Privacy Policy SurgaVIP — Data Protection Personal Malaysian Members

SurgaVIP values the privacy of every member who uses our platform. This Privacy Policy is designed to provide a clear and transparent understanding of how we handle your personal data — from the point of collection through to final deletion.

We operate the platform at surgavip.run and an official mobile app available for Android and iOS. All services we provide, including slot games, live casino, fish shooting games and VIP services, are subject to this Privacy Policy.

This policy applies to all individuals who register an account, visit our website or use any SurgaVIP service, regardless of the access method used.

SurgaVIP only collects data that is strictly necessary to provide our services safely and efficiently. The following are the categories of data we collect:

The personal data we collect is used solely for the following purposes:

• Account management: Creating and maintaining your account, processing registration and login securely.
• Transaction processing: Processing deposits and withdrawals, verifying transactions and resolving any payment disputes.
• KYC Compliance: Verifying your identity to meet legal requirements and prevent money laundering.
• Customer support: Handling your enquiries, complaints and support requests more effectively.
• Platform security: Detecting and preventing fraud, account abuse and suspicious activity.
• Personalisation: Personalising your gaming experience and promotional offers relevant to your playing habits, with your consent.
• Service communications: Sending important notifications related to your account, security and terms changes.

SurgaVIP only shares your personal data with third parties in limited and controlled situations as follows:

• Payment providers: The payment gateway that processes your deposits and withdrawals requires the minimum financial information needed to complete transactions.
• Game service providers: Our game providers receive game session data to operate the games — this information does not include personally identifiable data.
• Legal authorities: In cases required by law, court order or official investigation, we may be required to disclose certain information to the relevant authorities.
• Infrastructure providers: Cloud and hosting service providers that store our data are bound by strict data protection agreements.

The SurgaVIP platform uses cookies and similar tracking technologies to enhance your user experience and maintain login session security. The following are the types of cookies we use:

• Session cookies: Required to maintain your login session and ensure account security. This cookie will be deleted when you close your browser.
• Preference cookies: Saving your preference settings such as language and time zone for a smoother repeat experience.
• Analytics cookies: Helps us understand how users interact with the platform for continuous improvement. This data is collected in aggregate and does not identify individuals.
• Security cookies: Used to detect suspicious login attempts and protect your account from unauthorised access.

You can manage cookie settings through your web browser preferences. However, blocking essential cookies may affect the functionality of the SurgaVIP platform.

SurgaVIP continuously invests in security infrastructure to ensure your personal data remains protected at all times. The security measures we have implemented include:

• 256-bit SSL encryption for all data transmitted between users and our servers.
• Encryption of sensitive data in databases using industry-approved cryptographic algorithms.
• Real-time security monitoring by our cybersecurity team on duty 24/7.
• Regular penetration testing conducted by accredited independent security firms.
• Role-based access controls ensuring only authorised staff can access personal data.
• Encrypted data backups stored at separate locations for service continuity.

SurgaVIP retains your personal data for as long as your account is active and for a defined period following account closure, based on legal and operational requirements:

• Active account data: Retained for as long as your account remains active on the SurgaVIP platform.
• Financial transaction records: Stored for 7 years from the transaction date, in accordance with Malaysia's accounting legal requirements.
• KYC documents: Stored for 5 years following account closure to fulfil anti-money laundering compliance obligations.
• Support communication logs: Stored for 2 years for reference and dispute resolution.
• Analytics data: Stored in aggregate form without personal identifiers and not subject to the same time limits.

When the retention period expires or when data is no longer needed, it will be securely deleted using methods that ensure the data cannot be recovered.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and data protection best practices, you hold the following rights regarding your personal data at SurgaVIP:

SurgaVIP does not direct our services at individuals under the age of 18, and we do not knowingly collect personal data from children. This platform is for adults only.

Should we find that personal data of a child under 18 years of age has been collected without proper age verification, we will take immediate steps to delete that data and close the associated account.

SurgaVIP reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements or improvements in how we protect your data.

For material amendments — that is, changes that significantly affect your privacy rights — we will provide adequate notice through:

• Notifications displayed on the SurgaVIP platform homepage.
• Email sent to the address registered in your account.
• Push notifications via the SurgaVIP mobile app.

Continued use of the SurgaVIP platform after any Privacy Policy changes take effect constitutes your acceptance of the updated terms. The "Updated" date at the top of this page will always reflect the date of the latest amendment.