Privacy Policy

1. Introduction

surg11 ("we", "us", "our", or "the Company") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, store, share, and protect data you provide when using our online betting platform and associated services (collectively, "the Platform").

This Privacy Policy applies to all users of surg11, including Indonesian residents accessing our services from Jakarta, Surabaya, Medan, Bandung, Bali, and other locations throughout Indonesia. By creating an account or using any part of the Platform, you acknowledge that you have read, understood, and consent to the data practices described in this Privacy Policy.

We process personal data in accordance with applicable data protection laws and international best practices. If you do not agree with any part of this Privacy Policy, you should not use surg11 services and must close your account immediately. Your continued use of the Platform following any modifications to this Privacy Policy constitutes your acceptance of such changes.

2. Data Controller

surg11 acts as the data controller for all personal information collected through the Platform. This means we determine the purposes and means of processing your personal data and are responsible for ensuring compliance with applicable privacy laws and regulations.

As the data controller, we are accountable for implementing appropriate technical and organizational measures to protect your personal information against unauthorized access, loss, destruction, alteration, or disclosure. We maintain documented policies and procedures governing data processing activities and regularly review our privacy practices to ensure ongoing compliance.

3. Information We Collect

surg11 collects several categories of personal information necessary to provide betting services, comply with legal obligations, prevent fraud, and enhance user experience. The types of data we collect include:

3.1 Account Registration Information

• Identity Data: Full legal name, date of birth, gender, nationality, and Indonesian KTP (Kartu Tanda Penduduk) number.
• Contact Data: Email address, phone number (mobile), residential address (street, city, postal code, province).
• Credentials: Username, password (stored in encrypted hashed format), security questions and answers.
• KYC Documents: Photographs of government-issued identification (Indonesian KTP front and back, passport), selfie photographs for identity verification, proof of address documents where required.

3.2 Financial Information

• Payment Details: Bank account numbers, bank names (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI), e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Transaction History: Deposit amounts and timestamps, withdrawal requests and processing status, payment method used for each transaction, transaction reference numbers.
• Financial Behavior: Deposit patterns, spending habits, account balance history, bonus usage records.

3.3 Betting & Gaming Data

• Betting Activity: All bets placed including sports events, game types, stake amounts, odds, bet outcomes (win/loss), betting patterns and frequency.
• Game Play Data: Slot game selections and play duration, live casino table sessions, RTP (Return to Player) statistics for your account, bonus wagering progress.
• Account Activity: Login timestamps and frequency, session duration, last login date and time, feature usage patterns.

3.4 Technical & Device Information

• Device Data: Device type (smartphone, tablet, desktop), operating system and version, browser type and version, screen resolution, device manufacturer and model.
• Network Data: IP address, internet service provider (ISP), geographic location (country, region, city inferred from IP), time zone settings.
• Usage Data: Pages visited on the Platform, clickstream data, referring website URLs, search queries entered, time spent on each page.

3.5 Communications & Support Data

• Customer Support Records: Live chat transcripts, email correspondence with support staff, WhatsApp message history, support ticket content and resolution notes.
• Marketing Preferences: Opt-in/opt-out status for promotional emails, SMS marketing consent, notification preferences, communication language preference.

4. How We Collect Your Information

surg11 collects personal information through multiple channels and methods:

4.1 Direct Collection

• Registration Process: Information you provide when creating your surg11 account through our registration form.
• KYC Verification: Documents and photographs you upload during the identity verification process to comply with anti-money laundering regulations.
• Account Updates: Changes you make to your profile, contact information, or payment methods through account settings.
• Customer Support: Information disclosed during live chat conversations, email exchanges, or WhatsApp communications with our support team.
• Voluntary Surveys: Feedback and opinions you provide when participating in user satisfaction surveys or promotional questionnaires.

4.2 Automatic Collection

• Cookies & Similar Technologies: Data collected through cookies, web beacons, pixel tags, and local storage mechanisms placed on your device when you access the Platform.
• Server Logs: Technical information automatically recorded by our web servers each time you access surg11, including IP addresses, timestamps, and HTTP requests.
• Analytics Tools: Usage statistics gathered through analytics platforms that track user behavior, page navigation, and feature engagement.
• Mobile App Permissions: Device information collected through mobile application permissions such as location access (if granted), camera access (for document upload), and device identifiers.

4.3 Third-Party Sources

• Payment Processors: Transaction confirmation data received from Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay) when you make deposits or withdrawals.
• Identity Verification Services: Enhanced due diligence data from third-party KYC verification providers used to validate Indonesian KTP documents and detect fraudulent identification.
• Fraud Prevention Databases: Shared information from industry blacklists, fraud detection networks, and responsible gaming databases to identify high-risk users or problem gamblers.

5. How We Use Your Data

surg11 processes your personal information for the following legitimate purposes:

5.1 Service Provision & Account Management

• Creating and maintaining your surg11 account with secure authentication.
• Processing your sports bets, casino wagers, and game sessions in real-time.
• Calculating bet settlements, crediting winnings, and updating account balances accurately.
• Processing deposit and withdrawal transactions through Indonesian payment methods.
• Providing customer support via live chat, email, and WhatsApp channels.
• Administering VIP loyalty programs, tier upgrades, and exclusive rewards.

