This Privacy Notice explains how Incaspin Casino collects, handles, keeps, and safeguards personal data pertaining to players located in Germany. The document works within the framework of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino functions as the data controller for personal information provided through its website, mobile applications, and related services. German players have specific statutory rights relating to their data, and this notice details the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards implemented to prevent unauthorised access. The document also describes the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been compiled to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, providing German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed across the entire customer lifecycle.
1. Data Controller Identity and Contact Details
Správcem údajů for all personal data zpracovávané na platformě the Incaspin Casino platform je the legal entity působící pod obchodní značkou Incaspin Casino, zapsaná v státě uznávané pro přijetím standardů ekvivalentních ochraně údajů EU. Sídlo společnosti and company registration number jsou k dispozici na žádost s ověřením totožnosti by emailing pověřenci pro ochranu osobních údajů, případně v části s právními informacemi of the main website. Němečtí hráči mohou adresovat veškeré dotazy ohledně ochrany soukromí na jmenovanému pracovníkovi pro ochranu údajů, jenž pracuje samostatně and reports directly to nejvyššímu managementu. Tento pracovník can be reached via speciální šifrovanou e-mailovou adresu zveřejněnou v rámci úplného znění zásad ochrany soukromí. Incaspin Casino maintains oprávněného zástupce within the European Union z důvodu ustanovení čl. 27 GDPR, aby bylo zaručeno, že německé kontrolní orgány and data subjects mají přímé kontaktní místo pro regulační záležitosti. The controller stanovuje účely a prostředky zpracovávání všech osobních údajů shromážděných během account registration, ověřování Know Your Customer, platebních transakcích vkladů a výběrů, a průběžné aktivitě při hraní. This includes data generated through souborů cookies, technologií pro identifikaci zařízení, and server logs. German players should note, that the controller exercises plnou rozhodovací pravomoc over data processing operations a zároveň zadává důkladně vybrané zpracovatele k zajištění konkrétních technických služeb jako je hosting, platební brány, a CRM platformy. Each processor relationship se řídí právně závaznou dohodou o zpracování dat jež vyhovuje podmínkám Article 28 GDPR, s vyhrazenými povinnými právy na audit by Incaspino Casino pro ověření průběžného souladu. Podrobné kontakty zástupce v EU jsou poskytnuty kompetentnímu německému dozorovému orgánu pro ochranu dat v souladu s právními předpisy.
Two Groups of Individual Data Collected
Two Point One Identification Confirmation and Player Data
German players must provide specific private data to establish and keep an current Incaspin Casino account. This group includes complete official full name, physical address, birth date, birthplace, nationality, and gender. For identification validation reasons needed under German anti-money laundering laws, the casino collects government-issued identity documents such as passport copies, scans of national ID, and residence permit documentation. The platform also records the document number, issuing authority, expiration date, and a biometric matching score generated during the automatic verification process. Residential verification is completed through latest utility bills, bank statements, or formal mail that plainly shows the member’s name, recorded location, and an creation date inside of the previous three months. Incaspin Casino applies these verification conditions uniformly to comply with the Fourth and 5th Anti-Money Laundering Directives as transposed into German law, making sure that each account satisfies the legal identity confidence level prior to any withdrawals are authorized.
Two Point Two Monetary and Transaction Data
Financial data encompasses all transaction records, including payment instrument data, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and crypto wallet addresses where applicable. Incaspin Casino stores complete transaction histories showing timestamps, amounts in EUR or digital currency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and accompanying documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is isolated in encrypted database tables with access confined to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino receiving only the information necessary to credit the player account.
2.3 Behavioral and Technical Information
When German players access the Incaspin Casino platform, the system automatically collects technical data points including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data includes login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus permits the casino to offer optimised gaming experiences, identify fraudulent activity patterns, and respect responsible gambling self-exclusion settings. Behavioural analytics monitor betting frequency, average stake sizes, session duration, and deposit velocity to inform the responsible gambling algorithms that generate personalised risk alerts. All technical logs are pseudonymised where possible and stored apart from core identity records, with re-identification possible only through a tightly controlled cryptographic lookup procedure accessible exclusively to the fraud and compliance teams under documented access justification.
