Privacy Policy — Surya88

This Privacy Policy ("Policy") issued by Surya88 ("we", "us", "our", "the Platform") and applies to all personal data collected from individuals ("you", "the User", "the Player") who register an account with, visit, or otherwise interact with the Surya88 platform at https://surya88.cam and all associated mobile and digital interfaces.

Surya88 is Malaysia's trusted online sports betting and casino platform, serving players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and throughout the country. In delivering our services — including sports betting on Liga Super Malaysia, EPL, UFC, and other competitions live casino games, high-RTP slots, lottery, and arcade products — we necessarily process certain categories of personal data. This Policy governs how that data is handled.

By registering an account or continuing to use the Surya88 Platform, you acknowledge that you have read and understood this Privacy Policy. Please read it carefully alongside our Terms & Conditions. If you have any questions, our support team is available 24/7.

The following definitions apply throughout this Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, as defined under applicable data protection legislation.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, Surya88 acts as the Data Controller for all personal data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of Surya88, pursuant to a data processing agreement.
• "KYC" (Know Your Customer) — the identity verification process conducted by Surya88 to confirm a Player's identity and comply with anti-money laundering and responsible gambling obligations.
• "Cookies" — small text files placed on your device by the Platform for functional, analytical, and preference-management purposes.
• "Sensitive Personal Data" — categories of personal data warranting heightened protection, including government-issued identity document numbers, financial account details, and health-related information (where applicable in responsible gambling context).

Surya88 collects the following categories of personal data:

Surya88 does not intentionally collect personal data from individuals under the age of 21 and does not process special categories of sensitive personal data (such as racial or ethnic origin, political opinions, or biometric data) except where explicitly required by applicable law or regulation.

Surya88 collects personal data through the following channels:

• Directly from you — when you complete account registration, submit KYC documents, make a deposit or withdrawal, contact customer support, set responsible gambling limits, or participate in promotions.
• Automatically — through the use of cookies, log files, and similar tracking technologies that record technical data about your device and browsing activity on the Platform. See Section 8 for full details on cookies.
• From payment processors and verification partners — when you make a payment via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, RHB, or any other supported payment method, our payment processor partners may share transaction confirmation data with us.
• From identity verification services — where we engage a third-party KYC provider to assist with document verification, that provider may supply verification status data to Surya88.

Surya88 processes personal data only where a valid legal basis exists for doing so. The primary legal bases under which we process your data are as follows:

• Contractual necessity — processing required to create, maintain, and perform the user account agreement and to deliver the services you have requested, including processing deposits and withdrawals, settling bets, and managing your account balance.
• Legal obligation — processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and financial record-keeping requirements.
• Legitimate interests — processing necessary to pursue Surya88's legitimate business interests where those interests are not overridden by your rights, including fraud detection, security monitoring, Platform improvement, and responsible gambling programme management.
• Consent — where we have obtained your explicit consent prior to processing, such as for the sending of promotional communications or the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

Surya88 uses your personal data for the following specific purposes:

• To create, manage, and verify your Account, including confirming your age (21+) and identity;
• To process your deposits and withdrawals via Malaysian payment channels including Touch 'n Go eWallet, DuitNow, FPX, and supported banks;
• To settle your bets, credit your winings, and maintain an accurate account balance;
• To comply with Anti-Money Laundering (AML) and Know Your Customer (KYC) obligations, including transaction monitoring and reporting as required by applicable law;
• To deliver customer support services across Live Chat, WhatsApp, and email channels, and to maintain records of those interactions;
• To administer responsible gambling tools you have requested, including deposit limits, cool-off periods, and self-exclusion;
• To detect, investigate, and prevent fraud, account abuse, prohibited conduct, and security breaches;
• To send you transactional communications relating to your account, such as deposit confirmations, withdrawal notifications, and account security alerts;
• To send you promotional and marketing communications where you have opted in to receive them;
• To improve the Platform, personalise your user experience, and conduct internal analytics to understand how players use our services;
• To enforce our Terms & Conditions and other applicable policies.

Surya88 does not sell personal data. We share personal data with third parties only in the following limited circumstances, and only to the extent strictly necessary:

• Payment processing partners — Malaysian payment service providers (including e-wallet operators and banks) receive transaction data necessary to process deposits and withdrawals on your behalf;
• Identity verification providers — third-party KYC service providers engaged to assist with document verification and identity checks may process identity data as Data Processors under our instruction;
• IT and infrastructure providers — cloud hosting, data storage, and platform infrastructure vendors who process data as Data Processors pursuant to contractual data protection obligations;
• Regulatory and law enforcement authorities — Surya88 may be required by law to disclose personal data to regulatory bodies, law enforcement agencies, or courts in response to valid legal requests or regulatory inquiries;
• Fraud prevention and security organisations — where disclosure is necessary to prevent, detect, or prosecute fraud, money laundering, or other serious crimes;
• Business successors — in the event of a merger, acquisition, or sale of all or substantially all of Surya88's assets, player data may be transferred to the acquiring entity, subject to the same privacy protections as described in this Policy.

All third-party Data Processors engaged by Surya88 are bound by contractual data processing agreements that impose obligations equivalent to those under applicable data protection standards.

