surga99 is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what information we collect, why we collect it, how it is used and stored, and what rights you have over your data as a surga99 player.
Last Updated: 01 January 2026 · Version 2.4These cards summarise our core privacy commitments. They do not replace the full Privacy Policy below, which governs your use of the surga99 platform.
surga99 collects only the personal data strictly necessary to operate your account, process transactions in MYR, verify your identity, and comply with our licensing obligations. We do not collect data speculatively.
surga99 does not sell, rent, or trade your personal data to unaffiliated third parties for marketing or commercial purposes. Your data serves your account — nothing else.
All personal and financial data transmitted between your browser and surga99 is protected by 256-bit SSL/TLS encryption. Data at rest is encrypted using industry-standard protocols across all storage layers.
You have the right to access, correct, export, and request deletion of your personal data at any time. surga99 has established clear processes for handling all data rights requests promptly and without discrimination.
We do not retain your data indefinitely. Personal data is held only as long as required by our licensing obligations or as necessary to fulfil the purpose for which it was collected, after which it is securely deleted or anonymised.
In the event of a data security incident that materially affects your personal data, surga99 will notify affected players without undue delay and will take immediate remediation steps in accordance with applicable regulations.
This Privacy Policy ("Policy") describes how surga99 ("surga99", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes personal data in connection with the surga99 online sportsbook and live casino platform accessible at https://surga99.cam ("Platform").
surga99 is committed to handling your personal data responsibly and in accordance with applicable data protection principles. This Policy applies to all persons who access, register on, or use the surga99 Platform ("Player", "User", "you", "your"), whether from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or any other location.
By creating an account and using the surga99 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, processing, and use of your personal data as described herein. If you do not agree with the terms of this Policy, please do not use the Platform and close your account.
The following defined terms are used throughout this Privacy Policy:
surga99 collects personal data through several channels and at various stages of your relationship with the Platform. The categories of data we collect are set out below.
| Category | Examples | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, Malaysian NRIC / Passport number | Registration and KYC verification |
| Contact Data | Email address, phone number, residential address | Registration and account updates |
| Financial Data | Payment method details, DuitNow / FPX account references, Maybank / CIMB / Public Bank account references, transaction history in MYR | Deposit, withdrawal, and KYC processes |
| KYC Documentation | MyKad scan, Driver's Licence, Passport, utility bill, proof-of-address document, selfie photograph | Identity verification (mandatory for withdrawals) |
| Responsible Gambling Data | Deposit limits set, self-exclusion requests, session limit preferences | Player self-service tools in Account Settings |
| Support Communications | Live chat transcripts, email correspondence, complaint records | Customer support interactions |
When you access the surga99 Platform, certain technical data is collected automatically by our systems:
surga99 processes your personal data only when we have a valid legal basis to do so. The applicable legal bases for each category of processing are as follows:
surga99 uses your personal data for the following purposes, each tied to a legitimate basis as described in Section 4:
surga99 does not sell, rent, or trade your personal data to unaffiliated third parties. We may share your data only in the following limited and controlled circumstances:
We engage carefully selected third-party service providers who process data on our behalf under binding data processing agreements. These include:
All processors are contractually required to process your data only as instructed by surga99, to implement appropriate security measures, and to refrain from using your data for their own purposes.
surga99 may disclose personal data to regulatory authorities, law enforcement agencies, or judicial bodies when required to do so by law, court order, or our licensing obligations. Such disclosures will be limited to the minimum data necessary to satisfy the specific legal requirement.
In the event of a merger, acquisition, restructuring, or sale of assets involving surga99, personal data held about Players may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer and the applicable privacy terms before the change takes effect.
surga99 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by our licensing obligations and applicable law. Our standard retention periods are as follows:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Identity Data | Duration of account + 5 years post-closure | Licensing obligation / AML compliance |
| Transaction Records (MYR) | 7 years from transaction date | Financial regulatory requirement |
| KYC Documents | 5 years from submission or account closure (whichever is later) | AML / KYC licensing obligation |
| Betting & Gaming History | 3 years from the date of each transaction | Dispute resolution / licensing |
| Support Communications | 3 years from last interaction | Dispute resolution / legitimate interest |
| Marketing Consent Records | Until consent is withdrawn, plus 1 year | Proof of consent |
| Technical / Log Data | 12 months | Security / fraud prevention |
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.
