surga19 Privacy Policy

1.1 surga19 takes the privacy of its players seriously. This Policy has been prepared in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), and its Implementing Rules and Regulations, as administered by the National Privacy Commission ("NPC").

1.2 This Policy applies to all personal data collected by surga19 in connection with your use of the Platform, whether you are a registered player, a visitor browsing the site, or a person who contacts surga19 for support purposes.

1.3 This Policy should be read together with surga19's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

1.4 If you have any questions about how surga19 handles your personal data, you may contact our Data Protection Officer at any time using the contact details provided in Section 15 of this Policy.

2.1 For the purposes of the Data Privacy Act of 2012 and this Policy, surga19 acts as the personal information controller in respect of the personal data it collects from players and users of the Platform.

2.2 As personal information controller, surga19 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in accordance with applicable Philippine data privacy laws.

2.3 surga19 has appointed a Data Protection Officer ("DPO") who is responsible for overseeing compliance with this Policy and applicable data privacy regulations. You may contact the DPO using the details set out in Section 15.

3.1 surga19 collects the following categories of personal data from players and users of the Platform:

3.2 surga19 does not intentionally collect sensitive personal information as defined under the DPA (such as health data, religious beliefs, or political affiliations) unless specifically required by law or regulatory obligation.

3.3 Where surga19 requires you to submit government-issued identification documents for KYC purposes, copies of such documents are stored securely and used solely for identity verification and regulatory compliance purposes.

4.1 surga19 collects personal data through the following means:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions;
• Automated technologies: Data collected automatically when you access the Platform, including cookies, web beacons, pixel tags, and server logs that record your IP address, device identifiers, and browsing behavior on the Platform;
• Payment providers: Transaction confirmation data received from GCash, PayMaya, BPI, BDO, Metrobank, and other payment processors when you make deposits or withdrawals;
• Third-party verification services: Identity and age verification data received from KYC service providers used to confirm your eligibility to use the Platform;
• Regulatory sources: Data received from regulatory authorities or self-exclusion registers in connection with our responsible gaming obligations.

5.1 surga19 uses the personal data it collects for the following purposes:

• Account management: To create, maintain, and administer your surga19 player account, including processing your registration, verifying your identity, and managing your account settings;
• Transaction processing: To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment methods, and to maintain accurate financial records;
• Regulatory compliance: To comply with applicable Philippine laws and regulations, including anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, and gaming regulatory reporting;
• Responsible gaming: To monitor your gaming activity for signs of problem gambling, to enforce deposit and loss limits you have set, and to administer self-exclusion requests;
• Platform security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, and other prohibited activities;
• Customer support: To respond to your inquiries, resolve disputes, and provide technical assistance;
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates where you have consented to receive such communications. You may withdraw consent at any time;
• Platform improvement: To analyze usage patterns, conduct performance testing, and improve the features and functionality of the surga19 Platform;
• Legal proceedings: To establish, exercise, or defend legal claims in connection with your use of the Platform.

5.2 surga19 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing another lawful basis for processing.

6.1 surga19 processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing is necessary to perform the contract between you and surga19 — specifically, to operate your player account, process transactions, and deliver the gaming services you have requested;
• Legal obligation: Processing is necessary for surga19 to comply with its legal and regulatory obligations under Philippine law, including AML regulations, KYC requirements, and gaming regulatory reporting obligations;
• Legitimate interests: Processing is necessary for surga19's legitimate interests in operating a secure, fair, and commercially viable gaming platform, including fraud prevention, platform security, and responsible gaming monitoring, provided such interests are not overridden by your rights and interests;
• Consent: Where surga19 relies on your consent as the legal basis for processing — for example, for marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7.1 surga19 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. surga19 may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers, for the purpose of processing your deposits and withdrawals;
• KYC and identity verification providers: Third-party service providers engaged to verify your identity and age in connection with our regulatory obligations;
• IT and platform service providers: Cloud hosting providers, cybersecurity firms, and software vendors who support the operation and maintenance of the surga19 Platform, under strict data processing agreements;
• Regulatory and law enforcement authorities: Philippine regulatory bodies, law enforcement agencies, and courts where disclosure is required by law, court order, or regulatory direction — including reporting obligations under the Anti-Money Laundering Act;
• Professional advisers: Lawyers, auditors, and accountants engaged by surga19 in connection with legal, compliance, or financial matters, subject to professional confidentiality obligations;
• Business successors: In the event of a merger, acquisition, or sale of all or part of surga19's business, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

7.2 Where surga19 engages third-party service providers to process personal data on its behalf, surga19 requires those providers to implement appropriate technical and organizational security measures and to process personal data only in accordance with surga19's instructions.

8.1 surga19 uses cookies and similar tracking technologies (including web beacons and pixel tags) on the Platform. Cookies are small text files placed on your device that help us recognize you, maintain your session, and improve your experience on the Platform.

