Privacy Policy Surga11 – How We Protect the Personal Information of Malaysia Members

This Privacy Policy explains how Surga11 (hereinafter referred to as "we", "our platform", or "Surga11") collects, uses, discloses, stores, and protects the personal information you provide to us when using the platform at surga11.cash.

We take our members' privacy very seriously. For Malaysian residents who register and play at Surga11, your trust is our most valued asset. Every decision regarding data handling is made with your interests and security as a member at the forefront.

By using the platform Surga11 – whether by registering an account, making a deposit, playing games, or simply browsing our website – you consent to the collection and use of your personal data as described in this policy. If you do not agree, please stop using the platform and contact us to close your account.

Surga11 collects various types of information depending on how you interact with our platform. Generally, the data we collect can be grouped into the following categories:

Information You Provide Directly:

• Registration Information: Your full name, Malaysian phone number, email address, and the password you chose when creating your account.
• Identity Verification (KYC) Information: A copy of your MyKad or other valid Malaysian identification document, a verification selfie, and proof of address where required for withdrawal processing or security reviews.
• Financial Information: E-wallet account numbers (Touch 'n Go, GrabPay, Boost, ShopeePay), DuitNow ID, and your Malaysian bank account number – used solely to process deposits and withdrawals in Ringgit Malaysia (RM).
• Communications: Any messages, enquiries, or complaints you send to our support team via live chat or email.

Automatically Collected Data:

• Technical Data: IP address, browser type, device type (Android/iPhone), operating system, screen resolution, and other technical information collected when you access the platform.
• Usage Data: Pages you visit, games you play, time spent per session, login frequency, and your navigation patterns within the platform.
• Transaction Data: A complete record of all deposits, withdrawals, bets, and winnings in your account Surga11 yours.
• Location Data: General location information based on your IP address – used for security purposes and to verify that you are accessing the platform from Malaysia.

Surga11 uses the personal data collected for legitimate and necessary purposes in operating the platform and delivering services to you. The primary purposes for using your data are as follows:

Surga11 will not use your personal data for any purpose not stated above without obtaining your consent first. If you receive any communication from us that you do not wish to receive, you may withdraw your consent at any time by contacting our support team.

Surga11 does not sell, rent, or disclose members' personal information to third parties for their own marketing purposes. We only share data where necessary in the following circumstances:

• Payment Processors: Transaction information that must be shared with Malaysian payment service providers – including Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX-affiliated banks – to process your deposits and withdrawals. These providers maintain their own privacy policies and are obligated to protect any data shared with them.
• Game Providers: Minimum game session information required by slots and game providers (such as Pragmatic Play, PG Soft, Habanero) to operate the games. These providers do not receive your full personal identification details.
• Statutory Authority: Surga11 will disclose personal data to Malaysian government authorities or law enforcement agencies when required to do so by law, court order, or a directive from a competent authority. This includes the Malaysian Anti-Corruption Commission (MACC), the Royal Malaysia Police (PDRM), and Bank Negara Malaysia where relevant to a statutory investigation.
• Technical Service Providers: Companies providing technical infrastructure services – such as server hosting, cloud services, and cybersecurity – are granted only the limited access to data necessary to perform their duties and are bound by strict confidentiality agreements.

Surga11 continuously invests in security infrastructure to ensure our members' personal and financial data is protected at all times. The key security measures we implement are as follows:

• 256-bit SSL Encryption: All communications between your browser or application and our servers Surga11 encrypted using Secure Socket Layer (SSL) with a 256-bit key length – the same standard used by major banks in Malaysia.
• Hashed Password Storage: Your account password is not stored in plain text. It is processed using a secure one-way hashing algorithm, meaning that even if our database were ever accessed without authorisation, your original password cannot be retrieved.
• Strict Access Controls: Staff only Surga11 with a legitimate business need are permitted to access members' personal data. All access is logged and regularly audited.
• Threat Detection System: Our platform is equipped with a 24-hour security monitoring system that detects unauthorised access attempts, cyberattacks, and suspicious activity in real time.
• Regular Security Audits: Surga11 conducting regular security assessments and penetration testing by independent third parties to identify and address vulnerabilities before they can be exploited.
• Two-Factor Authentication (2FA): An additional verification feature is available for members who want to add an extra layer of security to their account login.

