SurgaPlay regards your privacy as a core responsibility. This document clearly and transparently explains how we collect, use, store and protect your personal data as a SurgaPlay Malaysia member.
SurgaPlay ("we", "the platform" or "SurgaPlay") respects and values the privacy of every individual who uses our services. This Privacy Policy ("Policy") describes in detail how we collect, process, store, protect and, under certain circumstances, disclose your personal information as a member or visitor of the SurgaPlay platform.
This policy is formulated in compliance with Personal Data Protection Act 2010 (PDPA) Malaysia and any applicable data protection laws. By registering an account or using any part of the SurgaPlay platform, you give your explicit consent to the collection and processing of your personal data as described in this Policy.
Our commitment: SurgaPlay will not sell, rent or trade your personal data to any third party for marketing purposes without your explicit consent. Your privacy is not a commodity — it is your right.
If you have any questions or concerns about how we handle your data, you are welcome to reach us at any time at support@surgaplay.ws. We are committed to responding to every privacy enquiry within three (3) business days.
SurgaPlay collects your personal data from several different sources depending on how you interact with our platform. Below are the main categories of data we collect:
Personal Identification Data:
Financial & Payment Data:
Technical & Device Data:
Gaming Behaviour Data:
SurgaPlay does not store full credit/debit card details. Sensitive payment information is handled directly by licensed payment gateways operating to the highest security standards.
SurgaPlay only uses your personal data for lawful and necessary purposes. We do not collect more data than is required to operate our services. Below are the specific purposes for which your data is used:
| Purpose of Use | Data Type | Legal Basis |
|---|---|---|
| Identity verification & account registration | Personal identity data | Contractual compliance |
| Deposit & withdrawal processing | Financial data | Contractual compliance |
| Fraud prevention & anti-money laundering | Identity & financial data | Legal requirements |
| 24/7 Customer Support | Identification, technical data | Contractual compliance |
| Game analytics & platform improvement | Behavioural data | Legitimate Interests |
| Promotional & bonus notifications | Identity & email data | Consent |
| Responsible gaming monitoring | Behavioural data | Legitimate Interests |
You may withdraw consent for marketing communications at any time by contacting the SurgaPlay support team or using the "unsubscribe" link in any promotional email you receive from us.
SurgaPlay invests seriously in security infrastructure to ensure your data remains protected at all times. Below are the key security measures we have implemented:
Data retention period: SurgaPlay retains your personal data for as long as it is needed to fulfil the processing purposes set out in this Policy, or as required by Malaysian law. Financial and transaction records are retained for a minimum of 7 years in line with anti-money laundering regulatory requirements.
While SurgaPlay takes all reasonable steps to protect your data, no system can be guaranteed 100% secure against cyber threats. You also play an important role — never share your password and always log out when you are done using your SurgaPlay account.
SurgaPlay will not sell or trade your personal data to any third party. However, under certain limited and legitimate circumstances, we may need to share some of your data with the following parties:
In all instances of data sharing, SurgaPlay ensures that the receiving party upholds data protection standards equal to or higher than our own.
SurgaPlay uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.
The following are the types of cookies we use:
You may manage or disable cookies at any time through your internet browser settings. However, disabling essential cookies may affect your ability to log in or use certain features of the SurgaPlay platform.
Under Malaysia's Personal Data Protection Act 2010 (PDPA) and SurgaPlay's Privacy Policy, you have the following rights regarding the personal data we hold about you:
You have the right to request and receive a copy of all personal data we hold about you within 21 business days from the date of your request.
You may request the correction of any personal data we hold about you that is inaccurate, incomplete or out of date, at any time.
Under certain circumstances, you may request the deletion of your personal data, subject to our legal obligations to retain specific records.
You may withdraw your consent to data processing for marketing purposes at any time, without affecting your eligibility to use the SurgaPlay platform.
You have the right to receive your personal data in a machine-readable format (CSV or JSON) for transfer to another service provider if required.
You may object to the processing of your data for specific purposes, such as direct marketing or automated profiling that influences important decisions.
To exercise any of the above rights, please submit a written request to support@surgaplay.ws with the subject line "Privacy Rights Request – [Your Full Name]". We will respond within 3 business days and fulfil the request within 21 business days.
SurgaPlay takes the protection of children and minors extremely seriously. The SurgaPlay platform is strictly prohibited for use by individuals under the age of 18.
We do not knowingly collect, process or store any personal data from individuals under the age of 18. Our registration process includes age verification, and we reserve the right to request supporting documents such as a valid MyKad or Malaysian passport at any time to confirm a member's age eligibility.
If we discover that personal data belonging to a minor has been collected without valid knowledge or consent, we will immediately delete that data and close the account in question. Parents or guardians who believe their child may have registered a SurgaPlay account should contact us immediately at support@surgaplay.ws.
SurgaPlay reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, or platform service improvements.
When significant changes are made to this Policy, we will:
Continued use of the SurgaPlay platform after the effective date of any amendment constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you may close your account by contacting our support team.
If you have any questions, concerns or complaints regarding this Privacy Policy or how we handle your personal data, you may reach us through the following channels:
We are committed to resolving all privacy-related complaints and enquiries fairly, promptly and within a reasonable timeframe. If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.
How we keep your privacy protected at every level
Every bit of data travelling between your phone or computer and SurgaPlay's servers is encrypted using TLS 1.3 and 256-bit SSL — the same standard used by Malaysia's largest banks.
256-bit SSLSurgaPlay employs two-factor authentication (2FA), SMS OTP verification and a thorough KYC process to ensure that only you can access your account.
2FA EnabledYour data is accessible only to SurgaPlay staff who genuinely require it to perform their duties. Multi-layered access controls and strict audit logs are enforced at every level.
Access ControlSurgaPlay's automated monitoring system operates 24/7 to detect and block unauthorised access attempts, cyberattacks, and suspicious activity before they can compromise your data.
24/7 MonitoringSurgaPlay operates in full compliance with Malaysia's Personal Data Protection Act 2010 (PDPA). Our compliance team ensures that all data processing practices consistently meet the latest legal requirements.
PDPA CompliantSurgaPlay undergoes comprehensive security audits twice a year, conducted by accredited independent cybersecurity firms. Audit reports are used to continuously strengthen the protection of your data.
Bi-annual AuditYour data is protected with best-in-class security technology. Register for free today and enjoy over 500 casino games, slots, blackjack, baccarat and Sports Betting safely and responsibly.