This Privacy Notice describes how Incaspin Casino collects, handles, stores, and protects personal data pertaining to players located in Germany. The document functions within the framework of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino acts as the data controller for personal information provided through its website, mobile applications, and related services. German players enjoy specific statutory rights regarding their data, and this notice outlines the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards used to prevent unauthorised access. The document also details the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been drafted to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, offering German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed during the entire customer lifecycle.
První bod: Identita správce údajů and Contact Details
Osobou odpovědnou za zpracování údajů for all personal data zpracovávané na platformě the Incaspin Casino webové stránky je the legal entity vystupující pod obchodní značkou Incaspin Casino, zapsaná v státě známé svým dodržováním standardů ochrany údajů odpovídajících EU https://incaspincasino.de.com/legal-and-affiliates/. Sídlo společnosti a registrační číslo are available upon verified request by emailing pověřenci pro ochranu osobních údajů, or by consulting části s právními informacemi hlavních webových stránek. Němečtí hráči mohou směřovat veškeré dotazy ohledně ochrany soukromí k jmenovanému pracovníkovi pro ochranu údajů, jenž pracuje samostatně a je přímo podřízen senior management. Pověřenec je k zastižení přes vyhrazeného šifrovaného e-mailového kanálu uvedenou v úplného znění zásad ochrany soukromí. Incaspin Casino udržuje oprávněného zástupce na území Evropské unie z důvodu článku 27 GDPR, ensuring that německé dozorové úřady a subjekty údajů have a direct point of contact ohledně regulačních otázek. Tento subjekt determines cíle a způsoby of processing všech osobních údajů shromážděných během registraci účtu, Know Your Customer verification, deposit and withdrawal transactions, a probíhající herní činnosti. This includes data generated through cookies, device fingerprinting technologies, a serverových logů. Němečtí hráči by měli vzít na vědomí, that the controller exercises plnou rozhodovací pravomoc ohledně činností zpracování dat a zároveň zadává důkladně vybrané zpracovatele pro specifické technické služby jako je hosting, platební brány, a platformy pro řízení vztahů se zákazníky. Každý vztah se zpracovatelem is governed by právně závaznou dohodou o zpracování dat jež vyhovuje podmínkám ustanovení čl. 28 GDPR, with mandatory audit rights reserved by Incaspino Casino to verify ongoing compliance. The contact details zástupce v EU are provided to příslušnému německému úřadu pro ochranu osobních údajů v souladu s právními předpisy.
8. Rights of German Data Subjects
German gamblers enjoy the full range of data subject rights listed in Articles 15 through 21 of the GDPR, along with the entitlement to lodge a grievance with a supervisory authority. The right to access enables players to acquire assurance of whether Incaspin Casino processes their individual data and to receive a copy of that data including details about processing aims, types, receivers, holding terms, and the occurrence of automated decision-making. Access applications are processed within one month, at no cost for the primary request, with the answer supplied in a structured, generally used, machine-readable structure. The right of correction enables players to correct inaccurate personal data or fill in partial records, a notably relevant prerogative for identity document revisions following name modifications or address relocations. Incaspin Casino handles rectification inquiries within ten business days and confirms rectifications to any third-party addressees to whom the inaccurate data was disclosed. The erasure right holds true where the personal data is no more necessary for the aims for which it was gathered, where consent is withdrawn, where the player objects to processing and no overriding legitimate grounds are present, or where processing is unlawful. Nevertheless, statutory retention requirements supersede erasure requests, and data needed for legal compliance will be limited from further processing rather than erased until the retention period expires. The restriction right of processing acts as an alternative where the precision of data is contested, processing is unlawful but the player objects to deletion, or the player requires the data for legal demands despite the controller no longer demanding it. Data portability prerogatives under Article 20 GDPR extend only to data furnished by the player and processed by automated ways based on authorization or contract, implying gameplay history and transaction logs are eligible for portability while fraud detection assessments coming from internal algorithms do not. Rights inquiries should be sent to the Data Protection Officer email address, with valid proof of identity required before any data is shared.
