Your personal data is our responsibility. This Privacy Policy transparently explains how SurgaPlay collects, uses, stores and protects your information in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).
SurgaPlay takes the privacy of your personal data very seriously. As a digital entertainment and online betting platform built exclusively for Malaysian users, we understand that your trust is the most valuable asset we have. Without it, nothing else matters.
This Privacy Policy is written in plain, straightforward English – not confusing legal jargon – so you genuinely understand what happens with your information. We are not fans of fine print that buries the important stuff, which is exactly why this document is made to be as clear as possible.
SurgaPlay operates in accordance and compliance with Personal Data Protection Act 2010 (PDPA) Malaysia in its entirety. This is not merely a legal obligation – it is a core value that guides every data-related decision we make, every day.
SurgaPlay only collects data that is strictly necessary to provide the services you request. We do not collect data excessively or without a clear purpose.
| Data Type | Example | Purpose of Collection |
|---|---|---|
| Identity Information | Full name, MyKad number | Identity verification (KYC), fraud prevention |
| Contact Information | Email, phone number | Account communications, important notices, support |
| Financial Information | Payment method (DuitNow, FPX, TnG), partial account number | Deposit/withdrawal processing in RM |
| Login Information | Username (hashed password) | Account security, verification |
| Game Preferences | Preferred sports, favourite casino games | Personalising your experience on SurgaPlay |
The data we collect is used solely for the following purposes, and nothing beyond that:
SurgaPlay does not sell, rent, or trade your personal data to any third party for their own commercial purposes. This is an absolute commitment we uphold. However, in the normal operation of the platform, we may need to share data with the following limited parties:
SurgaPlay may disclose your data to Malaysian government authorities where required by court order, law enforcement directive, or other legal obligation. In such cases, we will notify you personally unless prohibited from doing so by law.
We invest heavily in security infrastructure to ensure your data is protected to the highest practical standard. The following are the security layers we have in place:
SurgaPlay does not store your data indefinitely. We have a clear data retention policy based on the original purpose of collection and applicable legal requirements:
| Data Type | Retention Period | Reason |
|---|---|---|
| Active account records | For the duration of the active account | Service operational requirements |
| Financial Transaction Records (MYR) | 7 years after the transaction | Malaysia PDPA compliance & financial audit requirements |
| Security logs | 2 years | Fraud investigation and security |
| Support communication records | 3 years | Dispute resolution and quality improvement |
| KYC data (identity verification) | 5 years after account closure | Anti-money laundering (AML) compliance requirements |
| Marketing data (where permitted) | Until you unsubscribe | Consent that can be withdrawn at any time |
Once the retention period expires, your data will be securely deleted or anonymised so it can no longer be linked to your identity.
SurgaPlay uses cookies and similar technologies to keep the platform running smoothly, enhance your experience, and understand how the platform is used. Here are the types of cookies we use:
You can manage your cookie settings through your browser. However, disabling certain cookies may affect the functionality of the SurgaPlay platform.
Under Malaysia's Personal Data Protection Act 2010 (PDPA) and our commitment to privacy, you have the following rights regarding the personal data we hold about you:
Request a copy of the personal data we hold about you in a readable format.
Request a correction to any inaccurate or incomplete data in your SurgaPlay account.
Request the deletion of your data, subject to applicable legal retention obligations.
Object to the processing of your data for marketing purposes at any time through your account settings.
Receive your data in a structured, machine-readable format for transfer to another platform.
Request that SurgaPlay restrict the processing of your data during an active dispute or review.
The SurgaPlay platform is for users aged 18 and above only. We do not knowingly collect or process the personal data of any individual under the age of 18.
If we discover that personal data of an underage individual has been collected inadvertently, we will take immediate action to delete that data and close the account in question. Parents or guardians who suspect their child has registered on SurgaPlay are urged to contact us immediately at support@surgaplay.biz.
SurgaPlay reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or new platform features. When we make material changes, we will:
If you disagree with any changes made, you have the right to close your account and withdraw your remaining balance. Continued use of the SurgaPlay platform after changes take effect will be deemed acceptance of the updated Privacy Policy.
If you have any questions, concerns, or complaints regarding this Privacy Policy or how SurgaPlay handles your personal data, please reach out to us through the following channels:
Six layers of protection we apply every day to safeguard every member's personal information
Every bit of data transmitted between your device and SurgaPlay's servers is protected by the same level of encryption used by Maybank and CIMB Bank Malaysia. No third party can read your data in transit.
SurgaPlay is fully compliant with Malaysia's Personal Data Protection Act 2010 (PDPA). We conduct regular audits of our data practices to ensure ongoing compliance with Malaysian data protection laws.
This is a promise we have never broken: SurgaPlay does not sell, rent or trade your personal data to any party for their own commercial gain. Full stop.
Only SurgaPlay staff who require access to your data to carry out specific duties are permitted to do so. All access is logged and monitored in real time by our security team.
In the event of any security incident affecting your data, SurgaPlay is committed to notifying you within 72 hours – well ahead of what most industry standards require.
All your MYR transactions via DuitNow, FPX (Maybank2u, CIMB Clicks), Touch 'n Go, GrabPay, Boost and ShopeePay are handled by certified payment processors that comply with PCI-DSS security standards.
With 256-bit SSL, full PDPA compliance, and a strict no-data-sale policy, you can play on SurgaPlay with complete peace of mind. Register for free and claim your welcome bonus today.
18+ only. Play responsibly.