Privacy Policy Surga777 – Your Data Protection

This Privacy Policy is issued by Surga777 ("we", "platform", or "Surga777") and applies to all users who access or use our online casino platform at surga777.my and all related services.

We understand that your personal data is a trust we take seriously. Every decision we make regarding data handling always prioritizes your interests and privacy as a Surga777 member. This Privacy Policy has been drafted in accordance with Personal Data Protection Act 2010 (PDPA) Malaysia and the highest international standards in data protection.

By registering and using the Surga777 platform, you acknowledge that you have read, understood, and agreed to the terms set out in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the platform and contact our support team to close your account.

Surga777 only collects data that is genuinely necessary to provide our services safely and efficiently. Below are the categories of data we collect:

Data You Provide Directly:

• Identity information: Full name, national identification number (MyKad) or passport, date of birth, gender and nationality — required for identity verification (KYC) and legal compliance.
• Contact information: Email address, mobile number, and current residential address — used for account communications and transaction verification.
• Financial information: Bank account number, bank name, e-wallet account number (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow) — used solely to process deposits and withdrawals in MYR.
• Verification documents: MyKad or passport copy, bank statements, and proof of address — collected as part of the KYC process required by law.

Automatically Collected Data:

• Technical data: IP address, browser type, operating system, screen resolution, and device ID — used for account security and fraud prevention.
• Gaming data: Betting history, wins and losses, session duration, favourite games, and usage patterns — used to deliver a better experience and to monitor responsible gaming.
• Location data: General geographic location based on IP address — used to ensure jurisdictional compliance and detect suspicious login attempts from unusual locations.
• Cookies data: Site preferences, session tokens and analytics data — see Section 6 for more details.

Surga777 uses your personal data only for legitimate and transparent purposes. We will not use your data for any other purpose without your prior consent. Below are the primary purposes for which data is used:

• Account management: Creating, verifying, managing and securing your Surga777 account, including processing logins and two-factor authentication.
• Financial transaction processing: Processes deposits via FPX (Maybank2u, CIMB Clicks, Public Bank), Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and DuitNow, as well as withdrawals to your bank account in MYR.
• Legal compliance and KYC: Fulfilling legal compliance obligations including KYC (Know Your Customer), AML (Anti-Money Laundering) procedures, and reporting requirements to the relevant authorities.
• Security and fraud prevention: Detecting, preventing and investigating fraudulent activity, money laundering or any illegal activity involving your account.
• Customer support: Responding to your enquiries, complaints and support requests via live chat, email or other available communication channels.
• Direct marketing (with consent): Sending you information about Surga777's promotions, bonuses and exclusive offers where you have given consent to receive marketing communications. You may withdraw this consent at any time.
• Service improvement: Analysing aggregated, anonymised usage patterns to improve the user experience, platform performance, and game offerings.
• Responsible gambling monitoring: Detecting gaming patterns that may indicate problem gambling and reaching out to members who may need assistance or support.

In accordance with Malaysia's PDPA, Surga777 processes your personal data on valid legal grounds. Below are the bases we rely on for each category of processing:

• Contract performance: Processing required to fulfil the agreement between you and Surga777, including account management and financial transaction processing in MYR.
• Legal obligations: Processing required under Malaysian law, including KYC, AML, and reporting obligations to the relevant authorities.
• Legitimate interests: Processing carried out for security purposes, fraud prevention, and service improvement, which falls within Surga777's legitimate interests and does not compromise your fundamental rights.
• Consent: For direct marketing and promotional communications, we require your explicit consent. You may withdraw this consent at any time without affecting the core services you receive.

Surga777 does not sell, rent, or trade your personal data. However, in certain limited circumstances, we may share your data with the following parties:

• Payment service providers: Information required to process MYR transactions is shared with approved payment gateway providers (Touch 'n Go, GrabPay, DuitNow, FPX and others). These providers are bound by strict confidentiality agreements.
• Game software providers: Only the minimum session data required is shared with authorised gaming platform providers, strictly for technical and compliance purposes.
• KYC and AML Services: Identity information is shared with authorised third-party identity verification service providers for legal compliance purposes.
• Legal authority: Surga777 will disclose data when required by court order, directive from a competent authority in Malaysia, or other applicable legal requirements.
• Business transfer: In the event that Surga777 is involved in a merger, acquisition or asset transfer, user data may be transferred as part of that transaction. You will be notified in advance before your data is transferred and will be subject to a different privacy policy.

