surgagg Privacy Policy

01Introduction

surgagg is an English-language online gaming information and entertainment platform created for Malaysian adults aged 21 and above. In the course of providing the Platform, surgagg necessarily collects and processes certain personal information. This Policy sets out in plain terms what information we collect, the purposes for which it is used, the circumstances in which it may be shared, how long it is retained and the rights available to you as a data subject.

surgagg takes the privacy of its users seriously. We process personal data only for legitimate, defined purposes and apply reasonable technical and organisational safeguards to reduce the risk of unauthorised access, disclosure, alteration or destruction. This Policy should be read alongside the surgagg Terms and Conditions, which govern the broader relationship between surgagg and its users.

02Definitions

The following terms carry the meanings set out below throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, date of birth, payment details and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, transmission, restriction, erasure or destruction.
• "Data Controller" means surgagg, which determines the purposes and means of processing Personal Data submitted through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of surgagg under contractual instructions, such as payment service providers or identity verification services.
• "User" means any individual who registers, visits or otherwise interacts with the Platform.
• "Cookies" means small text files placed on a User's device by the Platform for functionality, analytics or preference storage purposes.
• "KYC" means Know Your Customer — the identity and document verification process used to confirm a User's identity, age and payment ownership.

03Data We Collect

3.1 Registration Data

When you create an account, surgagg collects information required to establish your identity and enable account functionality. This includes your full name, date of birth, email address, mobile number and country of residence. Malaysian users may also be asked to provide their NRIC number (MyKad) or passport details for identity verification purposes.

3.2 Financial and Transaction Data

When you make a deposit or withdrawal, surgagg and its payment processing partners collect the information necessary to complete that transaction. This may include bank account identifiers, e-wallet account references, and transaction amounts in MYR. Supported channels include Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay and supported cryptocurrencies (BTC, ETH, USDT, LTC). surgagg does not store full card numbers or internet banking passwords.

3.3 Usage and Technical Data

surgagg automatically collects certain technical information when you access the Platform, including IP address, device type, operating system, browser type, session duration, pages visited and approximate geographic location derived from IP. This data is used for security monitoring, fraud prevention and service improvement.

3.4 Communications Data

If you contact surgagg via email or the support channel, we retain a record of that correspondence, including the content of your message, your contact details and the nature of your enquiry, for the period necessary to resolve the matter and comply with any associated retention obligations.

3.5 Data Collected from Third Parties

surgagg may receive information about you from identity verification providers, fraud screening services and payment processors in the ordinary course of account administration. Such information is used solely for the purposes for which it was received.

04Data Processing

surgagg processes Personal Data for the following defined purposes. Each purpose is matched with the specific categories of data used:

05Legal Basis for Processing

surgagg processes Personal Data only where a valid legal basis exists. The primary bases relied upon are:

• Contractual necessity: Processing required to fulfil the account agreement, including registration, deposit processing, withdrawals and bonus administration.
• Legal obligation: Processing necessary to comply with applicable anti-money-laundering rules, identity verification requirements and record-keeping duties.
• Legitimate interests: Processing necessary for fraud prevention, security monitoring, service improvement and operational communications, where such interests are not overridden by the User's rights.
• Consent: Where surgagg relies on consent for a specific processing activity (such as optional marketing communications), that consent may be withdrawn at any time by contacting us using the details in Section 14.

06Data Sharing

surgagg does not sell, rent or otherwise trade Personal Data with third-party marketing organisations. Personal Data may be disclosed to the following categories of third parties only to the extent necessary for a defined operational purpose:

• Payment service providers: Banks, e-wallet operators (including Touch 'n Go eWallet, Boost and GrabPay), DuitNow, FPX and crypto network processors require transaction data to process deposits and withdrawals.
• Identity verification providers: KYC and age verification partners receive the minimum data necessary to confirm a User's identity and eligibility.
• Fraud prevention services: Third-party screening tools may receive technical and account data to identify suspicious activity.
• Legal and regulatory authorities: surgagg may disclose Personal Data where required by law, court order or a competent regulatory authority.
• Professional advisers: Legal, audit or compliance advisers may access Personal Data under obligations of confidentiality where strictly necessary for their advisory role.

All Data Processors engaged by surgagg are required to handle Personal Data in accordance with appropriate contractual safeguards consistent with this Policy.

