Privacy Policy Surga55 – Personal Data Protection for Malaysia Online Casino Players

Surga55 ("Platform", "we", "us") operates at surga55.im and provides online casino, Sports Betting and digital entertainment services to users in Malaysia. We understand that your trust is our most valuable asset, and that trust starts with responsible and transparent management of your personal data.

This Privacy Policy explains in detail how Surga55 handles your personal data — from the point of collection through to storage and eventual deletion when it is no longer needed. We have written this policy in plain language because we believe every Surga55 member deserves to know exactly what happens with their information.

This Privacy Policy applies to all users of the Surga55 platform, including visitors who have not yet registered an account, active registered members, and former members whose data remains stored in our systems. Continued use of the Surga55 platform following any changes to this Policy constitutes acceptance of the updated terms.

Surga55 collects only the data genuinely necessary to provide the services you request. We do not engage in excessive data collection. The following are the categories of data we collect:

Data you provide directly during registration, when making deposits via DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay or FPX through Maybank2u or CIMB Clicks, and during interactions with the Surga55 support team is our primary source of data.

Surga55 also collects data automatically when you use the platform — for example, technical information about your device for security purposes and to detect any unauthorised access attempts on your account.

All personal data collected by Surga55 is used for specific and legitimate purposes. Below is a full list of the purposes for which your data is used:

• Account management: Creating and maintaining your Surga55 account, including identity verification, password recovery and profile updates.
• Transaction processing: Processing deposits and withdrawals via DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay and FPX securely and in a timely manner.
• Provision of gaming services: Grants you access to all games at Surga55, including Live Casino, jackpot slots, Malaysia Super League and EPL Sports Betting, e-sports, and other categories.
• Security and fraud prevention: Identifying and preventing fraudulent activity, money laundering, bonus abuse, and any security breaches that could compromise the platform or other members.
• Service communications: Sending you important account notifications, changes to terms, security information, and platform updates via email or SMS.
• Platform improvements: Analysing usage data in aggregate (not individual data) to understand how members use Surga55 and make relevant improvements.
• Responsible gaming: Monitor gaming patterns to identify signs of problem gambling and provide appropriate support interventions when needed.
• Legal compliance: To fulfil legal obligations under applicable Malaysian law, including anti-money laundering requirements and consumer protection regulations.

Surga55 does not sell, rent, or disclose member personal data to third parties for their own marketing or commercial purposes. However, there are limited circumstances where Surga55 is required to share data with certain parties in order to provide services to you:

• Payment providers: When you make a deposit or withdrawal, the required data will be shared with the relevant payment service provider, such as DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay and FPX processors. This disclosure is limited strictly to the information necessary to process the transaction in question.
• Licensed game providers: For Live Casino games and third-party games available on Surga55, basic session data may be shared with licensed game providers that operate those games. All such providers are bound by strict confidentiality agreements with Surga55.
• Legal authorities: Surga55 may disclose personal data when required by Malaysian law, court order, or a lawful request from a law enforcement agency. In such cases, we will disclose only the minimum data necessary.
• Fraud prevention: To protect all Surga55 members and the integrity of the platform, certain data may be shared with audited third-party fraud prevention services that are bound by strict confidentiality agreements.

In all of the above cases, Surga55 ensures that any party receiving members' personal data is contractually required to protect that data to a standard at least equivalent to Surga55's own data protection standards. We never permit third parties to use your data for their own purposes unrelated to the services they provide to Surga55.

Surga55 continually invests in security infrastructure to ensure all member personal data is protected to the highest standards we can achieve. The technical and organisational security measures we implement include:

• 256-bit SSL Encryption: All communications between your browser and Surga55's servers are encrypted using the latest TLS protocol, making it virtually impossible for third parties to read data in transit.
• Data-at-rest encryption: Sensitive data stored in Surga55's databases — including financial information — is held in encrypted form using robust encryption algorithms.
• Layered access controls: Internal access to member data is tiered and restricted to staff who require it only. All access is automatically audited and logged.
• Continuous security monitoring: An automated monitoring system operates 24 hours a day to detect any unauthorised access attempts or suspicious activity within Surga55's data infrastructure.
• Regular security testing: Surga55 conducts regular penetration testing and vulnerability assessments to identify and address any security weaknesses before they can be exploited.
• Staff training: All Surga55 staff with access to member personal data receive comprehensive information security training, which is updated on a regular basis.

Surga55 retains your personal data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, or as required by applicable law. Our principle is straightforward — we do not keep data for longer than needed.

