Privacy Policy

This Privacy Policy ("Policy") describes how surga55 ("surga55", "we", "us", "our") collects, processes, stores, and discloses personal data obtained from users ("you", "your", "User") of the surga55 online gaming platform accessible at https://surga55.cam (the "Platform").

surga55 is an English-language online gaming platform designed primarily for users in Malaysia. Our services include sports betting covering Liga Super Malaysia, EPL, UFC and other international events; a live casino featuring baccarat, roulette and blackjack; a slots library; lottery; and related gaming verticals — all transacted in Malaysian Ringgit (MYR).

We are committed to protecting your personal data and handling it responsibly, transparently, and in accordance with applicable data protection and privacy legislation. This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy.

For the purposes of this Privacy Policy, the following terms have the meanings assigned below:

• "Personal Data" means any information that identifies or could reasonably be used to identify you as an individual, including your name, identification number, email address, payment details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, surga55.
• "Data Processor" means a third party that processes Personal Data on behalf of surga55, such as payment service providers or identity verification partners.
• "KYC" means Know Your Customer identity and verification procedures required for regulatory compliance and fraud prevention purposes.
• "Cookies" means small text files placed on your device by the Platform to collect standard internet log information and visitor behaviour data.
• "MYR / RM" means Malaysian Ringgit, the currency in which all transactions on the surga55 Platform are conducted.

surga55 acts as the Data Controller in respect of all Personal Data collected and processed through the Platform. As Data Controller, surga55 determines the purposes for which your Personal Data is used and bears primary responsibility for its lawful, fair, and transparent processing.

surga55 may engage third-party Data Processors — including payment processing partners, identity verification service providers, customer support platforms, and fraud prevention systems — to assist in delivering the Platform's services. All such third parties are contractually bound to process Personal Data only on surga55's documented instructions and in accordance with applicable data protection requirements.

For all privacy-related enquiries, please contact us at [email protected] (plain text — not a clickable link) referencing "Privacy Enquiry" in your subject line.

surga55 collects the following categories of Personal Data from users of the Platform:

surga55 does not collect sensitive personal data categories such as health data, biometric data beyond photo ID for KYC, racial or ethnic origin, political opinions, religious beliefs, or trade union membership, unless specifically required by applicable law or regulation.

surga55 collects Personal Data through the following channels and mechanisms:

• Direct provision by you: When you register an account, complete KYC verification, make deposits or withdrawal requests, contact customer support, or respond to any surveys or promotions.
• Automated technical collection: Through cookies, web beacons, server logs, and similar tracking technologies as you interact with the Platform. See Section 9 for full details on cookies.
• Payment processor data: When you transact via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, bank transfers, or cryptocurrency channels, relevant transaction data is shared with surga55 by the respective payment service providers.
• Third-party verification services: Identity verification and fraud screening providers may supply data points used to validate your identity during KYC processes.
• Referral programmes: Where you arrive on the Platform through a referral link, limited data may be collected regarding the referral source for bonus attribution purposes.

surga55 processes your Personal Data on one or more of the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations to you under the surga55 Terms & Conditions, including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable legal requirements, including KYC / anti-money laundering obligations, age verification (21+), and tax or regulatory reporting requirements.
• Legitimate interests: Processing carried out for surga55's legitimate business interests, such as fraud prevention, platform security, responsible gambling monitoring, and service improvement — where such interests are not overridden by your rights and interests.
• Consent: Where you have provided explicit, freely given, and informed consent to a specific processing activity, such as receiving marketing communications. You may withdraw consent at any time by contacting our support team.

surga55 uses the Personal Data it collects for the following specific purposes:

• To create and manage your surga55 account and verify your identity in accordance with KYC requirements;
• To process deposits in MYR and facilitate withdrawals via your chosen payment method (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, or cryptocurrency);
• To deliver the gaming services you request, including sportsbook bets on EPL and Liga Super Malaysia matches, live casino sessions, slot games, and other gaming verticals;
• To administer promotional bonuses, loyalty rewards, and referral programmes in accordance with their respective terms;
• To provide customer support via live chat, email, and ticketing systems;
• To monitor gaming activity for responsible gambling purposes, including detecting patterns indicative of problem gambling and prompting appropriate interventions;
• To detect, investigate, and prevent fraud, money laundering, collusion, and other prohibited conduct;
• To comply with applicable legal obligations, including age verification (strictly 21+), anti-money laundering reporting, and regulatory requirements;
• To improve the Platform through analytics of user behaviour and technical performance data;
• To communicate with you regarding account status, security notices, and service updates — and where you have consented, to send promotional communications.

surga55 does not use Personal Data to make solely automated decisions that produce legal or similarly significant effects on you, without providing you an opportunity to seek human review.

surga55 does not sell or rent your Personal Data to any third party. We may share your data only in the following limited and controlled circumstances:

• Payment service providers: We share necessary financial data with Malaysian payment processors — including providers supporting Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and major Malaysian banks — solely to execute your transactions.
• Identity verification and KYC providers: We engage specialist third-party services to assist in verifying the identity and age of users. These providers receive only the data required for verification purposes.
• Fraud prevention and security services: We may share technical and behavioural data with fraud screening and cybersecurity providers to protect the integrity of the Platform.
• Responsible gambling service providers: Where required to deliver responsible gambling tools, data may be shared with specialist providers in a privacy-preserving manner.
• Legal and regulatory authorities: We will disclose Personal Data to competent authorities, law enforcement agencies, or regulatory bodies when required to do so by applicable law, court order, or to protect the rights and safety of surga55 users or the public.
• Business transfers: In the event of a merger, acquisition, or asset sale involving surga55, Personal Data may be transferred to the successor entity, subject to equivalent privacy protections.