Platform Surga11 uses cookies and similar tracking technologies to enhance your browsing experience and ensure certain platform features function correctly.

Types of Cookies We Use:

• Essential Cookies: Required for core platform operations – including maintaining your login session, remembering language preferences, and ensuring session security. Without these cookies, the platform cannot function properly. They cannot be disabled.
• Functional Cookies: Remembering your preferences and settings – such as your interface theme, last game played, and preferred betting limits – so you enjoy a more personalised experience each time you log in.
• Analytics Cookies: Collecting information about how you use the platform – including your most frequently visited pages, time spent, and navigation patterns. This data is used in aggregate form to improve the platform and is not linked to your personal identity.
• Security Cookies: Helps detect suspicious login activity and protect your account from unauthorised access.

You can manage or delete cookies through your browser settings. Please note, however, that disabling certain cookies may affect the functionality of the platform. Surga11. Necessary cookies cannot be disabled without affecting your ability to log in and play.

Under the Malaysia Personal Data Protection Act 2010 (PDPA), you, as the individual whose personal data we process, hold several important rights. Surga11 respects and facilitates the exercise of these rights:

Surga11 retains members' personal data only for as long as necessary to fulfil the purposes described in this policy, or to meet applicable legal requirements. Our general data retention periods are as follows:

• Active Account Data: As long as your account remains active on Surga11, all relevant personal data will be retained to enable us to provide services to you.
• Financial Transaction Records: All deposit and withdrawal records in RM are retained for a minimum of 7 years from the date of the transaction, in line with Malaysia's financial and tax legal requirements.
• KYC Records: Identity verification documents (MyKad and others) are retained for a minimum of 5 years following account closure, in accordance with applicable anti-money laundering (AML) requirements.
• Security Logs: Access logs and security activity records are retained for 12 months for the purpose of security incident investigation and fraud prevention.
• Communication Data: Records of communications with our support team are retained for 2 years for reference and dispute resolution purposes.

When data is no longer needed and there is no legal obligation to retain it, Surga11 will securely delete or anonymise such data using methods that ensure recovery is not possible.

Platform Surga11 is strictly for individuals aged 18 and above. We do not knowingly collect or process personal data from anyone under the age of 18.

If we discover that personal data of a child under 18 years of age has been collected without our knowledge, we will take the following steps immediately:

• Immediate closure of the account in question.
• Permanently deleting all personal data associated with the underage individual.
• Returning any remaining balance to the original payment method used.

Surga11 reserves the right to update or amend this Privacy Policy at any time. Members will be notified of significant changes via their registered email or through a prominent notice displayed on the platform at least 14 days before the changes take effect.

Amendments required immediately for security or legal compliance reasons may take effect with shorter notice or without prior notice. In such cases, we will inform you as soon as reasonably possible after the amendment has been made.

The "Updated" date at the top of this page reflects the date of the most recent revision. Continued use of the Surga11 following the effective date of any amendment shall be considered acceptance of the revised policy. We encourage you to review this page periodically.

If you have any questions, concerns, or wish to submit a request regarding your personal data at Surga11, our team is here to help.

• Privacy Email: support@surga11.cash – include "Data Privacy" in your email subject line to help us resolve your request faster.
• Live Chat: Available on the platform after login – operating 24 hours a day, 7 days a week, including Malaysian public holidays.

Support team Surga11 with Malaysian-language support will handle your privacy requests respectfully and within a reasonable timeframe. For requests that require identity verification (such as data access or deletion), we may need additional proof of identity before the request can be fully processed – this is to safeguard the security of your data.