• Active account data: For as long as your account remains active with Surga55, your personal data is retained to allow you to use all platform services. This data is updated whenever you make changes through your account settings.
• Data following account closure: After your account is closed at your request, Surga55 retains certain data for the minimum period required under Malaysian law (typically seven years for financial records) for legal compliance, dispute resolution and fraud prevention purposes.
• Technical log data: Technical access logs and security records are retained for 12 months before being automatically deleted or anonymised.
• Support communication data: Live chat conversation records and support emails are retained for 24 months for quality assurance and dispute resolution purposes.

When data is no longer needed, Surga55 deletes it securely using methods that ensure it cannot be recovered, or anonymises it so that it can no longer be linked to you personally. You may contact us to request further details about the specific retention periods for particular categories of data.

The Surga55 platform uses cookies and similar tracking technologies to enhance the user experience and ensure platform security. Understanding how cookies are used helps you make more informed decisions about your privacy while using Surga55.

Essential cookies cannot be disabled as they are required for the basic functionality of the Surga55 platform, including login authentication. Other cookies can be managed through your web browser settings. Please note that disabling certain cookies may affect some features of the Surga55 platform.

Surga55 does not use third-party cookies for marketing or cross-site tracking purposes. All cookies in use are intended solely to enhance the experience and security of Surga55 users.

Under Malaysia's Personal Data Protection Act 2010, you have a number of rights you may exercise in relation to the personal data held by Surga55. These rights are substantive and Surga55 is committed to facilitating their exercise:

• Right of Access: You have the right to request a copy of all personal data we hold about you. Your request will be processed within 30 business days.
• Right to Rectification: If any personal data we hold is inaccurate or out of date, you have the right to request a correction. Some information can be updated directly through your Surga55 account settings.
• Right to Erasure: In certain circumstances, you may request that Surga55 delete your personal data. Each request will be considered in light of any legal obligations that may require us to retain that data for a specified period.
• Right to Restrict Processing: You may request that we restrict how we process your data in certain circumstances — for example, when you dispute the accuracy of the data or object to its processing.
• Right to Withdraw Consent: Where data processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to the withdrawal.
• Right to Lodge a Complaint: If you are dissatisfied with how Surga55 handles your personal data, you have the right to lodge a complaint directly with Surga55 or with the Personal Data Protection Commissioner of Malaysia.

To exercise any of the rights above, contact the Surga55 privacy team via live chat on the platform or email your request to support@surga55.im with "Data Privacy Request" in the subject line. We may need to verify your identity before processing your request in order to protect the security of your account.

Surga55 is a platform restricted to individuals aged 18 and above. We do not knowingly collect or process the personal data of any individual under the age of 18.

Should Surga55 discover that we have inadvertently collected personal data from a minor, we will take immediate steps to delete that data from our systems and close the associated account. Parents or guardians who have reason to believe their child has registered with Surga55 without authorisation are encouraged to contact us immediately at support@surga55.im for prompt action.

The Surga55 platform may contain links to or integrations with certain third-party services, including licensed game providers and payment processors such as DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay and FPX via Maybank2u or CIMB Clicks.

When you use these third-party services, their own privacy policies will apply to any data they collect directly. Surga55 is not responsible for the privacy practices of these third parties and encourages you to read their privacy policies before using those services.

However, all third-party providers that integrate directly with the Surga55 platform are bound by data processing agreements that require them to protect any Surga55 data they access to standards consistent with our Privacy Policy.

Surga55 reserves the right to update this Privacy Policy at any time to reflect changes in our practices, new legal requirements, or improvements to how we protect your data. Each new version of the Privacy Policy will display an "Updated" date at the top of this page.

For significant changes that could materially affect how we use or protect your data, Surga55 will provide clearer notice — whether by email to your registered address, an in-platform notification when you log in, or another appropriate method. We believe you have the right to know about important changes to how your data is managed before those changes take effect.

Continued use of the Surga55 platform after any amendment to this Privacy Policy takes effect will be considered acceptance of the updated version. If you do not agree with any changes, you have the right to stop using the platform and request account closure in accordance with the procedure set out in Terms & Conditions Surga55.

If you have any questions, concerns, or requests regarding this Privacy Policy or how Surga55 manages your personal data, you are welcome to reach us through any of the following channels:

• Live Chat: Use the live chat button on the Surga55 platform — available 24 hours a day, 7 days a week. This is the fastest way to get an immediate response.
• Privacy Email: Send an email to support@surga55.im and include "Data Privacy Inquiry" in the subject line for faster processing.

Our team will acknowledge receipt of your request within 24 hours and aim to provide a full response within 14 business days. For more complex requests, such as full data access applications, the response period may extend to 30 business days in accordance with legal requirements.

Surga55 takes every privacy enquiry seriously. We use feedback from our members to continually improve our data protection practices over time. Your privacy is not merely a legal obligation for us — it is a fundamental part of the trust you place in Surga55 as your preferred entertainment platform in Malaysia.