This Privacy Notice outlines how Incaspin Casino gathers, manages, retains, and protects personal data pertaining to players located in Germany https://incaspincasino.de.com/legal-and-affiliates/. The document functions within the context of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino functions as the data controller for personal information submitted through its website, mobile applications, and related services. German players have specific statutory rights regarding their data, and this notice specifies the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards deployed to prevent unauthorised access. The document also details the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section is prepared to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, offering German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed during the entire customer lifecycle.
Kapitola 1. Kontakt na správce údajů and Contact Details
The data controller for all personal data zpracovávané na platformě the Incaspin Casino platformy je právnická osoba působící pod obchodní značkou Incaspin Casino, zapsaná v a jurisdiction recognised for its adherence to standardů ochrany údajů odpovídajících EU. Adresa sídla a identifikační číslo společnosti poskytneme na ověřenou žádost by emailing the Data Protection Officer, případně v the imprint section webové prezentace. German players mohou adresovat any privacy-related inquiries to the designated Data Protection Officer, jenž pracuje samostatně a je přímo podřízen vrcholovému vedení. The DPO může být kontaktován via vyhrazeného šifrovaného e-mailového kanálu zveřejněnou v rámci kompletního textu politiky ochrany osobních údajů. Incaspin Casino udržuje právního zástupce within the European Union z důvodu ustanovení čl. 27 GDPR, čímž zajišťuje, že German supervisory authorities a subjekty údajů disponují přímým kontaktem pro regulační záležitosti. Tento subjekt stanovuje cíle a způsoby zpracování all personal data collected during account registration, ověřování Know Your Customer, platebních transakcích vkladů a výběrů, a průběžné aktivitě při hraní. To zahrnuje údaje vytvářené prostřednictvím cookies, technologií otisku zařízení, a záznamů serveru. Němečtí hráči by měli vzít na vědomí, že správce vykonává plnou rozhodovací pravomoc ohledně činností zpracování dat přičemž pověřuje pečlivě prověřené zpracovatele for specific technical services např. hosting, platební brány, a CRM platformy. Každá smluvní dohoda se zpracovatelem je upravena závaznou smlouvou o zpracování údajů jež vyhovuje podmínkám Article 28 GDPR, s možností provádět povinné audity by Incaspino Casino to verify ongoing compliance. Kontaktní údaje na zástupce pro Evropskou unii byly sděleny kompetentnímu německému dozorovému orgánu pro ochranu dat v souladu s právními předpisy.
8. Entitlements of German-resident Data Subjects
German gamblers enjoy the complete range of data subject rights enumerated in Articles 15 through 21 of the GDPR, together with the entitlement to file a appeal with a supervisory authority. The right of access permits players to obtain assurance of as to whether Incaspin Casino processes their private data and to obtain a version of that data along with details about processing purposes, types, addressees, storage periods, and the presence of automated decision-making. Access applications are completed within one month, at no cost for the initial request, with the reply supplied in a structured, widely used, machine-readable structure. The right of correction enables players to rectify wrong personal data or supplement missing documents, a notably pertinent prerogative for identity document updates following name alterations or address transfers. Incaspin Casino processes rectification requests within ten business days and verifies rectifications to any third-party recipients to whom the inaccurate data was shared. The erasure right is applicable where the personal data is not anymore necessary for the purposes for which it was obtained, where authorization is revoked, where the player opposes to processing and no overriding legitimate grounds are in place, or where processing is not permitted. However, statutory retention requirements override erasure inquiries, and data necessary for legal compliance will be limited from further processing rather than erased until the retention period expires. The right to restriction of processing acts as an substitute where the accuracy of data is contested, processing is contrary to law but the player is against deletion, or the player needs the data for legal assertions despite the controller no longer requiring it. Data portability rights under Article 20 GDPR extend only to data furnished by the player and handled by automated ways based on consent or agreement, implying gameplay history and transaction logs are suitable for portability while fraud detection scores coming from internal systems do not. Rights inquiries should be addressed to the Data Protection Officer email address, with proper proof of identity needed before any data is disclosed.
5: International Data Transfers
The main data storage infrastructure for Incaspin Casino operates from secure facilities located in the European Economic Area, specifically engineered to serve the German market with latency-optimized connectivity while maintaining full GDPR jurisdictional coverage. Some specialised processing activities may involve international data transfers to countries outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For any such transfer, Incaspin Casino enforces the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures utilised where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include full encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who want to know the geographical flow of their information.
