This Privacy Notice describes how Incaspin Casino collects, manages, retains, and safeguards personal data belonging to players located in Germany. The document works within the framework of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino acts as the data controller for personal information submitted through its website, mobile applications, and related services. German players enjoy specific statutory rights regarding their data, and this notice specifies the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards deployed to prevent unauthorised access. The document also describes the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been drafted to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, offering German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed across the entire customer lifecycle.
První bod: Kontakt na správce údajů a kontaktní údaje
The data controller za veškeré osobní údaje zpracovávané prostřednictvím the Incaspin Casino platformy is subjekt vystupující pod the brand name Incaspin Casino, registered in státě uznávané pro its adherence to standardů ochrany údajů odpovídajících EU. Adresa sídla a registrační číslo poskytneme na ověřenou žádost e-mailem na adresu the Data Protection Officer, or by consulting the imprint section of the main website. Hráči z Německa mohou směřovat jakékoli dotazy týkající se soukromí na jmenovanému pracovníkovi pro ochranu údajů, jenž pracuje samostatně and reports directly to senior management. The DPO může být kontaktován via vyhrazeného šifrovaného e-mailového kanálu uvedenou v úplného znění zásad ochrany soukromí. Incaspin Casino maintains právního zástupce na území Evropské unie z důvodu Article 27 GDPR, aby bylo zaručeno, že německé dozorové úřady i dotčené osoby disponují přímým kontaktem pro regulační záležitosti. Správce určuje cíle a způsoby zpracování všech osobních údajů získaných při account registration, identifikačním procesu KYC, transakcích vkladů a výběrů, a průběžné aktivitě při hraní. To zahrnuje údaje vytvářené prostřednictvím souborů cookies, technologií pro identifikaci zařízení, a záznamů serveru. German players should note, že správce vykonává plnou rozhodovací pravomoc ohledně činností zpracování dat while commissioning carefully vetted processors k zajištění konkrétních technických služeb such as hosting, payment gateways, a platformy pro řízení vztahů se zákazníky. Každý vztah se zpracovatelem is governed by a binding data processing agreement that meets the requirements of Article 28 GDPR, s možností provádět povinné audity pro Incaspin Casino pro ověření průběžného souladu. Kontaktní údaje zástupce v EU jsou poskytnuty příslušnému německému úřadu pro ochranu osobních údajů v souladu s právními předpisy.
Two Categories of Individual Data Gathered
2.1 Identity Verification and Player Data
German users must submit particular individual data to establish and sustain an active Incaspin Casino account. This class includes complete statutory name, physical location, date of birth, place of birth, nationality, and sex. For identification validation purposes needed under German anti-money laundering laws, the casino obtains government-issued identity documents such as passport copies, scans of national ID, and residence permit documentation. The platform also logs the document number, issuer, expiry date, and a biometrical matching score generated during the automated validation process. Residential verification is completed through current utility bills, bank statements, or official mail that evidently shows the player’s full name, registered location, and an creation day inside of the previous three months. Incaspin Casino applies these validation conditions uniformly to comply with the 4th and Fifth Anti-Money Laundering Orders as incorporated into Germany’s law, ensuring that all account satisfies the statutory identity confidence level before any withdrawals are permitted.
Two Point Two Monetary and Transaction Data
Transaction records encompasses all deposit and withdrawal records, including payment instrument data, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and digital wallet addresses where applicable. Incaspin Casino stores complete transaction histories showing timestamps, amounts in EUR or equivalent cryptocurrency, processing statuses, and any intermediary payment processor references. Source of funds declarations and supporting documents such as payslips, tax returns, or business financial statements are collected when players reach specific deposit thresholds or trigger enhanced due diligence procedures. This data is separated in encrypted database tables with access limited to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino getting only the information necessary to credit the player account.
2.3 Technical and Behavioural Data
As German players visit the Incaspin Casino platform, the system captures technical data points including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data encompasses login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus enables the casino to provide optimised gaming experiences, identify fraudulent activity patterns, and respect responsible gambling self-exclusion settings. Behavioural analytics monitor betting frequency, average stake sizes, session duration, and deposit velocity to inform the responsible gambling algorithms that generate personalised risk alerts. All technical logs are anonymised where possible and stored separately from core identity records, with re-identification possible only through a tightly controlled cryptographic lookup procedure available exclusively to the fraud and compliance teams under documented access justification.
