At surga22, your privacy is more than a legal obligation — it's a personal commitment we stand by. This document transparently explains how we collect, use, store, and protect the personal information of every Malaysian member.
256-bit SSL for all data
Your data is never sold to anyone
Compliant with Malaysia's Personal Data Protection Act
You may access, amend, or delete your data
Surga22 takes our responsibility to every member's privacy and data security seriously. This Privacy Policy is drawn up in accordance with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and reflects best practices in the fintech and online entertainment industry.
By using the surga22 platform — including the surga22.ws website, mobile app, and any related services — you agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, please discontinue use of our platform.
This Privacy Policy applies to all personal information collected by surga22 across every channel of interaction between you and our platform. This includes the account registration process, gaming activity, financial transactions, customer support interactions, and general use of the surga22 website or app.
Surga22 acts as the data controller and is fully responsible for all personal information collected. We ensure that all data processing is carried out lawfully, fairly, and transparently, in line with Malaysia's PDPA principles.
This policy applies to all users accessing surga22 from Malaysia, including registered members, website visitors, and any individual who interacts with surga22's official communication channels such as support@surga22.ws.
Surga22 collects several categories of information to enable us to deliver services that are secure, legally compliant, and high in quality. Below is a full breakdown of the data we collect:
| Data Category | Example Information | Requirement |
|---|---|---|
| Personal Identity | Full name, MyKad number, date of birth, gender, nationality | Mandatory |
| Contact Information | Malaysian phone number, email address, residential address | Mandatory |
| Financial Data | E-wallet account IDs (Touch 'n Go, GrabPay, DuitNow), FPX bank account details for withdrawals | Mandatory |
| Gaming Data | Betting history, wins, losses, favourite games, play duration | Automatic |
| Technical Data | IP address, device type, browser version, operating system, session cookies | Automatic |
| Communications | Customer support chat records and emails sent to surga22 | Contextual |
| KYC Documents | Front and back copy of MyKad, verification selfie, proof of address | Required for withdrawals |
Surga22 collects your information through several different channels. Understanding how this collection works helps you make informed decisions about the data you share with us.
Surga22 uses collected information only for legitimate purposes that are necessary to operate our services. Every use of data has a clear legal basis under Malaysia's PDPA.
Surga22 does not sell, rent, or trade members' personal information to any third party for marketing or commercial purposes. This is a commitment we uphold without exception.
However, in the course of operating the platform, surga22 may need to share certain data with the following parties within strictly controlled boundaries:
Surga22 invests seriously in cybersecurity infrastructure to ensure your data remains protected at all times. We employ multiple complementary layers of security to deliver comprehensive protection.
Surga22 retains your personal information only for as long as necessary for the purposes stated in this Privacy Policy, or as required under applicable Malaysian law.
| Data Type | Retention Period | Reason |
|---|---|---|
| Active account information | For as long as your account remains active | Service operations |
| Financial transaction records | 7 years after transaction | PDPA compliance & Malaysian tax laws |
| KYC Documents | 5 years after account closure | Malaysia AML Obligations |
| Game logs | 3 years | Dispute resolution |
| Customer support records | 2 years | Service quality & referrals |
| Marketing data (with consent) | Until you withdraw your consent | Marketing communications |
Once the retention period expires, your data will be securely deleted using methods that prevent any possibility of recovery, or fully anonymised for analytical purposes.
Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have clearly defined rights regarding the personal data held by surga22. We fully respect and facilitate the exercise of these rights.
Request a complete copy of the personal data surga22 holds about you at any time.
Request corrections to inaccurate or incomplete data via your account settings or by emailing our support team.
Request deletion of your data (subject to ongoing legal obligations).
Request that surga22 restrict the processing of your data in certain circumstances.
Receive your data in a structured format for transfer to another platform should you wish.
Object to the processing of your data for direct marketing purposes at any time.
Like most modern websites, surga22 uses cookies and similar tracking technologies to enhance the user experience, maintain session security, and understand how our platform is used.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Session Cookies | Keeping you logged in during an active session and ensuring secure navigation | Expires when browser is closed |
| Preference Cookies | Saving your language preference, theme, and display settings | 1 year |
| Analytics Cookies | Helping surga22 understand how users interact with the platform | 2 years |
| Security Cookies | Detecting and preventing fraudulent activity and unauthorised access | 30 days |
You can manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the surga22 platform, particularly session cookies required for login.
Handling financial data requires stricter security and privacy standards. surga22 complies with all obligations under Malaysia's anti-money laundering (AML) laws and the Financial Services Act 2013.
When you use Malaysian payment methods such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX via Maybank2u or CIMB Clicks, transactions are processed through payment gateways compliant with PCI-DSS (Payment Card Industry Data Security Standard). surga22 does not store your full card number or e-wallet password — only encrypted transaction tokens are retained in our systems.
The KYC (Know Your Customer) process is a legal requirement that requires you to verify your identity before your first withdrawal can be processed. Documents collected — including copies of your MyKad and proof of address — are stored in an encrypted environment with access strictly restricted to surga22's compliance team only.
Surga22 has a zero-tolerance policy toward use of the platform by individuals under the age of 18. Our platform is not designed for minors and we do not knowingly collect personal information from underage individuals.
If you have any questions, concerns, or requests regarding surga22's Privacy Policy or how we handle your personal data, our privacy team is ready to assist.
More than just a written policy — these are the day-to-day operational standards we uphold at every moment
256-bit SSL encryption protects every byte of data transmitted between your device and surga22's servers — the same standard used by Maybank, CIMB, and Malaysia's major banks.
All of surga22's data handling practices comply with Malaysia's Personal Data Protection Act 2010. Your rights as a data subject are fully respected and upheld.
Surga22 has never sold, rented, or traded members' personal information to any third party for commercial purposes — and we never will. This is our unwavering commitment.
Surga22's systems undergo penetration testing and cybersecurity audits by independent experts on a quarterly basis. Audit findings are used to drive continuous improvements.
Access, correct, download, or request deletion of your data at any time. surga22 processes data rights requests within the timeframes set by Malaysia's PDPA.
No confusing fine print, no hidden data collection. surga22 clearly explains every type of data collected and the reason behind it.
With strict privacy protection and bank-grade security, surga22 is the safest choice for your online entertainment experience in Malaysia.