Privacy Policy — SurgaPlay

This Privacy Policy (the "Policy") is issued by SurgaPlay (the "Company", "we", "us", or "our"), the operator of the online gaming platform accessible at https://surgaplay.cam (the "Platform"). This Policy applies to all personal data collected, processed, stored, and shared by SurgaPlay in connection with the operation of the Platform and the services offered thereon.

SurgaPlay serves players across Malaysia, including users based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations throughout the peninsula. We understand that our players entrust us with sensitive personal and financial information, and we take that responsibility seriously.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, which together form the complete framework governing your relationship with SurgaPlay. By registering an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy.

For the purposes of this Policy, the following terms shall bear the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — an "identifiable" person being one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or one or more factors specific to the identity of that person.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this case, SurgaPlay.
• "Data Processor" means any natural or legal person that processes Personal Data on behalf of the Data Controller.
• "Account Holder" or "Player" means any individual who has registered a player account on the SurgaPlay Platform.
• "KYC Data" means identity verification documents and supporting information collected as part of SurgaPlay's Know Your Customer programme.
• "Cookies" means small text files placed on a user's device by a website, used to store session information and user preferences.
• "PDPA" means the Personal Data Protection Act 2010 (Malaysia), as amended from time to time, which governs the Processing of personal data of individuals in Malaysia.

SurgaPlay acts as the Data Controller with respect to all Personal Data collected from Account Holders and visitors to the Platform. As Data Controller, SurgaPlay determines the purposes for which and the means by which Personal Data is processed, and is responsible for ensuring that such processing is carried out in compliance with applicable data protection laws, including the Malaysian Personal Data Protection Act 2010 (PDPA) and applicable international standards.

All enquiries relating to data protection, the exercise of data subject rights, or concerns about our data handling practices should be directed to our support team using the contact details set out in Section 16 of this Policy.

SurgaPlay collects Personal Data from Account Holders and Platform visitors through several channels. The categories of data we collect and the circumstances in which they are collected are summarised below:

4.1 Registration Data

When you register an account on the Platform, we collect: full legal name; date of birth; residential address; email address; mobile telephone number; preferred currency (MYR); and username. This information is required to create and maintain your account and to verify that you meet the minimum age requirement of 21 years.

4.2 Identity Verification (KYC) Data

In accordance with our anti-money laundering (AML) obligations, we collect copies of government-issued identity documents (such as your Malaysian MyKad, passport, or driving licence), proof of residential address documents, and payment method verification documents. This data is used solely for identity verification and fraud prevention purposes.

4.3 Financial Data

We collect information about your deposits and withdrawals, including the payment methods used (for example, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, or cryptocurrency wallet addresses), transaction amounts in MYR or cryptocurrency equivalents, and transaction timestamps. We do not store full bank account numbers or card numbers on our servers — payment processing is handled by certified third-party payment processors.

4.4 Gaming and Betting Activity Data

We record all betting and gaming activity on your account, including games played, bet amounts, outcomes, bonus usage, and session duration. This data is used for account management, bonus administration, fraud detection, and responsible gambling monitoring purposes.

4.5 Technical and Usage Data

When you access the Platform, we automatically collect certain technical data including your IP address, device type and operating system, browser type and version, pages visited, time and duration of visits, referring URLs, and session identifiers. This data is collected via server logs and cookies as described in Section 7.

4.6 Communications Data

We retain records of communications between you and SurgaPlay's support team, including live chat transcripts, email correspondence, and any complaints or feedback submitted. These records are kept to ensure continuity of service and to comply with our regulatory record-keeping obligations.

SurgaPlay uses your Personal Data for the following purposes:

• Account Administration: To create, manage, and maintain your Account, including processing deposits, withdrawals, and bonus claims.
• Identity Verification: To verify your identity, age, and residential address as required by our KYC programme and AML obligations.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, multiple account abuse, money laundering, and other prohibited activities.
• Regulatory Compliance: To comply with applicable laws, regulations, and licensing requirements, including AML/CTF obligations, record-keeping requirements, and cooperation with law enforcement where legally required.
• Customer Support: To respond to your enquiries, resolve disputes, and provide ongoing support in Bahasa Melayu, Mandarin Chinese, or English.
• Responsible Gambling Monitoring: To monitor betting patterns, identify potential problem gambling behaviour, and apply or enforce any responsible gambling tools you have activated, including deposit limits, cooling-off periods, and self-exclusion.
• Platform Improvement: To analyse usage patterns, troubleshoot technical issues, and improve the performance and user experience of the Platform.
• Marketing Communications: Where you have given explicit consent, to send you promotional offers, bonus notifications, and product updates. You may withdraw this consent at any time.
• Legal Proceedings: To establish, exercise, or defend legal claims in the event of a dispute.

SurgaPlay processes your Personal Data on one or more of the following legal bases, consistent with applicable data protection legislation including the Malaysian PDPA:

• Contractual Necessity: Processing is necessary to perform the contract between you and SurgaPlay — specifically, to provide the gaming and betting services you have registered to use and to process your financial transactions.
• Legal Obligation: Processing is necessary for SurgaPlay to comply with legal obligations, including KYC/AML requirements, regulatory reporting, and cooperation with competent authorities.
• Legitimate Interests: Processing is necessary for the legitimate interests of SurgaPlay or a third party (such as fraud prevention, Platform security, and responsible gambling monitoring), provided that such interests are not overridden by your privacy rights.
• Consent: Where processing is based on consent (for example, for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

SurgaPlay uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you visit our site. The categories of cookies we use are as follows:

7.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be disabled. They include session authentication tokens, security cookies, and load-balancing cookies. No personal data beyond what is technically required for session management is stored in these cookies.

