networks to process your financial transactions.
• Identity Verification Providers: KYC data is shared with licensed identity verification services to authenticate your documents.
• Legal Authority: surga22 will disclose the required information to authorities when mandated by court order, official investigation, or applicable legal requirements.
• Technical Service Providers: Cloud and technical infrastructure providers that help us operate the platform, subject to strict confidentiality agreements.

05Your Data Security

We continually invest in security infrastructure to ensure your data remains protected at all times. The technical and organisational security measures we employ are as follows:

• Transit Encryption: All communications between your device and surga22 servers are secured using the TLS 1.3 protocol, ensuring no third party can intercept or read your data in transit.
• Storage Encryption: Sensitive data stored in our databases is encrypted using AES-256, the encryption standard used by global defence and financial institutions.
• Internal Access Controls: Only surga22 staff with a legitimate business need are permitted to access user personal data, and all access is logged for audit purposes.
• Two-Factor Authentication: surga22 internal systems require two-factor authentication for all staff accessing data management systems.
• Security Audit: We conduct regular security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident Response Plan: surga22 has clear procedures in place to respond to any data breach, including notifying affected users within the timeframe required by law.

While we take all reasonable steps to protect your data, no security system can be guaranteed to be one hundred percent foolproof. You also play an important role in data security by keeping your password and login credentials confidential.

06Cookie Policy

Surga22 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

We use three main categories of cookies:

• Essential Cookies: Required for core platform functions such as login authentication and session security. These cookies cannot be disabled as the platform will not function properly without them.
• Performance & Analytics Cookies: Help us understand how users interact with our platform so we can make meaningful improvements. Data collected is aggregated and anonymised.
• Functional Cookies: Allows the platform to remember your preferences such as language, display settings, and login details to improve ease of use.

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the surga22 platform. For more information on managing cookies in popular browsers, please refer to your browser's help documentation.

07User Rights Regarding Personal Data

Under Malaysia's PDPA and surga22's policy, you have the following rights regarding your personal data. We are committed to respecting and facilitating the exercise of these rights:

To exercise any of the above rights, please contact the surga22 customer support team via live chat. We will respond to valid requests within 30 business days. In cases involving complex requests, we may require additional time and will notify you accordingly.

08Data Retention Period

Surga22 only retains your personal data for as long as necessary to fulfil the purposes stated in this Privacy Policy or as required by Malaysian law. Our data retention guidelines are as follows:

• Active Account Data: Retained for the duration your account is active, plus the legally required period after account closure.
• Financial Transaction Records: Retained for a minimum of seven (7) years in accordance with Malaysia's tax and AML legal requirements.
• Security Logs: Retained for 12 months for security incident investigation purposes.
• KYC Data: Retained for the period required by Malaysian financial authorities, typically five (5) years after the business relationship ends.
• Communication Data: Emails and customer support communication records are retained for two (2) years.

Once the retention period expires, your data will be securely deleted or anonymised using industry-standard data deletion procedures.

09Children's Privacy

The surga22 platform is intended exclusively for adult users aged 18 and above. We do not knowingly collect, process, or store personal data from individuals under the age of 18.

If we find that we have collected data from someone under the age of 18, we will take immediate steps to delete that information and close the account in question. If you are aware that a minor has registered on our platform, please contact our support team immediately so we can take appropriate action.

10Amendments to the Privacy Policy

Surga22 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or service improvements. Any material amendments will be communicated to you via:

• Email notification to your registered address at least 14 days before changes take effect.
• In-app or on-platform notifications on surga22 while you are logged in.
• Update the "Last Updated" date at the top of this document.

Continued use of the surga22 platform after the effective date of any amendment constitutes acceptance of the updated terms. We encourage you to review this page periodically to stay informed about how we protect your information.

Previous versions of this Privacy Policy are available upon request by contacting the surga22 customer support team. For any enquiries regarding this Privacy Policy, our dedicated data protection team is ready to assist you.