Surya88 uses cookies and similar tracking technologies (such as web beacons and local storage) to operate and improve the Platform. The cookies we use fall into the following categories:

• Strictly Necessary Cookies — essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing identifiers. They cannot be disabled without significantly impairing your ability to use the Platform.
• Functional Cookies — used to remember your preferences, such as your language settings and responsible gambling limit configurations, to enhance your experience during and between visits.
• Analytical Cookies — used to collect aggregated, anonymised information about how players use the Platform, enabling us to identify performance issues, popular pages, and areas for improvement. No individually identifiable data is shared with analytics providers without your consent.
• Marketing Cookies — used only where you have explicitly consented, to personalise promotional communications and assess the effectiveness of marketing campaigns. You may withdraw consent for marketing cookies at any time.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies may prevent certain features of the Platform from functioning correctly. For players accessing Surya88 from Kuala Lumpur, Penang, Johor Bahru, or elsewhere in Malaysia, cookie settings function identically regardless of location.

Surya88 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention guidelines apply:

• Account and identity data — retained for the duration of your Account and for a minimum of five (5) years following Account closure, in accordance with AML and financial record-keeping requirements;
• Transaction and gaming activity data — retained for a minimum of five (5) years from the date of each transaction, as required for regulatory compliance and dispute resolution;
• Customer support communications — retained for two (2) years from the date of the interaction, unless a longer retention period is necessary due to an ongoing dispute or investigation;
• Marketing consent records — retained for the duration of the marketing relationship and for a reasonable period thereafter, to demonstrate compliance with consent obligations;
• Cookie and technical data — retained for session duration (session cookies) or up to twelve (12) months (persistent cookies), depending on cookie type.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with our data disposal procedures.

Surya88 implements technical and organisational security measures proportionate to the risk associated with the personal data we process. These include:

• AES-256 encryption for personal data stored at rest on our servers;
• TLS (Transport Layer Security) encryption for all data transmitted between your device and the Platform;
• Two-factor authentication (2FA) options for Player account access;
• Role-based access controls restricting internal access to personal data to authorised personnel on a need-to-know basis;
• Continuous security monitoring, intrusion detection systems, and regular vulnerability assessments;
• Formal data breach response procedures, including assessment, containment, notification, and post-incident review protocols.

Despite these measures, no data transmission or storage system can be guaranteed to be 100% secure. In the event of a security incident that materially affects your personal data, Surya88 will notify affected players and relevant authorities in accordance with applicable legal requirements.

Subject to applicable law and certain conditions, you hold the following rights with respect to your personal data held by Surya88. Please see the User Rights summary section below for a visual overview. To exercise any of these rights, please contact our support team using the details in Section14.

• Right of Access — you may request a copy of the personal data Surya88 holds about you;
• Right to Rectification — you may request correction of inaccurate or incomplete personal data;
• Right to Erasure ("Right to Be Forgotten") — you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations;
• Right to Restriction of Processing — you may request that we restrict processing of your data in certain circumstances, for example while a dispute regarding its accuracy is resolved;
• Right to Data Portability — you may request that we provide your personal data in a structured, commonly used, machine-readable format;
• Right to Object — you may object to processing carried out on the basis of legitimate interests, or to the use of your data for direct marketing purposes;
• Right to Withdraw Consent — where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Surya88 will respond to rights requests within a reasonable timeframe and in accordance with applicable legal requirements. We may require identity verification before actioning a request to ensure we are releasing data only to its rightful owner. Note that certain rights are subject to limitations — for example, we cannot delete data we are legally required to retain for AML compliance purposes.

The Surya88 Platform is strictly for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. If we become aware that personal data has been collected from an individual below this age threshold, we will take immediate steps to delete that data and close the associated account.

Parents and guardians concerned about underage access to gambling platforms are encouraged to use parental control software and to consult the resources on ourResponsible Gambling page.

Surya88 reserves the right to update or modify this Privacy Policy at any time. Where changes are material — such as a new category of data being collected, a new purpose being added, or a change to how data is shared — we will provide reasonable advance notice by posting a prominent notification on the Platform and updating the "Last Updated" date.

Where required by applicable law, we will obtain your consent to material changes before they take effect. For non-material changes — such as clarifications of existing language or minor structural reorganisation — no prior notice will be given, but the updated Policy will be available on this page at all times.

Your continued use of the Surya88 Platform following the publication of any amendment to this Policy constitutes your acknowledgement of and agreement to the revised terms.

If you wish to exercise any of your data rights, have a question about this Privacy Policy, or wish to raise a data protection concern, please contact the Surya88 support and compliance team through the following channels:

• Live Chat: Available 24/7 through the Platform. Identify your enquiry as a "Data Protection Request" and you will be directed to the appropriate team member.
• WhatsApp Support: Available 24/7. Please initiate contact through the support section of the Platform and state clearly that your enquiry relates to your personal data.
• Email: [email protected] — mark your message "Privacy Request" in the subject line. Responses within 24 hours; data rights requests resolved within the applicable legal timeframe.

All data rights requests will be acknowledged promptly and actioned within a reasonable period, subject to identity verification. For complex requests or those involving large volumes of data, we will communicate a realistic response timeline at the point of acknowledgement.

For all other Platform enquiries, including account support, payments, and responsible gambling tools, please visit our FAQ page or contact our support team via the channels above.