Surga22 Privacy Policy

This Privacy Policy ("Policy") is issued by Surga22 ("Surga22", "we", "us", "our") and applies to all personal data collected, processed, stored, and used in connection with your use of the Surga22 online casino and sports betting platform at https://surga22.cam ("the Platform") and any related services, features, or applications.

Surga22 recognises the importance of privacy and is committed to protecting the personal information of all users, including those accessing the Platform from Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and throughout Malaysia. We handle your data with care, transparency, and in accordance with the principles of purpose limitation, data minimisation, integrity, and confidentiality.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy. By using the Surga22 Platform, you acknowledge that you have read and agree to this Privacy Policy in full.

For the purposes of this Privacy Policy, the following terms shall have the meanings assigned below:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, identification document details, payment account identifiers, IP address, and device identifiers.
• "Processing" — Any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction, whether by automated or manual means.
• "Data Controller" — Surga22, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — A third party that processes personal data on behalf of Surga22 pursuant to a written data processing agreement, including payment processors, KYC verification providers, and cloud hosting providers.
• "Consent" — A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC Data" — Identity verification documents and related data submitted by a User during the Know Your Customer process, including copies of government-issued identification such as a Malaysian MyKad, passport, or equivalent document.
• "Usage Data" — Automatically collected data regarding your interaction with the Platform, including login timestamps, session duration, pages visited, game activity, and device and browser information.

Surga22 collects personal data in the following categories, depending on how you interact with the Platform:

Surga22 processes your personal data on the following legal bases, depending on the nature and purpose of the processing activity:

• Contractual Necessity: Processing required to perform the contract between you and Surga22, including account registration, deposit and withdrawal processing, KYC verification, and service delivery.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) obligations, age verification requirements, and regulatory reporting duties.
• Legitimate Interests: Processing conducted in pursuit of Surga22's legitimate business interests, including fraud detection, platform security, system maintenance, and service improvement, provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your explicit consent, including the sending of promotional communications, personalised offers, and optional analytics participation. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Surga22 uses the personal data we collect for the following purposes:

• Account Management: To create, verify, maintain, and secure your Surga22 account, including password resets, two-factor authentication, and session management.
• Transaction Processing: To process deposits via Maybank, CIMB, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and supported cryptocurrency networks; and to process withdrawal requests to your verified payment method.
• Identity Verification: To verify your identity, age (21+), and eligibility to use the Platform in accordance with our regulatory obligations and Terms & Conditions.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, account sharing, multi-accounting, and other prohibited conduct as defined in our Terms & Conditions.
• Regulatory Compliance: To fulfil our obligations under applicable anti-money laundering (AML) frameworks, responsible gambling regulations, and any applicable data protection laws.
• Customer Support: To respond to your enquiries, investigate complaints, and provide assistance with account, deposit, withdrawal, and gameplay issues — in English, 24 hours a day.
• Marketing Communications: Where you have provided consent, to send you promotions, bonus offers, VIP tier updates, and platform news. You may opt out at any time through your account settings.
• Platform Improvement: To analyse usage patterns, identify technical issues, and improve the overall quality, reliability, and performance of the Surga22 Platform.

6.1 No Sale of Data. Surga22 does not sell, rent, or otherwise transfer your personal data to any third party for their independent commercial use. Your data is not a commodity.

6.2 Operational Service Providers. Surga22 may share personal data with the following categories of data processors, solely for the purpose of delivering our services to you:

• Payment processors and banking partners (including FPX, DuitNow infrastructure providers, and e-wallet operators);
• KYC and identity verification service providers;
• Cloud hosting and data centre infrastructure providers;
• Customer support platform providers;
• Fraud detection and cybersecurity service providers;
• Licensed game studio providers who deliver game content to the Platform.

All third-party data processors engaged by Surga22 are bound by contractual data processing agreements that restrict their use of your data to the specific services they provide on Surga22's behalf.

6.3 Legal Disclosure. Surga22 may disclose personal data to law enforcement agencies, regulators, or judicial authorities where required by applicable law, court order, or regulatory demand, without prior notice to the affected user where legally permitted or required.

7.1 What Are Cookies. Cookies are small text files placed on your device when you access the Surga22 Platform. They enable us to recognise your device, remember your preferences, maintain your session, and analyse how the Platform is used.

7.2 Types of Cookies We Use.

• Essential Cookies: Required for the Platform to function, including session management, login state, and security tokens. These cannot be disabled without impairing core platform functionality.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and previously selected payment methods.
• Analytics Cookies: Collect aggregated, anonymised data about how users interact with the Platform, used to improve performance and user experience. These are only activated with your consent.
• Security Cookies: Used to detect and prevent fraudulent activity, bot traffic, and account abuse attempts.

