Privacy Policy surga77 — Your Data Is Safe, Your Privacy Is Protected

Surga77 is an online casino and Sports Betting platform operating exclusively for the Malaysian market. As a responsible platform, we recognise that member trust is our most valuable asset – and trust cannot be built without transparency in how personal data is handled.

This Privacy Policy is written in plain language that is easy to understand – not filled with confusing legal jargon. We want every member surga77 to truly understand what happens with their data – not just tick a consent box without reading it.

Surga77 complies with Malaysia's Personal Data Protection Act 2010 (PDPA), which governs how organisations operating in Malaysia collect, process, and use personal data. We also apply internationally recognised best practices in data protection across all our operations.

Surga77 only collects data that is strictly necessary to provide the services you request. We do not collect excessive data or data unrelated to the purpose of our services.

Data you provide directly:

Automatically collected data:

The personal data we collect is used exclusively for legitimate purposes directly related to surga77's services. We will not use your data for any other purpose without first obtaining your consent.

• Account Management: Creating, verifying, and managing your surga77 account, including the required KYC (Know Your Customer) process.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX, as well as your withdrawal of winnings.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, or unauthorised use of your account.
• Legal Compliance: To comply with all legal and regulatory requirements applicable to surga77's operations, including Malaysia's PDPA.
• Responsible Gaming: Monitoring gameplay activity patterns to identify signs of problem gambling and offer appropriate support.
• Service Communications: Sending important account-related notifications, including transaction confirmations, security updates, and policy changes.
• Marketing (with consent): Sending promotional information, bonuses, and special offers — only if you have consented to receive them.
• Platform Improvements: Analysing usage patterns in aggregate (without identifying individuals) to improve the surga77 user experience.

The security of your personal data is our most important technical priority surga77. We continually invest in the latest security infrastructure to ensure your data remains protected against cyber threats.

• 256-bit SSL Encryption: All data transmitted between your browser and surga77's servers is encrypted using TLS 1.3 — the same security protocol used by Malaysia's major banks such as Maybank and CIMB.
• Industry-Leading Data Encryption: Sensitive data such as MyKad numbers, payment card details, and passwords are stored in encrypted form using AES-256 encryption — unreadable even by surga77's own technical staff.
• Strict Access Controls: Only specifically authorised staff may access members' personal data, and every access is recorded in an audit log that cannot be deleted.
• Secure Servers: Data is stored in data centres equipped with physical access controls, 24/7 CCTV, and fire suppression systems.
• Regular Security Testing: surga77 conducts regular penetration testing by independent third parties to identify and address any security vulnerabilities.

surga77 does not sell your personal data to anyone — this is a principle that will never change. However, there are limited situations where we need to share data with certain parties to ensure our services function properly.

• Payment Service Providers: Transaction details required to process your payments are shared with providers such as Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, and FPX banks. These parties are bound by strict data protection agreements.
• Legal Compliance: surga77 will disclose data to Malaysian authorities if ordered by a competent court, police investigation, or other valid legal requirement.
• Fraud Prevention: In cases of suspected fraud, limited information may be shared with security partners to protect the platform ecosystem.
• Business Transfer: Should surga77 undergo any change of ownership or business merger, members will be notified in advance and data will be transferred under terms that offer equal or greater protection.

In all of the sharing scenarios above, surga77 ensures that all receiving parties comply with data protection standards equivalent to or exceeding our own.

Surga77 uses cookies and similar tracking technologies to enhance your experience on our platform. Below is an explanation of the types of cookies we use.

• Essential Cookies: Required for core platform functions such as login, session management, and security. Cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting information on how you use surga77 (e.g. pages visited, time spent) to help us improve the platform. All data is collected anonymously.
• Functional Cookies: Remembering your preferences such as language, theme, and display settings to deliver a more personalised experience.
• Analytics Cookies: Used to understand overall platform usage patterns without identifying individuals. This helps surga77 make better-informed development decisions.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a member surga77 have the following rights regarding your personal data. All requests will be processed within 14 business days.

To exercise any of the rights above, contact surga77 via email at support@surga77.ws with the subject line "Personal Data Rights Request". Please include a copy of your identification document for verification purposes.

Surga77 is a platform exclusively for individuals aged 21 years and above. We do not intentionally collect or process personal data from individuals under the age of 21.

• Should we discover that personal data of an individual under the age of 21 has been collected without our knowledge, that data will be deleted immediately and the account in question will be closed.
• Parents or guardians who discover that their child has registered on surga77 are urged to contact us immediately via email or Live Chat.
• Surga77 applies age verification measures during the registration process to minimise the risk of underage sign-ups.

Your personal data is stored primarily on servers located in the Asia Pacific region. In specific cases where data processing must be carried out at other locations (for example, for data backup or disaster recovery purposes), surga77 ensures:

• All international data transfers are carried out in accordance with appropriate and recognised legal mechanisms.
• The recipient country or region maintains a level of data protection equivalent to or exceeding Malaysia's standards.
• Binding and detailed data transfer agreements are signed with all parties involved before any transfer takes place.
• You will be notified of such a transfer if it involves a material change to how your data is managed.

Surga77 does not retain your personal data indefinitely. We set different retention periods based on the type of data and applicable legal requirements.

Once the retention period expires, data will be permanently deleted or anonymised so that it can no longer be linked back to your identity.

Surga77 reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or improvements to the way we protect your data.

• Significant changes will be communicated to all members via their registered email and in-platform notifications at least 14 days before taking effect.
• The date of the most recent update will always be displayed at the top of this page.
• Continued use of the surga77 platform after any amendments take effect constitutes your acceptance of the updated Privacy Policy.
• If you do not agree with any amendment, you have the right to close your account and request data deletion in accordance with Section 7 above.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how surga77 manage your personal data, we strongly encourage you to contact us directly.

• Privacy Email: support@surga77.ws (Subject: "Data Privacy Enquiry")
• Live Chat: Available 24/7 on the surga77 platform
• Response Language: Bahasa Malaysia and English
• Response Time: Within 2 hours (live chat) or 24 hours (email)

If you are not satisfied with the response provided by surga77, you have the right to lodge a complaint with Personal Data Protection Department (JPDP) Malaysia that enforces PDPA 2010.