8.2 surga19 uses the following types of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session cookies that keep you logged in to your surga19 account. These cannot be disabled without affecting Platform functionality;
• Performance and analytics cookies: Used to collect anonymized data about how players use the Platform, which pages are visited most frequently, and where errors occur. This data helps surga19 improve the Platform;
• Functionality cookies: Used to remember your preferences, such as your preferred language and display settings, so you don't have to re-enter them each time you visit;
• Security cookies: Used to detect and prevent fraudulent activity, unauthorized access attempts, and other security threats.

8.3 You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when a new cookie is set. Please note that disabling certain cookies may affect the functionality of the surga19 Platform, including your ability to stay logged in.

8.4 surga19 does not use third-party advertising cookies or allow third-party advertisers to place cookies on the Platform.

9.1 surga19 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and regulatory obligations.

9.2 The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account relationship with surga19, and for a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements;
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act of the Philippines;
• KYC documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant transaction;
• Customer support communications: Retained for three (3) years from the date of the last interaction, unless a longer period is required for dispute resolution or legal proceedings;
• Marketing preferences and consent records: Retained for the duration of your account relationship and for three (3) years following account closure.

9.3 When personal data is no longer required for any lawful purpose, surga19 will securely delete or anonymize it in accordance with its data disposal procedures.

10.1 surga19 implements a range of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the surga19 Platform;
• Encryption of sensitive data at rest, including financial data and identity documents;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular security audits, vulnerability assessments, and penetration testing of the Platform;
• Multi-factor authentication for internal systems that process personal data;
• Comprehensive staff training on data privacy and security obligations.

10.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, surga19 will notify the National Privacy Commission and, where required, affected players, in accordance with the timeframes prescribed by the DPA and NPC regulations.

10.3 While surga19 takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. surga19 cannot guarantee absolute security and encourages you to take steps to protect your own account, including using a strong, unique password and keeping your login credentials confidential.

11.1 Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by surga19:

• Right to be informed: The right to be informed of how your personal data is being collected and processed, as set out in this Policy;
• Right of access: The right to request a copy of the personal data surga19 holds about you, along with information about how it is being processed;
• Right to rectification: The right to request correction of any inaccurate or incomplete personal data surga19 holds about you;
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to surga19's legal and regulatory retention obligations;
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on surga19's legitimate interests;
• Right to data portability: The right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, where technically feasible;
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission if you believe surga19 has processed your personal data in violation of the DPA.

11.2 To exercise any of the above rights, please contact surga19's Data Protection Officer using the contact details in Section 15. surga19 will respond to all verified requests within fifteen (15) business days, in accordance with NPC guidelines.

11.3 surga19 may need to verify your identity before processing a data rights request. This is to ensure that personal data is not disclosed to unauthorized individuals.

12.1 The surga19 Platform is strictly intended for individuals aged 21 years and above, in accordance with Philippine gaming regulations. surga19 does not knowingly collect personal data from individuals under the age of 21.

12.2 If surga19 becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will take immediate steps to delete that data and close the associated account. Any deposits made by an underage player will be handled in accordance with surga19's Terms & Conditions.

12.3 If you believe that surga19 may have collected personal data from a person under the age of 21, please contact our support team immediately so that we can investigate and take appropriate action.

13.1 surga19 primarily stores and processes personal data on servers located within the Philippines. In certain circumstances, personal data may be transferred to, or accessed from, locations outside the Philippines — for example, where surga19 uses cloud-based service providers whose infrastructure is located abroad.

13.2 Where personal data is transferred outside the Philippines, surga19 ensures that appropriate safeguards are in place to protect your data, in accordance with the requirements of the Data Privacy Act of 2012 and NPC guidelines. These safeguards may include contractual clauses requiring the recipient to apply equivalent data protection standards.

13.3 By using the surga19 Platform, you acknowledge and consent to the transfer of your personal data outside the Philippines where necessary for the purposes described in this Policy, subject to the safeguards described above.

14.1 surga19 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this page will be revised accordingly.

14.2 Where changes to this Policy are material, surga19 will notify registered players via email or an in-platform notification prior to the changes taking effect. Your continued use of the surga19 Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms.

14.3 We encourage you to review this Policy periodically to stay informed about how surga19 protects your personal data. The most current version of this Policy will always be available at this page.

15.1 If you have any questions, concerns, or requests relating to this Privacy Policy or surga19's handling of your personal data, please contact our Data Protection Officer through any of the following channels:

• Live Chat: Available 24/7 directly on the surga19 Platform — the fastest way to reach our support team;
• Email: [email protected] — for formal data privacy inquiries and data rights requests.

15.2 surga19 aims to acknowledge all privacy-related inquiries within two (2) business days and to resolve them within fifteen (15) business days, in line with NPC guidelines.

15.3 If you are not satisfied with surga19's response to your privacy inquiry, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.