surga99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Key security measures include:
While surga99 takes all reasonably practicable measures to protect your data, no internet-based transmission or storage system is completely impenetrable. We encourage you to use a strong, unique password for your surga99 account and to contact support immediately if you suspect any unauthorised access.
surga99 uses cookies and similar tracking technologies to operate the Platform, personalise your experience, and collect analytical data. A "cookie" is a small text file placed on your device by a website you visit. surga99 uses the following categories of cookies:
These cookies are essential for the Platform to function and cannot be disabled. They include session management cookies that keep you logged in, security cookies that detect fraudulent activity, and load-balancing cookies that ensure stable performance. No personal data collected by strictly necessary cookies is used for marketing purposes.
These cookies allow surga99 to measure Platform traffic, understand how players navigate the site, and identify areas for improvement. Data collected is aggregated and anonymised where possible. Analytical cookies are set only with your consent.
Functional cookies remember your preferences — such as your chosen language, selected sports markets, or preferred odds format — to provide a more personalised experience on return visits.
You may control and delete cookies through your browser settings at any time. Please be aware that disabling strictly necessary cookies will impair Platform functionality and may prevent you from accessing your account. Browser-level cookie controls vary by browser; refer to your browser's help documentation for specific instructions.
As a Data Subject, you have the following rights in relation to your personal data held by surga99. surga99 will respond to all valid rights requests within 30 calendar days. Requests should be submitted to the contact details in Section 14.
Request a copy of the personal data surga99 holds about you and information about how it is processed.
Request correction of any inaccurate or incomplete personal data in your account record.
Request deletion of your personal data where it is no longer necessary for the purpose collected, subject to overriding legal obligations.
Request that we restrict processing of your data in certain circumstances, such as while an accuracy dispute is being resolved.
Request a machine-readable export of personal data you have provided to surga99, for transfer to another controller.
Object to processing of your data based on legitimate interests, including profiling for marketing purposes.
Withdraw any previously given consent (e.g., marketing emails) at any time without affecting prior lawful processing.
Lodge a complaint with the relevant data protection authority if you believe your rights have not been respected.
surga99 is strictly prohibited for use by persons under the age of 21. The Platform does not knowingly collect personal data from any person under 21 years of age. The mandatory age verification process (KYC) is specifically designed to prevent underage access to gambling services.
If surga99 becomes aware or reasonably suspects that personal data has been collected from a person under 21, we will:
If you are a parent or guardian and believe that a minor in your care has registered on or used the surga99 Platform, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action.
The surga99 Platform may reference or link to third-party services, including payment providers (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong), game content studios, and identity verification platforms. Each of these third parties operates under their own independently published privacy policies, which surga99 does not control.
surga99 is not responsible for the privacy practices, data handling, or content of any third-party service. We recommend that you review the privacy policy of each third-party service you interact with in connection with your surga99 account.
All third-party processors who handle personal data on our behalf are required to enter into data processing agreements with surga99 that bind them to at minimum the same level of data protection as this Policy.
surga99 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, Platform features, applicable law, or regulatory requirements. When material changes are made, the "Last Updated" date at the top of this document will be updated accordingly.
Where changes are material — for example, a new category of data collection, a new sharing arrangement, or a change to your rights — surga99 will endeavour to notify active Players via in-platform notification or email prior to the change taking effect. For non-material updates (such as clarifications of existing practices), changes will take effect upon publication.
Your continued use of the surga99 Platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. We recommend bookmarking this page and reviewing it at least once per calendar quarter.
If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have concerns about how surga99 handles your personal data, please contact us using the following channels:
surga99 aims to acknowledge all privacy-related correspondence within 2 business days and to provide a substantive response within 30 calendar days. Where a request is complex or involves a high volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.
If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction.
Our support team is available 24/7 to help with data rights requests, account questions, and any privacy concerns. You can also review our full Terms and Conditions for a complete picture of your rights and obligations on surga99.
For players aged 21 and above only · Play responsibly