Privacy Policy

This Privacy Policy ("Policy") describes how Surga11 ("surga11", "we", "us", "our") — the operator of the online casino and sports betting platform accessible at surga11.cam ("the Platform") — collects, uses, stores, discloses, and otherwise processes personal data relating to our users ("User", "Player", "you") in connection with your use of the Platform and its associated services.

Surga11 is committed to handling your personal data responsibly and in accordance with applicable data protection laws and principles. We recognise that players across Malaysia — from Kuala Lumpur and Penang to Johor Bahru, Petaling Jaya, and Shah Alam — entrust us with sensitive personal and financial information, and we take that responsibility seriously.

By registering an account on the Platform, completing the KYC verification process, making a deposit, placing a wager, or otherwise using any feature of surga11, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data in the manner described herein.

The following terms carry the meanings set out below for the purposes of this Privacy Policy:

Surga11 collects only the personal data that is necessary and proportionate to delivering our services and meeting our legal and regulatory obligations. The categories of personal data we collect are set out below:

3.1 Registration Data

When you create an account on the Platform, we collect:

• Full legal name;
• Date of birth (to verify the 21+ age requirement);
• Residential address (including city, state, and postcode);
• Email address;
• Mobile phone number;
• Username and encrypted password.

3.2 Identity Verification (KYC) Data

To comply with applicable anti-money laundering (AML) and Know Your Customer obligations, and to verify the 21+ age requirement, we collect copies of:

• Government-issued photo identification (e.g., Malaysian MyKad, passport);
• Proof of residential address (e.g., utility bill, bank statement not older than 3 months);
• Where applicable, source of funds documentation.

3.3 Financial Transaction Data

When you make a deposit or withdrawal via supported payment methods — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, or cryptocurrency — we collect:

• Transaction reference numbers and amounts;
• Partial payment account identifiers (e.g., last four digits of a bank account number or e-wallet identifier);
• Transaction timestamps and processing status.

3.4 Platform Usage Data

As you use the Platform, we automatically collect certain technical data including:

• IP address and approximate geolocation;
• Device type, operating system, and browser version;
• Pages visited, session duration, and navigation patterns;
• Game activity, bet history, deposit and withdrawal history;
• Customer support interaction logs.

3.5 Communication Data

When you contact our support team via live chat or email, we retain records of those communications, including the content of messages and any supporting documentation you provide.

Surga11 collects personal data through the following channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit, contact support, respond to surveys, or participate in promotions;
• Automatically through the Platform: Via cookies, web beacons, server logs, and similar tracking technologies when you access and use the Platform (see Section 8 — Cookies & Tracking);
• From payment providers: Transaction confirmation data received from payment processors including FPX, DuitNow, and e-wallet providers when you deposit or withdraw funds;
• From identity verification services: Where surga11 uses a third-party KYC service provider to assist with document verification, that provider may return verification results and risk scores to us;
• From publicly available sources: Including publicly accessible databases used for fraud prevention, sanctions screening, or address verification purposes.

Surga11 processes your personal data for the following specific and documented purposes:

Surga11 processes personal data only where a valid legal basis exists for doing so. The primary legal bases we rely upon are as follows:

• Contractual Necessity: Processing necessary for the performance of the contract between you and surga11 — including account management, processing of deposits and withdrawals, and delivery of gaming services;
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including AML laws, KYC requirements, and age verification mandates;
• Legitimate Interests: Processing necessary for the purposes of surga11's legitimate interests — including Platform security, fraud detection, responsible gambling monitoring, and improving the user experience — provided that such processing does not override your fundamental privacy rights;
• Consent: Where we rely on your consent as a legal basis (e.g., for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing that took place before withdrawal.

Surga11 does not sell, rent, or trade your personal data to third parties. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment Service Providers: Including FPX operators, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency network providers — solely for the purpose of processing financial transactions you initiate;
• Identity Verification Providers: Third-party KYC and AML screening services contracted to assist with document verification and sanctions screening. All such providers are bound by strict data processing agreements;
• Game Content Providers: Game studios and live dealer operators that provide content to the Platform receive only the anonymised session and technical data necessary to deliver their services. They do not receive personally identifiable information;
• IT and Hosting Providers: Cloud infrastructure and cybersecurity service providers responsible for hosting and securing the Platform. All providers operate under binding data protection agreements;
• Regulatory and Law Enforcement Authorities: Where required or permitted by applicable law, we may disclose personal data to relevant authorities in response to lawful requests, court orders, or regulatory requirements;
• Fraud Prevention Services: Third-party fraud detection and prevention services used to protect surga11 and its players from financial crime.