5.2 Legal Compliance & Regulatory Obligations

• Verifying your identity and age to enforce 21+ age restrictions in accordance with responsible gaming standards.
• Conducting KYC (Know Your Customer) checks using Indonesian KTP documents to comply with anti-money laundering (AML) regulations.
• Monitoring transactions for suspicious activity and reporting to financial intelligence units where legally required.
• Maintaining records to comply with legal retention requirements and respond to lawful requests from authorities.
• Preventing underage gambling, identity theft, and unauthorized account access.

5.3 Fraud Prevention & Security

• Detecting and preventing fraudulent activity including account takeovers, payment fraud, bonus abuse, and collusion between users.
• Identifying duplicate accounts created to circumvent betting limits or exploit promotional offers.
• Analyzing betting patterns to detect match-fixing, insider trading, or other manipulation attempts.
• Implementing risk-based authentication measures and account security alerts.
• Protecting our Platform and users from cyberattacks, hacking attempts, and distributed denial-of-service (DDoS) attacks.

5.4 Marketing & Communications

• Sending promotional emails about bonuses, tournaments, and special offers tailored to Indonesian players (only with your consent).
• Delivering personalized marketing content based on your betting preferences, game history, and VIP tier.
• Notifying you about platform updates, new features, and service announcements via email or push notifications.
• Conducting market research and user surveys to improve surg11 services.

5.5 Platform Improvement & Analytics

• Analyzing user behavior and betting patterns to optimize game selection, odds pricing, and platform features.
• Conducting A/B testing to improve website usability, mobile app performance, and conversion rates.
• Monitoring platform performance, identifying technical issues, and resolving bugs or glitches.
• Developing new products, services, and features based on aggregated user data and market trends.

5.6 Responsible Gaming

• Identifying users exhibiting problem gambling behaviors based on spending patterns, session duration, and loss chasing.
• Implementing deposit limits, loss limits, and session time reminders to promote safer gambling.
• Administering self-exclusion requests and temporary account cooling-off periods.
• Providing resources and support contacts for users experiencing gambling-related harm.

6. Data Sharing & Third Parties

surg11 does not sell, rent, or trade your personal information to third parties for their own marketing purposes. However, we may share your data with trusted third-party service providers and partners under the following circumstances:

Recipient Category	Purpose of Sharing	Data Shared
Payment Processors	Processing deposits and withdrawals via Indonesian banks and e-wallets	Bank account details, transaction amounts, payment method identifiers
KYC Verification Providers	Validating identity documents and detecting fraudulent KTP submissions	Name, date of birth, KTP number, ID document photographs
Game Providers	Delivering slot games, live casino tables, and other gaming content	Username, betting activity, session data, account balance
Cloud Hosting Services	Storing data on secure servers and ensuring platform availability	All data categories as necessary for hosting and backup
Customer Support Tools	Managing live chat, email tickets, and support request tracking	Contact information, support history, conversation transcripts
Analytics Providers	Analyzing user behavior and platform performance metrics	Device data, usage patterns, anonymized behavioral data
Fraud Prevention Networks	Detecting and preventing fraudulent activity across the industry	IP addresses, device fingerprints, betting patterns, blacklist status
Legal & Regulatory Authorities	Complying with legal obligations, court orders, and regulatory requests	Any data required by law enforcement or government agencies

All third-party service providers are bound by contractual obligations to maintain the confidentiality and security of your personal information. We conduct due diligence to ensure partners comply with applicable data protection standards and use your data only for the specified purposes.

7. Data Security Measures

surg11 implements comprehensive technical and organizational security measures to protect your personal information against unauthorized access, loss, destruction, alteration, or disclosure:

7.1 Technical Safeguards

• Encryption: All data transmitted between your device and our servers is protected by 256-bit SSL/TLS encryption — the same technology used by major financial institutions worldwide.
• Password Protection: User passwords are hashed using industry-standard cryptographic algorithms (bcrypt with salt) and never stored in plain text.
• Firewall Protection: Multi-layered firewall systems protect our network infrastructure from external attacks and unauthorized access attempts.
• Intrusion Detection: Real-time monitoring systems detect and alert security teams to potential breaches or suspicious activity.
• Secure Data Centers: Personal information is stored in geographically distributed data centers with physical security controls including biometric access, 24/7 surveillance, and redundant power systems.

7.2 Organizational Safeguards

• Access Controls: Internal access to personal data is restricted on a need-to-know basis and limited to authorized personnel only.
• Staff Training: All surg11 employees receive regular training on data protection principles, security best practices, and incident response procedures.
• Regular Audits: We conduct periodic security audits, penetration testing, and vulnerability assessments to identify and remediate potential weaknesses.
• Incident Response Plan: Documented procedures ensure swift response to data breaches, including user notification and remediation measures as required by law.

