Privacy Policy

1. Definitions

Throughout this Privacy Policy, the following defined terms apply:

• "surg33", "we", "us", "our" — the surg33 platform and its operators, accessible at https://surg33.cam.
• "Player", "you", "your" — any individual who visits, registers on, or uses the surg33 platform.
• "Personal Data" — any information that relates to an identified or identifiable natural person, including name, email address, date of birth, financial details, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "KYC" — Know Your Customer; the identity verification process required before certain account functions are enabled.
• "Third Party" — any entity other than you and surg33, including payment processors, game providers, and analytics services.
• "Cookies" — small data files placed on your device by a website to store preference, session, or tracking information.

2. Data Controller

surg33 acts as the data controller for all Personal Data collected through the platform. As data controller, we determine the purposes and means of processing your personal information and bear responsibility for ensuring that such processing is carried out lawfully, fairly, and transparently in accordance with applicable data protection principles.

If you have questions, requests, or complaints regarding the handling of your Personal Data, please contact our dedicated privacy team using the details in Section 15 of this Policy. We aim to respond to all privacy inquiries within 30 days.

3. Data We Collect

surg33 collects only the Personal Data that is necessary to operate our platform safely, legally, and effectively. The categories of data we collect are described below.

3.1 Identity and Contact Data

• Full legal name (as it appears on your KTP or passport)
• Date of birth (to verify you meet the 21+ age requirement)
• Gender (optional, for personalization)
• Residential address in Indonesia (city, province, postal code)
• Email address
• Phone number (including WhatsApp number if provided)
• Photograph of your KTP or passport and, where requested, a selfie with the document

3.2 Financial and Transaction Data

• Bank account details for deposit and withdrawal processing (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon)
• E-wallet account identifiers (OVO, DANA, GoPay)
• Deposit amounts, withdrawal amounts, and transaction timestamps
• Bonus credits received, wagering progress, and cashback calculations
• Account balance history

3.3 Gaming Activity Data

• Games played, bet amounts, win/loss outcomes, and session durations
• Sports betting selections, odds accepted, and market types wagered on
• Responsible gaming limit settings and self-exclusion status
• Game preferences and browsing behavior within the platform

3.4 Technical and Device Data

• IP address and approximate geolocation
• Device type, operating system, browser type and version
• Session identifiers, login timestamps, and session duration
• Pages visited within the platform and time spent on each page
• Referring website (if you arrived via a link from another site)

3.5 Communications Data

• Content of live chat conversations with our support team
• Email correspondence with surg33 (including support tickets)
• Feedback, complaints, and survey responses you provide voluntarily

4. How We Collect Your Data

We collect your Personal Data through the following means:

• Direct Provision: Information you provide when registering an account, completing KYC, making deposits or withdrawals, setting responsible gaming limits, or contacting our support team.
• Automated Technologies: Technical data collected automatically as you browse and interact with our platform, including via cookies, web beacons, and server logs.
• Third-Party Sources: Identity verification data from KYC service providers; fraud screening data from our payment processors; analytics data from aggregated, anonymized tracking services.
• Public Sources: In cases of suspected fraud or money laundering, we may consult publicly available databases or official government records to verify your identity or investigate suspicious activity.

5. Purposes and Legal Basis for Processing

We process your Personal Data only where we have a valid legal basis to do so. The table below summarizes our primary processing activities and the corresponding legal basis for each:

6. Sharing Your Personal Data

surg33 does not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes. We share your data only in the circumstances described below, and only to the extent necessary for each purpose.