7. Information Security Safeguards
Incaspin Casino implements a multilevel security architecture in accordance with the ISO 27001 control framework and the technical requirements specified in Article 32 of the GDPR. Network-level protections comprise enterprise-grade firewalls set up with stateful packet inspection, intrusion detection and prevention systems that monitor traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that absorb volumetric attacks before they arrive at the application layer. All data sent between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, blocking retrospective decryption of captured traffic even if long-term private keys are eventually leaked. Internal administrative interfaces are separated on a management network inaccessible from the public internet, with access permitted exclusively through multi-factor authenticated VPN tunnels originating from pre-registered static IP addresses belonging to authorised personnel. At the application layer, the platform enforces strong password policies demanding minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies initiate step-up authentication challenges or temporary account locks awaiting manual review by the security team. Database-level encryption secures data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each controlled through a hardware security module that logs every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm confirm the effectiveness of these controls, with critical findings resolved within 48 hours. Security incident response procedures are evaluated through bi-annual tabletop exercises engaging the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline mandated by GDPR. klicken und mehr lesen
Number 6. Data Retention and Removal Guidelines
Incaspin Casino operates a detailed data retention policy designed to fulfill statutory record-keeping duties while minimising the retention of personal data past its necessary purpose. Player account data and entire transaction logs are stored for the entire duration of the active business relationship, characterized as the period from account creation until the account is terminated, plus an supplementary statutory retention period mandated by German anti-money laundering laws and commercial law. Under the Geldwäschegesetz, identification files, transaction vouchers, and due diligence documentation must be kept for at least five years following the end of the calendar year in which the business relationship concluded. Accounting records relevant to tax obligations are stored for ten years in compliance with the German Fiscal Code. Following the conclusion of these mandatory terms, personal data is either irreversibly de-identified so that re-identification becomes unfeasible with all means reasonably expected to be applied, or safely erased through cryptographic erasure and physical storage media wiping methods. Technical logs and security event data observe a shorter retention interval of twelve months, after which they are compiled into anonymised statistical overviews. Inactive accounts demonstrating no login activity for a unbroken period of 24 months are flagged for dormancy check, and the associated personal data is limited to keep only the core ID and transaction records necessary for the leftover statutory retention timeline. The casino uses automated data lifecycle management processes that execute weekly to identify records past their retention deadlines, triggering deletion procedures without human intervention, with the results documented for compliance audit purposes.
4. Data Sharing and External Recipients
4.1 Internal Data Access Structure
Within the Incaspin Casino operational structure, personal data access utilizes a strict least-privilege model implemented across four distinct personnel tiers. Customer support agents access basic account information and communication history but cannot view full financial records or identity documents. Compliance officers possess permissions to review verification documents, transaction patterns, and risk scores. Financial department personnel process withdrawal requests and view payment instrument details required to execute transfers. IT security staff access system logs and security event data but do not typically interact with player-identifiable records. Every access event is tracked with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is checked quarterly by the Data Protection Officer. German players are able to request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Service Providers and Authorities
Incaspin Casino utilizes specialist external processors such as cloud hosting providers running ISO 27001-certified data centres within the European Economic Area, payment processors licensed by the German Federal Financial Supervisory Authority, identity verification services that match submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts stipulate data processing solely on documented instructions from Incaspin Casino, with no entitlement for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators occur only when legally mandated, and unless prohibited by law, the casino will inform affected players of such disclosures. The following key principles regulate all third-party data sharing arrangements:
- Processors receive only the least personal data needed to execute their contracted function, with field-level data minimisation implemented to every integration.
- Sub-processor engagements need prior written approval from Incaspin Casino, and any unauthorised subcontracting represents a material breach of the data processing agreement.
- All processors must hold ISO 27001 certification or comparable independently audited security standards, with current certificates filed with Incaspin Casino before data flows commence.
- No personal data is disclosed to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.
3. bod Účely a právní základy zpracování
Incaspin Casino provádí zpracování osobních údajů podle několika odlišných GDPR právních základů, zvolených podle konkrétní zpracovatelské činnosti. The performance of a contract ve smyslu Article 6(1)(b) GDPR pokrývá všechna zpracování dat nezbytné to create and manage the player account, zpracování vkladů a výběrů, and deliver služeb interaktivního hraní jež German players aktivně požadují během registrace. This zahrnuje transmitting payment instructions akvizičním bankám and verifying toho, že players dosahují požadavek minimálního věku osmácti let under German law. Legal obligation processing podle Article 6(1)(c) GDPR pokrývá anti-money laundering customer due diligence, oznamování podezřelých obchodů to relevant Financial Intelligence Units, uchovávání záznamů k uspokojení commercial and tax law requirements, a dodržování s německou regulací hazardu ohledně norem ochrany hráčů. Použitelné právní rámce obsahují Geldwäschegesetz a ustanovení of the Glücksspielstaatsvertrag kde je to relevantní pro povinnosti uchovávání dat.
