surg88 Privacy Policy

1. Introduction & Scope

surg88 is committed to protecting the privacy and security of our users. This Privacy Policy applies to all personal data collected through our website (surg88.cam), mobile applications, customer support channels, and any other services we provide. We comply with applicable Indonesian data protection laws and international best practices including the General Data Protection Regulation (GDPR) principles for users in regions where GDPR applies.

This Privacy Policy should be read in conjunction with our Terms & Conditions. Where there is a conflict between the two documents, the Terms & Conditions shall prevail regarding user obligations, while this Privacy Policy shall govern data handling practices.

Personal data means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

2. Information We Collect

2.1 Information You Provide Directly

When you register an account with surg88, we collect the following personal information:

• Identity Information: Full legal name, date of birth, gender, nationality, government-issued identification number (Indonesian KTP number, passport number, or driver's license number).
• Contact Information: Email address, mobile phone number, residential address (street, city, province, postal code).
• Financial Information: Bank account details (bank name, account number, account holder name), e-wallet information (OVO, DANA, GoPay account numbers), payment card details (for supported payment methods), transaction history including deposits, withdrawals, bets placed, and winnings.
• Verification Documents: Copies of government-issued photo ID, proof of address documents (utility bills, bank statements), proof of payment method ownership, and any additional documents requested during the KYC (Know Your Customer) verification process.
• Communication Records: Any correspondence with our customer support team via live chat, email, WhatsApp, or other channels, including the content of messages, timestamps, and support ticket details.
• Account Preferences: Username, password (stored in encrypted form), language preferences, currency settings, notification preferences, responsible gaming limits (deposit limits, loss limits, session time limits), and self-exclusion requests.

2.2 Information We Collect Automatically

When you access and use the surg88 Platform, we automatically collect certain technical and behavioral information:

• Device Information: Device type (desktop, mobile, tablet), operating system and version, browser type and version, screen resolution, device identifiers (IMEI, MAC address, advertising ID).
• Usage Data: IP address, geolocation data (country, city, approximate coordinates), login timestamps, pages visited, time spent on pages, click patterns, game play history, bet amounts, game selections, win/loss records.
• Cookies and Tracking Data: Session cookies, persistent cookies, web beacons, pixel tags, and similar tracking technologies. See Section 9 for detailed information about cookies.
• Performance Data: Connection speed, network performance, error logs, crash reports, and technical diagnostics to improve platform stability.

2.3 Information from Third Parties

We may receive information about you from third-party sources including:

• Payment Processors: Verification of payment method ownership, transaction success/failure notifications, fraud risk scores.
• Identity Verification Providers: Automated identity verification results, document authenticity checks, biometric matching scores.
• Fraud Prevention Services: Risk assessments, device fingerprinting data, IP reputation scores, behavioral analysis results.
• Game Providers: Game session data, RTP calculations, bonus feature triggers, jackpot wins (for games provided by third-party studios like Pragmatic Play, Evolution Gaming, Microgaming, NetEnt).

3. How We Use Your Information

surg88 processes your personal data for the following purposes:

3.1 Account Management and Service Provision

• Creating and maintaining your user account
• Verifying your identity and age (21+ requirement)
• Processing deposits and withdrawals
• Enabling you to place bets and play games
• Calculating and crediting winnings to your account
• Managing bonus credits and promotional offers
• Providing customer support and responding to inquiries

3.2 Legal and Regulatory Compliance

• Complying with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations
• Preventing underage gambling and enforcing age restrictions
• Detecting and preventing fraud, money laundering, and other illegal activities
• Cooperating with law enforcement investigations and legal requests
• Fulfilling tax reporting obligations and financial audits
• Maintaining records as required by gaming license conditions

3.3 Security and Fraud Prevention

• Monitoring for suspicious account activity and unauthorized access
• Detecting collusion, bonus abuse, and multi-accounting
• Implementing responsible gaming limits and self-exclusion
• Protecting against cyberattacks, data breaches, and system intrusions
• Verifying payment method ownership to prevent financial fraud

3.4 Platform Improvement and Analytics

• Analyzing user behavior to improve platform usability and performance
• Conducting A/B testing to optimize features and interfaces
• Generating anonymized statistics and aggregated reports
• Developing new products, games, and services based on user preferences
• Troubleshooting technical issues and optimizing system performance

3.5 Marketing and Communications (with consent)

• Sending promotional emails about bonuses, tournaments, and new games
• Delivering personalized offers based on your gaming history
• Notifying you of important account updates, security alerts, and policy changes
• Conducting customer satisfaction surveys

Note: You may opt out of marketing communications at any time through your account settings or by following the unsubscribe link in emails. Transactional and security-related communications cannot be opted out of as they are essential for service provision.

