This Privacy Notice explains how Incaspin Casino collects, handles, retains, and safeguards personal data of players located in Germany. The document operates within the framework of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino acts as the data controller for personal information furnished through its website, mobile applications, and related services. German players enjoy specific statutory rights concerning their data, and this notice outlines the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards used to prevent unauthorised access. The document also explains the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been drafted to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, providing German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed across the entire customer lifecycle.
1. Data Controller Identity a kontaktní údaje
The data controller za veškeré osobní údaje zpracovávané na platformě the Incaspin Casino platformy představuje subjekt působící pod názvem značky Incaspin Casino, zapsaná v státě recognised for dodržováním standardů ochrany údajů odpovídajících EU. Adresa sídla a identifikační číslo společnosti are available upon ověřenou žádost e-mailem na adresu the Data Protection Officer, případně v části s právními informacemi of the main website. Hráči z Německa mohou směřovat jakékoli dotazy týkající se soukromí na jmenovanému pracovníkovi pro ochranu údajů, jenž pracuje samostatně a je přímo podřízen senior management. Pověřenec může být kontaktován prostřednictvím speciální šifrovanou e-mailovou adresu zveřejněnou v rámci úplného znění zásad ochrany soukromí. Incaspin Casino udržuje právního zástupce v Evropské unii for purposes of ustanovení čl. 27 GDPR, aby bylo zaručeno, že německé kontrolní orgány i dotčené osoby have a direct point of contact for regulatory matters. Tento subjekt determines účely a prostředky zpracování všech osobních údajů collected during vytváření účtu, ověřování Know Your Customer, transakcích vkladů a výběrů, and ongoing gameplay activity. This includes data generated through cookies, technologií otisku zařízení, and server logs. Němečtí hráči by měli vzít na vědomí, že tento subjekt uplatňuje absolutní moc nad rozhodováním over data processing operations a zároveň zadává důkladně vybrané zpracovatele for specific technical services např. hosting, platební brány, and CRM platforms. Each processor relationship se řídí právně závaznou dohodou o zpracování dat jež vyhovuje podmínkám Article 28 GDPR, with mandatory audit rights reserved by Incaspino Casino k ověření trvalého dodržování předpisů. Kontaktní údaje of the EU representative are provided to kompetentnímu německému dozorovému orgánu pro ochranu dat as required by law.
8. Prerogatives of German-resident Data Subjects
German players possess the full suite of data subject prerogatives listed in Articles 15 through 21 of the GDPR, as well as the entitlement to lodge a appeal with a supervisory authority. The right to access permits players to obtain confirmation of as to whether Incaspin Casino processes their private data and to receive a copy of that data including particulars about processing purposes, classes, recipients, storage periods, and the occurrence of automated decision-making. Access requests are fulfilled within one month, at no cost for the first request, with the response provided in a organized, generally used, machine-readable format. The rectification right enables players to correct incorrect personal data or supplement missing records, a especially pertinent prerogative for identity document updates following name modifications or address moves. Incaspin Casino processes rectification applications within ten business days and confirms rectifications to any third-party receivers to whom the inaccurate data was disclosed. The right to erasure applies where the personal data is no longer needed for the purposes for which it was collected, where consent is withdrawn, where the player objects to processing and no prevailing legitimate grounds are in place, or where processing is unlawful. However, statutory retention duties supersede erasure inquiries, and data required for legal compliance will be restricted from further processing rather than deleted until the retention period ends. The restriction right of processing acts as an substitute where the correctness of data is contested, processing is contrary to law but the player opposes deletion, or the player needs the data for legal demands despite the controller no longer requiring it. Data portability prerogatives under Article 20 GDPR extend only to data supplied by the player and processed by automated methods based on consent or agreement, implying gameplay history and transaction logs are eligible for portability while fraud detection ratings coming from internal systems do not. Rights requests should be sent to the Data Protection Officer email address, with legitimate proof of identity required before any data is shared.
7. Information Security Measures
Incaspin Casino deploys a tiered security architecture in accordance with the ISO 27001 control framework and the technical requirements specified in Article 32 of the GDPR. Network-level protections encompass enterprise-grade firewalls set up with stateful packet inspection, intrusion detection and prevention systems that monitor traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that withstand volumetric attacks before they hit the application layer. All data sent between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, avoiding retrospective decryption of captured traffic even if long-term private keys are later compromised. Internal administrative interfaces are isolated on a management network not accessible from the public internet, with access granted only through multi-factor authenticated VPN tunnels starting from pre-registered static IP addresses owned by authorised personnel. At the application layer, the platform imposes strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks until manual review by the security team. Database-level encryption secures data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each administered through a hardware security module that tracks every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm verify the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are practiced through bi-annual tabletop exercises including the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline mandated by GDPR.
