Privacy Policy

01 Introduction

surga77 ("surga77", "We", "Us", "Our") operates the online gaming and sports betting platform accessible at surga77.cam. We are committed to protecting the privacy and personal data of all individuals who interact with our platform, including registered players, visitors, and prospective members.

This Privacy Policy ("Policy") describes the categories of personal data that surga77 collects, the purposes for which that data is processed, the parties with whom it may be shared, the retention periods that apply, and the rights available to data subjects. This Policy is incorporated by reference into our Terms & Conditions and should be read in conjunction with them.

By registering an account with surga77, accessing the platform, or otherwise engaging with our services, you confirm that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue use of the surga77 platform immediately.

02 Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, directly or indirectly, including name, identification number, contact details, financial data, and online identifiers such as IP address.
• "Data Controller" — surga77, being the entity that determines the purposes and means of processing Personal Data collected through the platform.
• "Data Processor" — a third party that processes Personal Data on behalf of surga77 in accordance with documented instructions and applicable data protection law.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, transmission, disclosure, erasure, or destruction.
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.
• "KYC Data" — identity and address verification documents submitted by players as part of the Know Your Customer process, including identity cards, passports, utility bills, and selfie verification images.
• "Cookies" — small text files stored on a user's device by a web browser, used to retain session information, preferences, and analytics data.

03 Data We Collect

surga77 collects Personal Data in the following categories:

3.1 Registration & Account Data

• Full legal name as it appears on your identity document
• Date of birth (for age verification — you must be 21 or older)
• Email address and contact telephone number
• Residential address, including city and postcode
• Username and encrypted password
• Preferred currency (MYR) and language preference

3.2 Identity Verification (KYC) Data

• Scanned or photographed identity documents (Malaysian IC / MyKad, Driver's Licence, Passport)
• Proof of address documents (utility bills from TNB, Syabas, Unifi; or bank statements from Maybank, CIMB, Public Bank, Hong Leong)
• Selfie photographs taken alongside identity documents
• Payment method verification documentation where required

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method identifiers
• Payment method details (e.g., partial e-wallet identifiers for Touch 'n Go eWallet, GrabPay, Boost; bank account references for DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong)
• Bonus credit and wagering activity records
• Account balance history

3.4 Gaming & Behavioural Data

• Games played, bet amounts, win/loss records, and session durations
• Sports betting market selections, odds accepted, and in-play activity
• Responsible gambling tool activations (deposit limits, self-exclusion periods)
• Customer support interaction records

3.5 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Browser type, version, and operating system
• Device identifiers and screen resolution
• Session timestamps, pages visited, and clickstream data
• Cookie identifiers and local storage values

04 How We Collect Data

surga77 collects Personal Data through the following methods:

• Directly from you — when you register an account, complete identity verification, make deposits or withdrawal requests, contact our support team, or respond to surveys and promotions.
• Automatically — through cookies, server logs, and similar technologies as you navigate and interact with the surga77 platform. This includes data collected via analytics tools that help us understand platform usage and improve user experience.
• From payment processors — transaction confirmation data is received from payment service providers including DuitNow, FPX, and e-wallet operators in order to reconcile deposits and withdrawals.
• From identity verification services — where surga77 engages third-party KYC providers to assist in verifying identity documents, those providers may return verification status and related data.
• From fraud prevention services — surga77 may receive risk signals and device fingerprinting data from third-party fraud detection partners to safeguard the platform against financial crime.

05 Purposes of Data Processing

surga77 processes Personal Data for the following purposes:

06 Legal Basis for Processing

surga77 relies on one or more of the following legal bases when processing your Personal Data:

• Contractual necessity — processing is necessary to perform the contract between surga77 and the player, including account management, payment processing, and delivery of gaming services.
• Legal obligation — processing is required to comply with applicable laws and regulations, including anti-money laundering obligations, age verification requirements, and regulatory reporting.
• Legitimate interests — processing is necessary for the legitimate interests of surga77 or a third party, including fraud prevention, platform security, responsible gambling monitoring, and business analytics, where such interests are not overridden by the data subject's rights.
• Consent — for processing activities that are not strictly necessary for the performance of our contract or compliance with a legal obligation, surga77 will seek your express consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

07 Data Retention

surga77 retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law or regulation. The following general retention periods apply:

• Account and registration data — retained for the duration of the account relationship, and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping obligations.
• KYC documents — retained for a minimum of five (5) years from the date of submission or the date of account closure, whichever is later.
• Financial transaction records — retained for a minimum of five (5) years from the date of the transaction, or longer where required by applicable regulatory obligations.
• Customer support records — retained for three (3) years from the date of the interaction.
• Technical and device data — retained for up to twelve (12) months from the date of collection, except where extended retention is required for fraud investigation purposes.
• Marketing preferences and consent records — retained for the duration of the account relationship, updated upon each change of preference.