7.3 Managing Cookies. You may configure your browser to block or delete cookies at any time. Note that disabling essential cookies may prevent some features of the Surga22 Platform from functioning correctly. Most modern browsers provide clear cookie management options in their settings menu.

8.1 Surga22 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy our legal, regulatory, accounting, or reporting requirements.

8.2 The following general retention periods apply:

• Account Data: Retained for the duration of the active account relationship, plus a minimum period of five (5) years following account closure, to comply with AML record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years following the completion of the business relationship, as required under applicable AML frameworks.
• Transaction Records: Retained for a minimum of seven (7) years for financial compliance purposes, including records of all MYR deposits and withdrawals via Maybank, CIMB, DuitNow, FPX, and all other accepted payment methods.
• Support Correspondence: Retained for a minimum of three (3) years following the resolution of the relevant enquiry or complaint.
• Marketing Preferences: Retained until you withdraw consent or close your account, whichever occurs earlier.

8.3 Following the expiration of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents re-identification.

9.1 Surga22 implements industry-standard technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS 1.3 encryption for all data in transit between your device and Surga22 servers;
• AES-256 encryption for all personal data stored at rest;
• Role-based access controls limiting internal access to personal data to authorised personnel only;
• Regular third-party penetration testing and vulnerability assessments;
• Multi-factor authentication requirements for administrative access to data systems;
• PCI-DSS compliant payment data handling infrastructure.

9.2 User Responsibilities. While Surga22 takes extensive measures to protect your data, you are also responsible for maintaining the security of your account. You must keep your login credentials confidential, enable two-factor authentication where available, and notify Surga22 immediately if you suspect unauthorised access to your account.

9.3 Data Breach Response. In the event of a data security incident that poses a risk to your personal data, Surga22 will take prompt remedial action and notify affected users in accordance with applicable data protection requirements.

Subject to applicable law, you have the following rights with respect to your personal data held by Surga22:

• Right of Access: You may request a copy of the personal data Surga22 holds about you. Requests will be fulfilled within 14 business days, subject to identity verification.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you. You may also update certain data directly through your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to any overriding legal or regulatory retention obligations.
• Right to Restriction: You may request that Surga22 restricts the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data.
• Right to Data Portability: Where technically feasible, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing conducted on the basis of legitimate interests, including profiling for marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

11.1 The Surga22 Platform is strictly intended for adults aged 21 years and above. Surga22 does not knowingly collect, process, or store personal data from any person under the age of 21.

11.2 Where Surga22 discovers or is notified that personal data has been collected from a person under the age of 21 — whether through registration or any other means — all such data will be immediately deleted, the associated account will be closed, and any deposits will be returned.

11.3 If you have reason to believe that a minor has provided personal data to Surga22, please contact our support team immediately at the details provided in Section 14 of this Policy.

12.1 The Surga22 Platform integrates with a number of third-party services necessary for its operation, including payment gateways (such as FPX, DuitNow, and e-wallet platforms), KYC providers, and game content delivery systems. Each of these third parties operates under their own privacy policies and terms of service.

12.2 Surga22 is not responsible for the privacy practices, data handling, or security standards of third-party services accessed through the Platform. We encourage you to review the privacy policies of any third-party payment providers you use — including your bank (Maybank, CIMB, Public Bank, Hong Leong), your e-wallet provider (Touch 'n Go eWallet, Boost, GrabPay), and the DuitNow or FPX infrastructure — to understand how they process your data independently.

12.3 All third-party processors engaged by Surga22 are subject to data processing agreements that restrict the use of your data strictly to the services they provide on our behalf.

13.1 Surga22 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or the nature of our services. The "Last Updated" date at the top of this page will be revised upon any material change.

13.2 Where changes are material — meaning they significantly affect how we collect, use, or share your personal data — registered users will be notified via email and/or an in-platform notification at least 14 days before the changes take effect.

13.3 Your continued use of the Surga22 Platform following the effective date of an amended Privacy Policy constitutes your acceptance of the revised terms. We recommend reviewing this page periodically to remain informed of any changes.

If you have any questions, concerns, or requests regarding this Privacy Policy, or wish to exercise any of your data rights as described in Section 10, please contact Surga22 using the details below:

For responsible gambling queries or self-exclusion requests, please visit our dedicated Responsible Gambling page.