Surgagg Privacy Policy – Malaysia User Data Protection

1 Introduction and Scope of This Policy

Surgagg understands the importance of privacy to Malaysian users and is committed to protecting your personal data to the highest standard. This Privacy Policy is formulated in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international best practices in data protection.

This policy applies to all personal data you provide to us through various channels — including during account registration, platform usage, financial transactions, interactions with our support team, and any other communications with surgagg.

We encourage you to read this document carefully. If you disagree with any aspect of this policy, you are advised not to use our platform. Enquiries regarding this policy may be directed to our support team at any time.

2 Types of Personal Data We Collect

Surgagg collects various types of personal data depending on how you interact with our platform. The following are the main categories of data collected:

We also collect data you provide voluntarily, such as feedback, surveys, or additional information during the account verification process. All data collection is carried out transparently and solely for legitimate purposes.

3 How We Use Your Personal Data

Personal data collected by surgagg is used solely for legitimate and transparent purposes. The following are the primary purposes for which your data is used:

• Account Management: Creates, verifies, and maintains your account on the surgagg platform, including the mandatory KYC process.
• Transaction Processing: Processes your deposits, withdrawals, and all financial transactions securely and accurately.
• Service Provision: Enables you to access all games, platform features, and services provided by surgagg.
• Platform Security: Detects and prevents fraud, money laundering, unauthorised access, and suspicious activity.
• Service Communications: Sends important notifications regarding your account, transactions, terms changes, and security updates.
• Customer Support: Assists you whenever questions, complaints, or technical issues arise.
• Legal Compliance: Fulfils applicable legal and regulatory obligations, including reporting requirements to the relevant authorities.
• Platform Improvements: Analyses aggregate usage patterns to continuously improve the user experience.

Surgagg does not use your data to make automated decisions that have a significant impact on you without human involvement in the evaluation process.

4 Data Sharing and Disclosure

Surgagg does not sell, rent, or trade your personal data to third parties. However, there are limited situations where we may need to share your data with certain parties:

• Service Providers: Third parties that assist us in operating the platform, such as payment processors, cloud service providers, and identity verification companies — all bound by strict confidentiality agreements.
• Legal Authorities: When required by a court order, official investigation, or directive from a legitimate regulatory authority.
• Fraud Prevention: With security partners for the purpose of detecting and preventing fraud, money laundering, or other security threats.
• Business Transfers: In the event that surgagg undergoes a merger, acquisition, or asset transfer — users will be notified in advance.

5 Data Security and Protection

Surgagg continually invests in industry-grade security infrastructure to ensure your personal data remains protected at all times. The key security measures we implement include:

• 256-bit SSL Encryption: All data transmitted between your browser and the surgagg platform is protected with the highest level of encryption.
• Encryption of Stored Data: Sensitive data stored in our databases is encrypted using strong encryption algorithms.
• Layered Access Control: Only authorised staff with a legitimate job requirement may access user data, and every access is logged and monitored.
• Continuous Monitoring: Active security monitoring systems operate 24 hours a day, 7 days a week to detect any unusual activity.
• Regular Security Testing: Penetration testing and security audits are conducted periodically by independent parties.
• Two-Factor Authentication: Two-factor authentication (2FA) is available for all user accounts as an additional layer of protection.

While we do everything possible to protect your data, no system is ever 100% immune to all threats. You also play an important role in keeping your account secure by using a strong password and not sharing your login credentials.

6 Use of Cookies and Tracking Technologies

Surgagg uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you browse our website.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as login authentication and session security. Cannot be disabled.
• Performance Cookies: Collects information on how users interact with the platform to help us improve performance and the user experience.
• Functional Cookies: Saves your preferences such as language, display settings, and other options for your convenience.
• Analytics Cookies: Helps us understand aggregate traffic patterns and platform usage that cannot be individually identified.

You can manage cookie settings through your browser. However, disabling essential cookies may affect the functionality and security of your surgagg account.

7 Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have certain rights regarding your personal data held by surgagg. We respect and facilitate the exercise of these rights:

8 Data Retention Period

Surgagg retains your personal data only for as long as necessary to fulfil the purposes stated in this policy or as required by law. Our data retention guidelines are as follows:

• Active Account Data: Retained for the duration your account is active and up to 5 years after account closure for legal compliance purposes.
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with Malaysia's financial and tax legal requirements.
• Security Logs: Retained for 12 months for security incident investigation purposes if required.
• Support Communication Records: Retained for 3 years after the last interaction for reference and service improvement purposes.
• Cookie Data: The validity period depends on the cookie type, ranging from the current session up to a maximum of 12 months.

Upon expiry of the retention period, your data will be securely deleted or anonymised so that it can no longer be linked to any specific individual.

9 Protection of Underage Users

The surgagg platform is strictly for users aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18.

Should we discover that a child's personal data has been collected without proper age verification, we will take immediate steps to:

• Immediately suspends the account in question.
• Removes all related personal data from our systems.
• Returns any remaining fund balance once verification has been completed.

Parents or guardians who suspect their child has registered on the surgagg platform are urged to contact us immediately via our support email so that appropriate action can be taken without delay.

10 Changes to This Privacy Policy

Surgagg reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or new platform features. We encourage you to review this page periodically.

When we make significant changes to this policy, we will:

• Updates the "Last Updated" date at the top of this page.
• Sends notifications to registered users via email or in-platform notifications.
• In the case of major changes that affect user rights, we may seek your renewed consent before the changes take effect.

Continued use of the surgagg platform after the effective date of any Privacy Policy amendment is considered your acceptance of the latest version of that policy.

11 Contact Us Regarding Privacy

If you have any questions, concerns, or wish to exercise your rights regarding personal data, our team is ready to assist through the following channels:

• Privacy Email: [email protected] — for privacy enquiries and data requests
• Live Chat: Available 24/7 via the chat icon on the platform for immediate assistance
• FAQ Page: Visit FAQ section for quick answers

We are committed to responding to all privacy-related enquiries within 14 business days. For more complex requests such as full data exports or account deletion, processing may take up to 30 business days.