Privacy Policy

1. Introduction

surga8 ("we", "us", "our") operates the online betting and casino platform at surga8.cam. We recognize that your personal data is valuable and sensitive. This Privacy Policy describes how surga8 collects, processes, stores, shares, and protects personal information in accordance with Indonesian data protection laws and international best practices.

By registering an Account on surga8, accessing our platform, or using any of our services, you acknowledge that you have read, understood, and agreed to the data practices described in this Privacy Policy. If you do not agree with this Privacy Policy, you must not use surga8.

surga8 reserves the right to update, modify, or amend this Privacy Policy at any time. Changes become effective immediately upon publication on this page. We encourage you to review this Privacy Policy periodically. Continued use of surga8 after changes constitutes acceptance of the updated Privacy Policy.

2. Information We Collect

surga8 collects personal information from you in several ways to provide a secure, compliant, and personalized betting experience. The types of information we collect include:

2.1 Information You Provide Directly

When you register an Account on surga8, you voluntarily provide the following personal information:

• Identity Information: Full legal name, date of birth, gender, nationality, government-issued identity document number (KTP number, passport number, or driver's license number).
• Contact Information: Email address, mobile phone number, residential address (street, city, province, postal code).
• Financial Information: Bank account details (bank name, account number, account holder name), e-wallet account details (OVO, DANA, GoPay, ShopeePay, LinkAja account identifiers).
• Account Credentials: Username, password (stored in encrypted form), security questions and answers (if applicable).
• Identity Verification Documents: Scanned or photographed copies of your KTP (Indonesian identity card), passport, driver's license, utility bills, or bank statements submitted during the KYC (Know Your Customer) verification process.

2.2 Information Collected Automatically

When you access and use surga8, we automatically collect certain technical and behavioral information:

• Device Information: Device type (desktop, mobile, tablet), operating system (Windows, macOS, iOS, Android), browser type and version, screen resolution, device identifiers (IMEI, advertising ID).
• Connection Information: IP address, internet service provider (ISP), connection type (Wi-Fi, mobile data), approximate geographic location (city, province) derived from IP address.
• Usage Information: Pages visited, features used, links clicked, time spent on pages, referring and exit pages, search queries entered, games played, bets placed, deposit and withdrawal activity, session duration, timestamps.
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to track user sessions, remember preferences, analyze site traffic, and detect fraud. See Section 9 (Cookies) for more details.

2.3 Information from Third Parties

surga8 may receive limited information about you from third-party service providers:

• Payment Processors: Confirmation of deposit and withdrawal transactions, payment method verification, transaction status updates from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Identity Verification Services: Results of identity checks, fraud detection scores, watchlist screening results, and document authenticity verification from third-party KYC and anti-fraud vendors.
• Affiliate Partners: If you registered through an affiliate referral link, we may receive your referral source identifier to credit the referring affiliate (no additional personal information is shared by affiliates).

3. How We Use Your Information

surga8 uses the personal information we collect for the following lawful purposes:

3.1 Account Management and Service Delivery

• Create, maintain, and manage your surga8 Account.
• Process your registration and verify your identity (KYC compliance).
• Authenticate your login sessions and maintain Account security.
• Process deposits, withdrawals, and other financial transactions in Indonesian Rupiah (IDR).
• Record and settle bets placed on sports markets, live casino games, slots, togel draws, and other gaming products.
• Issue bonuses, promotions, cashback, and loyalty rewards according to your eligibility and activity.
• Communicate with you regarding Account activity, transaction confirmations, and service updates.

3.2 Legal and Regulatory Compliance

• Verify that you are at least 21 years of age and legally eligible to use surga8 services.
• Comply with anti-money laundering (AML) regulations, counter-terrorist financing (CTF) obligations, and international sanctions screening requirements.
• Detect, investigate, and prevent fraud, collusion, bonus abuse, multi-accounting, arbitrage betting, and other prohibited activities.
• Respond to legal requests, court orders, subpoenas, or government inquiries from Indonesian authorities or international law enforcement agencies.
• Maintain records for audit, dispute resolution, and regulatory reporting purposes.

3.3 Platform Security and Fraud Prevention

• Monitor Account activity and transaction patterns to identify suspicious behavior.
• Detect and block unauthorized access attempts, bot activity, and automated scripts.
• Analyze IP addresses, device fingerprints, and behavioral patterns to prevent Account takeover, identity theft, and payment fraud.
• Enforce our Terms & Conditions and protect the integrity of surga8 services.

3.4 Service Improvement and Personalization

• Analyze user behavior, preferences, and feedback to improve platform features, game offerings, and user experience.
• Conduct A/B testing, usability studies, and performance optimization.
• Personalize content, promotions, and recommendations based on your gaming preferences and activity history (you may opt out of personalized marketing).
• Develop new products, features, and services tailored to the Indonesian market.