4. Legal Basis for Processing

Under applicable data protection laws, we must have a lawful basis for processing your personal data. Our legal bases include:

• Contractual Necessity: Processing is necessary to perform our contract with you (Terms & Conditions) and provide gaming services you have requested.
• Legal Obligation: Processing is required to comply with Indonesian law and international regulations including KYC, AML, tax reporting, and gaming license conditions.
• Legitimate Interests: Processing is necessary for our legitimate business interests in preventing fraud, improving our services, and ensuring platform security, provided these interests do not override your fundamental rights and freedoms.
• Consent: Where required by law or where none of the above bases apply (such as for marketing communications), we rely on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

5. Data Sharing & Third Parties

5.1 When We Share Your Data

surg88 does not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may share your data with the following categories of third parties for legitimate business purposes:

5.2 Service Providers and Business Partners

• Payment Processors: Banks, e-wallet providers, and payment gateways that facilitate deposits and withdrawals (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, etc.).
• Game Providers: Software studios that supply games to our platform (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, etc.). These providers receive minimal data necessary to operate games and track gameplay sessions.
• Identity Verification Services: Third-party KYC and AML screening providers that verify identity documents, check sanction lists, and assess fraud risk.
• Cloud Hosting Providers: Secure data centers and cloud infrastructure providers that host our servers and databases.
• Customer Support Tools: Live chat platforms, email service providers, and ticketing systems that enable customer support operations.
• Analytics Platforms: Web analytics services that help us understand user behavior and improve our platform (data is anonymized wherever possible).

All third-party service providers are contractually bound to protect your data, use it only for specified purposes, and comply with applicable data protection laws. We conduct due diligence on all vendors to ensure adequate security measures are in place.

5.3 Legal and Regulatory Authorities

We may disclose your information to government agencies, law enforcement, regulatory bodies, or courts when required by law or when we believe in good faith that disclosure is necessary to:

• Comply with legal obligations, subpoenas, court orders, or official requests
• Enforce our Terms & Conditions and investigate violations
• Detect, prevent, or address fraud, security issues, or illegal activity
• Protect the rights, property, or safety of surg88, our users, or the public

5.4 Business Transfers

In the event of a merger, acquisition, sale of assets, bankruptcy, or other corporate restructuring involving surg88, your personal data may be transferred to the acquiring or successor entity. We will notify you of any such change via email or prominent notice on our platform, and the new entity will be bound by this Privacy Policy unless you consent to a new policy.

6. Data Security & Protection

6.1 Technical Security Measures

surg88 implements industry-standard security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction:

• Encryption: All data transmitted between your device and our servers is encrypted using SSL/TLS protocols (minimum 256-bit encryption). Sensitive data at rest, including passwords and payment details, is encrypted in our databases.
• Firewalls and Intrusion Detection: Our servers are protected by enterprise-grade firewalls, intrusion detection systems, and DDoS mitigation technologies.
• Access Controls: Access to personal data is restricted to authorized employees and contractors on a need-to-know basis. All personnel with data access undergo background checks and sign confidentiality agreements.
• Multi-Factor Authentication: Critical systems and administrative accounts require multi-factor authentication to prevent unauthorized access.
• Regular Security Audits: We conduct periodic security audits, penetration testing, and vulnerability assessments by independent third-party security firms.
• Secure Payment Processing: Payment transactions are processed through PCI-DSS compliant payment gateways. surg88 does not store complete credit card numbers or CVV codes on our servers.

6.2 Organizational Security Measures

• Employee training on data protection and privacy best practices
• Incident response plan to address data breaches or security incidents promptly
• Regular backups of data to secure, geographically distributed locations
• Vendor risk management program to assess third-party security practices

6.3 Your Responsibility

While we implement robust security measures, the security of your account also depends on your actions. You are responsible for:

• Choosing a strong, unique password and keeping it confidential
• Not sharing your login credentials with anyone
• Logging out of your account when using shared or public devices
• Notifying us immediately if you suspect unauthorized account access
• Keeping your email account and mobile phone secure, as these are used for account recovery

7. Data Retention

surg88 retains your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy and to comply with legal, regulatory, and business requirements.

7.1 Active Account Data

While your account is active, we retain all personal information, transaction history, and gameplay records to provide ongoing services, manage your account, and comply with gaming regulations.