6.1 Service Providers

We engage trusted third-party service providers who process data on our behalf under strict data processing agreements. These include:

• Payment processors: To facilitate deposits via BCA, BRI, BNI, Mandiri, and e-wallets (OVO, DANA, GoPay)
• KYC and identity verification providers: To validate your identity documents and confirm eligibility
• Game software providers: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe, and others who deliver games through our platform
• IT infrastructure and hosting providers: Who store and transmit data on secure servers on our behalf
• Customer support platforms: For delivering live chat, email, and WhatsApp support
• Fraud detection services: To identify and prevent unauthorized account access and financial fraud

6.2 Legal and Regulatory Authorities

We may disclose your Personal Data to law enforcement agencies, regulators, or government bodies when required to do so by applicable law, court order, or regulatory directive. We may also disclose data when we believe disclosure is necessary to protect the rights, property, or safety of surg33, our players, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of surg33's business, your Personal Data may be transferred to the acquiring entity as part of that transaction. We will notify you via email and/or a prominent notice on our Website if such a transfer occurs and if your data will be subject to a different Privacy Policy as a result.

7. International Data Transfers

As an online platform serving Indonesian pl ayers with internationally licensed operations, your Personal Data may be transferred to and stored on servers located outside Indonesia. Where such transfers occur, we take appropriate safeguards to ensure your data receives an equivalent level of protection, including:

• Contractual clauses in data processing agreements with all third-party service providers
• Engaging only with providers who maintain internationally recognized data security certifications
• Implementing technical measures such as encryption in transit and at rest to protect data regardless of where it is stored

By using the surg33 platform, you acknowledge that your Personal Data may be processed in countries outside Indonesia. We will always handle your data in accordance with this Privacy Policy regardless of where it is processed.

8. Data Retention

surg33 retains your Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

When Personal Data is no longer required, we securely delete or anonymize it so that it can no longer be associated with you. Anonymized and aggregated data (which cannot identify you) may be retained indefinitely for statistical and analytical purposes.

9. Security Measures

surg33 implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

9.1 Technical Safeguards

• 256-bit SSL/TLS encryption: All data transmitted between your device and our servers is encrypted using industry-standard TLS 1.2 or higher protocols
• Data encryption at rest: Sensitive fields including identity documents, bank account details, and KYC data are encrypted in our databases using AES-256 encryption
• Two-factor authentication: Available for player accounts to add an additional layer of login security
• Firewalls and intrusion detection: Enterprise-grade firewall infrastructure and real-time intrusion detection systems monitor our network continuously
• Regular security audits: Periodic penetration testing and vulnerability assessments conducted by qualified independent security professionals

9.2 Organizational Safeguards

• Access to Personal Data is restricted on a strict need-to-know basis; only authorized personnel whose role requires access to specific data categories may view that data
• All staff members who handle Personal Data receive regular data protection and security awareness training
• Third-party service providers are vetted for security practices and contractually required to maintain appropriate protections
• A documented data breach response procedure is in place; in the event of a breach that poses a risk to your rights and freedoms, we will notify affected players promptly

10. Cookies and Tracking Technologies

surg33 uses cookies and similar tracking technologies to operate and improve our platform. Cookies are small text files stored on your device when you visit our Website. They allow us to remember your preferences, keep you logged in during a session, and understand how Players use our platform.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the platform to function. These enable core features such as account login, session management, and security checks. They cannot be disabled without affecting platform functionality.
• Performance and Analytics Cookies: Collect anonymized information about how Players use surg33 — which pages are visited most, how long sessions last, and where errors occur. This helps us improve platform performance and user experience.
• Functional Cookies: Remember your preferences such as language settings, display options, and last visited game category to provide a more personalized experience.
• Marketing Cookies: Used to deliver relevant promotional content based on your gaming preferences and browsing behavior on our platform. These are only placed with your consent.

10.2 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or receive a warning before a cookie is stored. Please note that disabling strictly necessary cookies may impair your ability to use the surg33 platform. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.

Where applicable, we use a cookie preference tool that allows you to granularly consent to or withdraw consent for non-essential cookie categories when you first visit our platform.

