This Privacy Notice explains how Incaspin Casino obtains, handles, retains, and protects personal data of players located in Germany. The document functions within the context of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino acts as the data controller for personal information provided through its website, mobile applications, and related services. German players enjoy specific statutory rights regarding their data, and this notice specifies the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards implemented to prevent unauthorised access. The document also explains the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been drafted to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, providing German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed throughout the entire customer lifecycle.
9. Cookie Policy and Tracking Technologies
9.1 Core and Operational Cookies
The Incaspin Casino site and mobile platform deploy a range of cookies and similar tracking technologies to ensure core functionality. Strictly necessary cookies control session state across page loads, keep login authentication tokens, and uphold security context for CSRF protection. These first-party session cookies terminate when the browser is closed and do not require prior consent under German law enforcing the ePrivacy Directive, as they are indispensable for the required service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players encounter a consistent personalized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they become invalid automatically if the player has not revisited the platform. Incaspin Casino does not use flash cookies, supercookies, or any regenerating techniques that bypass browser deletion actions.
9.2 Analytics and Marketing Cookies
Analytics and marketing cookies are set only after German players give explicit, freely given consent through the cookie consent management platform presented on first visit. The consent tool offers clear descriptions of each cookie category, the specific providers participating, the purposes of data collection, and the retention duration for each cookie type. Players may grant or withhold consent for each category independently, and consent preferences are logged as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service measure aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies enable campaign attribution and frequency capping for promotional banners displayed within the logged-in casino environment. German players may adjust their consent choices at any time by using the cookie settings panel referenced in the website footer. Refusing analytics or marketing cookies does not affect gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to update or update their preferences.
4. Data Sharing and Third-Party Recipients
4.1 In-House Data Access Model
In the Incaspin Casino operational system, personal data access follows a strict least-privilege model used for four distinct personnel tiers. Customer support agents view basic account information and communication history but cannot view full financial records or identity documents. Compliance officers hold permissions to examine verification documents, transaction patterns, and risk scores. Financial department personnel handle withdrawal requests and view payment instrument details required to execute transfers. IT security staff review system logs and security event data but do not regularly interact with player-identifiable records. Every access event is tracked with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is reviewed quarterly by the Data Protection Officer. German players can request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 Third-Party Services and Authorities
Incaspin Casino utilizes specialist external processors such as cloud hosting providers running ISO 27001-certified data centres inside the European Economic Area, payment processors regulated by the German Federal Financial Supervisory Authority, identity verification services that compare submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment encompassing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts require data processing solely on documented instructions from Incaspin Casino, with no right for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will alert affected players of such disclosures. The following key principles control all third-party data sharing arrangements:
- Processors obtain only the minimal personal data necessary to carry out their agreed function, with field-level data minimisation applied to every integration.
- Sub-processor engagements require prior written consent from Incaspin Casino, and any unauthorised subcontracting represents a material breach of the data processing agreement.
- All processors must maintain ISO 27001 certification or similar independently audited security credentials, with current certificates filed with Incaspin Casino before data flows start.
- No personal data is transferred to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.
7. Security of Data Controls
Incaspin Casino deploys a tiered security architecture conforming to the ISO 27001 control framework and the technical requirements specified in Article 32 of the GDPR. Network-level protections encompass enterprise-grade firewalls equipped with stateful packet inspection, intrusion detection and prevention systems that analyze traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that withstand volumetric attacks before they arrive at the application layer. All data transmitted between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, avoiding retrospective decryption of captured traffic even if long-term private keys are later compromised. Internal administrative interfaces are segmented on a management network inaccessible from the public internet, with access permitted exclusively through multi-factor authenticated VPN tunnels originating from pre-registered static IP addresses owned by authorised personnel. At the application layer, the platform enforces strong password policies demanding minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies trigger step-up authentication challenges or temporary account locks awaiting manual review by the security team. Database-level encryption safeguards data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each managed through a hardware security module that tracks every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm validate the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are tested through bi-annual tabletop exercises engaging the Data Protection Officer, with a documented breach notification workflow ensuring German players and the supervisory authority receive notification within the 72-hour deadline required by GDPR.
