Official Documents

SurgaPlay Privacy Policy – Your Personal Data Protection

Surgaplay cares about your privacy. This document explains in detail how we collect, use, store, and protect your personal information as a user of our platform.

Effective: 1 January 2026  |  Version 3.1
Overview
Your data is not sold to third parties
256-bit SSL encryption for all data
You have the right to request deletion of your data
Cookie controls available to every user
Compliance with Malaysia's PDPA
Our Privacy Commitment to You

Six core pillars of data protection at SurgaPlay

Industry-Grade Encryption

Every personal and financial detail you submit to our platform is protected by 256-bit SSL encryption — the same security standard used by the world's leading banks.

Secure Data Storage

Your personal data is stored on servers protected by multi-layered access controls, enterprise-grade firewalls and real-time threat monitoring around the clock.

Full User Control

You have full control over your data — including the right to access, correct, download or request deletion of your personal information at any time.

No Data Selling

Surgaplay has never and will never sell, rent, or share your personal data with advertisers or data brokers. Your data is used solely for the purposes stated in this policy.

PDPA Compliance

Our operations fully comply with Malaysia's Personal Data Protection Act (PDPA). We appoint an internal data protection officer to ensure every data processing activity meets legal requirements.

Flexible Communication Options

You can choose to receive or opt out of any marketing communications from us at any time via your account settings, with no conditions or fees.

Introduction

Surgaplay ("us", "Platform" or "SurgaPlay.vin") respects the privacy of every individual who uses our services. This Privacy Policy transparently explains how we collect, process, store and protect your personal information when you use our website, mobile app or any services associated with SurgaPlay.

This policy applies to all SurgaPlay platform users including visitors, registered members and VIP members. By continuing to use our platform, you agree to the terms set out in this Privacy Policy.

Legal Compliance: surgaplay operates in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international standards on personal data protection. We are committed to continuously updating our data protection practices in line with the latest legal developments.

If you have any questions about this Privacy Policy or how we handle your personal information, please contact our team through the channels listed at the end of this document.

Data We Collect

Surgaplay collects various types of information depending on how you interact with our platform. The following are the categories of data we collect:

Data Category Type of Information Primary Purposes
Identity Data Full name, date of birth, MyKad number, KYC selfie photo Identity verification & compliance
Contact Data Phone number, email address, residential address Communications & notification delivery
Financial Data Bank account number, deposit & withdrawal records Payment processing
Technical Data IP address, device type, web browser, operating system Security & platform improvements
Usage Data Game history, game preferences, active session duration User experience & responsible gaming

We only collect data that is strictly necessary for the stated purposes. We do not collect sensitive information such as biometric data, medical records, or religious beliefs unless required by law.

Third-Party Data: In some cases, we may receive information about you from third-party KYC service providers we use for identity verification. This information is used exclusively to ensure the security of your account.

How We Use Your Data

Every piece of data we collect is used for a clear and lawful purpose. The following are the primary purposes of data processing at surgaplay:

  • Service delivery: Creating and managing your account, processing deposits and withdrawals, and providing access to all games on the platform.
  • Identity verification (KYC): Ensuring every user is a real individual who meets the required age and location eligibility criteria.
  • Fraud prevention: Detecting and blocking suspicious activity, including the use of multiple accounts or fraud attempts.
  • Customer support: Responding to inquiries, resolving complaints, and providing you with technical assistance more effectively.
  • Targeted marketing: Sending relevant promotional offers and updates – only to users who have given their consent.
  • Platform improvements: Analyzing usage patterns to continuously improve platform quality, speed, and security.
  • Legal compliance: Fulfilling obligations under Malaysian law, including anti-money laundering (AML) requirements.

Surgaplay will not use your data for any purpose other than those stated above without first obtaining your consent.

Information Sharing

Surgaplay does not sell or rent your personal data to any third party for marketing purposes. However, there are limited situations where we need to share your information with others:

  • Payment service providers: Transaction information required to process your deposits and withdrawals is shared with registered banks and e-wallet operators.
  • KYC service providers: Identity verification data is shared with recognised KYC partners to ensure compliance with the verification process.
  • Game software providers: Minimal game session information is shared with software providers for technical game operation purposes.
  • Legal authorities: We will disclose information when required by Malaysian law, court order, or directive from a competent authority.

All third parties we work with are required to sign strict data protection agreements and comply with the security standards set by surgaplay. We have zero tolerance for data breaches by our partners.

Data Security

Protecting your personal data is surgaplay's highest priority. We continuously invest in the latest security infrastructure to keep your information safe at all times.

