Privacy Policy Surga898 – Personal Data Protection for Malaysian Players

Surga898 collects your personal data in several ways – directly when you register and use the platform, automatically through tracking technologies as you browse our website, and in certain cases from legitimate third-party sources. We only collect data that is necessary to provide the services you request.

Below are the categories of data we collect, along with their purposes and legal basis:

The personal data we collect is used solely for purposes related to providing Surga898 services to you as a Malaysian player. We do not use your data for any other purpose without your explicit consent.

• Account Management – To create, verify, and manage your Surga898 account, including the KYC and identity verification processes required by law.
• Transaction Processing – To process MYR deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX, as well as to securely and accurately process winnings withdrawals to your account.
• Provision of Betting Services – To allow you to place bets on Malaysia Super League football, EPL, live casino, slots, virtual sports, and all other Surga898 products.
• Customer Support – To effectively resolve enquiries, complaints, and technical issues that you raise via Live Chat, email, or WhatsApp.
• Security & Fraud Prevention – To detect, investigate, and prevent fraudulent activity, money laundering, system abuse, and other unlawful activities that may involve your account or our platform.
• Responsible Gaming – To monitor your betting patterns in order to identify early signs of problem gambling and provide appropriate assistance when needed, in line with our commitment to player well-being.
• Platform Enhancements – To analyze aggregated (non-identifiable) usage data in order to improve the performance, navigation, and overall experience of the Surga898 platform.
• Marketing Communications – To send you information about Surga898 promotions, bonuses, and new offers, but only where you have given consent to receive such communications. You may withdraw this consent at any time.
• Legal Compliance – To fulfil applicable legal and regulatory obligations, including maintaining records required under anti-money laundering (AML) laws and know-your-customer (KYC) requirements.

Surga898 will not use your data for any purpose beyond those stated above without notifying you in advance and obtaining your consent where required. If you receive any communication from Surga898 that seems inappropriate, please inform our support team immediately.

Surga898 does not sell your personal data to any third party. However, in the course of operating our platform, there are limited situations where we need to share your personal data with certain parties. We ensure that all data sharing is lawful, necessary, and protected by strict confidentiality agreements.

• Payment Processing Providers – Required transaction data is shared with payment processors that handle deposits and withdrawals via Touch 'n Go, GrabPay, DuitNow, Maybank2u, CIMB Clicks, and FPX. These providers are held to strict PCI-DSS security standards.
• Game Software Providers – Game session data required for operations is shared with our Live Casino, slots, and virtual sports platform providers. This data is used solely for technical purposes and is not used for any independent marketing purposes by these parties.
• Identity Verification Services (KYC) – For mandatory KYC verification purposes, certain identity data may be shared with authorised third-party identity verification service providers that comply with the highest security standards.
• Law Enforcement Authorities – Surga898 will disclose personal data to law enforcement or regulatory authorities where required to do so by valid law, court order, or official directive from a relevant authority.
• Platform Analytics Providers – Non-identifiable usage data (aggregated and anonymized) may be shared with analytics providers to help us understand usage patterns and improve the platform. This data contains no information that can personally identify you.

Protecting the personal data of Malaysian players is an absolute priority for Surga898. We continuously invest in the latest security technologies and procedures to ensure your data remains safe at all times.

• Data Encryption in Transit – All communications between your browser and Surga898's servers are secured with TLS 1.3 protocol using AES-256 encryption. This means your data cannot be read or intercepted in transit, even if a third party attempts to do so.
• Data Encryption at Rest – Sensitive data such as financial information and identification numbers are stored in encrypted databases. Player passwords are never stored in plain text – we use bcrypt hashing with a unique salt for every account.
• Role-Based Access Control – Access to player data among Surga898 staff is restricted to those who require it to carry out their duties, in accordance with the least privilege principle.
• Continuous Threat Monitoring – Our SIEM (Security Information and Event Management) system monitors all platform activity 24 hours a day, 365 days a year, detecting anomalies, intrusion attempts, and suspicious activity in real time.
• Regular Security Audits – Surga898 conducts regular penetration testing and independent security audits to identify and address any vulnerabilities before they can be exploited.
• Staff Training – All Surga898 staff who handle player data receive regular data protection training and are bound by strict confidentiality agreements.

