Surga33 Privacy Policy – Personal Data Protection for Malaysian Players

Introduction

Surga33 ("we", "platform", "Company") takes the privacy and security of every member's personal information seriously. This Privacy Policy is provided to explain clearly and transparently how we collect, process, store, and protect your personal data when you use the surga33.click platform and all related services.

This Policy is prepared in accordance with Personal Data Protection Act 2010 (PDPA) Malaysia and the highest international data protection standards. By registering for or using surga33's services, you agree to the terms set out in this Privacy Policy.

We are committed to never selling, renting, or transferring your personal data to third parties for marketing purposes without your explicit consent. Your privacy is not merely a legal obligation to us — it is a trust you place in surga33, and one we take to heart.

Personal Information We Collect

Surga33 only collects information necessary to provide a secure, efficient service that meets legal requirements. The information we collect falls into several main categories:

How We Collect Your Data

Surga33 collects information through a variety of lawful and transparent means:

• Directly From You: When registering an account, completing your profile, making deposits or withdrawals, contacting our support team, or filling in a survey.
• Automatically: When you browse the Surga33 platform, our systems automatically collect technical data such as your IP address, device type, and in-platform activity through cookies and similar tracking technologies.
• From Third Parties: In certain cases, we may receive information from identity verification (KYC) service providers, payment providers such as Touch 'n Go eWallet, GrabPay, or FPX, and fraud prevention agencies.
• From Marketing Partners: If you registered via a referral link or promotional campaign, we may receive basic information about the referral source.

All data collection methods are lawful, and we ensure every data source is legitimate and authorised.

How Your Personal Data Is Used

Surga33 uses your personal data only for the following lawful and necessary purposes:

• Account Management: Opening, verifying, and maintaining your member account on the Surga33 platform.
• Service Provision: Processing deposits and withdrawals, enabling access to live casino games, Sports Betting (EPL, Malaysia Super League, badminton), e-sports, lottery, and all other services on Surga33.
• Identity Verification (KYC): Meeting legal compliance requirements, including anti-money laundering (AML) obligations and age verification.
• Security & Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, account misuse, or any suspicious behaviour.
• Service Communications: Sending important notifications about your account, transactions, policy changes, or security matters.
• Customer Support: Responding to enquiries, resolving complaints, and providing technical support.
• Platform Enhancement: Analysing usage patterns to improve the user experience, fix technical issues, and develop new features that benefit Malaysian members.
• Marketing (with consent): Sending information about surga33 bonuses, promotions, and exclusive offers that may interest you — only if you have consented to receive marketing communications.
• Legal Compliance: To comply with legal obligations, court orders, or directives from relevant regulatory authorities.

Legal Basis for Data Processing

In accordance with Malaysia's PDPA and international data protection standards, surga33 processes your personal data on the following legal bases:

• Agreement: Processing required to fulfil the contract between you and Surga33, including providing betting services and handling financial transactions.
• Legitimate Interests: Processing for platform security, fraud prevention, usage pattern analysis, and service improvement purposes.
• Legal Obligation: Processing required to fulfil Malaysian legal obligations, including the PDPA 2010, the Anti-Money Laundering Act, and related regulations.
• Consent: For marketing communications and any data processing that requires your explicit consent.

Data Sharing & Disclosure

Surga33 does not sell your personal data to any third party. However, under the following limited circumstances, we may share your data with carefully selected parties:

• Payment Service Providers: Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX providers (Maybank2u, CIMB Clicks) to process your financial transactions.
• Game Providers: Companies such as Evolution Gaming, Pragmatic Play, SA Gaming, and Playtech that provide live casino games and slots on the Surga33 platform – only data necessary for game delivery is shared.
• KYC Verification Services: Third-party identity verification service providers that assist us in meeting our legal compliance requirements.
• Anti-Fraud Agencies: The body that helps us detect and prevent fraudulent activity to protect all members.
• Legal Authorities: When required by Malaysian law, court order, or directive from a law enforcement agency.
• Business Transfers: In the event of a merger, acquisition, or sale of company assets, your data may be transferred to the new entity with appropriate prior notice.

All third parties receiving data from Surga33 are bound by strict data protection agreements and are permitted to use that data solely for the specified purpose.