Six. Data Retention and Erasure Guidelines
Incaspin Casino operates a precise data retention plan aimed to fulfill statutory record-keeping duties while minimising the storage of personal data past its useful purpose. Player account data and full transaction records are retained for the complete length of the ongoing business relationship, defined as the period from account creation until the account is terminated, plus an supplementary statutory retention duration stipulated by German anti-money laundering regulations and commercial law. Under the Geldwäschegesetz, identification files, transaction vouchers, and due diligence papers must be preserved for at least five years from the end of the calendar year in which the business relationship ended. Accounting records pertinent to tax obligations are retained for ten years in accordance with the German Fiscal Code. Following the end of these mandatory intervals, personal data is either irrevocably masked so that re-identification becomes impracticable with all means reasonably likely to be used, or reliably deleted through cryptographic erasure and physical storage media cleaning procedures. Technical logs and security event data follow a briefer retention cycle of twelve months, after which they are compiled into anonymised statistical reports. Inactive accounts demonstrating no login activity for a unbroken period of 24 months are marked for dormancy assessment, and the related personal data is minimised to store only the core identifier and transaction records needed for the outstanding statutory retention schedule. The casino deploys automated data lifecycle management scripts that execute weekly to identify records over their retention thresholds, initiating deletion workflows without human intervention, with the results logged for compliance audit reasons.
4. Information Sharing and Third Parties
4.1 Internal Data Access Structure
Within the Incaspin Casino operational structure, personal data access follows a strict least-privilege model implemented across four distinct personnel tiers. Customer support agents retrieve basic account information and communication history but cannot view full financial records or identity documents. Compliance officers hold permissions to review verification documents, transaction patterns, and risk scores. Financial department personnel process withdrawal requests and view payment instrument details required to execute transfers. IT security staff review system logs and security event data but do not regularly interact with player-identifiable records. Every access event is recorded with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is reviewed quarterly by the Data Protection Officer. German players are able to request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Providers and Regulatory Bodies
Incaspin Casino employs specialist external processors comprising cloud hosting providers running ISO 27001-certified data centres within the European Economic Area, payment processors authorised by the German Federal Financial Supervisory Authority, identity verification services that compare submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts mandate data processing solely on documented instructions from Incaspin Casino, with no entitlement for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles control all third-party data sharing arrangements:
- Processors get only the minimal personal data necessary to perform their specified function, with field-level data minimisation implemented to every integration.
- Sub-processor engagements demand prior written authorisation from Incaspin Casino, and any unapproved subcontracting forms a material breach of the data processing agreement.
- All processors must maintain ISO 27001 certification or comparable independently audited security standards, with current certificates filed with Incaspin Casino before data flows begin.
- No personal data is disclosed to advertising technology platforms, data brokers, or any entity whose primary business focuses on monetising personal information.
5: International Data Transfers
The main data storage infrastructure for Incaspin Casino resides within secure facilities located in the European Economic Area, specifically engineered to serve the German market with latency-optimised connectivity while maintaining full GDPR jurisdictional coverage. Specific specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino applies the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures applied where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include full encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who seek to grasp the geographical flow of their information.
2. Groups of Private Data Obtained
Two Point One Identity Confirmation and Account Data
German players must provide specific individual data to establish and keep an active Incaspin Casino account. This class includes full statutory name, home location, DOB, birthplace, citizenship, and sex. For identification verification aims needed under Germany’s anti-money laundering laws, the casino obtains government-issued ID files such as passport copies, national identity card scans, and proof of residency. The platform also logs the ID number, issuing authority, validity end, and a biometrical matching rating created during the automated verification process. Residential confirmation is finished through recent utility bills, bank statements, or formal correspondence that evidently presents the user’s name, on-file address, and an creation date within the previous three months. Incaspin Casino applies these validation prerequisites consistently to adhere with the 4th and 5th Anti-Money Laundering Orders as implemented into Germany’s law, ensuring that every account fulfills the regulatory identity certainty level prior to any withdrawals are allowed.
Two Point Two Fiscal and Deal Data
Financial data encompasses all transaction records, including payment method identifiers, masked card numbers, e-wallet account email addresses, bank account IBAN details for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino retains complete transaction histories showing timestamps, amounts in EUR or equivalent cryptocurrency, processing statuses, and any intermediary payment processor references. Source of funds declarations and supporting documents such as payslips, tax returns, or business financial statements are collected when players cross specific deposit thresholds or trigger enhanced due diligence procedures. This data is separated in encrypted database tables with access confined to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino getting only the information necessary to credit the player account.