3.5 Marketing and Communications (With Your Consent)

• Send promotional emails, SMS messages, or push notifications about new games, bonuses, special offers, and platform updates (you may unsubscribe at any time).
• Display personalized advertisements and offers based on your activity (subject to your consent and local advertising regulations).
• Conduct customer satisfaction surveys and request feedback on your experience.

4. Legal Basis for Processing Your Data

surga8 processes your personal information based on the following legal grounds under Indonesian data protection law:

Processing Purpose	Legal Basis
Account creation and service delivery	Performance of contract (Terms & Conditions)
Identity verification (KYC), age verification, AML/CTF compliance	Legal obligation and legitimate interest
Fraud detection, platform security, Terms enforcement	Legitimate interest
Service improvement, analytics, personalization	Legitimate interest
Marketing communications	Your explicit consent (opt-in)

5. How We Share Your Information

surga8 does not sell, rent, or trade your personal information to third parties for their own marketing purposes. We only share your data with trusted third-party service providers and partners under strict confidentiality agreements, and only to the extent necessary to deliver our services and comply with legal obligations.

5.1 Service Providers and Partners

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive your financial transaction data to process deposits and withdrawals.
• Game Providers: Certified game studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Pocket Games Soft) receive limited session data (username, bet amounts, game outcomes) to deliver live casino, slots, and other gaming content.
• Identity Verification and Fraud Prevention Services: Third-party KYC, AML, and anti-fraud vendors receive your identity documents, personal details, and transaction history to verify your identity, assess fraud risk, and screen against watchlists.
• Cloud Hosting and IT Infrastructure Providers: Secure data centers and cloud service providers host surga8's servers, databases, and backups. All data is encrypted in transit and at rest.
• Customer Support Tools: Customer support platforms (live chat, ticketing systems, email management) process your communications with our support team to resolve queries and issues.
• Analytics and Marketing Platforms: Anonymous or pseudonymized data may be shared with analytics providers (Google Analytics, Mixpanel) and marketing platforms to measure campaign performance and improve user experience. These platforms do not have access to your full identity or financial details.

5.2 Legal and Regulatory Disclosures

surga8 may disclose your personal information to government authorities, law enforcement agencies, or courts when legally required or when necessary to:

• Comply with Indonesian laws, regulations, court orders, subpoenas, or government requests.
• Respond to lawful requests from international law enforcement agencies in cases involving cross-border fraud, money laundering, or criminal investigations.
• Enforce our Terms & Conditions, investigate suspected violations, or protect the rights, property, and safety of surga8, our users, or the public.
• Prevent or investigate fraud, security breaches, or illegal activity.

5.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of assets, your personal information may be transferred to the acquiring entity or successor organization. You will be notified of any such transfer, and the new entity will be bound by this Privacy Policy (or an equivalent privacy policy).

6. Data Retention

surga8 retains your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal and regulatory obligations, resolve disputes, and enforce our Terms & Conditions.

• Active Accounts: Personal information and transaction records are retained for the duration of your Account's active status.
• Closed Accounts: After you close your Account, surga8 retains your personal information and transaction history for a minimum of 5 years to comply with AML/CTF record-keeping requirements, tax laws, and regulatory audit obligations.
• Identity Verification Documents: Copies of KTP, passport, and other identity documents are retained for 5 years after Account closure or the last transaction, whichever is later.
• Marketing Data: If you unsubscribe from marketing communications, we retain your email address and phone number on a suppression list to ensure you do not receive future marketing messages. This suppression data is retained indefinitely.
• Legal Hold: If your Account is subject to a legal dispute, investigation, or regulatory inquiry, surga8 may retain your data beyond standard retention periods until the matter is resolved.

After the applicable retention period expires, personal information is securely deleted or anonymized so that it can no longer be associated with you.

7. Data Security

surga8 implements industry-standard technical, administrative, and physical security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and surga8 servers is protected using 256-bit SSL/TLS encryption. Sensitive data (passwords, financial details, identity documents) is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorized surga8 employees, contractors, and service providers on a need-to-know basis. All personnel with data access undergo background checks and sign confidentiality agreements.
• Secure Infrastructure: surga8 uses secure, geographically redundant data centers with 24/7 monitoring, intrusion detection systems, firewalls, and regular security audits.
• Regular Penetration Testing: Independent security experts conduct regular penetration tests and vulnerability assessments to identify and remediate security weaknesses.
• Incident Response Plan: surga8 maintains a documented data breach response plan. In the event of a security incident affecting your personal information, we will notify you and relevant authorities in accordance with Indonesian data breach notification laws.