8. Rights of German-resident Data Subjects
German players hold the entire suite of data subject entitlements listed in Articles 15 through 21 of the GDPR, along with the option to file a complaint with a supervisory authority. The access right enables players to acquire verification of whether Incaspin Casino processes their private data and to receive a version of that data together with details about processing objectives, categories, recipients, retention periods, and the presence of automated decision-making. Access inquiries are completed within one month, without charge for the primary request, with the response delivered in a ordered, widely used, machine-readable format. The right to rectification permits players to rectify wrong personal data or complete partial files, a particularly pertinent right for identity document changes following name changes or address transfers. Incaspin Casino handles rectification inquiries within ten business days and acknowledges rectifications to any third-party addressees to whom the inaccurate data was shared. The right of deletion holds true where the personal data is no longer required for the aims for which it was obtained, where authorization is canceled, where the player opposes to processing and no prevailing legitimate grounds are in place, or where processing is illegal. Nonetheless, statutory retention obligations override erasure inquiries, and data necessary for legal compliance will be limited from further processing rather than deleted until the retention period expires. The right to restriction of processing serves as an option where the accuracy of data is disputed, processing is illegal but the player is against deletion, or the player needs the data for legal demands despite the controller no longer demanding it. Data portability entitlements under Article 20 GDPR are limited to data furnished by the player and processed by automated ways based on permission or contract, signifying gameplay history and transaction logs qualify for portability while fraud detection assessments derived from internal systems do not. Rights inquiries should be addressed to the Data Protection Officer email address, with valid proof of identity necessary before any data is released.
Six. Information Retention and Erasure Policies
Incaspin Casino operates a precise data retention policy intended to satisfy statutory record-keeping duties while limiting the keeping of personal data beyond its intended purpose. Player account data and entire transaction histories are stored for the complete length of the current business relationship, defined as the period from account creation until the account is terminated, plus an extra statutory retention period stipulated by German anti-money laundering regulations and commercial law. Under the Geldwäschegesetz, identification documents, transaction receipts, and due diligence documentation must be kept for at least five years from the end of the calendar year in which the business relationship concluded. Accounting records applicable to tax duties are retained for ten years in accordance with the German Fiscal Code. Following the expiration of these mandatory intervals, personal data is either irrevocably anonymised so that re-identification becomes impossible with all means reasonably probable to be employed, or safely removed through cryptographic erasure and physical storage media sanitisation methods. Technical logs and security event data adhere to a shorter retention interval of twelve months, after which they are aggregated into anonymised statistical summaries. Inactive accounts demonstrating no login activity for a consecutive period of 24 months are flagged for dormancy check, and the associated personal data is reduced to keep only the core ID and transaction records required for the outstanding statutory retention timeline. The casino utilizes automated data lifecycle management scripts that operate weekly to find records past their retention limits, triggering deletion procedures without human involvement, with the results logged for compliance audit purposes.
7. Information Security Safeguards
Incaspin Casino utilizes a multi-layered security architecture in accordance with the ISO 27001 control framework and the technical requirements set forth in Article 32 of the GDPR. Network-level protections encompass enterprise-grade firewalls equipped with stateful packet inspection, intrusion detection and prevention systems that watch traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that withstand volumetric attacks before they arrive at the application layer. All data sent between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, avoiding retrospective decryption of captured traffic even if long-term private keys are eventually leaked. Internal administrative interfaces are segmented on a management network unreachable from the public internet, with access permitted exclusively through multi-factor authenticated VPN tunnels originating from pre-registered static IP addresses owned by authorised personnel. At the application layer, the platform enforces strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks awaiting manual review by the security team. Database-level encryption protects data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each managed through a hardware security module that tracks every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm verify the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are practiced through bi-annual tabletop exercises involving the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline required by GDPR.
Číslo 5: International Data Transfers
The primary data storage infrastructure for Incaspin Casino operates from secure facilities located in the European Economic Area, specifically designed to serve the German market with latency-optimized connectivity while maintaining full GDPR jurisdictional coverage. Specific specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino applies the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures implemented where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include full encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who wish to understand the geographical flow of their information.