Surga11 uses cookies and similar tracking technologies to operate the Platform effectively, personalise your experience, and gather analytics data that helps us improve our services. The types of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function correctly — including session authentication cookies that keep you logged in during your visit. These cannot be disabled without impairing Platform functionality;
• Functional Cookies: Used to remember your preferences — such as language settings, display preferences, and previously entered information — to improve the consistency of your experience across sessions;
• Analytical Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform — including pages visited, session duration, and navigation paths — to help us identify areas for improvement;
• Security Cookies: Used to detect and prevent fraudulent activity, including suspicious login attempts and unusual transaction patterns.

You may control and delete cookies through your browser settings. Please note that disabling strictly necessary cookies may prevent certain Platform features from functioning correctly. Analytical and functional cookies can typically be disabled without affecting core Platform access.

Surga11 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, and in accordance with applicable legal, regulatory, and operational requirements. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised. Where data cannot be deleted immediately due to technical constraints, it will be placed in a restricted state pending deletion.

Surga11 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, disclosure, or alteration. Our security framework includes:

• Encryption: All data in transit is protected by 256-bit SSL/TLS encryption. Sensitive data at rest (including KYC documents and financial records) is encrypted using AES-256 standards;
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All surga11 personnel with access to personal data are bound by confidentiality obligations and receive regular data protection training;
• Two-Factor Authentication (2FA): Available for all player accounts and mandatory for all surga11 staff accessing back-end systems containing personal data;
• Regular Security Audits: Surga11 conducts regular penetration testing and third-party security audits to identify and remediate vulnerabilities;
• Incident Response: We maintain a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights, we will notify affected users promptly and take all necessary remediation steps.

While surga11 takes all reasonable measures to protect your personal data, no method of internet transmission or electronic storage is 100% secure. You also play a role in protecting your account — please use a strong, unique password and enable 2FA to help keep your surga11 account secure.

You have the following rights with respect to the personal data that surga11 holds about you. These rights may be subject to certain limitations under applicable law, particularly where processing is required for legal compliance or fraud prevention purposes.

To exercise any of the rights listed above, please contact surga11 via live chat or by emailing [email protected]. We will acknowledge your request within 5 business days and respond fully within 30 calendar days. Where requests are complex or numerous, we may extend this period by a further 30 days, in which case we will notify you accordingly.

The surga11 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21.

Surga11 employs a mandatory age verification process as part of account registration and KYC. Where we have reasonable grounds to believe that an account is being operated by a person under 21 years of age:

• The account will be immediately suspended pending age verification;
• Any deposits held in the account will be returned to the original deposit source;
• Any winnings generated from bets placed while the account holder was under 21 will be voided;
• Personal data collected in connection with the underage account will be deleted promptly following the resolution of any outstanding compliance obligations.

The Platform may contain references to third-party services — including payment processors such as Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong — solely for the purpose of facilitating transactions.

When you interact with a third-party payment system, that interaction is governed by the privacy policy and terms of service of the relevant third party, not by this Privacy Policy. Surga11 has no control over and accepts no responsibility for the privacy practices of third-party services, and we encourage you to review their respective policies before submitting personal data directly to those services.

Surga11 reserves the right to update, modify, or replace this Privacy Policy at any time. All changes will be published on this page with an updated "Last Updated" date. Where changes are material — for example, where we introduce a new category of data processing or a new category of third-party data sharing — we will notify registered users by email or via a prominent notice on the Platform.

Your continued use of the Platform following publication of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to any changes, you should cease using the Platform and request account closure in accordance with the procedure set out in our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy, or if you wish to exercise any of your data subject rights, please contact surga11 through the following channels:

• Live Chat: Available 24/7 directly from your surga11 account dashboard. Our team handles data subject requests and privacy enquiries with a target response time of under 2 minutes for initial acknowledgement.
• Email: [email protected] — for privacy-specific enquiries, please include "Privacy Request" in the subject line. We aim to respond within 5 business days.