This Privacy Notice describes how Incaspin Casino obtains, processes, keeps, and safeguards personal data of players located in Germany. The document operates within the scope of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino functions as the data controller for personal information submitted through its website, mobile applications, and related services. German players possess specific statutory rights regarding their data, and this notice details the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards deployed to prevent unauthorised access. The document also explains the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been compiled to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, offering German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed during the entire customer lifecycle.
1. Kontakt na správce údajů and Contact Details
The data controller for all personal data processed through the Incaspin Casino platform představuje subjekt operating under the brand name Incaspin Casino, registered in jurisdikci recognised for dodržováním standardů ochrany údajů odpovídajících EU. The registered office address a identifikační číslo společnosti are available upon verified request zasláním e-mailu pověřenci pro ochranu osobních údajů, případně v části s právními informacemi of the main website. Hráči z Německa may direct jakékoli dotazy týkající se soukromí na the designated Data Protection Officer, who operates independently and reports directly to nejvyššímu managementu. Pověřenec can be reached prostřednictvím vyhrazeného šifrovaného e-mailového kanálu published within kompletního textu politiky ochrany osobních údajů. Incaspin Casino udržuje a legal representative na území Evropské unie pro účely ustanovení čl. 27 GDPR, aby bylo zaručeno, že německé kontrolní orgány a subjekty údajů mají přímé kontaktní místo ohledně regulačních otázek. Tento subjekt determines účely a prostředky zpracování all personal data collected during account registration, Know Your Customer verification, transakcích vkladů a výběrů, a probíhající herní činnosti. Sem patří informace generované pomocí cookies, technologií otisku zařízení, a serverových logů. Němečtí hráči by měli vzít na vědomí, že správce vykonává absolutní moc nad rozhodováním over data processing operations while commissioning pečlivě prověřené zpracovatele for specific technical services jako je hosting, platební brány, and CRM platforms. Každá smluvní dohoda se zpracovatelem se řídí právně závaznou dohodou o zpracování dat jež vyhovuje podmínkám článku 28 GDPR, s vyhrazenými povinnými právy na audit pro Incaspin Casino to verify ongoing compliance. Kontaktní údaje zástupce v EU jsou poskytnuty kompetentnímu německému dozorovému orgánu pro ochranu dat jak vyžaduje zákon.
7. Information Security Measures
Incaspin Casino deploys a multi-layered security architecture conforming to the ISO 27001 control framework and the technical requirements articulated in Article 32 of the GDPR. Network-level protections include enterprise-grade firewalls equipped with stateful packet inspection, intrusion detection and prevention systems that watch traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that withstand volumetric attacks before they reach the application layer. All data transferred between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, preventing retrospective decryption of captured traffic even if long-term private keys are later compromised. Internal administrative interfaces are segmented on a management network inaccessible from the public internet, with access granted only through multi-factor authenticated VPN tunnels originating from pre-registered static IP addresses owned by authorised personnel. At the application layer, the platform enforces strong password policies requiring minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks pending manual review by the security team. Database-level encryption secures data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each administered through a hardware security module that records every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm verify the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are tested through bi-annual tabletop exercises involving the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.
2. Categories of Private Data Gathered
2.1 Identification Verification and User Data
German players must provide certain private data to set up and sustain an current Incaspin Casino account. This class includes entire official full name, home location, DOB, birthplace, nationality, and gender. For identity confirmation aims required under German anti-money laundering rules, the casino obtains government-issued identification papers such as passport scans, national ID copies, and proof of residency. The system also stores the ID number, issuing authority, expiry date, and a biometric comparison score created during the automatic verification process. Residential confirmation is done through recent utility bills, bank statements, or official communication that plainly presents the member’s name, registered address, and an creation date inside of the past three months. Incaspin Casino uses these confirmation conditions consistently to comply with the Fourth and 5th Anti-Money Laundering Directives as implemented into German law, guaranteeing that all account satisfies the legal identification assurance level before any withdrawals are permitted.
2.2 Fiscal and Transaction Data
Payment information encompasses all deposit and withdrawal records, including payment instrument data, masked card numbers, e-wallet account email addresses, bank account IBAN details for SEPA transfers, and crypto wallet addresses where applicable https://incaspincasino.de.com/legal-and-affiliates/. Incaspin Casino retains complete transaction histories showing timestamps, amounts in EUR or digital currency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and supporting documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is segregated in encrypted database tables with access confined to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino obtaining only the information necessary to credit the player account.