3. Účely a právní základy zpracování
Incaspin Casino provádí zpracování osobních údajů na základě několika různých GDPR právních důvodů, vybraných according to dané činnosti zpracování. Realizace smlouvy ve smyslu Article 6(1)(b) GDPR zahrnuje všechna zpracování dat necessary pro vytvoření a správu the player account, zpracování vkladů a výběrů, a doručení the interactive gaming services které German players aktivně vyžadují během registrace. This includes transmitting payment instructions to acquiring banks and verifying that players dosahují minimální věkový požadavek 18 let under German law. Povinné zpracování podle Article 6(1)(c) GDPR zahrnuje anti-money laundering customer due diligence, oznamování podezřelých obchodů relevantním jednotkám finančního zpravodajství, uchovávání záznamů pro splnění commercial and tax law requirements, a soulad s německými herními předpisy týkajících se standardů ochrany hráčů. Použitelné právní rámce zahrnují zákon o praní špinavých peněz a ustanovení Glücksspielstaatsvertragu kde je to relevantní to data retention mandates.
Legitimní zájmy prosazované Incaspin Casino under Article 6(1)(f) GDPR zahrnují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted dle Section 7 of the German Act Against Unfair Competition, a analýzy podnikání pro zlepšení služeb https://incaspincasino.de.com/legal-and-affiliates/. German players zachovávají si the absolute right odmítnout zpracování založeném na oprávněných zájmech, včetně profilování k přímým marketingovým účelům, a takové námitky budou ctěny without undue delay. Povolení podle Article 6(1)(a) GDPR je využíván pro volitelné marketingové komunikace prostřednictvím e-mailu a SMS pokud hráč aktivně souhlasil, for the placement of non-essential cookies and tracking technologies, and for sensitive data processing v konkrétních případech. Mechanismy pro odvolání souhlasu jsou nápadně umístěny v rámci nastavení účtu a v zápatí každé marketingové komunikace, with withdrawal taking effect without retroactive consequences pro dříve legální zpracování. German players kteří ještě nedosáhli the age of 18 nesmějí otevírat účty, a veškerá omylem sebraná data nezletilých is deleted immediately upon discovery.
Číslo 5: International Data Transfers
The primary data storage infrastructure for Incaspin Casino operates from secure facilities located in the European Economic Area, specifically designed to serve the German market with latency-optimized connectivity while maintaining full GDPR jurisdictional coverage. Some specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino applies the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures implemented where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include full encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who seek to grasp the geographical flow of their information.
Summary
Incaspin Casino has structured its data protection framework to fulfill the high standards expected by German players and stipulated by the GDPR and the BDSG-neu. From the preliminary collection of identity and contact data through to the final deletion or anonymisation of records years after account closure, every personal data life cycle stage operates under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino keeps transparent communication channels for rights requests, supplies granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are advised to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.
Two Classes of Private Data Collected
2.1 Identification Confirmation and Player Data
Players from Germany must supply particular personal data to create and maintain an active Incaspin Casino account. This class includes complete official name, physical address, date of birth, place of birth, nationality, and gender. For identity verification aims needed under Germany’s anti-money laundering regulations, the casino collects government-issued identification papers such as copy of passport, scans of national ID, and residence permit documentation. The platform also logs the ID number, issuing authority, expiry date, and a biometrical matching score created during the automatic validation process. Home confirmation is completed through current utility bills, bank statements, or authorized communication that clearly displays the member’s full name, on-file address, and an issuing day inside the previous three months. Incaspin Casino implements these validation prerequisites uniformly to adhere with the Fourth and Fifth Anti-Money Laundering Directives as implemented into German law, guaranteeing that all account fulfills the regulatory identity confidence level ahead of any withdrawals are permitted.
Two Point Two Financial and Deal Data
Transaction records encompasses all deposit and withdrawal records, including payment method details, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino retains complete transaction histories showing timestamps, amounts in EUR or digital currency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is isolated in encrypted database tables with access limited to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino receiving only the information necessary to credit the player account.
2.3 Behavioral and Technical Information
While German players log into the Incaspin Casino platform, the system automatically collects technical data points including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data covers login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus allows the casino to provide optimised gaming experiences, spot fraudulent activity patterns, and honour responsible gambling self-exclusion settings. Behavioural analytics measure betting frequency, average stake sizes, session duration, and deposit velocity to supply the responsible gambling algorithms that generate personalised risk alerts. All technical logs are de-identified where possible and stored apart from core identity records, with re-identification possible only through a carefully managed cryptographic lookup procedure reserved exclusively to the fraud and compliance teams under documented access justification.
