This Privacy Notice describes how Incaspin Casino obtains, processes, keeps, and safeguards personal data belonging to players located in Germany. The document works within the context of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino acts as the data controller for personal information furnished through its website, mobile applications, and related services. German players possess specific statutory rights relating to their data, and this notice specifies the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards implemented to prevent unauthorised access. The document also describes the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been drafted to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, giving German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed across the entire customer lifecycle.
Kapitola 1. Identita správce údajů a kontaktní údaje
The data controller pro všechny osobní údaje processed through the Incaspin Casino platform představuje subjekt vystupující pod the brand name Incaspin Casino, zapsaná v a jurisdiction uznávané pro přijetím EU data protection equivalence standards. Adresa sídla a registrační číslo are available upon žádost s ověřením totožnosti zasláním e-mailu the Data Protection Officer, or by consulting the imprint section of the main website. Němečtí hráči mohou adresovat any privacy-related inquiries to určenému pověřenci pro ochranu osobních údajů, jenž pracuje samostatně and reports directly to vrcholovému vedení. The DPO je k zastižení prostřednictvím a dedicated encrypted email channel published within the full privacy policy text. Incaspin Casino udržuje oprávněného zástupce within the European Union z důvodu ustanovení čl. 27 GDPR, ensuring that německé dozorové úřady and data subjects disponují přímým kontaktem ohledně regulačních otázek. Tento subjekt stanovuje the purposes and means zpracování všech osobních údajů collected during vytváření účtu, identifikačním procesu KYC, deposit and withdrawal transactions, a probíhající herní činnosti. Sem patří údaje vytvářené prostřednictvím souborů cookies, technologií pro identifikaci zařízení, a záznamů serveru. Hráči z Německa by si měli uvědomit, že tento subjekt uplatňuje full decision-making power ohledně činností zpracování dat přičemž pověřuje důkladně vybrané zpracovatele for specific technical services such as hosting, payment gateways, a CRM platformy. Each processor relationship je upravena závaznou smlouvou o zpracování údajů jež vyhovuje podmínkám ustanovení čl. 28 GDPR, with mandatory audit rights reserved pro Incaspin Casino pro ověření průběžného souladu. Kontaktní údaje na zástupce pro Evropskou unii are provided to příslušnému německému úřadu pro ochranu osobních údajů v souladu s právními předpisy.
8. Entitlements of German-resident Data Subjects
German players possess the entire range of data subject rights specified in Articles 15 through 21 of the GDPR, as well as the option to submit a complaint with a supervisory authority. The access right permits players to receive confirmation of if Incaspin Casino processes their personal data and to receive a duplicate of that data including details about processing purposes, types, recipients, retention terms, and the existence of automated decision-making. Access inquiries are completed within one month, at no cost for the initial request, with the response supplied in a ordered, widely used, machine-readable layout. The right of correction allows players to correct inaccurate personal data or fill in incomplete files, a particularly pertinent prerogative for identity document changes following name changes or address relocations. Incaspin Casino deals with rectification inquiries within ten business days and confirms rectifications to any third-party receivers to whom the incorrect data was revealed. The erasure right applies where the personal data is not anymore necessary for the objectives for which it was gathered, where consent is canceled, where the player raises objection to processing and no dominant legitimate grounds are present, or where processing is unlawful. Nonetheless, statutory retention obligations override erasure applications, and data required for legal compliance will be confined from further processing rather than removed until the retention period lapses. The restriction right of processing serves as an substitute where the precision of data is contested, processing is illegal but the player objects to deletion, or the player necessitates the data for legal demands despite the controller no longer needing it. Data portability entitlements under Article 20 GDPR apply solely to data provided by the player and handled by automated methods based on consent or agreement, implying gameplay history and transaction logs are eligible for portability while fraud detection ratings coming from internal systems do not. Rights applications should be addressed to the Data Protection Officer email address, with valid proof of identity necessary before any data is released.
