surga898 is committed to protecting the privacy and personal data of every player who uses our platform. This Privacy Policy explains precisely what personal information we collect, why we collect it, how we use and protect it, and the rights you hold over your own data — including the rights afforded to Malaysian users under applicable data protection principles.
This Privacy Policy ("Policy") issued by surga898 ("we", "us", "our") and applies to all users ("you", "Player "User") of the surga898 website, mobile applications, and associated gaming and sports betting services accessible at surga898.cam (collectively, the "Platform").
surga898 operates as an online gaming and sports betting platform directed primarily at adult users in Malaysia and other permitted jurisdictions. In the course of providing our services — which include casino games, live dealer tables, sports betting covering Liga Super Malaysia, EPL, and other major competitions, as well as payment processing via local Malaysian methods such as DuitNow, FPX, Touch 'n Go eWallet, Boost, and major local banks — we necessarily collect and process certain personal data about our users.
We take our data protection obligations seriously. This Policy sets out in transparent terms what data we collect, the legal basis on which we process it, how long we retain it, and the rights you can exercise over your personal information. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy.
For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:
surga898 collects the following categories of Personal Data from users of the Platform:
| Data Category | Examples | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, MyKad / passport number, nationality | Registration, KYC verification |
| Contact Data | Email address, mobile number, residential address | Registration, account updates |
| Financial Data | Bank account details, e-wallet identifiers (TNG/Boost/GrabPay), transaction history, deposit and withdrawal amounts in MYR | Payment processing, KYC |
| Gaming Activity Data | Game sessions, wager history, win/loss records, bonus usage, VIP tier progress | Throughout platform use |
| Technical Data | IP address, device type, browser type, operating system, session timestamps, geolocation data | Automatically on platform access |
| Communications Data | Live chat transcripts, email correspondence, support ticket contents | When you contact support |
| Marketing Preferences | Opted-in communication channels, promotion redemption history, preferred game categories | Registration, account settings |
We do not collect special categories of sensitive Personal Data (such as health data, biometric data, or data revealing racial or ethnic origin) unless specifically required to meet a legal or regulatory obligation, and only with your explicit consent where applicable.
surga898 collects Personal Data through the following channels and mechanisms:
surga898 processes your Personal Data one or more of the following legal bases, depending on the specific processing activity:
surga898 uses the Personal Data we collect for the following purposes:
surga898 does not sell your Personal Data to third parties. We share your data only in the limited circumstances described below, and only to the extent necessary for each stated purpose:
surga898 retains your Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by our legal and regulatory obligations. The following indicative retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Identity Data | Duration of account + 5 years post-closure | AML/KYC legal obligation |
| Financial Transaction Data | 7 years from transaction date | Regulatory and tax compliance |
| Gaming Activity Data | Duration of account + 3 years post-closure | Responsible gambling monitoring, disputes |
| KYC Documents | 5 years from submission or account closure | AML legal obligation |
| Support Communications | 3 years from last interaction | Dispute resolution, service quality |
| Technical / Log Data | Up to 12 months from collection | Security and fraud prevention |
| Marketing Preferences | Until consent is withdrawn | Consent |
Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised. Whereisation is not technically feasible, the data will be archived with access controls preventing its use for operational purposes.
surga898 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:
Despite these measures, no system is entirely immune to security incidents. In the event of a data breach that is likely to result in a risk to your rights and freedoms, surga898 will notify affected users in accordance with our notification obligations and take immediate remedial action.
The surga898 Platform uses cookies and similar tracking technologies (including web beacons, pixel tags, and local storage objects) to operate and improve the Platform. The following types of cookies are used:
You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies will affect your ability to use the Platform. You may also clear cookies at any time through your browser's privacy settings, noting that this will require you to log in again on your next visit.
As a Data Subject, you hold the following rights in relation to the Personal Data surga898 holds about you. To exercise any of these rights, please submit a written request to [email protected] with sufficient information to identify your account and the specific right you wish to exercise. We will respond within thirty (30) calendar days.
Request a copy of all Personal Data we hold about you, the purposes for which it is processed, and the categories of recipients to whom it has been disclosed.
Request correction of any inaccurate or incomplete Personal Data we hold about you. For account profile data, you may also update information directly in your account settings.
Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations and ongoing compliance requirements.
Request that we temporarily restrict the processing of your Personal Data in certain circumstances — for example, while you contest the accuracy of data we hold.
Request receipt of your Personal Data in a structured, commonly used, machine-readable format where processing is based on consent or contractual necessity and is carried out by automated means.
Object to processing of your Personal Data based on legitimate interests, including for direct marketing purposes. You may opt out of marketing communications at any time via account settings or by contacting support.
surga898 operates on an international basis and some of the third-party service providers we use (including payment processors, identity verification platforms, and analytics providers) may be located in, or transfer data to, countries outside Malaysia. Where Personal Data is transferred internationally, surga898 takes steps to ensure that appropriate safeguards are in place, including:
By using the surga898 Platform and accepting this Privacy Policy, you acknowledge that your Personal Data may be transferred to and processed in countries outside Malaysia, subject to the safeguards described above.
The surga898 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain Personal Data from any person under the age of 21. Our KYC verification process includes age verification as a mandatory step before full account functionality — including deposits, withdrawals, and wager placement — is enabled.
If we become aware that Personal Data of a person under 21 has been collected through the Platform, we will promptly suspend the associated account, delete the relevant Personal Data, and take appropriate action. If you believe a minor may have registered on our Platform, please contact us immediately at [email protected].
surga898 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform services. When material changes are made, we will provide advance notice to registered users via email and/or a prominent notice on the Platform, with a minimum of seven (7) days before the changes take effect.
The "Last updated" date displayed at the top of this page will reflect the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.
If you disagree with any amendment to this Policy, you should discontinue use of the Platform and may close your account by contacting [email protected].
For any questions, concerns, or requests relating to this Privacy Policy or the Personal Data surga898 holds about you — including to exercise any of your data rights set out in Section 11 — please contact us using the details below. All privacy-related requests will be acknowledged within five (5) business days and substantively resolved within thirty (30) calendar days.
Your Personal Data is never sold, rented, or traded to unaffiliated third parties for their own marketing or commercial purposes. We share data only as described in this Policy and only to the extent strictly necessary.
All data transmitted between your device and the surga898 Platform is protected by 256-bit SSL/TLS encryption. Sensitive data stored on our servers is encrypted at rest and access-controlled by role-based permissions.
Access, correct, delete, or export your Personal Data at any time. Submit a written request to [email protected] and we will respond substantively within 30 calendar days — no bureaucratic runaround.
If you consented to receive promotional communications from surga898, you can withdraw that consent at any time through your account settings or by emailing [email protected] — no questions asked.
surga898 does not collect or process data from persons under the age of 21. Mandatory KYC age verification is required before any real-money activity is permitted on the Platform.
We keep your data only as long as necessary for the stated purpose or as required by law. When the retention period expires, data is securely deleted or anonymised — not held indefinitely.
Our support team is available24/7 to address any privacy concern or data rights request. You can also read our full Terms & Conditions or visit the FAQ page for quick answers.