Six. Data Storage and Erasure Policies
Incaspin Casino implements a precise data retention schedule intended to fulfill statutory record-keeping requirements while reducing the keeping of personal data past its useful purpose. Player account data and full transaction histories are retained for the complete period of the active business relationship, described as the term from account creation up to the account is closed, plus an extra statutory retention period stipulated by German anti-money laundering regulations and commercial law. Under the Geldwäschegesetz, identification documents, transaction vouchers, and due diligence materials must be maintained for at least five years after the end of the calendar year in which the business relationship ended. Accounting records applicable to tax requirements are kept for ten years in compliance with the German Fiscal Code. Following the expiration of these mandatory intervals, personal data is either irreversibly de-identified so that re-identification becomes unfeasible with all methods reasonably probable to be employed, or securely deleted through cryptographic erasure and physical storage media sanitisation procedures. Technical logs and security event data follow a briefer retention period of twelve months, after which they are compiled into anonymised statistical reports. Inactive accounts exhibiting no login activity for a unbroken period of 24 months are designated for dormancy review, and the connected personal data is reduced to store only the core name and transaction records necessary for the remaining statutory retention schedule. The casino deploys automated data lifecycle management processes that run weekly to identify records beyond their retention deadlines, starting deletion workflows without human intervention, with the results recorded for compliance audit objectives.
8. Prerogatives of German Data Subjects
German players possess the full suite of data subject rights enumerated in Articles 15 through 21 of the GDPR, along with the entitlement to submit a appeal with a supervisory authority. The right of access enables players to receive assurance of if Incaspin Casino processes their personal data and to get a copy of that data along with particulars about processing purposes, categories, recipients, holding durations, and the occurrence of automated decision-making. Access applications are completed within one month, at no cost for the initial request, with the response provided in a organized, commonly used, machine-readable structure. The rectification right permits players to rectify incorrect personal data or supplement partial records, a notably applicable right for identity document changes following name changes or address moves. Incaspin Casino processes rectification applications within ten business days and acknowledges rectifications to any third-party receivers to whom the wrong data was shared. The erasure right applies where the personal data is not anymore necessary for the purposes for which it was obtained, where authorization is canceled, where the player raises objection to processing and no overriding legitimate grounds are present, or where processing is not permitted. Nonetheless, statutory retention duties supersede erasure inquiries, and data required for legal compliance will be confined from further processing rather than deleted until the retention period ends. The restriction right of processing functions as an alternative where the precision of data is challenged, processing is unlawful but the player is against deletion, or the player needs the data for legal demands despite the controller no longer needing it. Data portability prerogatives under Article 20 GDPR extend only to data provided by the player and dealt with by automated methods based on authorization or contract, meaning gameplay history and transaction logs qualify for portability while fraud detection scores obtained from internal systems do not. Rights inquiries should be directed to the Data Protection Officer email address, with proper proof of identity necessary before any data is disclosed.
1. Identita správce údajů a kontaktní údaje
Osobou odpovědnou za zpracování údajů pro všechny osobní údaje processed through the Incaspin Casino platform představuje the legal entity operating under the brand name Incaspin Casino, zapsaná v jurisdikci recognised for its adherence to standardů ochrany údajů odpovídajících EU. The registered office address and company registration number are available upon žádost s ověřením totožnosti zasláním e-mailu pracovníkovi pro ochranu osobních údajů, or by consulting the imprint section hlavních webových stránek. Hráči z Německa mohou adresovat jakékoli dotazy týkající se soukromí na the designated Data Protection Officer, jenž pracuje samostatně a podává zprávy přímo nejvyššímu managementu. The DPO can be reached via a dedicated encrypted email channel published within kompletního textu politiky ochrany osobních údajů. Incaspin Casino maintains a legal representative na území Evropské unie for purposes of ustanovení čl. 27 GDPR, aby bylo zaručeno, že německé kontrolní orgány i dotčené osoby disponují přímým kontaktem pro regulační záležitosti. Tento subjekt stanovuje účely a prostředky zpracování veškerých osobních dat collected during registraci účtu, ověřování Know Your Customer, platebních transakcích vkladů a výběrů, a probíhající herní činnosti. This includes data generated through cookies, device fingerprinting technologies, and server logs. Hráči z Německa by si měli uvědomit, that the controller exercises absolutní moc nad rozhodováním ohledně činností zpracování dat while commissioning pečlivě prověřené zpracovatele for specific technical services např. hosting, platební brány, a CRM platformy. Každý vztah se zpracovatelem je upravena a binding data processing agreement that meets the requirements of Article 28 GDPR, with mandatory audit rights reserved by Incaspino Casino k ověření trvalého dodržování předpisů. Podrobné kontakty zástupce v EU byly sděleny kompetentnímu německému dozorovému orgánu pro ochranu dat v souladu s právními předpisy.
