Important Note: This Privacy Policy explains how SurgaWin collects, uses, discloses, and protects your personal information. By using our platform, you agree to this Privacy Policy. Please read it carefully before registering.
All data transmitted between your device and SurgaWin's servers is protected by industry-grade encryption.
SurgaWin never sells or rents your personal data to any advertiser or third party.
We operate in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international standards.
You have the right to access, correct, transfer, and request deletion of your personal data at any time.
You have full control over non-essential cookies through your browser settings or preference panel.
This policy is updated periodically to reflect changes in legislation and industry best practices.
Quick Summary – SurgaWin Data & Protection
| Item | SurgaWin Policies |
|---|---|
| Data Controller | SurgaWin (surgawin.biz) |
| Applicable Law | Personal Data Protection Act 2010 (PDPA), Malaysia |
| Data Transmission Encryption | TLS / SSL 256-bit |
| Sale of Data to Third Parties | No – strictly prohibited |
| Data Retention Period (Active Accounts) | For the duration of the active account + 7 years after closure |
| Right to Data Erasure | Yes – request via support |
| Payment Data (TnG, GrabPay, DuitNow, etc.) | Not stored directly – processed through a secure gateway |
| Marketing Emails | Opt-in only – unsubscribe at any time |
| Age Restriction | 18 years and above |
1 Introduction & Scope of This Policy
SurgaWin ("we", "platform") is committed to protecting the privacy of every member and user of our platform. This Privacy Policy transparently explains how we handle your personal information when you visit, register, or use any service on SurgaWin.
This policy applies to all users of the SurgaWin platform, including the website, mobile app, and any related service channels. It covers all forms of personal data processing carried out by SurgaWin, whether directly or through appointed third-party service providers.
SurgaWin operates in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international data protection standards. We regard your privacy not merely as a legal obligation, but as an ethical responsibility we take seriously.
✅ Our Core Principles: SurgaWin collects only what is strictly necessary, retains it only for as long as needed, protects it with the latest technology, and never sells it to any third party.
2 Personal Data We Collect
SurgaWin collects several categories of information depending on how you interact with our platform. Below is a full breakdown of the data we may collect:
A. Data You Provide Directly
- Registration Information: Full name, phone number, email address, date of birth, and password (stored as an unreadable hash).
- Identity Verification (KYC): MyKad number, front and back MyKad images, proof of address (utility bills, bank statements), and an identity verification selfie where required.
- Financial Information: Payment method details (account holder name, partially masked account number for Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, or FPX). Note: SurgaWin does not store your full card number or e-wallet PIN.
- Communications: Any messages, complaints, or feedback you submit to the SurgaWin support team.
B. Automatically Collected Data
- Technical Data: IP address, browser type and version, operating system, screen resolution, and device time zone.
- Usage Data: Pages visited, session duration, click actions, games played (baccarat, poker, slots, live casino, football betting), and account setting preferences.
- Transaction Data: Records of all deposits, withdrawals, bets, and winnings for audit, fraud prevention, and regulatory compliance purposes.
- Location Data: General geographic location based on IP address, used to verify permitted regions. We do not track your precise GPS location.
C. Data from Third-Party Sources
- Identity verification information from SurgaWin-appointed KYC agents, where verification is required.
- Information sourced from fraud prevention and anti-money laundering (AML screening) lists.
⚠️ Data Minimisation Principle: SurgaWin only collects data that is strictly necessary to deliver our services. We do not collect sensitive data such as health information, religious beliefs, or political views.
3 How SurgaWin Uses Your Data
Your personal data is used by SurgaWin for the following purposes, each of which has a valid legal basis under the PDPA:
- Account Management: Creating and maintaining your SurgaWin account, processing logins, and managing your preference settings.
- Service Provision: Enables you to play baccarat, poker, slots, Live Casino, Malaysia Super League and EPL Sports Betting, and all other games on the SurgaWin platform.
- Payment Processing: Securely processing deposits and withdrawals via Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, and FPX.
- Identity Verification (KYC): Fulfilling legal obligations related to age verification, fraud prevention, and anti-money laundering.
- Platform Security: Detecting and preventing fraud, account misuse, unauthorised access, and other unlawful activities.
- Customer Support: Responding to enquiries, resolving complaints, and providing technical support to SurgaWin members.
- Platform Improvement: Analysing usage patterns in aggregate (not at an individual level) to improve the user experience and develop new features.
- Marketing Communications: Sending information about SurgaWin promotions, bonuses, and the latest offers – only if you have agreed to receive them (opt-in).
- Legal Compliance: Meeting the reporting and compliance obligations required under applicable Malaysian law.
4 Data Sharing & Disclosure
SurgaWin does not sell, rent, or share your personal data with third parties for their own marketing purposes. Your data may only be disclosed in the following limited circumstances:
A. Appointed Service Providers
SurgaWin works with selected third-party service providers to help operate the platform. These include:
- Payment Gateway: Processors for Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, and FPX to facilitate financial transactions.
- KYC Provider: Accredited identity verification services to meet compliance requirements.
- Game Providers: Companies such as Evolution Gaming and Pragmatic Play that provide gaming software. Only data necessary for game delivery is shared.
- Cloud Infrastructure: Hosting and CDN providers that securely store and distribute platform data.
All service providers are bound by strict data processing agreements and are not permitted to use your data for their own purposes.
B. Legal Requirements
SurgaWin may disclose personal data where required by law, court order, or a lawful request from a relevant Malaysian authority in connection with criminal investigations, fraud prevention, or regulatory compliance.