7.2 Performance and Analytics Cookies

These cookies collect aggregated, anonymised information about how players use the Platform — for example, which pages are visited most frequently and whether error messages are received. This information is used to improve Platform performance and reliability.

7.3 Functional Cookies

These cookies remember your preferences (such as language settings and notification preferences) to provide a more personalised experience when you return to the Platform.

7.4 Managing Cookies

You may configure your browser to refuse all cookies or to notify you when a cookie is being set. However, disabling strictly necessary cookies may impair the functionality of the Platform, including your ability to log in and place bets. Mobile browser settings for common devices used in Malaysia (including Android and iOS) provide options to manage cookie preferences within the browser settings menu.

SurgaPlay does not sell, rent, or trade your Personal Data to third parties for commercial purposes. We may share your data with third parties only in the following circumstances:

• Payment Processors: We share the minimum data necessary with our payment processing partners (including those facilitating Touch 'n Go eWallet, GrabPay, Boost, DuitNow, FPX, and bank transfers via Maybank, CIMB, Public Bank, and Hong Leong Bank) to process your deposits and withdrawals. These processors are contractually bound to handle your data securely and in accordance with applicable law.
• Game Providers: We share session identifiers and bet data with our licensed third-party game providers to enable game functionality and resolve disputes. Providers receive only the data technically necessary for game delivery.
• Identity Verification Services: We use regulated KYC service providers to assist with identity verification. These providers process your documents under strict confidentiality and data security obligations.
• Fraud Prevention Networks: We may share anonymised risk signals with industry fraud prevention networks to identify and prevent patterns of abuse across multiple platforms.
• Legal and Regulatory Authorities: We will disclose Personal Data to competent authorities, courts, or law enforcement agencies where we are legally required to do so, or where we reasonably believe disclosure is necessary to prevent or investigate illegal activity, protect the safety of any person, or enforce our Terms and Conditions.
• Corporate Transactions: In the event of a merger, acquisition, or restructuring of SurgaPlay's business, your data may be transferred to a successor entity, subject to that entity providing equivalent data protection commitments.

In all cases where data is shared with third-party processors, SurgaPlay enters into data processing agreements that require those processors to implement appropriate technical and organisational measures to protect your data.

SurgaPlay retains Personal Data only for as long as is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be linked to an identifiable individual.

SurgaPlay operates infrastructure and engages service providers that may be located in jurisdictions outside Malaysia. Where Personal Data is transferred to countries that do not provide a level of data protection equivalent to that in Malaysia, SurgaPlay implements appropriate safeguards, which may include:

• Standard contractual clauses approved by relevant data protection authorities;
• Binding corporate rules applicable to intra-group transfers;
• Reliance on recognised adequacy decisions or certifications applicable to the recipient jurisdiction.

All international transfers are made only to the extent necessary for the purposes described in this Policy and are subject to the security and confidentiality obligations described in Section 12.

As a data subject, you have the following rights with respect to your Personal Data held by SurgaPlay. To exercise any of these rights, please contact our support team as described in Section 16. We will respond to verified requests within 30 calendar days.

SurgaPlay implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers;
• Encryption at rest for sensitive data categories including KYC documents and financial records;
• Role-based access controls limiting employee access to Personal Data on a strict need-to-know basis;
• Multi-factor authentication requirements for all administrative access to systems containing Personal Data;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Intrusion detection and prevention systems monitoring network traffic in real time;
• Incident response procedures providing for timely notification to affected individuals and regulatory authorities in the event of a data breach where required by law.

While we take every reasonable precaution to secure your data, no internet-based system is entirely immune from risk. You are encouraged to use a strong, unique password for your SurgaPlay Account and to enable two-factor authentication where available.

The SurgaPlay Platform is strictly intended for adults aged 21 years and above. SurgaPlay does not knowingly collect Personal Data from individuals below the age of 21. Age verification is conducted as part of the KYC process for all Account Holders.

If SurgaPlay becomes aware that Personal Data has been collected from an individual below the age of 21, we will immediately suspend the relevant Account, delete or anonymise all associated Personal Data to the extent permitted by our legal obligations, and notify the applicable regulatory authorities where required.

If you believe that a minor has registered an Account on the Platform, please contact our support team immediately so that we can investigate and take appropriate action.

The SurgaPlay Platform does not contain links to third-party websites. In the event that any such links are introduced in the future, SurgaPlay will not be responsible for the privacy practices or content of those external sites. This Policy applies exclusively to the SurgaPlay Platform and the services we directly operate.

SurgaPlay reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Where material changes are made, we will notify Account Holders by email to their registered address or by a prominent notice on the Platform at least fourteen (14) days prior to the changes taking effect.

The "Last Updated" date at the top of this Policy will reflect the most recent revision. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the revised Policy. We recommend reviewing this Policy periodically to remain informed of how SurgaPlay protects your data.

If you have any questions, concerns, or complaints regarding this Privacy Policy or SurgaPlay's data handling practices, or if you wish to exercise your data subject rights, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the Platform. Identify your enquiry as a "Privacy / Data Protection" matter for priority routing. Average response time: 3–5 minutes.
• Email: [email protected] (plain text only — not a clickable link). Please use the subject line "Privacy Policy Enquiry" or "Data Subject Request" as applicable.
• Languages: Our support team can handle privacy enquiries in Bahasa Melayu, Mandarin Chinese, and English.

We will acknowledge your request within two (2) business days and provide a substantive response within thirty (30) calendar days. Where a request is complex or voluminous, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reason for it.