2. Groups of Private Data Obtained
Two Point One Identification Validation and Player Data
German players must submit specific private data to establish and sustain an living Incaspin Casino account. This group contains entire official full name, physical address, birth date, birthplace, citizenship, and sex. For identification confirmation reasons mandatory under German anti-money laundering rules, the casino obtains government-issued ID files such as copy of passport, national ID copies, and residence permit papers. The program also records the ID number, issuing authority, expiration date, and a biometrical matching score generated during the computerized confirmation process. Residential confirmation is completed through current utility bills, bank statements, or formal communication that clearly presents the user’s full name, recorded address, and an issue day inside of the previous three months. Incaspin Casino implements these confirmation conditions evenly to adhere with the 4th and Fifth Anti-Money Laundering Directives as incorporated into German law, guaranteeing that all account fulfills the regulatory identification assurance level before any withdrawals are authorized.
Two Point Two Financial and Deal Data
Transaction records encompasses all deposit and withdrawal records, including payment method identifiers, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and crypto wallet addresses where applicable. Incaspin Casino keeps complete transaction histories showing timestamps, amounts in EUR or cryptocurrency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is segregated in encrypted database tables with access limited to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino getting only the information necessary to credit the player account.
2.3 Technical and Behavioral Records
When German players access the Incaspin Casino platform, the system gathers technical markers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data encompasses login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus enables the casino to provide optimised gaming experiences, identify fraudulent activity patterns, and honour responsible gambling self-exclusion settings. Behavioural analytics measure betting frequency, average stake sizes, session duration, and deposit velocity to feed the responsible gambling algorithms that generate personalised risk alerts. All technical logs are de-identified where possible and stored independently from core identity records, with re-identification possible only through a tightly controlled cryptographic lookup procedure reserved exclusively to the fraud and compliance teams under documented access justification.
4. Information Sharing and Third Parties
4.1 Internal Data Access Structure
Inside the Incaspin Casino operational framework, personal data access adheres to a strict least-privilege model implemented across four distinct personnel tiers. Customer support agents view basic account information and communication history but cannot view full financial records or identity documents. Compliance officers have permissions to review verification documents, transaction patterns, and risk scores. Financial department personnel process withdrawal requests and view payment instrument details required to execute transfers. IT security staff monitor system logs and security event data but do not regularly interact with player-identifiable records. Every access event is recorded with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is examined quarterly by the Data Protection Officer. German players can request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Service Providers and Authorities
Incaspin Casino engages specialist external processors including cloud hosting providers running ISO 27001-certified data centres within the European Economic Area, payment processors licensed by the German Federal Financial Supervisory Authority, identity verification services that compare submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts stipulate data processing solely on documented instructions from Incaspin Casino, with no authority for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles regulate all third-party data sharing arrangements:
- Processors obtain only the minimal personal data required to perform their specified function, with field-level data minimisation applied to every integration.
- Sub-processor engagements demand prior written consent from Incaspin Casino, and any unlicensed subcontracting constitutes a material breach of the data processing agreement.
- All processors must maintain ISO 27001 certification or comparable independently audited security standards, with current records filed with Incaspin Casino before data flows start.
- No personal data is transferred to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.
Pátý bod: International Data Transfers
The core data storage infrastructure for Incaspin Casino resides within secure facilities located in the European Economic Area, specifically designed to serve the German market with latency-optimised connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino implements the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures utilised where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include complete encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who wish to understand the geographical flow of their information.
3. Důvody a právní základy pro zpracování
Incaspin Casino provádí zpracování osobních údajů podle několika odlišných GDPR legal bases, zvolených podle dané činnosti zpracování. Plnění smlouvy podle Article 6(1)(b) GDPR pokrývá all data processing necessary pro vytvoření a správu the player account, zpracování vkladů a výběrů, and deliver the interactive gaming services jež German players aktivně vyžadují při registraci. This includes transmitting payment instructions akvizičním bankám and verifying že players meet požadavek minimálního věku of 18 years podle německého práva. Legal obligation processing dle Article 6(1)(c) GDPR pokrývá anti-money laundering customer due diligence, hlášení podezřelých transakcí to relevant Financial Intelligence Units, record retention k uspokojení požadavků obchodního a daňového práva, a soulad with German gambling regulations ohledně norem ochrany hráčů. Použitelné právní rámce include the Geldwäschegesetz a ustanovení státní smlouvy o hazardu kde je to relevantní k mandátům uchovávání údajů.