7.2 Closed Account Data

After you close your account, we retain certain data for specified periods:

• Financial Records: Transaction history, deposit/withdrawal records, and payment details are retained for 7 years to comply with tax laws and financial auditing requirements.
• Identity Verification Records: KYC documents and verification results are retained for 5 years to comply with anti-money laundering regulations.
• Gameplay History: Bet records and game outcomes are retained for 5 years to resolve disputes and meet gaming license obligations.
• Customer Support Records: Communication logs are retained for 3 years for quality assurance and dispute resolution.
• Marketing Data: If you consented to marketing communications, we delete or anonymize your contact information within 90 days of account closure unless you request immediate deletion.

7.3 Legal Hold

In cases of ongoing legal proceedings, regulatory investigations, or disputes, we may retain relevant data beyond standard retention periods until the matter is resolved.

7.4 Anonymization

Where possible, we anonymize or aggregate personal data so it can no longer identify you. Anonymized data may be retained indefinitely for statistical analysis and business intelligence purposes.

8. Your Privacy Rights

Under applicable data protection laws, you have the following rights regarding your personal data:

8.1 Right to Access

You have the right to request a copy of the personal data we hold about you. You can access most of your data directly through your account dashboard. For a comprehensive data export, contact our Data Protection Officer.

8.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data. You can update most information through your account settings. For changes to verified identity information (name, date of birth), contact customer support with supporting documentation.

8.3 Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data in certain circumstances. However, this right is not absolute and may be limited by legal, regulatory, or contractual obligations that require us to retain data (e.g., financial records for tax purposes, KYC records for AML compliance).

8.4 Right to Restriction of Processing

You have the right to request that we restrict processing of your personal data in specific situations (e.g., while verifying data accuracy or during dispute resolution).

8.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another service provider where technically feasible.

8.6 Right to Object

You have the right to object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests by demonstrating compelling grounds relating to your particular situation.

8.7 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

8.8 How to Exercise Your Rights

To exercise any of these rights, contact our Data Protection Officer at [email protected] (displayed as plain text). We will respond to your request within 30 days. In some cases, we may need to verify your identity before fulfilling your request to protect against unauthorized access to your data.

9. Cookies & Tracking Technologies

9.1 What Are Cookies

Cookies are small text files stored on your device when you visit our website. They help us recognize your device, remember your preferences, and improve your user experience. surg88 uses both session cookies (deleted when you close your browser) and persistent cookies (remain on your device for a set period).

9.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for platform functionality, enabling login, account security, and transaction processing. These cannot be disabled without breaking core features.
• Performance Cookies: Collect anonymous usage statistics to help us understand how users interact with the platform and identify areas for improvement.
• Functional Cookies: Remember your preferences (language, currency, layout settings) to provide a personalized experience.
• Targeting/Advertising Cookies: Track your activity across websites to deliver relevant advertisements and promotional content. These cookies are only set with your consent.

9.3 Managing Cookies

Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies or alert you when cookies are being set. Note that disabling cookies may limit your ability to use certain features of the Platform. You can manage cookie preferences through your browser settings or through our cookie consent banner displayed on your first visit.

10. International Data Transfers

surg88 operates primarily in Indonesia, but some of our service providers, data processors, and cloud infrastructure may be located outside Indonesia. When we transfer personal data internationally, we ensure adequate protection through:

• Standard contractual clauses approved by data protection authorities
• Ensuring the recipient country provides adequate data protection (e.g., EU adequacy decisions)
• Obtaining your explicit consent where required by law
• Implementing supplementary security measures such as encryption during transit and at rest

By using surg88, you acknowledge and consent to the transfer of your data to countries that may have different data protection laws than Indonesia, provided such transfers comply with this Privacy Policy and applicable laws.

11. Children's Privacy

surg88 services are strictly for adults aged 21 and above. We do not knowingly collect personal data from individuals under 21 years of age. Our registration process includes age verification mechanisms, and we require proof of age during KYC verification.

If we discover that we have inadvertently collected personal data from someone under 21, we will immediately delete that information and permanently close the account. If you are a parent or guardian and believe your child has provided personal information to surg88, please contact us immediately at [email protected].

We encourage parents and guardians to monitor their children's internet usage and use parental control software to prevent minors from accessing gambling websites.

12. Changes to This Privacy Policy

surg88 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document
• Send you an email notification to the address associated with your account
• Display a prominent notice on the Platform for at least 30 days
• For significant changes affecting your rights, request your renewed consent where required by law

Your continued use of surg88 services after any changes to this Privacy Policy constitutes acceptance of the revised policy. If you do not agree with the changes, you must stop using the Platform and close your account.

13. Contact & Data Protection Officer

If you have questions, concerns, or complaints about this Privacy Policy or our data handling practices, please contact our Data Protection Officer:

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. For users in Indonesia, you may contact the Indonesian Ministry of Communication and Information Technology.