While we take all reasonable precautions, no security system can guarantee 100% protection at all times. In the event of a material data breach involving your personal data, we will notify you within the timeframe required by applicable law and take appropriate remedial action.

Surga898 uses cookies and similar tracking technologies to enhance your experience on our platform, ensure proper functionality, and understand how Malaysian players use our site. The following are the types of cookies we use:

You can manage cookies through your web browser settings. Some browsers allow you to block or delete cookies automatically. However, blocking essential cookies may affect the functionality of the Surga898 platform — including your ability to log in and place bets. We recommend allowing at least essential and functional cookies for the best experience.

As a registered Surga898 player and data subject, you have certain rights regarding the personal data we hold about you. Surga898 respects these rights and will assist you in exercising them promptly and efficiently.

Surga898 does not retain your personal data for longer than is necessary for the purposes for which it was collected, or as required by applicable law. Retention periods vary according to the type of data and applicable legal requirements.

• Active Account Data – For as long as your account remains active on Surga898, we retain all data necessary to provide our services to you. Data is updated periodically to ensure it remains accurate and current.
• Financial Transaction Records – Records of all deposits in MYR and withdrawals via Touch 'n Go, GrabPay, DuitNow, and other methods are retained for 7 years from the transaction date, as required under the Malaysian Financial Services Act and AML obligations.
• KYC Records & Identity Verification – Identity verification documents such as copies of MyKad and bank statements are retained for 5 years after the account closure date or the date of the last transaction, whichever is later.
• Betting History – Complete betting records are retained for 3 years for customer support, dispute resolution, and regulatory compliance purposes.
• Support Communication Logs – Records of Live Chat sessions, emails, and WhatsApp conversations with the Surga898 support team are retained for 2 years for quality assurance and dispute resolution purposes.
• Technical Data & Logs – Access logs and technical data are retained for a maximum of 90 days before being automatically deleted, unless a security or investigative requirement necessitates longer retention.

Once the retention period expires, data is securely deleted using methods that ensure it cannot be recovered. For digital data, we apply secure deletion techniques that meet industry standards. For physical copies (where applicable), we use certified document destruction services.

Surga898 reserves the right to update or amend this privacy policy from time to time to reflect changes in our data practices, new legal requirements, or improvements to our services.

• Significant amendments to this privacy policy will be communicated to registered players via email or in-platform notification at least 14 days before they take effect.
• The "Updated" date at the top of this page reflects the last date this policy was reviewed — please check back periodically.
• Continued use of the Surga898 platform after any amendments take effect will be considered acceptance of the revised policy.
• If you do not agree with the amendments, you have the right to close your account and request data deletion in accordance with the procedure set out in Section 6.

We encourage you to review this page periodically to stay informed about how we protect your privacy. If you have any questions about the changes made, feel free to contact our support team in Bahasa Melayu.

If you have any questions, concerns, or complaints regarding how Surga898 handles your personal data, or if you wish to exercise any of the privacy rights described in section 6, please contact us through the following channels.

• Privacy Email: Submit a written request to support@surga898.click with the subject line "Privacy Enquiry" or "Privacy Rights Request". We aim to respond within 3 business days, and no longer than 14 business days for more complex requests.
• Live Chat 24/7: For general privacy enquiries, you can reach the Surga898 support team — fluent in Bahasa Melayu — via Live Chat, available 24 hours a day, 7 days a week.
• WhatsApp: Contact us via the Surga898 WhatsApp number listed in your account settings for privacy enquiries in Bahasa Melayu. This is a popular option among Malaysian players who prefer communicating through WhatsApp.

We are committed to handling every privacy enquiry with care and respect. If you feel our response is unsatisfactory, you have the right to lodge a complaint with the Department of Personal Data Protection under the Ministry of Communications and Digital Malaysia, or any other relevant regulatory authority.