3. bod Důvody a právní základy pro zpracování
Incaspin Casino zpracovává osobní data na základě několika různých GDPR legal bases, selected v závislosti na the specific processing activity. Plnění smlouvy pursuant to Article 6(1)(b) GDPR zahrnuje all data processing nezbytné to create and manage hráčského účtu, zpracování vkladů a výběrů, a doručení the interactive gaming services that German players actively request při registraci. This zahrnuje předávání platebních instrukcí to acquiring banks a kontrolu že players dosahují minimální věkový požadavek 18 let dle německé legislativy. Legal obligation processing dle Article 6(1)(c) GDPR encompasses anti-money laundering customer due diligence, suspicious transaction reporting to relevant Financial Intelligence Units, retence záznamů k uspokojení požadavků obchodního a daňového práva, a dodržování with German gambling regulations ohledně norem ochrany hráčů. The applicable legal frameworks obsahují the Geldwäschegesetz and the stipulations státní smlouvy o hazardu where relevant pro povinnosti uchovávání dat.
Legitimate interests pursued by Incaspin Casino podle Article 6(1)(f) GDPR include network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted podle Section 7 of the German Act Against Unfair Competition, a obchodní analýzy pro zlepšení služeb. German players mají absolutní právo vznášet námitky proti zpracování based on legitimate interests, včetně vytváření profilů k přímým marketingovým účelům, a takové námitky will be honoured bez zbytečné prodlevy. Consent podle Article 6(1)(a) GDPR is relied upon for optional marketing communications via email and SMS kde the player has actively opted in, pro umístění nepodstatných cookies a sledovacích technologií, and for sensitive data processing in specific circumstances. Způsoby zrušení souhlasu jsou nápadně umístěny v rámci nastavení účtu a v patičce každého marketingového sdělení, přičemž odvolání nabývá účinnosti bez retroaktivních následků for previously lawful processing. German players who have not yet reached osmácti let nemají povoleno otevírat účty, a jakákoli neúmyslně shromážděná data nezletilých je ihned po odhalení odstraněna.
4. Information Sharing and Third Parties
4.1 Internal Data Access Structure
Within the Incaspin Casino operational structure, personal data access follows a strict least-privilege model applied across four distinct personnel tiers. Customer support agents retrieve basic account information and communication history but cannot view full financial records or identity documents. Compliance officers hold permissions to examine verification documents, transaction patterns, and risk scores. Financial department personnel handle withdrawal requests and view payment instrument details required to execute transfers. IT security staff monitor system logs and security event data but do not routinely interact with player-identifiable records. Every access event is logged with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is reviewed quarterly by the Data Protection Officer. German players are able to request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Service Providers and Authorities
Incaspin Casino utilizes specialist external processors such as cloud hosting providers running ISO 27001-certified data centres inside the European Economic Area, payment processors licensed by the German Federal Financial Supervisory Authority, identity verification services that match submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment covering technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts stipulate data processing solely on documented instructions from Incaspin Casino, with no authority for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will inform affected players of such disclosures. The following key principles control all third-party data sharing arrangements:
- Processors get only the minimum personal data necessary to perform their agreed function, with field-level data minimisation enforced to every integration.
- Sub-processor engagements need prior written approval from Incaspin Casino, and any unlicensed subcontracting represents a material breach of the data processing agreement.
- All processors must have ISO 27001 certification or comparable independently audited security credentials, with current certificates filed with Incaspin Casino before data flows begin.
- No personal data is disclosed to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.
9. Cookie Policy and Tracking Technologies
9.1 Necessary and Technical Cookies
The Incaspin Casino platform and mobile platform implement a range of cookies and similar tracking technologies to ensure core functionality. Strictly necessary cookies control session state across page loads, preserve login authentication tokens, and uphold security context for CSRF protection. These first-party session cookies end when the browser is closed and do not require prior consent under German law transposing the ePrivacy Directive, as they are necessary for the requested service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players encounter a consistent personalized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they become invalid automatically if the player has not accessed the platform. Incaspin Casino does not use flash cookies, supercookies, or any recreating techniques that bypass browser deletion actions.
9.2 Analytics and Marketing Cookies
Analytics and marketing cookies are set only after German players grant explicit, freely given consent through the cookie consent management platform shown on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers participating, the purposes of data collection, and the retention duration for each cookie type. Players may allow or withhold consent for each category independently, and consent preferences are recorded as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service track aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies facilitate campaign attribution and frequency capping for promotional banners shown within the logged-in casino environment. German players may adjust their consent choices at any time by using the cookie settings panel located in the website footer. Refusing analytics or marketing cookies does not affect gameplay functionality or account standing in any manner. The consent tool asks again players annually to reaffirm or update their preferences.
Closing Thoughts
Incaspin Casino has structured its data protection system to fulfill the high standards anticipated by German players and stipulated by the GDPR and the BDSG-neu. From the initial collection of identity and contact details through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage functions under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino maintains transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are urged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.
