Privacy Policy surg55 — Our Commitment to Protecting Your Data

Surg55 is an online casino platform operating in Malaysia, committed to protecting the privacy and data security of every member on our platform. This Privacy Policy is an official document that explains in detail how we collect, store, use, disclose and protect your personal information when you use the surg55.pro website and all related services.

By registering an account or using the surg55 platform, you are deemed to have read, understood, and agreed to all provisions in this Privacy Policy. If you do not agree with any part of this document, please discontinue use of our platform and contact the support team to close your account.

This Privacy Policy should be read together with Terms and Conditions surg55 and Responsible Gambling Policy us. These three documents together form a comprehensive agreement between you and surg55 regarding use of the platform.

Surg55 collects various types of personal information depending on how you interact with our platform. All data collection is carried out transparently and only for legitimate purposes.

Data you provide directly:

• Full name as shown on official identification (MyKad or passport)
• Date of birth and gender
• Active email address registered in your name
• A Malaysian mobile number registered in your name
• Residential address including state and postcode
• Bank account or e-wallet details for processing deposits and withdrawals
• Copies of identification documents for the KYC verification process when required

Data collected automatically during platform use:

Surg55 only collects and processes your personal data for the following legitimate and necessary purposes:

• Account Management — to create, verify and manage your member account on the surg55 platform, including the required KYC (Know Your Customer) process.
• Transaction Processing — to securely process your deposits and withdrawals via supported payment methods such as DuitNow, FPX, TNG eWallet, GrabPay and Boost.
• Identity Verification — to verify that you meet the minimum age requirement of 21 years and to prevent the use of false identities on our platform.
• Security & Fraud Prevention — to detect and prevent fraudulent activity, money laundering and any misuse of the platform.
• Legal Compliance — to fulfil our obligations under Malaysian law including PDPA 2010, the Anti-Money Laundering Act 2001 and applicable gambling regulations.
• Service Communications — to send you important notifications regarding your account, transactions, security updates and policy changes.
• Product Improvement — to analyse aggregated usage patterns to improve the user experience, platform performance and the range of games offered.
• Marketing Communications — to send you promotional information, bonuses and exclusive offers, only if you have given consent to receive such communications.

Surg55 takes a highly cautious approach to sharing members' personal data. We do not sell, do not rent and do not trade your personal data to any third party for their own marketing purposes.

However, there are limited situations where we need to share your information with certain parties:

• Platform Service Providers — game software providers (such as Pragmatic Play, Evolution Gaming) that require minimal technical data to deliver gaming services to you. All such providers are bound by strict confidentiality agreements with surg55.
• Payment Processors — financial institutions and payment gateways that process your deposit and withdrawal transactions. Information shared is limited to what is necessary to complete the transaction only.
• Legal Authorities — we may be required to disclose information to Malaysian government authorities or law enforcement bodies when ordered by a court order or where there is a legitimate legal requirement.
• Auditors & Security Experts — third parties appointed to conduct security audits, financial audits or compliance assessments of the surg55 platform. These parties are bound by binding confidentiality agreements.

Surg55 invests seriously in security infrastructure to protect members' personal data. The technical and organisational security measures we implement include:

• 256-bit SSL/TLS Encryption — all communications between your device and surg55 servers are encrypted using the highest industry-standard encryption protocols.
• Data Encryption at Rest — personal data stored in our databases is encrypted using AES-256 algorithms, ensuring data security even in the event of unauthorised physical access to servers.
• Multi-Layered Firewall — surg55 servers are protected by firewall systems and intrusion detection systems (IDS/IPS) that monitor incoming and outgoing traffic in real time.
• Role-Based Access Control — internal surg55 staff may only access data required for their duties. All access is logged and continuously monitored.
• Regular Penetration Testing — surg55 conducts regular penetration testing by independent security experts to identify and remediate any vulnerabilities before they can be exploited.
• Two-Factor Authentication — you can and are encouraged to enable 2FA on your surg55 account as an additional layer of security.

While we take all reasonable steps to protect your data, no system can guarantee 100% absolute security. In the event of any data security breach affecting your personal data, surg55 will notify you within the timeframe required by applicable law.

The surg55 platform uses cookies and similar tracking technologies to enhance your user experience and ensure the platform functions correctly. The following are the types of cookies we use:

• Essential Cookies (Required) — these cookies are required for core platform functions such as login authentication, game session management and security. Without them, the platform will not function properly. These cookies cannot be disabled.
• Preference Cookies — these cookies remember your settings and preferences such as your preferred language, display layout and favourite games to provide a more personalised experience.
• Analytics Cookies — we use aggregated analytics data (not individual data) to understand how members use the platform, which pages are most popular and where improvements are needed. You may disable analytics cookies.
• Marketing Cookies — used to display relevant promotions and advertisements to you based on your interests. You can control these cookies through your browser settings.

To manage or delete cookies, you can adjust the settings in your browser. Please note that disabling certain cookies may affect the functionality of some surg55 platform features.

Under the Malaysia Personal Data Protection Act 2010 (PDPA) and surg55's policy, you have the following rights regarding your personal data:

To exercise any of the above rights, please contact the surg55 data protection team through our support channels. We will process your request within 30 business days of receipt. Please note that some deletion requests may not be fully fulfilled if the relevant data is required to comply with legal obligations.

Surg55 only retains your personal data for as long as necessary to fulfil the purposes stated in this Privacy Policy or as required by law. Our retention period guidelines are as follows:

• Active Account Data — retained for the duration your account is active and up to 7 years after account closure for legal compliance and audit purposes.
• Financial Transaction Records — retained for a minimum of 7 years in accordance with Malaysia's accounting and anti-money laundering legal requirements.
• KYC & Identity Verification Records — retained for 7 years after the date of verification or account closure, whichever is later.
• Technical Log Data — access and security logs are retained for 12 months for security incident investigation purposes.
• Support Communication Records — retained for 3 years from the date the issue is resolved.
• Marketing Data — retained until you withdraw your consent to receive marketing communications.

Once the designated retention period has expired, your personal data will be securely deleted or anonymised using methods that ensure the data cannot be recovered or identified.

The surg55 platform is for adult members aged 21 and above only. We do not intentionally collect, process, or store personal data of individuals under the age of 21.

All registrants are required to confirm that they are 21 years of age or older at the time of account registration. Our KYC process further verifies this age information through valid identity document checks.

Surg55 reserves the right to update or modify this Privacy Policy at any time. Changes may be made in response to changes in law, new industry practices, or improvements to our services.

For changes considered significant — such as changes to how we use or share your personal data — we will:

• Posting a prominent notice on the surg55.pro homepage for at least 14 days before changes take effect
• Sending notifications to the member's registered email address
• Displaying a notice on your account dashboard upon login

The "Last Updated" date at the top of this document will always reflect the latest version of the surg55 Privacy Policy. Continued use of the platform after any changes take effect will be considered your acceptance of the updated Privacy Policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way surg55 handles your personal data, our data protection team is ready to assist through the following channels:

• Live Chat — available 24 hours a day, 7 days a week directly within the surg55 platform
• Email — [email protected]
• FAQ Page — for frequently asked questions, visit FAQ page we

We are committed to responding to all privacy-related enquiries within 5 working days from the date of receipt. For complaints requiring further investigation, we will keep you informed of the progress within 14 business days.