Data Security

Surga33 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL Encryption: All data transmitted between your device and surga33's servers is encrypted using the latest SSL/TLS protocols.
• Data-at-Rest Encryption: Sensitive data stored in our databases is encrypted using AES-256 standards.
• Strict Access Controls: Access to members' personal data is restricted to employees who need it to carry out their duties. All access is logged and monitored.
• Two-Factor Authentication (2FA): Surga33's internal systems use 2FA for all administrative access.
• Regular Security Audits: We conduct regular penetration testing and security audits by independent experts to identify and address vulnerabilities.
• 24/7 Monitoring: Our systems are continuously monitored to detect any suspicious activity or intrusion attempts.
• Incident Response Plan: surga33 has clear procedures in place to handle any data security breaches, including notifying affected members within the stipulated timeframe.

Data Retention Period

Surga33 retains your personal data only for as long as necessary for the purposes outlined in this Policy or as required under Malaysian law:

• Active Account Data: For as long as your account remains active and for a reasonable period after closure to fulfil legal obligations.
• Financial Transaction Records: Minimum 7 years after the transaction date, in accordance with Malaysia's Tax Act and AMLA requirements.
• KYC Data: Minimum 5 years after the termination of the business relationship, in line with AML compliance requirements.
• Security Logs: 12 months for security investigation and audit purposes.
• Marketing Data (with consent): Until you withdraw consent or request deletion.
• Complaints & Disputes: Until final resolution and the expiry of any applicable appeal period.

Once the retention period expires, your data will be securely deleted or anonymised so it can no longer be linked to you.

Your Rights as a Data Subject

As a data subject under Malaysia's PDPA, you have the following rights regarding your personal data held by Surga33:

To exercise any of the rights above, please contact Surga33's data protection team by email at privacy@surga33.click. We will process your request within 30 days of receipt.

Cookie Policy

Surga33 uses cookies and similar tracking technologies to enhance the user experience, maintain platform security, and analyse usage patterns. We use several types of cookies:

• Essential Cookies: Required for core platform functions such as login, session management, and security. These cookies cannot be disabled without affecting platform functionality.
• Preference Cookies: Stores your preferences such as language, time zone, and display settings for a more personalised experience.
• Analytics Cookies: Helps us understand how members use the platform so we can improve performance and user experience. This data is collected in aggregate and does not identify you individually.
• Security Cookies: Used to detect suspicious activity and protect your account from unauthorised access.

You can manage your cookie preferences through your browser settings. However, disabling essential cookies may affect the functionality of the surga33 platform. The cookies we use do not contain sensitive personal information and do not share data with external advertisers.

Cross-Border Data Transfers

In the course of providing our services, your personal data may be transferred to and processed outside Malaysia — specifically on the servers and infrastructure of our game providers such as Evolution Gaming and Pragmatic Play, which operate across multiple countries.

Each such cross-border data transfer is carried out with adequate safeguards in place, including:

• Data processing agreements compliant with international standards
• Assessment of legal compliance in the recipient country
• Data encryption in transit
• Restricting data processing to authorised purposes only

Surga33 ensures that all international data transfers comply with Malaysia's PDPA requirements and provide a level of protection equivalent to what we offer within Malaysia.

Children's Privacy

Surga33 is a platform restricted to individuals aged 18 years and above. We do not knowingly collect any personal information from children under the age of 18.

If we become aware that a child's personal data has been inadvertently collected, we will take immediate steps to delete that data and close the associated account. Parents or guardians who suspect their child has registered or attempted to register on surga33 should contact us immediately at privacy@surga33.click.

Privacy Policy Amendments

Surga33 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or added service features.

When significant changes are made, we will notify you via:

• In-platform notifications when you log in
• Notification email to your registered address
• Update the review date at the top of this page

Minor amendments that do not affect your fundamental rights may be updated without specific notice. We encourage you to review this page periodically. The latest version of the Privacy Policy takes effect from the date stated on 1 January 2026.

Contact Our Data Protection Officer

If you have any questions, concerns, or wish to exercise your data protection rights, please contact Surga33's Data Protection Officer (DPO):

• Dedicated Privacy Email: privacy@surga33.click
• General Support Email: support@surga33.click
• Live Chat: Available 24/7 on the platform

If you are dissatisfied with how we handle your personal data or our response to your request, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia under the Ministry of Communications and Digital.

This Privacy Policy is the latest version and takes effect from 1 January 2026. Thank you for trusting Surga33 with your personal information — a trust we take seriously and uphold with the utmost responsibility.