Oprávněné zájmy sledované Incaspin Casino dle Article 6(1)(f) GDPR zahrnují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted podle Section 7 of the German Act Against Unfair Competition, a obchodní analýzy za účelem zlepšení služeb. German players retain absolutní právo odmítnout zpracování založeném na oprávněných zájmech, včetně profilování for direct marketing purposes, a tyto námitky will be honoured bez zbytečné prodlevy. Consent under Article 6(1)(a) GDPR je využíván pro volitelné marketingové komunikace e-mailem a SMS pokud hráč se aktivně přihlásil, pro umístění nepodstatných cookies a sledovacích technologií, a pro zpracování citlivých dat in specific circumstances. Způsoby zrušení souhlasu jsou nápadně umístěny within account settings and every marketing communication footer, with withdrawal taking effect bez zpětných důsledků pro dříve zákonné zpracování. German players kteří dosud nedosáhli osmácti let nemají povoleno otevírat účty, and any inadvertently collected minor data je ihned po odhalení odstraněna.
Two Groups of Private Data Obtained
2.1 Identification Verification and Player Data
German players must submit specific individual data to establish and maintain an current Incaspin Casino account. This class covers complete legal name, physical address, birth date, birthplace, citizenship, and sex. For identification validation aims mandatory under German anti-money laundering regulations, the casino obtains government-issued ID papers such as passport scans, national ID copies, and residence permit papers. The program also records the ID number, issuer, expiry date, and a biometrical comparison rating created during the automatic verification process. Residential verification is done through latest utility bills, bank statements, or official correspondence that evidently displays the member’s name, registered location, and an issue day inside of the last three months. Incaspin Casino uses these confirmation conditions evenly to adhere with the Fourth and 5th Anti-Money Laundering Directives as implemented into Germany’s law, making sure that all account satisfies the statutory identity confidence level ahead of any withdrawals are allowed.
2.2 Monetary and Deal Data
Financial data encompasses all deposit records, including payment method identifiers, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino keeps complete transaction histories showing timestamps, amounts in EUR or cryptocurrency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is isolated in encrypted database tables with access confined to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino receiving only the information necessary to credit the player account.
2.3 Technical and Behavioral Records
As German players log into the Incaspin Casino platform, the system automatically collects technical markers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data encompasses login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus permits the casino to deliver optimised gaming experiences, detect fraudulent activity patterns, and respect responsible gambling self-exclusion settings. Behavioural analytics track betting frequency, average stake sizes, session duration, and deposit velocity to inform the responsible gambling algorithms that produce personalised risk alerts. All technical logs are pseudonymised where possible and stored apart from core identity records, with re-identification possible only through a strictly regulated cryptographic lookup procedure accessible exclusively to the fraud and compliance teams under documented access justification.
9. Cookie Policy and Tracking Technologies
9.1 Core and Functional Cookies
The Incaspin Casino platform and mobile platform implement a variety of cookies and similar tracking technologies to provide core functionality. Strictly necessary cookies handle session state across page loads, preserve login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies terminate when the browser is closed and do not require prior consent under German law implementing the ePrivacy Directive, as they are essential for the requested service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, making sure that returning players find a consistent personalized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they expire automatically if the player has not revisited the platform. Incaspin Casino does not use flash cookies, supercookies, or any recreating techniques that bypass browser deletion actions.
9.2 Metrics and Marketing Cookies
Analytics and marketing cookies are set only after German players provide explicit, freely given consent through the cookie consent management platform displayed on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers participating, the purposes of data collection, and the retention duration for each cookie type. Players may give or deny consent for each category independently, and consent preferences are stored as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused bild.de measurement service monitor aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies support campaign attribution and frequency capping for promotional banners displayed within the logged-in casino environment. German players may change their consent choices at any time by visiting the cookie settings panel linked in the website footer. Declining analytics or marketing cookies does not influence gameplay functionality or account standing in any manner. The consent tool solicits players annually to reconfirm or update their preferences.
Summary
Incaspin Casino has structured its data protection system to satisfy the high standards demanded by German players and mandated by the GDPR and the BDSG-neu. From the preliminary collection of identity and contact data through to the final deletion or anonymisation of records years after account closure, every personal data life cycle stage functions under documented policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino maintains transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are encouraged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.