07Data Retention

surgagg retains Personal Data only for as long as is reasonably necessary for the purposes for which it was collected, or as required by applicable law. In practice:

• Account and identity data is retained for the duration of the active account and for a further period following closure as required by anti-money-laundering and regulatory record-keeping obligations. This period is commonly five to seven years from the date of last activity or account closure, whichever is later.
• Transaction records are retained for a minimum of five years from the transaction date to comply with financial record-keeping requirements.
• Customer support correspondence is retained for a period sufficient to resolve the matter and meet any associated compliance obligations, typically two to five years.
• Technical and usage data used for analytics purposes is retained in aggregated or anonymised form, which does not identify individual users, for an indefinite period.

When Personal Data is no longer required, surgagg will take reasonable steps to delete, anonymise or otherwise render it inaccessible.

08Cookies & Tracking Technologies

surgagg uses cookies and similar tracking technologies to support Platform functionality, remember user preferences and collect anonymised usage statistics. The categories of cookies used include:

• Strictly necessary cookies: Essential for the Platform to function correctly, including session management, authentication state and security features. These cannot be disabled.
• Functional cookies: Remember user preferences such as language selection, display preferences and previously entered information to improve the navigation experience.
• Analytics cookies: Collect anonymised data about how users interact with the Platform, including pages visited, session duration and error events, to support service improvement.

Users may adjust their browser settings to refuse or delete non-essential cookies. Note that disabling functional cookies may affect the performance of certain Platform features. surgagg does not use third-party advertising or retargeting cookies.

09Security Measures

surgagg implements reasonable technical and organisational measures to protect Personal Data against unauthorised access, disclosure, loss or destruction. These include encrypted data transmission, access controls restricting data access to authorised personnel, regular internal security reviews and the use of reputable third-party service providers with appropriate security standards.

While surgagg takes reasonable precautions, no online platform can guarantee absolute security. Users are responsible for maintaining the confidentiality of their account credentials and should notify surgagg immediately if they suspect unauthorised access. surgagg will never request passwords or full banking credentials through email or chat communications.

10User Rights

Subject to applicable law, users may exercise the following rights in relation to their Personal Data held by surgagg:

• Right of access: You may request a copy of the Personal Data surgagg holds about you and information about how it is processed.
• Right to rectification: You may request correction of inaccurate or incomplete Personal Data without undue delay.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations.
• Right to restrict processing: You may request that surgagg limits the processing of your Personal Data in certain circumstances, such as while a correction request is under review.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact surgagg using the details provided in Section 14 of this Policy. surgagg will acknowledge your request within a reasonable period and respond substantively in accordance with applicable requirements. Identity verification may be required before a request is processed.

11Minors

The surgagg Platform is strictly intended for adults aged 21 years and above. surgagg does not knowingly collect, store or process Personal Data from any individual who is under the age of 21. If surgagg becomes aware that Personal Data has been collected from a minor, it will take prompt steps to delete that data and close the associated account.

If a parent, guardian or responsible adult believes that a minor has submitted Personal Data to surgagg, they should contact us immediately using the details in Section 14 so that appropriate action can be taken without delay.

12International Data Transfers

surgagg primarily serves Malaysian users and aims to process Personal Data within appropriate jurisdictional boundaries. Where the use of third-party service providers (such as identity verification or fraud screening platforms) involves the transfer of Personal Data outside Malaysia, surgagg takes reasonable steps to ensure that appropriate contractual safeguards are in place to protect the data in transit and at rest.

Users should be aware that different jurisdictions may have different standards of data protection. surgagg will not transfer Personal Data to a third country or territory without taking reasonable measures to ensure an adequate level of protection consistent with the purposes described in this Policy.

13Policy Amendments

surgagg reserves the right to modify or replace this Privacy Policy at any time. The effective date of the current version is displayed at the top of this document. Where changes are material, surgagg will notify users through the Platform before the revised Policy takes effect. The updated Policy will be published at surgagg.cam/privacy-policy.

Continued use of the Platform after a revised Privacy Policy becomes effective constitutes acceptance of the updated terms. Users who do not accept a material amendment are encouraged to cease using the Platform and request account closure in accordance with the Terms and Conditions.

14Contact Us

For any questions, requests or formal notices relating to this Privacy Policy or the processing of your Personal Data, please contact surgagg through the following channel:

• Website email: [email protected]

Please include your registered account identifier, a brief description of your request and, where relevant, the specific Personal Data category concerned. surgagg aims to acknowledge formal data subject requests within a reasonable period and to provide a substantive response as required by applicable data protection obligations. For your security, please do not include passwords, PIN codes or full payment credentials in any email correspondence.