6. Information Archiving and Removal Rules
Incaspin Casino implements a detailed data retention policy intended to meet statutory record-keeping requirements while minimising the keeping of personal data beyond its necessary purpose. Player account data and complete transaction histories are stored for the complete period of the current business relationship, defined as the period from account creation until the account is closed, plus an additional statutory retention period mandated by German anti-money laundering regulations and commercial law. Under the Geldwäschegesetz, identification documents, transaction receipts, and due diligence materials must be maintained for at least five years from the end of the calendar year in which the business relationship terminated. Accounting records applicable to tax obligations are retained for ten years in accordance with the German Fiscal Code. Following the expiration of these mandatory terms, personal data is either irreversibly anonymised so that re-identification becomes impossible with all ways reasonably probable to be employed, or safely deleted through cryptographic erasure and physical storage media sanitisation procedures. Technical logs and security event data observe a shorter retention interval of twelve months, after which they are combined into anonymised statistical summaries. Inactive accounts showing no login activity for a consecutive period of 24 months are designated for dormancy check, and the associated personal data is limited to store only the core name and transaction records required for the outstanding statutory retention clock. The casino deploys automated data lifecycle management routines that run weekly to identify records beyond their retention deadlines, triggering deletion workflows without human involvement, with the results recorded for compliance audit purposes.
4. Information Sharing and Third Parties
4.1 In-House Data Access Model
Inside the Incaspin Casino operational framework, personal data access utilizes a strict least-privilege model implemented across four distinct personnel tiers. Customer support agents view basic account information and communication history but are unable to view full financial records or identity documents. Compliance officers hold permissions to examine verification documents, transaction patterns, and risk scores. Financial department personnel manage withdrawal requests and view payment instrument details necessary to execute transfers. IT security staff monitor system logs and security event data but do not typically interact with player-identifiable records. Every access event is recorded with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is reviewed quarterly by the Data Protection Officer. German players are able to request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Providers and Regulatory Bodies
Incaspin Casino employs specialist external processors such as cloud hosting providers managing ISO 27001-certified data centres in the European Economic Area, payment processors authorised by the German Federal Financial Supervisory Authority, identity verification services that check submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment encompassing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts mandate data processing solely on documented instructions from Incaspin Casino, with no entitlement for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will alert affected players of such disclosures. The following key principles govern all third-party data sharing arrangements:
- Processors get only the minimum personal data needed to execute their agreed function, with field-level data minimisation applied to every integration.
- Sub-processor engagements demand prior written approval from Incaspin Casino, and any unapproved subcontracting forms a material breach of the data processing agreement.
- All processors must hold ISO 27001 certification or comparable independently audited security credentials, with current documentation filed with Incaspin Casino before data flows start.
- No personal data is disclosed to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.
3. bod Důvody a právní základy pro zpracování
Incaspin Casino provádí zpracování osobních údajů na základě několika různých GDPR právních základů, selected according to konkrétní zpracovatelské činnosti https://incaspincasino.de.com/legal-and-affiliates/. Plnění smlouvy pursuant to Article 6(1)(b) GDPR covers všechna zpracování dat nezbytné k vytvoření a vedení the player account, provádění vkladů a výběrů, and deliver the interactive gaming services that German players aktivně vyžadují during registration. This includes transmitting payment instructions zúčtovacím bankám a ověřování toho, že players splňují minimální věkový požadavek osmácti let podle německého práva. Zpracování na základě právní povinnosti dle Article 6(1)(c) GDPR encompasses anti-money laundering customer due diligence, oznamování podezřelých obchodů relevantním jednotkám finančního zpravodajství, uchovávání záznamů k uspokojení obchodně-právních a daňových požadavků, a soulad s německou regulací hazardu concerning player protection standards. Použitelné právní rámce include the Geldwäschegesetz and the stipulations of the Glücksspielstaatsvertrag pokud je to relevantní pro povinnosti uchovávání dat.
Legitimate interests prosazované Incaspin Casino podle Article 6(1)(f) GDPR obsahují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers pokud je to povoleno under Section 7 of the German Act Against Unfair Competition, a obchodní analýzy for service improvement. German players mají absolutní právo to object to processing based on legitimate interests, including profiling for direct marketing purposes, and such objections budou respektovány without undue delay. Souhlas under Article 6(1)(a) GDPR je využíván pro volitelné marketingové komunikace prostřednictvím e-mailu a SMS where the player has actively opted in, for the placement of non-essential cookies and tracking technologies, and for sensitive data processing za specifických okolností. Způsoby zrušení souhlasu are prominently placed within account settings and every marketing communication footer, přičemž odvolání nabývá účinnosti bez retroaktivních následků pro dříve zákonné zpracování. German players kteří ještě nedosáhli the age of 18 are not permitted to open accounts, and any inadvertently collected minor data jsou okamžitě po zjištění smazána.
Číslo 5: International Data Transfers
The main data storage infrastructure for Incaspin Casino resides within secure facilities located in the European Economic Area, specifically configured to serve the German market with latency-optimised connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For every such transfer, Incaspin Casino enforces the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures utilised where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include end-to-end encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who want to know the geographical flow of their information.