8. Rights of Germany-based Data Subjects
German gamblers possess the entire set of data subject prerogatives specified in Articles 15 through 21 of the GDPR, together with the entitlement to submit a complaint with a supervisory authority. The right of access permits players to acquire assurance of if Incaspin Casino processes their private data and to get a copy of that data including information about processing objectives, types, recipients, holding terms, and the presence of automated decision-making. Access applications are processed within one month, without charge for the first request, with the answer delivered in a structured, widely used, machine-readable structure. The right of correction allows players to amend incorrect personal data or supplement partial files, a notably applicable prerogative for identity document updates following name modifications or address moves. Incaspin Casino handles rectification inquiries within ten business days and verifies corrections to any third-party recipients to whom the wrong data was disclosed. The right of deletion holds true where the personal data is not anymore needed for the objectives for which it was obtained, where authorization is canceled, where the player raises objection to processing and no prevailing legitimate grounds exist, or where processing is not permitted. However, statutory retention requirements take precedence over erasure inquiries, and data required for legal compliance will be confined from further processing rather than removed until the retention period expires. The right to restriction of processing functions as an substitute where the precision of data is contested, processing is unlawful but the player opposes deletion, or the player necessitates the data for legal assertions despite the controller no longer demanding it. Data portability entitlements under Article 20 GDPR are limited to data supplied by the player and handled by automated means based on permission or contract, implying gameplay history and transaction logs are eligible for portability while fraud detection ratings coming from internal algorithms do not. Rights inquiries should be addressed to the Data Protection Officer email address, with legitimate proof of identity necessary before any data is disclosed.
3. Účely a právní základy zpracování
Incaspin Casino processes personal data under several distinct GDPR právních základů, vybraných according to dané činnosti zpracování. Plnění smlouvy podle Article 6(1)(b) GDPR pokrývá veškeré zpracování údajů nezbytné to create and manage účtu hráče, zpracování vkladů a výběrů, and deliver interaktivních herních služeb jež German players aktivně vyžadují during registration. This zahrnuje transmitting payment instructions akvizičním bankám and verifying toho, že players splňují minimální věkový požadavek of 18 years under German law. Povinné zpracování podle Article 6(1)(c) GDPR pokrývá anti-money laundering customer due diligence, oznamování podezřelých obchodů relevantním jednotkám finančního zpravodajství, retence záznamů to satisfy požadavků obchodního a daňového práva, and compliance with German gambling regulations týkajících se standardů ochrany hráčů. Relevantní právní rámce obsahují the Geldwäschegesetz a předpisy státní smlouvy o hazardu kde je to relevantní pro povinnosti uchovávání dat.
Oprávněné zájmy pursued by Incaspin Casino under Article 6(1)(f) GDPR obsahují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers tam, kde je to dovoleno under Section 7 of the German Act Against Unfair Competition, a analýzy podnikání for service improvement. German players zachovávají si nezpochybnitelné právo vznášet námitky proti zpracování na základě oprávněných zájmů, including profiling k přímým marketingovým účelům, a tyto námitky budou ctěny without undue delay. Souhlas dle Article 6(1)(a) GDPR je spoléháno for optional marketing communications prostřednictvím e-mailu a SMS where hráč aktivně souhlasil, for the placement of non-essential cookies and tracking technologies, a pro zpracování citlivých údajů in specific circumstances. Způsoby zrušení souhlasu jsou výrazně umístěny v nastavení účtu a v patičce každého marketingového sdělení, s tím, že odvolání má účinek without retroactive consequences pro dříve zákonné zpracování. German players who have not yet reached the age of 18 nesmějí otevírat účty, and any inadvertently collected minor data jsou okamžitě po zjištění smazána.
6. Data Retention and Deletion Rules
Incaspin Casino operates a precise data retention policy designed to fulfill statutory record-keeping obligations while limiting the retention of personal data past its necessary purpose. Player account data and entire transaction records are stored for the entire duration of the active business relationship, defined as the period from account creation up to the account is closed, plus an extra statutory retention term mandated by German anti-money laundering laws and commercial law. Under the Geldwäschegesetz, identification records, transaction confirmations, and due diligence documentation must be preserved for at least five years from the end of the calendar year in which the business relationship terminated. Accounting records applicable to tax duties are stored for ten years in compliance with the German Fiscal Code. Following the expiration of these mandatory periods, personal data is either irreversibly anonymised so that re-identification becomes unfeasible with all ways reasonably expected to be employed, or securely removed through cryptographic erasure and physical storage media sanitisation processes. Technical logs and security event data adhere to a briefer retention cycle of twelve months, after which they are combined into anonymised statistical reports. Inactive accounts demonstrating no login activity for a continuous period of 24 months are flagged for dormancy assessment, and the connected personal data is limited to store only the core ID and transaction records needed for the leftover statutory retention schedule. The casino utilizes automated data lifecycle management scripts that run weekly to locate records past their retention limits, starting deletion workflows without human input, with the results recorded for compliance audit purposes.
