Privacy Policy SurgaVIP — Protecting Your Personal Data

SurgaVIP collects various types of information from members and users of our platform to ensure the services we provide are safe, efficient, and meet your needs. The information we collect can be divided into three main categories:

Information You Provide Directly

• Full name, date of birth, and identity card or passport number during the registration and KYC verification process.
• Email address and mobile number used as login credentials and communication channels.
• Residential address required for legal compliance and identity verification.
• Bank account or digital wallet details registered for deposit and withdrawal purposes.
• Any information you voluntarily provide when contacting our customer support team.

Automatically Collected Information

• IP address, device type, device model, operating system, and web browser version used.
• Activity log data including login times, pages visited, session duration, and in-platform actions.
• General geolocation data based on IP address for security and compliance purposes.
• Technical performance data such as response times and error reports for service improvement.

Transaction Information

• Records of all deposit, withdrawal, and wagering transactions made through the platform.
• Bonus and promotion history associated with your account.
• Information related to the payment method used, without storing full card numbers.

Every piece of information we collect is used for a clear and lawful purpose. surgavip does not use your data for any purpose not stated in this policy. The following are the primary ways we use your information:

For marketing communications via email or SMS, you may withdraw your consent at any time by clicking the "unsubscribe" link in any of our promotional emails or by contacting our customer support team directly.

SurgaVIP does not sell or trade your personal data to any party for commercial purposes. However, there are limited situations where we may need to share your information with trusted third parties:

• Payment Service Providers: Transaction information that must be shared with payment processors such as FPX, DuitNow, and digital wallet providers to facilitate deposits and withdrawals.
• KYC Service Providers: Identity verification documents are shared with certified third-party identity verification partners to meet legal compliance requirements.
• Game Providers: Technical information required to be shared with game software providers to ensure gaming sessions function correctly.
• Authorities: We are legally required to disclose certain information to regulatory authorities, law enforcement agencies, or courts when a valid order mandates it.
• Professional Consultants: Our lawyers, accountants, and auditors may access necessary data, subject to strict professional confidentiality obligations.

All third parties with whom we share data are bound by data processing agreements that require them to protect your information to the same or higher security standards that we apply ourselves.

The security of your personal data is our absolute priority. SurgaVIP continuously invests in security infrastructure to ensure your information is always protected:

• All Data Encrypted: Personal data is encrypted using AES-256 encryption at rest and SSL/TLS encryption in transit.
• Layered Access Controls: A role-based access control (RBAC) system ensures that only staff who require access to specific data are permitted to do so.
• Continuous Monitoring: Our 24/7 security monitoring system detects any unauthorized access attempts or unusual activity in real time.
• Penetration Testing: Security audits and penetration testing are conducted periodically by independent third parties to identify and address vulnerabilities.
• Data Backup: Data is automatically backed up and stored in a secure location to ensure service continuity.

Data Retention Period: SurgaVIP retains members' personal data for as long as the account is active and for a minimum period of 5 years after account closure, to comply with applicable legal and regulatory requirements. Data that is no longer needed will be securely deleted or anonymized.

SurgaVIP uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored in your browser when you visit our website. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login session authentication and security. These cookies cannot be disabled without affecting platform functionality.
• Preference Cookies: Saving your preferences such as language, time zone, and display settings so you do not need to reconfigure them each time you log in.
• Analytics Cookies: Collecting aggregated and anonymised data on how you use our platform to help us understand usage patterns and improve our services.
• Security Cookies: Helping detect and prevent fraudulent activity, including suspicious login attempts and cyberattacks.

You can manage or delete cookies through your web browser settings. Please note that disabling essential cookies may affect your ability to use certain features of our platform.

As a surgavip member, you have clear rights regarding your personal data. We fully respect these rights and provide straightforward mechanisms for you to exercise them:

To exercise any of the above rights, please contact our customer support team via live chat available 24/7 or by email at [email protected]. We will process your request within 30 days from the date of receipt.

SurgaVIP is a platform intended exclusively for individuals aged 18 years and above only. We do not intentionally collect, store, or process personal data of individuals under the age of 18.

If you are a parent or guardian who believes your underage child has registered or provided personal information to surgavip, please contact us immediately. We will take prompt action to verify and delete that information from our systems, and close the account in question.

In operating our global platform, your personal data may be transferred to and stored on servers located outside Malaysia. SurgaVIP ensures that any such data transfers are carried out with adequate safeguards:

• We only use cloud service providers that hold internationally recognised security certifications such as ISO 27001 and SOC 2.
• All agreements with overseas service providers require data protection standards equivalent to Malaysian legislation.
• Transferred data remains encrypted both in transit and at rest at overseas locations.

The surgavip platform is a self-contained website with no outbound links to unrelated third-party sites. However, if you access game provider or payment provider services integrated within our platform, those services may have their own privacy policies.

SurgaVIP is not responsible for the privacy practices of integrated third-party providers. We encourage you to review their respective privacy policies if you have any concerns.

SurgaVIP reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform improvements. When a significant amendment occurs, we will:

• Updating the "Last Updated" date at the top of this document.
• Sending notifications to the email address registered on your account.
• Displaying a clear notice on the main platform page for at least 14 days.

Continued use of the surgavip platform after any amendments constitutes your acceptance of the updated policy. If you disagree with the amendments, you have the right to close your account and withdraw any remaining balance before the amendments take effect.

If you have any questions, concerns, or wish to exercise your privacy rights, our team is ready to assist through the following channels:

• Live Chat: Available 24/7 directly through the SurgaVIP platform for immediate response.
• Email: [email protected] — we aim for a response time within 24 hours on business days.

For formal privacy complaints, please state "Privacy Complaint" in your message subject so it can be routed promptly to our privacy officer. All complaints will be reviewed thoroughly and responded to within 14 working days.