Oprávněné zájmy sledované Incaspin Casino under Article 6(1)(f) GDPR obsahují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted podle Section 7 of the German Act Against Unfair Competition, a obchodní analýzy for service improvement. German players zachovávají si the absolute right odmítnout zpracování based on legitimate interests, včetně vytváření profilů k přímým marketingovým účelům, a takové námitky will be honoured without undue delay. Povolení dle Article 6(1)(a) GDPR je využíván pro nepovinná marketingová sdělení e-mailem a SMS kde hráč se aktivně přihlásil, pro umístění nepodstatných cookies a sledovacích technologií, and for sensitive data processing za specifických okolností. Způsoby zrušení souhlasu jsou nápadně umístěny v nastavení účtu a v zápatí každé marketingové komunikace, s tím, že odvolání má účinek bez retroaktivních následků pro dříve zákonné zpracování. German players who have not yet reached osmácti let nemají povoleno otevírat účty, and any inadvertently collected minor data is deleted immediately upon discovery.
7. Information Security Controls
Incaspin Casino utilizes a multi-layered security architecture aligned with the ISO 27001 control framework and the technical requirements articulated in Article 32 of the GDPR. Network-level protections comprise enterprise-grade firewalls equipped with stateful packet inspection, intrusion detection and prevention systems that analyze traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that absorb volumetric attacks before they reach the application layer. All data transmitted between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, avoiding retrospective decryption of captured traffic even if long-term private keys are eventually leaked. Internal administrative interfaces are isolated on a management network unreachable from the public internet, with access permitted exclusively through multi-factor authenticated VPN tunnels starting from pre-registered static IP addresses belonging to authorised personnel. At the application layer, the platform enforces strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks pending manual review by the security team. Database-level encryption secures data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each controlled through a hardware security module that records every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm validate the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are practiced through bi-annual tabletop exercises engaging the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline required by GDPR.
Six. Information Retention and Erasure Guidelines
Incaspin Casino runs a granular data retention plan intended to satisfy statutory record-keeping requirements while limiting the storage of personal data beyond its necessary purpose. Player account data and complete transaction histories are retained for the full length of the ongoing business relationship, characterized as the term from account creation till the account is closed, plus an additional statutory retention duration mandated by German anti-money laundering legislation and commercial law. Under the Geldwäschegesetz, identification files, transaction confirmations, and due diligence materials must be preserved for at least five years following the end of the calendar year in which the business relationship terminated. Accounting records pertinent to tax requirements are stored for ten years in accordance with the German Fiscal Code. Following the expiration of these mandatory periods, personal data is either irrevocably anonymised so that re-identification becomes unfeasible with all methods reasonably likely to be applied, or safely erased through cryptographic erasure and physical storage media wiping processes. Technical logs and security event data follow a shorter retention interval of twelve months, after which they are aggregated into anonymised statistical overviews. Inactive accounts exhibiting no login activity for a consecutive period of 24 months are marked for dormancy assessment, and the connected personal data is reduced to retain only the core identifier and transaction records required for the remaining statutory retention timeline. The casino deploys automated data lifecycle management processes that execute weekly to identify records past their retention limits, triggering deletion workflows without human intervention, with the results documented for compliance audit reasons.
9. Cookie Policy and Tracking Technologies
9.1 Necessary and Operational Cookies
The Incaspin Casino platform and mobile platform deploy a range of cookies and similar tracking technologies to deliver core functionality. Strictly necessary cookies manage session state across page loads, preserve login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies end when the browser is closed and do not require prior consent under German law enforcing the ePrivacy Directive, as they are indispensable for the required service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, making sure that returning players find a consistent customized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they are deleted automatically if the player has not revisited the platform. Incaspin Casino does not use flash cookies, supercookies, or any regenerating techniques that circumvent browser deletion actions.
9.2 Analysis and Marketing Cookies
Analytics and marketing cookies are set only after German players provide explicit, freely given consent through the cookie consent management platform presented on first visit. The consent tool offers clear descriptions of each cookie category, the specific providers participating, the purposes of data collection, and the retention duration for each cookie type. Players may allow or deny consent for each category independently, and consent preferences are recorded as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service measure aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies enable campaign attribution and frequency capping for promotional banners presented within the logged-in casino environment. German players may modify their consent choices at any time by accessing the cookie settings panel located in the website footer. Rejecting analytics or marketing cookies does not affect gameplay functionality or account standing in any manner. The consent tool asks again players annually to update or update their preferences.
Closing Thoughts
Incaspin Casino has structured its data protection structure to satisfy the high standards expected by German players and stipulated by the GDPR and the BDSG-neu. From the preliminary collection of identity and contact information through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage operates under documented policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino keeps transparent communication channels for rights requests, supplies granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are advised to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.
Leave a Reply