Číslo 5: International Data Transfers
The primary data storage infrastructure for Incaspin Casino operates from secure facilities located in the European Economic Area, specifically configured to serve the German market with latency-optimised connectivity while maintaining full GDPR jurisdictional coverage. Some specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For every such transfer, Incaspin Casino applies the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures utilised where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include end-to-end encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who wish to understand the geographical flow of their information.
7. Data Security Controls
Incaspin Casino deploys a multilevel security architecture aligned with the ISO 27001 control framework and the technical requirements set forth in Article 32 of the GDPR. Network-level protections include enterprise-grade firewalls equipped with stateful packet inspection, intrusion detection and prevention systems that watch traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that withstand volumetric attacks before they reach the application layer. All data transmitted between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, blocking retrospective decryption of captured traffic even if long-term private keys are eventually leaked. Internal administrative interfaces are isolated on a management network unreachable from the public internet, with access permitted exclusively through multi-factor authenticated VPN tunnels starting from pre-registered static IP addresses assigned to authorised personnel. At the application layer, the platform enforces strong password policies demanding minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks until manual review by the security team. Database-level encryption secures data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each administered through a hardware security module that records every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm verify the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are evaluated through bi-annual tabletop exercises involving the Data Protection Officer, with a documented breach notification workflow ensuring German players and the supervisory authority receive notification within the 72-hour deadline required by GDPR.
4. Data Sharing and Third-Party Recipients
4.1 In-House Data Access Model
Within the Incaspin Casino operational structure, personal data access utilizes a strict least-privilege model used for four distinct personnel tiers. Customer support agents retrieve basic account information and communication history but cannot view full financial records or identity documents. Compliance officers hold permissions to examine verification documents, transaction patterns, and risk scores. Financial department personnel process withdrawal requests and view payment instrument details necessary to execute transfers. IT security staff monitor system logs and security event data but do not regularly interact with player-identifiable records. Every access event is tracked with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is reviewed quarterly by the Data Protection Officer. German players are able to request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Providers and Regulatory Bodies
Incaspin Casino employs specialist external processors comprising cloud hosting providers running ISO 27001-certified data centres in the European Economic Area, payment processors licensed by the German Federal Financial Supervisory Authority, identity verification services that compare submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts require data processing solely on documented instructions from Incaspin Casino, with no authority for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators occur only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles regulate all third-party data sharing arrangements:
- Processors obtain only the minimal personal data required to perform their agreed function, with field-level data minimisation implemented to every integration.
- Sub-processor engagements require prior written consent from Incaspin Casino, and any unlicensed subcontracting represents a material breach of the data processing agreement.
- All processors must maintain ISO 27001 certification or equivalent independently audited security credentials, with current records filed with Incaspin Casino before data flows begin.
- No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business centers on monetising personal information.
9. Cookie Policy and Tracking Technologies
9.1 Necessary and Functional Cookies
The Incaspin Casino platform and mobile platform utilize a variety of cookies and similar tracking technologies to deliver core functionality. Strictly necessary cookies manage session state across page loads, maintain login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies expire when the browser is closed and do not require prior consent under German law transposing the ePrivacy Directive, as they are essential for the required service delivery. Functional cookies save language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players encounter a uniform personalized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they expire automatically if the player has not accessed the platform. Incaspin Casino does not use flash cookies, supercookies, or any respawning techniques that circumvent browser deletion actions.
9.2 Analysis and Marketing Cookies
Analytics and marketing cookies are set only after German players provide explicit, freely given consent through the cookie consent management platform shown on first visit. The consent tool offers clear descriptions of each cookie category, the specific providers involved, the purposes of data collection, and the retention duration for each cookie type. Players may grant or refuse consent for each category independently, and consent preferences are logged as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service monitor aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies facilitate campaign attribution and frequency capping for promotional banners shown within the logged-in casino environment. German players may change their consent choices at any time by using the cookie settings panel linked in the website footer. Rejecting analytics or marketing cookies does not affect gameplay functionality or account standing in any manner. The consent tool solicits players annually to reconfirm or update their preferences.
Summary
Incaspin Casino has organized its data protection framework to satisfy the high standards expected by German players and mandated by the GDPR and the BDSG-neu. From the preliminary collection of identity and contact information through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage operates under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino preserves transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are encouraged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.
