Privacy Policy SurgaWin – Personal Data Protection for Malaysia Members

1SurgaWin Introduction & Commitment

SurgaWin understands that member trust is our most valuable asset. Much of that trust is built on the confidence that every member's personal information is handled with full responsibility, transparency, and care.

This Privacy Policy describes surgawin's privacy practices regarding the collection, use, disclosure and protection of personal information you provide to us when registering, using or interacting with our platform — whether via website or mobile app.

We comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and international best standards in personal data management. Every surgawin officer handling member data is required to adhere to strict internal data protection policies.

2Personal Information We Collect

SurgaWin only collects information that is strictly necessary to operate our services properly and comply with legal obligations. In general, the information we collect can be divided into two categories:

A. Information you provide directly:

• Full name as stated on your identification card (MyKad)
• An active mobile phone number
• Date of birth for age verification
• Email address (if registered)
• Bank account or e-wallet details for payment purposes
• Copies of identification documents for the KYC process

B. Information collected automatically:

• IP address and device information
• Type and version of web browser used
• Session data and in-platform activity logs
• Deposit and withdrawal transaction records
• Game history and platform usage habits

3How We Use Your Information

Every piece of information we collect has a clear and legitimate purpose. SurgaWin uses members' personal data for the following purposes:

• Account Management: Creating and maintaining member accounts, processing registrations, and ensuring secure access.
• Payment Processing: Securely processing deposits, withdrawals, and all financial transactions within the platform.
• Identity Verification (KYC): Fulfilling legal compliance obligations and keeping the platform free from fraud.
• Platform Security: Detecting and preventing suspicious activity, fraud, and security threats.
• Customer Support: Providing relevant assistance and resolving complaints more efficiently.
• Service Improvement: Analyzing usage patterns to improve the overall platform experience.
• Marketing Communications: Sending relevant promotional information and bonuses (with your consent).
• Legal Compliance: Meeting reporting requirements to the relevant authorities when required.

We do not use your data for any purpose beyond those stated above without first obtaining your consent.

4Information Sharing & Disclosure

SurgaWin does not sell, rent, or trade members' personal information to any third party for marketing purposes. However, in certain situations, we may need to share your information with the following parties:

• Payment Service Providers: Payment processors and banks that assist us in securely completing your financial transactions.
• Game Software Providers: Technology companies that provide games to SurgaWin may receive session data required for game functionality.
• Legal Authorities: We are required to disclose information to the police, courts or regulatory bodies when mandated by law.
• Security Partners: Fraud detection and cybersecurity services that help us protect the platform and its members.

All third parties who receive SurgaWin member data are required to sign a confidentiality agreement and comply with data protection policies equivalent to our own standards.

5Security & Data Protection

We continually invest in the latest security infrastructure to ensure your personal data is always protected. Our security layers include:

• 256-bit SSL encryption for all data transmitted between your device and our servers.
• Passwords are stored using one-way hashing that cannot be decrypted.
• Two-factor authentication (2FA) via OTP for all logins and important transactions.
• Active 24/7 security monitoring by our systems and security team.
• Regular independent security audits to identify and address any vulnerabilities.
• Strict internal access controls — only authorised staff may access member data.
• Secure, encrypted data backups to ensure service continuity.

While no system can guarantee 100% security, SurgaWin applies industry best practices and continuously updates our security measures in line with the latest threat developments.

6Cookies & Tracking Technology

SurgaWin uses cookies and similar tracking technologies to enhance user experience and analyze platform performance. The types of cookies we use are as follows:

• Essential Cookies: Required for core platform functions such as login and navigation. Cannot be disabled.
• Performance Cookies: Collecting statistical information on how you use the platform for continuous improvement purposes.
• Functional Cookies: Saving your preferences such as language and display settings.
• Session Cookies: Automatically deleted when you close your web browser.

You can manage or block cookies through your web browser settings. However, disabling certain cookies may affect the functionality of the surgawin platform.

7Your Rights Regarding Personal Data

As a SurgaWin member, you have certain rights regarding your personal data that are protected under Malaysian law:

• Right of Access: You have the right to know what personal data we hold about you.
• Right to Rectification: You can request that we correct any inaccurate or incomplete data.
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data.
• Right to Object: You can object to the processing of your data for direct marketing purposes.
• Right to Portability: You can request a copy of your data in a portable format.
• Right to Withdraw Consent: You can withdraw your consent at any time.

To exercise any of the above rights, please contact the SurgaWin support team via the platform's live chat. We will process your request within a reasonable timeframe, typically within 14 business days.

8Data Retention Period

SurgaWin retains members' personal data only for as long as necessary for the stated purposes or as required by applicable law:

• Active account data is retained for as long as your account remains active at surgawin.
• Financial transaction records are retained for a minimum of 7 years for financial legal compliance purposes.
• Security and activity logs are retained for 12 months for security investigation purposes.
• Once an account is closed, personal data no longer required for legal obligations will be deleted or de-identified within 90 days.

Once the retention period ends, data will be securely deleted using methods that ensure it cannot be recovered.

9Children's Privacy & Protection of Young Users

SurgaWin takes the protection of children and minors seriously. Our platform is strictly for users aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18.

If we determine that a person under the age of 18 has registered or provided personal information to us, we will immediately delete that information and close the account in question. Parents or guardians who discover their child has registered on SurgaWin may contact us for immediate action.

10Amendments to This Privacy Policy

SurgaWin reserves the right to amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or service improvements. When material changes occur, we will:

• Displaying clear notices within the platform before changes take effect.
• Updating the "Last Updated" date at the top of this page.
• Sending notifications to members via registered communication channels.

Continued use of the SurgaWin platform after changes take effect constitutes acceptance of the amended Privacy Policy. All previous versions of this Privacy Policy are kept on record and may be requested from our support team.

11How to Contact Us Regarding Privacy

If you have any questions, concerns or complaints regarding this Privacy Policy or how we handle your personal data, please contact the surgawin privacy team through the following channels:

• Live Chat within the SurgaWin platform — available 24/7 for immediate responses.
• Support email: [email protected] (displayed for reference only).

We are committed to addressing every privacy-related enquiry seriously and responding within a reasonable timeframe. For more complex issues, we aim to resolve them within 14 business days.

You may also refer to Terms and Conditions or FAQ page us for additional information about your rights and responsibilities as a SurgaWin member.