2.3 Technical and Behavioural Data
As German players visit the Incaspin Casino platform, the system gathers technical identifiers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data covers login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus allows the casino to offer optimised gaming experiences, spot fraudulent activity patterns, and respect responsible gambling self-exclusion settings. Behavioural analytics track betting frequency, average stake krone.at sizes, session duration, and deposit velocity to supply the responsible gambling algorithms that generate personalised risk alerts. All technical logs are anonymised where possible and stored independently from core identity records, with re-identification possible only through a carefully managed cryptographic lookup procedure reserved exclusively to the fraud and compliance teams under documented access justification.
8. Prerogatives of German Data Subjects
German gamblers hold the full set of data subject rights specified in Articles 15 through 21 of the GDPR, along with the option to file a complaint with a supervisory authority. The right of access permits players to acquire confirmation of whether Incaspin Casino processes their private data and to get a duplicate of that data together with information about processing objectives, classes, receivers, retention durations, and the presence of automated decision-making. Access applications are processed within one month, at no cost for the first request, with the reply delivered in a organized, generally used, machine-readable format. The right of correction allows players to correct inaccurate personal data or fill in missing documents, a notably relevant prerogative for identity document changes following name modifications or address transfers. Incaspin Casino deals with rectification inquiries within ten business days and acknowledges corrections to any third-party receivers to whom the inaccurate data was disclosed. The right to erasure holds true where the personal data is no longer needed for the purposes for which it was obtained, where consent is withdrawn, where the player opposes to processing and no overriding legitimate grounds are present, or where processing is illegal. Nonetheless, statutory retention obligations take precedence over erasure inquiries, and data needed for legal compliance will be limited from further processing rather than deleted until the retention period lapses. The restriction right of processing serves as an substitute where the precision of data is contested, processing is unlawful but the player is against deletion, or the player necessitates the data for legal claims despite the controller no longer demanding it. Data portability entitlements under Article 20 GDPR extend only to data furnished by the player and dealt with by automated methods based on consent or contract, implying gameplay history and transaction logs are suitable for portability while fraud detection assessments coming from internal systems do not. Rights applications should be directed to the Data Protection Officer email address, with legitimate proof of identity necessary before any data is disclosed.
Six. Information Archiving and Erasure Guidelines
Incaspin Casino runs a granular data retention policy designed to fulfill statutory record-keeping requirements while limiting the storage of personal data beyond its necessary purpose. Player account data and full transaction logs are retained for the full period of the active business relationship, described as the term from account creation up to the account is deactivated, plus an additional statutory retention term stipulated by German anti-money laundering legislation and commercial law. Under the Geldwäschegesetz, identification files, transaction vouchers, and due diligence materials must be preserved for at least five years following the end of the calendar year in which the business relationship terminated. Accounting records relevant to tax duties are stored for ten years in compliance with the German Fiscal Code. Following the expiration of these mandatory terms, personal data is either irrevocably de-identified so that re-identification becomes impossible with all ways reasonably expected to be employed, or safely erased through cryptographic erasure and physical storage media sanitisation processes. Technical logs and security event data adhere to a shorter retention cycle of twelve months, after which they are compiled into anonymised statistical overviews. Inactive accounts demonstrating no login activity for a consecutive period of 24 months are marked for dormancy review, and the associated personal data is limited to keep only the core name and transaction records needed for the outstanding statutory retention timeline. The casino utilizes automated data lifecycle management scripts that execute weekly to identify records past their retention limits, starting deletion processes without human input, with the results recorded for compliance audit reasons.
4. Information Sharing and Third Parties
4.1 Internal Data Access Structure
Within the Incaspin Casino operational structure, personal data access utilizes a strict least-privilege model applied across four distinct personnel tiers. Customer support agents access basic account information and communication history but are unable to view full financial records or identity documents. Compliance officers possess permissions to review verification documents, transaction patterns, and risk scores. Financial department personnel manage withdrawal requests and view payment instrument details required to execute transfers. IT security staff monitor system logs and security event data but do not routinely interact with player-identifiable records. Every access event is recorded with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is checked quarterly by the Data Protection Officer. German players are able to request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Providers and Regulatory Bodies
Incaspin Casino engages specialist external processors including cloud hosting providers managing ISO 27001-certified data centres within the European Economic Area, payment processors licensed by the German Federal Financial Supervisory Authority, identity verification services that check submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts stipulate data processing solely on documented instructions from Incaspin Casino, with no entitlement for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators happen only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles govern all third-party data sharing arrangements:
- Processors get only the minimum personal data needed to carry out their specified function, with field-level data minimisation implemented to every integration.