While surga8 employs robust security measures, no online platform can guarantee 100% security. You are responsible for maintaining the confidentiality of your Account login credentials and for using strong, unique passwords. If you suspect unauthorized access to your Account, contact us immediately at [email protected].

8. Your Privacy Rights

Under Indonesian data protection law, you have the following rights regarding your personal information:

• Right of Access: You may request a copy of the personal information surga8 holds about you. We will provide this information in a structured, commonly used format within 30 days of your request.
• Right to Rectification: If any personal information we hold about you is inaccurate, incomplete, or outdated, you may request that we correct or update it. You can update most Account information directly through your Account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal information in certain circumstances (e.g., if the data is no longer necessary for the purposes it was collected, or if you withdraw consent). However, we may be required to retain certain data to comply with legal, regulatory, or contractual obligations (e.g., AML record-keeping requirements).
• Right to Restriction of Processing: You may request that we temporarily suspend processing of your personal information in certain situations (e.g., while we verify the accuracy of disputed data).
• Right to Data Portability: You may request that we provide your personal information in a machine-readable format for transfer to another service provider (subject to technical feasibility).
• Right to Object: You may object to processing of your personal information based on legitimate interests or for direct marketing purposes. If you object to marketing communications, you can unsubscribe at any time by clicking the unsubscribe link in emails or contacting customer support.
• Right to Withdraw Consent: If we process your personal information based on your consent (e.g., for marketing), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

To exercise any of these rights, please contact us at [email protected] with your request and proof of identity (to prevent unauthorized disclosure). We will respond to your request within 30 days.

9. Cookies and Tracking Technologies

surga8 uses cookies, web beacons, pixel tags, and similar technologies to enhance your experience, analyze platform usage, and deliver personalized content. A cookie is a small text file stored on your device by your web browser when you visit surga8.

9.1 Types of Cookies We Use

• Essential Cookies: Required for basic platform functionality, including session management, authentication, security, and load balancing. These cookies cannot be disabled without impairing core services.
• Performance Cookies: Collect anonymous data on how you use surga8 (pages visited, navigation paths, errors encountered) to help us improve platform performance and user experience.
• Functionality Cookies: Remember your preferences (language, currency display, game favorites) to provide a personalized experience across sessions.
• Advertising and Marketing Cookies: Track your activity across surga8 and other websites to deliver targeted advertisements and measure campaign effectiveness. These cookies are only set with your explicit consent.

9.2 Managing Cookies

Most web browsers allow you to control cookies through browser settings. You can:

• Block all cookies
• Block third-party cookies
• Delete cookies after each session
• Accept cookies from specific sites only

Please note that disabling essential cookies will prevent you from accessing key surga8 features, including login and transaction processing. Disabling performance or functionality cookies may result in a degraded user experience.

For more information on how to manage cookies, visit your browser's help documentation (Chrome, Firefox, Safari, Edge).

10. International Data Transfers

surga8 primarily stores and processes your personal information within Indonesia. However, certain third-party service providers (e.g., cloud hosting providers, game studios, fraud prevention vendors) may be located outside Indonesia. When we transfer your data internationally, we ensure that appropriate safeguards are in place, including:

• Standard contractual clauses approved by Indonesian data protection authorities.
• Data processing agreements requiring service providers to implement equivalent data protection measures.
• Compliance with international data protection frameworks (e.g., APEC Cross-Border Privacy Rules).

All international data transfers are conducted in accordance with Indonesian data protection law and international best practices.

11. Children's Privacy

surga8 services are strictly intended for individuals who are at least 21 years of age. We do not knowingly collect personal information from individuals under the age of 21. If you are under 21, you must not register an Account, use surga8 services, or provide any personal information to us.

If we discover that we have inadvertently collected personal information from a user under the age of 21, we will immediately delete that information and close the Account. If you believe we have collected information from a minor, please contact us at [email protected].

12. Third-Party Links

surga8 may contain links to third-party websites, services, or content (e.g., game provider websites, payment processor portals, social media platforms). This Privacy Policy applies only to surga8. We are not responsible for the privacy practices, data collection methods, or content of third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to This Privacy Policy

surga8 reserves the right to update, amend, or revise this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will update the "Last Updated" date at the top of this page and may notify you via email, platform notification, or prominent banner announcement.

Your continued use of surga8 after changes are published constitutes acceptance of the updated Privacy Policy. We encourage you to review this page periodically to stay informed about how we protect your personal information.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or surga8's data practices, please contact us:

Email: [email protected]
Subject Line: Privacy Policy Inquiry
Support Hours: 24/7 (Indonesian-speaking agents available during WIB business hours)

We are committed to addressing your privacy concerns promptly and professionally. Most inquiries are resolved within 48 hours.