2.3 Technical and Behavioural Data
When German players visit the Incaspin Casino platform, the system gathers technical data points including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data includes login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus enables the casino to offer optimised gaming experiences, spot fraudulent activity patterns, and respect responsible gambling self-exclusion settings. Behavioural analytics measure betting frequency, average stake sizes, session duration, and deposit velocity to feed the responsible gambling algorithms that produce personalised risk alerts. All technical logs are pseudonymised where possible and stored separately from core identity records, with re-identification possible only through a tightly controlled cryptographic lookup procedure reserved exclusively to the fraud and compliance teams under documented access justification.
3. bod Účely a právní základy zpracování
Incaspin Casino provádí zpracování osobní data under several distinct GDPR právních důvodů, selected podle konkrétní zpracovatelské činnosti. Plnění smlouvy podle Article 6(1)(b) GDPR pokrývá všechna zpracování dat nezbytné k vytvoření a vedení hráčského účtu, zpracování vkladů a výběrů, and deliver the interactive gaming services které German players aktivně vyžadují při registraci. This zahrnuje zasílání platebních pokynů akvizičním bankám a ověřování toho, že players dosahují požadavek minimálního věku 18 let dle německé legislativy. Legal obligation processing podle Article 6(1)(c) GDPR encompasses anti-money laundering customer due diligence, hlášení podezřelých transakcí relevantním jednotkám finančního zpravodajství, record retention to satisfy požadavků obchodního a daňového práva, a dodržování s německou regulací hazardu ohledně norem ochrany hráčů. The applicable legal frameworks include the Geldwäschegesetz a předpisy of the Glücksspielstaatsvertrag pokud je to relevantní pro povinnosti uchovávání dat.
Legitimní zájmy prosazované Incaspin Casino dle Article 6(1)(f) GDPR zahrnují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers pokud je to povoleno podle Section 7 of the German Act Against Unfair Competition, a obchodní analýzy za účelem zlepšení služeb. German players zachovávají si the absolute right odmítnout zpracování na základě oprávněných zájmů, including profiling k přímým marketingovým účelům, a tyto námitky budou ctěny without undue delay. Povolení dle Article 6(1)(a) GDPR je spoléháno pro nepovinná marketingová sdělení via email and SMS where hráč se aktivně přihlásil, pro nasazení neesenciálních cookies a sledovacích technologií, and for sensitive data processing za specifických okolností. Způsoby zrušení souhlasu jsou nápadně umístěny within account settings a v zápatí každé marketingové komunikace, přičemž odvolání nabývá účinnosti bez zpětných důsledků pro dříve legální zpracování. German players kteří dosud nedosáhli the age of 18 nesmějí otevírat účty, a jakákoli neúmyslně shromážděná data nezletilých je ihned po odhalení odstraněna.
9. Cookie Policy and Tracking Technologies
9.1 Necessary and Technical Cookies
The Incaspin Casino platform and mobile platform implement a variety of cookies and similar tracking technologies to ensure core functionality. Strictly necessary cookies manage session state across page loads, preserve login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies expire when the browser is closed and do not require prior consent under German law implementing the ePrivacy Directive, as they are essential for the requested service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, making sure that returning players encounter a uniform personalized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they expire automatically if the player has not accessed the platform. Incaspin Casino does not use flash cookies, supercookies, or any recreating techniques that evade browser deletion actions.
9.2 Analysis and Marketing Cookies
Analytics and marketing cookies are set only after German players grant explicit, freely given consent through the cookie consent management platform shown on first visit https://incaspincasino.de.com/legal-and-affiliates/. The consent tool displays clear descriptions of each cookie category, the specific providers involved, the purposes of data collection, and the retention duration for each cookie type. Players may give or withhold consent for each category independently, and consent preferences are recorded as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service monitor aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies facilitate campaign attribution and frequency capping for promotional banners presented within the logged-in casino environment. German players may adjust their consent choices at any time by using the cookie settings panel linked in the website footer. Declining analytics or marketing cookies does not influence gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to update or update their preferences.
Summary
Incaspin Casino has structured its data protection system to meet the high standards expected by German players and stipulated by the GDPR and the BDSG-neu. From the first collection of identity and contact data through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage works under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino keeps transparent communication channels for rights requests, provides granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are advised to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.
Leave a Reply