The surga55 Platform uses cookies and similar tracking technologies to enhance user experience, maintain session continuity, and collect analytical data. The following categories of cookies are used on the Platform:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session cookies that maintain your login state and security tokens. These cookies cannot be disabled without affecting core platform functionality.
• Performance & Analytics Cookies: Collect anonymised data about how users interact with the Platform — such as pages visited, time on page, and error encounters — to help us improve the user experience. This data is aggregated and does not identify individual users.
• Functional Cookies: Remember your preferences such as language settings, display options, and previously used payment methods to provide a more personalised experience.
• Security Cookies: Used to detect and prevent fraudulent activity, protect against bot traffic, and maintain platform integrity.

You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. Most modern browsers allow you to refuse all cookies or to alert you when a cookie is being sent.

surga55 does not use third-party advertising cookies or share tracking data with ad networks for behavioural advertising purposes.

surga55 implements a comprehensive suite of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transmitted between your browser and the Platform is protected using TLS 1.2 or higher (256-bit SSL encryption).
• Encryption at rest: Stored Personal Data — including financial records and identity documents — is encrypted using AES-256 encryption.
• Access controls: Access to Personal Data is restricted on a strict need-to-know basis, with role-based access controls and multi-factor authentication enforced for all administrative systems.
• Intrusion detection and monitoring: Real-time monitoring systems detect and alert on unusual access patterns and potential security incidents.
• Regular security assessments: The Platform's security posture is reviewed and tested regularly, including vulnerability assessments and penetration testing.
• Staff training: All personnel with access to Personal Data receive regular training on data protection obligations and security best practices.

While surga55 takes all reasonable steps to protect your Personal Data, no internet transmission or electronic storage system is completely secure. In the event of a data breach that poses a material risk to your rights, surga55 will notify affected Users in accordance with applicable notification requirements.

surga55 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, taking into account applicable legal, regulatory, accounting, and operational requirements. The following retention principles apply:

• Account data: Retained for the duration of your active account relationship with surga55, plus an additional period as required for legal and regulatory compliance following account closure.
• Financial transaction records: Retained for the period required under applicable anti-money laundering, financial record-keeping, and tax compliance obligations.
• KYC documents: Retained for the period required by applicable KYC and anti-money laundering regulations, typically no less than five (5) years from the date of collection or account closure, whichever is later.
• Customer support communications: Retained for a period sufficient to resolve disputes, respond to regulatory enquiries, and maintain service quality records.
• Technical and usage data (anonymised): May be retained indefinitely in anonymised, aggregated form for platform analytics and improvement purposes.
• Marketing consent records: Retained for the duration of your subscription to marketing communications, plus a period necessary to demonstrate compliance with applicable consent requirements.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or irreversibly anonymised. Where deletion is not technically feasible immediately, the data will be isolated and protected from further processing until deletion is possible.

Subject to applicable law and certain conditions, you have the following rights in relation to your Personal Data held by surga55:

To exercise any of the above rights, please submit a written request to [email protected] (plain text — not a clickable link) with the subject line "Data Rights Request". surga55 will respond to all valid requests within 30 days. In certain complex cases, this period may be extended by a further 30 days, of which you will be notified.

Please note that certain rights may be limited or unavailable where processing is required for legal compliance purposes — for example, we cannot delete KYC records that must be retained under anti-money laundering legislation.

The surga55 Platform primarily processes and stores Personal Data within infrastructure serving the Malaysian market. However, certain Data Processors engaged by surga55 — including cloud service providers, fraud screening systems, and identity verification platforms — may operate in or store data in jurisdictions outside Malaysia.

Where Personal Data is transferred to service providers in other jurisdictions, surga55 ensures that appropriate safeguards are in place to protect the data, including:

• Contractual data processing agreements incorporating equivalent data protection obligations;
• Transfers to providers in jurisdictions recognised as providing adequate levels of data protection;
• Application of appropriate technical security controls to all cross-border data flows.

By using the surga55 Platform, you acknowledge and agree that your Personal Data may be transferred to and processed in jurisdictions outside Malaysia, subject to the safeguards described above.

The surga55 Platform is strictly intended for individuals who are 21 years of age or older. surga55 does not knowingly collect, process, or retain Personal Data from individuals under the age of 21.

If surga55 becomes aware that it has inadvertently collected Personal Data from an individual under 21, we will take immediate steps to delete that data from our systems, close the associated account, and return any deposited funds to the source payment method following appropriate verification.

If you are a parent or guardian and believe that a person under 21 in your care has accessed the surga55 Platform or provided us with their Personal Data, please contact us immediately at [email protected] so that we can take appropriate action.

surga55 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. The "Last Updated" date displayed at the top of this page will be revised to reflect the date of any material changes.

Where changes are material — that is, where they substantively affect how we use your Personal Data or reduce your rights — surga55 will notify registered Users via the email address associated with their account or through a prominent notice on the Platform prior to the changes taking effect.

Your continued use of the surga55 Platform following notification of any updated Privacy Policy constitutes acceptance of the revised terms. If you do not agree to the revised Policy, you should cease using the Platform and may request account closure by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by surga55, please contact our support team using the details below. All privacy enquiries are handled in confidence.

Platform: surga55 (https://surga55.cam)
Privacy Contact Email: [email protected] — subject line: "Privacy Enquiry" (plain text, not a clickable link)
Support Hours: Live Chat — 8:00am to 12:00am MYT; Ticketing — 24/7
Response Time: We aim to acknowledge all privacy-related requests within 2 business days and resolve them within 30 days.

For further information about your data rights and how they apply in your jurisdiction, you may also wish to consult the relevant data protection authority in Malaysia.