✅ Our Commitment: In all data-sharing instances, SurgaWin ensures only the minimum necessary data is shared, and all receiving parties are bound by strict confidentiality obligations.
5 Data Security – How We Protect Your Information
SurgaWin takes data security seriously. We implement multiple layers of technical and procedural safeguards to protect your personal data from unauthorised access, alteration, disclosure, or destruction.
- Transmission Encryption: All communications between your device and SurgaWin's servers are protected by 256-bit TLS/SSL protocol.
- Storage Encryption: Sensitive data such as identity verification information is stored in encrypted form within our database.
- Access Controls: Only SurgaWin staff who require access to carry out their duties may view member personal data, and all access is logged and audited.
- Two-Factor Authentication (2FA): Available to all member accounts as an additional layer of protection.
- 24/7 Monitoring: Continuous security monitoring systems detect and alert on suspicious activity in real time.
- Regular Security Audits: SurgaWin conducts regular penetration testing and security audits carried out by independent experts.
- Incident Response Plan: We have clear procedures in place to respond to any data breaches that may occur, including notifying the relevant authorities and affected members within the timeframes required by law.
⚠️ Shared Responsibility: While SurgaWin takes all reasonable steps to protect your data, account security also depends on you. Please keep your password safe, enable 2FA, and report any suspicious activity to us immediately.
6 Cookies & Tracking Technologies
SurgaWin uses cookies and similar tracking technologies to enhance your experience on our platform. Below is a detailed explanation of the types of cookies we use:
| Cookie Type | Purpose | Duration | Can Be Disabled? |
|---|---|---|---|
| Essential Cookies | Session login, security, and core SurgaWin platform functionality | Session / 30 days | No |
| Preference Cookies | Save your language, theme, and display preference settings | 1 year | Yes |
| Analytics Cookies | Understanding usage patterns to improve the platform (aggregated data, not individual) | 2 years | Yes |
| Security Cookies | Detecting suspicious login attempts and protecting your account | Session | No |
You can manage non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of some parts of the SurgaWin platform. For more information on managing cookies in your browser, refer to your browser's documentation.
7 Data Retention Period
SurgaWin retains your personal data only for as long as it is needed for the purposes stated in this Policy, or as required by applicable law.
- Active Account Data: Retained for as long as your account is active and for 7 years following account closure, in accordance with PDPA and financial regulations.
- Financial Transaction Records: Retained for a minimum of 7 years from the transaction date, in accordance with Malaysian accounting legislation.
- KYC Documents: Retained for the duration required under applicable Anti-Money Laundering (AMLA) legislation.
- Support Communication Logs: Retained for 2 years for service quality and dispute resolution purposes.
- Aggregated Analytics Data: May be retained indefinitely as it contains no personally identifiable information.
When the retention period expires or you request deletion, SurgaWin will securely delete or anonymise your data in accordance with established procedures, except where extended retention is required by law.
8 Your Rights Under PDPA
As a SurgaWin member and an individual protected under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you. Requests will be processed within 21 business days.
If any of your personal data is inaccurate or out of date, you may request a correction at no charge.
You may request the deletion of your personal data, subject to any applicable legal retention obligations.
You may request that we restrict the processing of your data in certain circumstances while a dispute is being resolved.
You have the right to receive your data in a structured, machine-readable format for transfer to another platform.
You may object to the processing of your data for direct marketing purposes at any time. Requests will be actioned immediately.
To exercise any of the rights above, please contact SurgaWin's Data Privacy Officer at privacy@surgawin.biz or via our support live chat. We will respond within 21 business days of receiving a complete request.
9 Child Protection
SurgaWin is an online entertainment platform that restricted to individuals aged 18 and above only. We take child protection very seriously.
SurgaWin does not knowingly collect, store, or process the personal data of any individual under the age of 18. All registrations go through a strict age verification and KYC process.
If you believe someone under the age of 18 has registered an account on SurgaWin, please notify us immediately at privacy@surgawin.biz. We will investigate and close the account, and delete all associated data without delay.
✅ Parental Responsibility: We encourage parents and guardians to monitor their dependants' online activities and make use of parental control tools available on their devices to prevent access to platforms unsuitable for children.
10 Amendments to This Privacy Policy
SurgaWin reserves the right to modify or update this Privacy Policy from time to time to reflect changes in our practices, the latest legal requirements, or improvements in privacy protection.
When we make material changes to this Policy, we will:
- Updating the "Last Updated" date at the top of this page.
- Sending email notifications to all registered SurgaWin members regarding important changes.
- A clear notice will be displayed on the platform for at least 30 days before any changes take effect.
Your continued use of the SurgaWin platform after an amended Policy takes effect will be considered your acceptance of those changes. If you do not agree with any changes, you have the right to close your account and request deletion of your data.
11 Contact SurgaWin's Data Privacy Officer
For any questions, complaints, or requests related to your privacy and personal data at SurgaWin, please contact us through the following channels:
Privacy Email
Privacy@surgawin.biz
Response within 21 business days
Live Chat Support
Available 24/7
Average response time < 3 minutes
General Support
Support@surgawin.biz
For general enquiries
Response Time
Privacy Enquiries: 21 days
Urgent complaints: 5 business days
If you are not satisfied with our response to your privacy complaint, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia or the relevant data protection authority.
Feel Safe? Join SurgaWin Today
Your data is protected by 256-bit SSL, governed by Malaysia's PDPA, and never sold to third parties. Register for free and start playing safely with SurgaWin.
For Malaysian citizens aged 18 and above only.