- Sub-processor engagements need prior written approval from Incaspin Casino, and any unapproved subcontracting forms a material breach of the data processing agreement.
- All processors must maintain ISO 27001 certification or similar independently audited security credentials, with current documentation filed with Incaspin Casino before data flows begin.
- No personal data is transferred to advertising technology platforms, data brokers, or any entity whose primary business centers on monetising personal information.
9. Cookie Policy and Tracking Technologies
9.1 Essential and Technical Cookies
The Incaspin Casino website and mobile platform deploy a set of cookies and similar tracking technologies to ensure core functionality. Strictly necessary cookies control session state across page loads, maintain login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies terminate when the browser is closed and do not require prior consent under German law enforcing the ePrivacy Directive, as they are essential for the requested service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players experience a coherent customized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they become invalid automatically if the player has not revisited the platform. Incaspin Casino does not use flash cookies, supercookies, or any recreating techniques that circumvent browser deletion actions.
9.2 Metrics and Marketing Cookies
Analytics and marketing cookies are set only after German players provide explicit, freely given consent through the cookie consent management platform displayed on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers involved, the purposes of data collection, and the retention duration for each cookie type. Players may allow or withhold consent for each category independently, and consent preferences are stored as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service measure aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies facilitate campaign attribution and frequency capping for promotional banners presented within the logged-in casino environment. German players may change their consent choices at any time by accessing the cookie settings panel located in the website footer. Declining analytics or marketing cookies does not affect gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to reaffirm or update their preferences.
3. Účely a právní základy zpracování
Incaspin Casino provádí zpracování personal data na základě několika různých GDPR právních základů, vybraných v závislosti na konkrétní zpracovatelské činnosti. The performance of a contract podle Article 6(1)(b) GDPR zahrnuje všechna zpracování dat necessary k vytvoření a vedení the player account, provádění vkladů a výběrů, a poskytování the interactive gaming services jež German players aktivně požadují during registration. This zahrnuje zasílání platebních pokynů zúčtovacím bankám and verifying toho, že players dosahují the minimum age requirement osmácti let under German law. Legal obligation processing under Article 6(1)(c) GDPR zahrnuje anti-money laundering customer due diligence, suspicious transaction reporting relevantním jednotkám finančního zpravodajství, uchovávání záznamů to satisfy obchodně-právních a daňových požadavků, a dodržování s německými herními předpisy týkajících se standardů ochrany hráčů. Relevantní právní rámce include Geldwäschegesetz a předpisy of the Glücksspielstaatsvertrag pokud je to relevantní pro povinnosti uchovávání dat.
Oprávněné zájmy prosazované Incaspin Casino podle Article 6(1)(f) GDPR obsahují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers tam, kde je to dovoleno dle Section 7 of the German Act Against Unfair Competition, a analýzy podnikání pro zlepšení služeb. German players zachovávají si the absolute right odmítnout zpracování based on legitimate interests, včetně vytváření profilů pro účely přímého marketingu, a tyto námitky budou respektovány without undue delay. Souhlas under Article 6(1)(a) GDPR je spoléháno pro volitelné marketingové komunikace e-mailem a SMS kde hráč aktivně souhlasil, pro nasazení neesenciálních cookies a sledovacích technologií, and for sensitive data processing in specific circumstances. Consent withdrawal mechanisms jsou nápadně umístěny v rámci nastavení účtu a v patičce každého marketingového sdělení, s tím, že odvolání má účinek bez zpětných důsledků pro dříve zákonné zpracování. German players kteří ještě nedosáhli the age of 18 nesmějí otevírat účty, a jakákoli neúmyslně shromážděná data nezletilých is deleted immediately upon discovery.
Pátý bod: International Data Transfers
The main data storage infrastructure for Incaspin Casino is located in secure facilities located in the European Economic Area, specifically engineered to serve the German market with low-latency connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino enforces the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures implemented where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include end-to-end encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who want to know the geographical flow of their information.
Conclusion
Incaspin Casino has organized its data protection framework to fulfill the high standards demanded by German players and mandated by the GDPR and the BDSG-neu. ausführliche Analyse From the initial collection of identity and contact information through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage works under documented policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino keeps transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are encouraged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.