All data sharing is governed by strict data protection agreements, and third-party providers are only permitted to use your data for the specified purposes.

Surga777 uses cookies and similar tracking technologies to enhance the user experience and ensure platform security. The following are the types of cookies we use:

• Essential cookies (cannot be disabled): These cookies are required for core platform functions such as login authentication, session security and language preferences. The platform cannot function properly without them.
• Performance cookies: Collecting information on how you use the Surga777 platform — most frequently visited pages, errors encountered and response times. All information is anonymised and used to improve platform performance.
• Functional cookies: Saving your preferences such as game selections, interface settings and communication preferences so you don't have to reconfigure them each time you log in.
• Analytical cookies: We use analytics tools to understand aggregate usage patterns for service improvement purposes. This data is not used to identify you personally.

You can manage your cookie settings through your browser settings. However, disabling certain cookies may affect the functionality of the Surga777 platform. For more information on managing cookies, please refer to your browser's help guide.

Surga777 retains your personal data only for as long as necessary for the stated purposes or as required by law. The following is our data retention policy:

• Active account data: Retained for as long as your account remains active or for as long as you continue using Surga777's services.
• Data after account closure: After account closure, your personal data will be retained for 7 years to meet Malaysian legal requirements, particularly those relating to financial compliance and anti-money laundering (AMLA 2001).
• Financial transaction records: Records of all transactions in MYR are retained for a minimum of 7 years in line with Malaysia's financial legislation.
• Marketing data: If you withdraw consent for marketing communications, the relevant data will be deleted or anonymised within 30 days of the withdrawal.

Once the retention period has ended, your data will be securely deleted or anonymised so that it can no longer be linked to you as an individual.

Under Malaysia's PDPA and the privacy principles we uphold, you have the following rights regarding your personal data at Surga777:

To exercise any of the above rights, contact our Data Protection Officer at privacy@surga777.my. We will respond within 30 business days of receiving your request. Identity verification may be required before your request is processed.

Surga777 continuously invests in the latest security infrastructure to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our key security measures include:

• Data encryption in transit: All communications between your browser and Surga777's servers are secured with TLS 1.3 and 256-bit SSL encryption — the highest security standard available.
• Data encryption at rest: Sensitive data, including financial information and identification numbers, is stored in encrypted format using AES-256.
• Two-factor authentication (2FA): We offer and encourage the use of 2FA on all accounts as an added layer of protection.
• 24/7 security monitoring: Our security team continuously monitors systems to detect and respond to any security threats promptly.
• Regular penetration testing: The Surga777 platform undergoes regular security testing by independent cybersecurity firms to identify and patch vulnerabilities before they can be exploited.
• Internal access controls: Access to Surga777 members' personal data within the company is restricted to employees who genuinely need it, based on the principle of least privilege.

The Surga777 platform may contain links or references to third-party websites in certain contexts. Please take note of the following:

• Surga777 is not responsible for the privacy practices or content of any third-party websites you may access.
• When you leave the Surga777 platform and visit other websites, those websites' own privacy policies will apply, not this Surga777 Privacy Policy.
• We recommend reading the privacy policy of every website you visit, especially before providing any personal information.

Surga777 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data handling practices, legal requirements or technological developments. We are committed to notifying you of any significant changes:

• Notifications of significant changes will be sent to your registered email address at least 14 days before the changes take effect.
• A notice will be displayed on the Surga777 platform's main page for a reasonable period after any changes are made.
• The "Updated" date at the top of this page will always reflect the latest date this policy was reviewed.
• Continued use of the Surga777 platform after changes take effect will be considered acceptance of the amended policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how Surga777 handles your personal data, please reach out to us through the following channels:

You also have the right to lodge a complaint with Personal Data Protection Department (PDPD) Malaysia if you are not satisfied with how Surga777 has handled your personal data after contacting us first.