11. Your Data Rights

As a Player using the surg33 platform, you have the following rights with respect to your Personal Data. We are committed to honoring these rights promptly and without undue delay:

11.1 Right of Access

You have the right to request a copy of the Personal Data we hold about you. This includes information on what data we hold, why we hold it, and with whom we have shared it. Submit your access request to [email protected] with the subject line "Data Access Request." We will respond within 30 days.

11.2 Right to Rectification

If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. You can update basic profile information (email address, phone number, residential address) directly through your account settings. For corrections to identity documents or date of birth, please contact our support team and provide updated documentation.

11.3 Right to Erasure ("Right to Be Forgotten")

You may request deletion of your Personal Data in certain circumstances — for example, if the data is no longer necessary for the purpose it was collected, or if you withdraw your consent and there is no other legal basis for processing. Please note that we may be required to retain certain data for legal, regulatory, or anti-money-laundering compliance purposes even after you request erasure. We will clearly communicate what data can be deleted and what must be retained, and why.

11.4 Right to Restriction of Processing

You may request that we limit the processing of your Personal Data in certain circumstances, such as when you contest the accuracy of the data or object to our processing. While a restriction is in place, we may store your data but will not actively use it except where permitted by law.

11.5 Right to Data Portability

Where processing is based on your consent or performance of a contract, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format, and to request that we transmit it directly to another data controller where technically feasible.

11.6 Right to Object

You have the right to object to processing of your Personal Data where our legal basis is legitimate interest. You also have an unconditional right to object to your data being used for direct marketing purposes at any time. To opt out of marketing communications, use the unsubscribe link in any marketing email, adjust your preferences in account settings, or contact our support team.

11.7 Rights Related to Automated Decision-Making

surg33 may use automated systems for fraud detection and responsible gaming monitoring. Where a purely automated decision significantly affects you (for example, account suspension triggered by a fraud detection algorithm), you have the right to request human review of that decision. Contact our support team to exercise this right.

12. Children's Privacy

surg33 is strictly an adult platform for players aged 21 and over. We do not knowingly collect Personal Data from individuals under the age of 21. If we become aware that we have collected Personal Data from someone under 21, we will immediately suspend that account, delete the associated data, and report the incident as required by applicable law.

Parents and guardians are encouraged to monitor their children's online activities and use appropriate parental control tools to prevent access to gambling websites. If you believe a minor has registered on surg33, please contact us immediately at [email protected] so we can investigate and take appropriate action without delay.

13. Third-Party Links and Services

The surg33 platform may contain references to third-party game providers (such as Pragmatic Play, Evolution Gaming, or Spribe) whose software runs within our platform environment. While we vet all providers for compliance with our standards, each provider operates under their own privacy policies with respect to data they independently collect through their software interfaces.

surg33 is not responsible for the privacy practices, content, or security of third-party websites or services. This Privacy Policy applies exclusively to data collected and processed by surg33 directly. We recommend reviewing the privacy policies of any third-party services you interact with.

14. Changes to This Policy

surg33 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or platform features. When material changes are made, we will notify you by:

• Sending an email notification to your registered address at least 14 days before the changes take effect
• Displaying a prominent banner or pop-up alert on the surg33 platform
• Updating the "Last Updated" date at the top of this Policy

Your continued use of the surg33 platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using our Services and close your account. We encourage you to review this Policy periodically to stay informed about how we protect your information.

15. Contact Our Privacy Team

If you have any questions, concerns, or requests related to this Privacy Policy or the way surg33 handles your Personal Data, please reach out to our Privacy Team through the following channels:

• Email: [email protected] — please use the subject line "Privacy Inquiry" for faster routing
• Live Chat: Available 24/7 on the surg33 platform — type "Privacy" at the start of your message to be connected to a senior support agent
• WhatsApp: Indonesian-speaking agents available for urgent data-related concerns

Our Privacy Team operates during Western Indonesia Time (WIB, UTC+7) business hours for formal written responses, though live chat and WhatsApp support is available around the clock. We are committed to addressing all privacy-related inquiries professionally and within the timelines stated in Section 11 of this Policy.