Two Groups of Personal Data Collected
Two Point One Identification Confirmation and User Data
German users must submit specific personal data to establish and keep an active Incaspin Casino account. This class includes entire statutory name, home location, date of birth, birthplace, citizenship, and gender. For identity validation purposes required under Germany’s anti-money laundering rules, the casino gathers government-issued ID files such as passport scans, scans of national ID, and proof of residency. The program also records the ID number, issuer, expiration date, and a biometrical comparison rating generated during the automated validation process. Address validation is finished through latest utility bills, bank statements, or official mail that evidently displays the player’s full name, on-file address, and an issue date inside of the last three months. Incaspin Casino uses these confirmation requirements consistently to adhere with the 4th and 5th Anti-Money Laundering Directives as implemented into German law, ensuring that all account satisfies the legal identity certainty level before any withdrawals are authorized.
Two Point Two Monetary and Transaction Data
Payment information encompasses all transaction records, including payment method details, masked card numbers, e-wallet account email addresses, bank account IBAN details for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino keeps complete transaction histories showing timestamps, amounts in EUR or cryptocurrency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and supporting documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is segregated in encrypted database tables with access restricted to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino getting only the information necessary to credit the player account.
2.3 Technical and Behavioral Records
While German players log into the Incaspin Casino platform, the system automatically collects technical data points including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data covers login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus permits the casino to deliver optimised gaming experiences, detect fraudulent activity patterns, and respect responsible gambling self-exclusion settings. Behavioural analytics monitor betting frequency, average stake sizes, session duration, and deposit velocity to feed the responsible gambling algorithms that produce personalised risk alerts. All technical logs are anonymised where possible and stored apart from core identity records, with re-identification possible only through a strictly regulated cryptographic lookup procedure reserved exclusively to the fraud and compliance teams under documented access justification.
7. Information Security Safeguards
Incaspin Casino implements a tiered security architecture in accordance with the ISO 27001 control framework and the technical requirements set forth in Article 32 of the GDPR. Network-level protections encompass enterprise-grade firewalls equipped with stateful packet inspection, intrusion detection and prevention systems that monitor traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that neutralize volumetric attacks before they hit the application layer. All data sent between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, blocking retrospective decryption of captured traffic even if long-term private keys are subsequently exposed. Internal administrative interfaces are separated on a management network not accessible from the public internet, with access granted only through multi-factor authenticated VPN tunnels coming from pre-registered static IP addresses belonging to authorised personnel. At the application layer, the platform imposes strong password policies requiring minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks pending manual review by the security team. Database-level encryption protects data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each controlled through a hardware security module that logs every key access operation. Regular vulnerability hardwareluxx.de scanning and annual penetration testing by an independent CREST-accredited security firm verify the effectiveness of these controls, with critical findings resolved within 48 hours. Security incident response procedures are tested through bi-annual tabletop exercises engaging the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.
9. Cookie Policy and Tracking Technologies
9.1 Essential and Functional Cookies
The Incaspin Casino site and mobile platform deploy a range of cookies and similar tracking technologies to provide core functionality. Strictly necessary cookies manage session state across page loads, maintain login authentication tokens, and uphold security context for CSRF protection. These first-party session cookies expire when the browser is closed and do not require prior consent under German law transposing the ePrivacy Directive, as they are necessary for the requested service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players find a coherent personalized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they expire automatically if the player has not returned to the platform. Incaspin Casino does not use flash cookies, supercookies, or any recreating techniques that evade browser deletion actions.
9.2 Metrics and Marketing Cookies
Analytics and marketing cookies are set only after German players give explicit, freely given consent through the cookie consent management platform displayed on first visit. The consent tool displays clear descriptions of each cookie category, the specific providers involved, the purposes of data collection, and the retention duration for each cookie type. Players may grant or refuse consent for each category independently, and consent preferences are recorded as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service monitor aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies enable campaign attribution and frequency capping for promotional banners shown within the logged-in casino environment. German players may change their consent choices at any time by using the cookie settings panel located in the website footer. Declining analytics or marketing cookies does not impact gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to update or update their preferences.
Closing Thoughts
Incaspin Casino has structured its data protection structure to fulfill the high standards expected by German players and mandated by the GDPR and the BDSG-neu. From the first collection of identity and contact details through to the ultimate deletion or anonymisation of records years after account closure, every personal data life cycle stage works under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino keeps transparent communication channels for rights requests, supplies granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are encouraged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.