Security measures we implement include:

  • End-to-end data encryption: All data transmitted between your device and our servers is protected by TLS 1.3 encryption with a 256-bit SSL certificate.
  • Two-factor authentication (2FA): An additional security layer is available for all user accounts to prevent unauthorized access.
  • 24/7 security monitoring: Our security team monitors all platform activity around the clock to detect and respond to any threats swiftly.
  • Regular security audits: Independent security assessments are conducted periodically by accredited third-party audit firms.
  • Internal access controls: Only authorized personnel have access to user personal data, and every access is logged for audit purposes.

Incident Response: In the event of any data breach affecting your personal information, surgaplay is committed to notifying you within 72 hours from the moment the incident is detected, in line with international data protection best practices.

Your Rights

As a surgaplay user, you have the following rights regarding your personal data under Malaysia's PDPA and our internal policies:

Right to Access

You may request a copy of all personal data we hold about you at any time.

Right to Rectification

You may update or correct any inaccurate or outdated personal information.

Right to Erasure

You may request the deletion of your personal data, subject to applicable legal requirements.

Right to Restriction

You may request that we restrict the processing of your data in certain situations as defined by law.

Right to Portability

You may request your data in a structured, machine-readable format for transfer to another platform.

Right to Object

You may object to the processing of your data for direct marketing purposes at any time, with no conditions.

To exercise any of the above rights, please contact our privacy team by email at [email protected]. We will process your request within 14 business days.

Cookie Policy

Surgaplay uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

  • Essential cookies: Required for core platform functions such as login authentication and session security. These cookies cannot be disabled.
  • Performance cookies: Collecting information about how you use the platform to help us improve website performance and speed.
  • Functionality cookies: Remembering your preferences such as language selection and display settings for a more personalized experience.
  • Analytics cookies: Used by recognised third-party analytics tools to understand traffic and usage patterns in aggregate, anonymous form.

You can manage your cookie settings through your web browser or via the SurgaPlay account settings panel. Please note that disabling certain cookies may affect the functionality of some parts of the platform.

International Data Transfers

In the course of platform operations, some of your personal data may be transferred to, stored or processed outside Malaysia, particularly for server infrastructure and international payment processing purposes.

Surgaplay ensures that any international data transfers are carried out with adequate safeguards, including:

  • Transfers only to countries or regions with an equivalent or higher level of data protection
  • Use of internationally recognized standard contractual clauses with all data-receiving partners
  • Strict risk assessment required before any data transfer is approved

Note: Even when data is processed outside Malaysia in certain cases, your rights as a user remain fully protected under the provisions of Malaysia's PDPA and this privacy policy.

Data Retention Period

Surgaplay retains your personal data for as long as your account is active or as long as necessary to provide services to you. When an account is closed, data is retained for a defined period before being securely deleted.

  • Active account data: Retained for as long as the account remains active and for 7 years after account closure for legal compliance purposes.
  • Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysia's accounting and tax legal requirements.
  • Support communication logs: Retained for 3 years for reference and dispute resolution purposes.
  • Usage and analytics data: Anonymised data may be retained for longer periods for platform improvement purposes.

Once the retention period expires, your data will be permanently deleted or anonymised using secure, irreversible methods.

Child Protection

Surgaplay strictly prohibits the registration and use of the platform by individuals under the age of 18. Our platform is not designed for children, and we do not knowingly collect personal data from minors.

Should we discover that personal data of an individual under the age of 18 has been collected without our knowledge, that data will be deleted immediately and the account in question will be closed. Parents or guardians who discover their child has registered on our platform are requested to contact us immediately.

We also support online child protection initiatives and work with relevant authorities to ensure our platform remains safe and free from underage users.

Privacy Policy Changes

Surgaplay reserves the right to update this Privacy Policy from time to time to reflect changes in our operational practices, legal requirements, or technological developments. Any changes made will be published on this page with a clear effective date.

For material changes that significantly affect your rights, we will:

  • Sending notices to your registered email at least 14 days before changes take effect
  • Displaying clear notices on the platform's home page
  • In some cases, seeking your renewed consent before changes take effect

Our Recommendation: We encourage you to review this Privacy Policy page periodically, at least once every six months, to stay informed about how we manage your data.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact our privacy team through the following channels:

Our privacy team will respond to all inquiries within 14 business days. For urgent data security matters, please contact us via Live Chat for the fastest response.

For more information on the platform's terms of use, please refer to Terms & Conditions ours. For healthy and responsible gaming guidance, visit the Responsible Gaming ours.

Safe & Trusted Platform

Your Privacy Protected. Your Gaming Experience Secured.

Join over 500,000 SurgaPlay members enjoying digital entertainment in a safe, transparent and responsible environment. Your data is protected, your games are fair.

Minimum age 18. Play responsibly.

surgaplay Privacy Guarantee
256-bit SSL Encryption
All data is transmitted through bank-grade secure channels.
KYC Verified
A secure and PDPA-compliant identity verification process.
No Data Selling
Your data is never sold to any third party.
14-Day Response
All privacy-related requests are processed within 14 business days.
Bahasa Melayu