Privacy Policy surga22 —
Your Data, Our Responsibility

Surga22 is an online entertainment and betting platform serving Malaysian players. We take our responsibility for protecting your personal data extremely seriously. This Privacy Policy was developed in accordance with Malaysian legal requirements, specifically the Personal Data Protection Act 2010 (PDPA).

This Privacy Policy applies to all personal information you provide to surga22 through:

• Account registration and verification process (KYC)
• Daily use of the surga22 platform, including gaming and betting activity
• Deposit and withdrawal transactions via Touch 'n Go, GrabPay, DuitNow, FPX, Boost, or ShopeePay
• Interactions with the surga22 customer support team
• Use of platform features via web browser or mobile device

By using the surga22 platform, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree, please discontinue use of the platform and contact us for further assistance.

Surga22 collects only the data strictly necessary to operate our services safely and comply with legal requirements. The following are the categories of data we collect:

A. Data You Provide Directly to Us

• Identity Information: Full name as per MyKad, Malaysian identification number (MyKad/Passport), date of birth, gender.
• Contact Information: An active Malaysian mobile number, email address, and current residential address.
• Financial Information: Bank account or e-wallet numbers used for deposits and withdrawals. We do not store credit or debit card details — transactions are processed directly through secure payment gateways.
• Verification Documents: A copy of your MyKad or passport, and a utility bill or bank statement for address verification (required during the KYC process).

B. Automatically Collected Data

• Technical Data: IP address, browser type, device operating system, screen resolution.
• Usage Data: Pages visited, session duration, games played, betting history, and transactions.
• Cookie Data: Small text files stored on your device to identify sessions and personalise your experience on surga22.
• Location Data: General location information based on IP address, used solely for security verification purposes.

Every piece of data we collect has a clear and lawful purpose. surga22 uses your information for the following:

• Service Provision: Creating and managing your surga22 account, processing deposit and withdrawal transactions, and enabling you to access all games in the surga22 collection.
• Identity Verification (KYC): Verifying your identity to comply with legal requirements relating to anti-money laundering (AML) and age verification.
• Account Security: Detecting suspicious activity, preventing fraud, and protecting your account from unauthorised access.
• Platform Improvements: Analysing usage patterns to improve the surga22 player interface, performance, and overall experience.
• Service Communications: Sending important notices related to your account, security updates, transaction confirmations, and customer support responses.
• Promotions & Bonuses: With your consent, we send you information about bonuses, promotions, and the latest offers from surga22 that are relevant to your gaming preferences.
• Legal Compliance: Maintaining records required under Malaysian law and responding to directives from competent regulatory authorities.

Surga22 will not use your data for any purpose beyond those stated above without first obtaining your explicit consent.

Surga22 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. Your data is only shared in the following limited and controlled circumstances:

• Payment Service Providers: Transaction data is shared with approved payment gateway providers (such as Touch 'n Go operators, GrabPay, DuitNow, and licensed Malaysian banks) solely for processing your deposits and withdrawals.
• Game Software Providers: Account numbers and currency (RM) are shared with game providers such as Pragmatic Play, Microgaming, and others strictly for technical purposes to enable gameplay.
• Legal Authorities: Information will be disclosed to Malaysian authorities where a valid court order, criminal investigation, or AML compliance requirement exists.
• Security Services: Technical data such as IP addresses is shared with fraud detection service providers to protect all surga22 users.

All third parties who receive surga22 user data are bound by strict data protection agreements and are permitted to use that data solely for the specified purposes.

Surga22 continually invests in security infrastructure to ensure your data is protected at all times. Our security measures include:

• Data Encryption: All sensitive data transmitted between your device and surga22's servers is protected by 256-bit SSL/TLS encryption — the same standard used by major financial institutions.
• Database Security: Data stored in surga22's databases is protected with additional encryption and strict access controls. Only authorised personnel are permitted to access user data.
• Two-Factor Authentication: surga22's 2FA system adds an extra layer of security to all user accounts.
• 24/7 Monitoring: The surga22 IT security team continuously monitors systems to detect any intrusion attempts or suspicious activity.
• Regular Security Audits: surga22 conducts regular independent security audits by specialist third parties to identify and address any vulnerabilities.
• Incident Response Plan: In the event of a data security breach, surga22 has a clear protocol for notifying affected users within the timeframe required by law.

Surga22 does not retain your personal data longer than necessary to fulfil the purpose for which it was collected or to comply with legal requirements. Our data retention guidelines are as follows:

• Active Account Data: Retained for as long as your surga22 account remains active and you continue using our platform.
• Financial Transaction Records: Retained for 7 years after the transaction date as required under Malaysian financial and tax laws.
• KYC Documents: Retained for 5 years after account closure or the date the last document was submitted, in accordance with AML requirements.
• Support Communication Logs: Retained for 2 years for reference and dispute resolution purposes.
• Technical Data & Logs: Retained for 90 days for security monitoring and technical troubleshooting purposes.
• Marketing Data: Retained until you withdraw your consent or request deletion.

Once the retention period expires, your data will be securely deleted using methods that ensure it cannot be recovered.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have certain rights regarding the personal data held by surga22. We respect and facilitate the exercise of these rights:

Surga22 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit surga22. The types of cookies we use are as follows:

You can manage and delete cookies through your web browser settings. Please note that disabling essential cookies may affect surga22 platform functionality and may require you to log in again on each visit.

Surga22 is a platform intended exclusively for individuals aged 18 and above. We do not knowingly collect personal information from anyone under the age of 18. If you believe your child or dependent under 18 has registered a surga22 account or provided us with their personal data, please contact the surga22 team immediately at support@surga22.im.

Once the case is confirmed, the account in question will be closed immediately and all personal data belonging to the minor will be deleted from surga22's systems as soon as possible. Surga22 conducts age verification as a mandatory part of the registration process to prevent access by minors.

Surga22 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service improvements. When significant changes are made, we will notify you via:

• A prominent notice on the surga22 homepage for at least 7 days before the changes take effect
• Notification emails sent to your registered email address
• Updating the "Last Updated" date at the top of this document

Your continued use of the surga22 platform after any changes to the Privacy Policy take effect constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how surga22 handles your personal data, please contact us through any of the following channels:

• Privacy Email: support@surga22.im (subject: "Privacy Enquiry")
• Live Chat: Available 24/7 directly on the surga22 platform
• WhatsApp: The number shown in your account settings after logging in

Surga22 is committed to responding to all privacy-related enquiries within 72 business hours. For urgent matters concerning account or data security, please use live chat for the fastest response.

If you are not satisfied with surga22's response, you also have the right to lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia, the authority responsible for enforcing the PDPA in Malaysia.