While we strive to protect your personal information using industry best practices, no method of transmission over the internet or electronic storage is 100% secure. You acknowledge that you provide information at your own risk and agree to maintain the security of your account credentials.

8. Data Retention Period

surg11 retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements:

• Active Accounts: Personal data is retained for the duration your account remains active plus any applicable legal retention period.
• Closed Accounts: After account closure, we retain essential data (identity information, transaction history, KYC documents) for a minimum of 5 years to comply with anti-money laundering regulations and facilitate potential dispute resolution.
• Financial Records: Transaction history and payment records are retained for 7 years in accordance with accounting and tax law requirements.
• Marketing Data: Contact information for marketing purposes is retained until you withdraw consent or request deletion, whichever comes first.
• Customer Support Records: Support tickets and chat transcripts are retained for 3 years to track service quality and resolve recurring issues.
• Technical Logs: Server logs, IP addresses, and device data are typically retained for 12 months for security monitoring and troubleshooting purposes.

Upon expiration of the retention period, we will securely delete or anonymize your personal information unless longer retention is required by law or necessary to protect our legitimate interests (e.g., defending against legal claims).

9. Your Privacy Rights

Under applicable data protection laws, you have the following rights regarding your personal information held by surg11:

9.1 Right of Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. We will provide this information in a commonly used electronic format within 30 days of your request.

9.2 Right to Rectification

You can update inaccurate or incomplete personal information directly through your account settings or by contacting customer support. We will correct verified errors within 7 business days.

9.3 Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected or when you withdraw consent. Note that legal obligations may require us to retain certain information even after a deletion request.

9.4 Right to Data Portability

You can request a copy of your personal data in a structured, machine-readable format (e.g., CSV or JSON) that can be transferred to another service provider.

9.5 Right to Object

You have the right to object to processing of your personal data for direct marketing purposes or when processing is based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.

9.6 Right to Restrict Processing

You may request limitation of data processing in specific situations, such as when you contest the accuracy of data or object to processing while we verify legitimate grounds.

10. Cookies & Tracking Technologies

surg11 uses cookies, web beacons, and similar tracking technologies to enhance user experience, analyze platform performance, and deliver personalized content. Cookies are small text files stored on your device that help us recognize you on subsequent visits.

10.1 Types of Cookies We Use

• Essential Cookies: Required for platform functionality including login authentication, session management, and security features. These cannot be disabled.
• Performance Cookies: Collect anonymous data about how users interact with the Platform to identify technical issues and optimize performance.
• Functional Cookies: Remember your preferences such as language settings, display options, and previously viewed games.
• Marketing Cookies: Track user behavior across sessions to deliver personalized promotional offers and measure advertising campaign effectiveness (requires your consent).

10.2 Managing Cookies

You can control cookie settings through your browser preferences. Most browsers allow you to refuse cookies or delete existing cookies. However, disabling essential cookies may impair platform functionality and prevent you from accessing certain features. For more information on cookie management, visit your browser's help documentation.

11. International Data Transfers

surg11 primarily serves Indonesian users and stores data in secure facilities located in jurisdictions with robust data protection frameworks. However, some of our service providers and partners operate internationally, which may require transferring your personal information across borders.

When we transfer personal data internationally, we implement appropriate safeguards to ensure your information receives adequate protection equivalent to the standards described in this Privacy Policy. These safeguards include:

• Standard contractual clauses approved by data protection authorities.
• Binding corporate rules for intra-group transfers.
• Adequacy decisions recognizing equivalent data protection in the destination country.
• Encryption and pseudonymization measures to protect data in transit.

12. Children's Privacy

surg11 is an adult-only platform. We do not knowingly collect, use, or disclose personal information from individuals under 21 years of age. Our Terms & Conditions explicitly prohibit underage gambling, and we implement age verification measures during account registration and KYC processes.

If we become aware that a user under 21 years of age has provided personal information or created an account, we will immediately:

• Permanently suspend the account to prevent further access.
• Delete all personal information associated with the underage account from our systems.
• Refund any deposited funds to the original payment source.
• Void all bets and forfeit any winnings (as minors cannot legally enter into gambling contracts).

Parents or legal guardians who discover that a minor has accessed surg11 services should contact us immediately at [email protected] so we can take appropriate action.

13. Changes to This Policy

surg11 reserves the right to modify, amend, or update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes that affect how we collect, use, or share personal information, we will:

• Update the "Last Updated" date at the top of this Privacy Policy.
• Notify registered users via email to their registered email address.
• Display a prominent notice on the Platform homepage for 30 days following the change.
• For significant changes affecting user rights, request explicit consent before the new policy takes effect.

Your continued use of surg11 services following notification of Privacy Policy changes constitutes your acceptance of the updated terms. We recommend reviewing this Privacy Policy periodically to stay informed about how we protect your information.

14. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data processing practices, please contact our Data Protection Officer through the following channels:

When contacting us regarding privacy matters, please provide sufficient detail to help us locate your account and understand your request. For security purposes, we may ask you to verify your identity before processing requests to access, modify, or delete personal information.