08 Data Sharing & Disclosure

surga77 does not sell or rent your Personal Data to any third party. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual protections:

8.1 Service Providers (Data Processors)

surga77 engages trusted third-party service providers to assist with platform operations, including identity verification providers, payment processing partners (including those operating DuitNow, FPX, Touch 'n Go eWallet, GrabPay, and Boost infrastructure), fraud detection services, cloud infrastructure providers, and customer support tools. All Data Processors are bound by written data processing agreements that restrict the use of your data to the specific services they provide on our behalf.

8.2 Regulatory & Law Enforcement Authorities

surga77 may be required to disclose Personal Data to regulatory bodies, financial intelligence units, or law enforcement agencies where required by applicable law, court order, or regulatory directive. Such disclosures are made only to the extent required and in accordance with our legal obligations.

8.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of surga77's business, Personal Data held by surga77 may be transferred to the acquiring or successor entity as part of the transaction. Players will be notified of any such transfer via their registered email address where required by applicable law.

8.4 Responsible Gambling Partners

Where a player activates a self-exclusion period, surga77 may share relevant account data with responsible gambling registries or helpline operators where required by our licensing obligations, to ensure the effectiveness of the exclusion.

09 International Data Transfers

surga77 operates with infrastructure and service providers that may be located outside Malaysia. Where Personal Data is transferred to countries or territories that do not provide an equivalent level of data protection, surga77 will implement appropriate safeguards such as standard contractual clauses, binding corporate rules, or other recognised transfer mechanisms to ensure that your data receives a standard of protection consistent with this Policy.

By using the surga77 platform, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Malaysia for the purposes described in this Policy, subject to the safeguards described above.

10 Cookies & Tracking Technologies

surga77 uses cookies and similar technologies — including local storage, session storage, and pixel tags — to deliver and improve platform functionality. The categories of cookies we use are as follows:

• Strictly Necessary Cookies — essential for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without impairing platform functionality.
• Functional Cookies — remember your preferences, such as language settings, currency display, and preferred game categories, to personalise your experience on return visits.
• Analytics Cookies — collect anonymised data about how players navigate the platform, including pages visited, session duration, and error events. This data helps surga77 improve platform performance and user experience.
• Security & Fraud Prevention Cookies — used to detect and prevent fraudulent activity, identify suspicious device behaviour, and protect against account takeover attempts.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect your ability to use some features of the surga77 platform. surga77 does not use advertising or retargeting cookies.

11 User Rights

Subject to applicable data protection law and any overriding legal obligations, you have the following rights in respect of your Personal Data held by surga77. To exercise any of these rights, please submit a written request to [email protected].

surga77 will respond to valid data rights requests within thirty (30) days of receipt. Where requests are complex or numerous, we may extend this period by a further sixty (60) days, notifying you of the extension and the reasons for it within the initial thirty-day window.

12 Children & Minors

surga77 is strictly an adult platform and is not intended for individuals under the age of 21. surga77 does not knowingly collect or process Personal Data from any person under the age of 21. If we become aware that Personal Data belonging to a person under 21 has been collected, we will take immediate steps to delete that data and close the associated account.

13 Security Measures

surga77 implements a multi-layered approach to data security, combining technical, organisational, and procedural safeguards to protect Personal Data against unauthorised access, loss, destruction, or alteration. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between the player's device and surga77 servers
• Encryption of sensitive data at rest, including identity documents and financial records
• Role-based access controls limiting employee access to Personal Data to those with a verified operational need
• Two-factor authentication (2FA) for player accounts and internal administrative systems
• Regular penetration testing and vulnerability assessments conducted by independent security specialists
• Incident response procedures to detect, report, and remediate data security incidents in a timely manner
• Staff training on data protection obligations and secure data handling practices

14 Third-Party Links

The surga77 platform may from time to time contain references to third-party services, including payment gateways and responsible gambling resources. surga77 is not responsible for the privacy practices or content of any third-party website or service. Players who access third-party services via links or integrations on the surga77 platform should review the privacy policies of those third parties independently.

15 Policy Amendments

surga77 reserves the right to update or revise this Privacy Policy at any time. Where changes are material, we will notify registered players via their registered email address at least seven (7) days before the revised Policy takes effect. The "Last Updated" date at the top of this page reflects the most recent revision.

Your continued use of the surga77 platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the platform and may request account closure in accordance with our Terms & Conditions.

16 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by surga77, please contact our support team. All data rights requests and privacy complaints should be submitted in writing.