This Privacy Notice explains how Incaspin Casino obtains, manages, stores, and protects personal data pertaining to players located in Germany. The document functions within the scope of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino acts as the data controller for personal information furnished through its website, mobile applications, and related services. German players enjoy specific statutory rights concerning their data, and this notice outlines the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards implemented to prevent unauthorised access. The document also explains the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section is prepared to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, providing German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed throughout the entire customer lifecycle.
1. Data Controller Identity a podrobnosti o kontaktu
The data controller pro všechny osobní údaje processed through the Incaspin Casino platform představuje subjekt působící pod názvem značky Incaspin Casino, zapsaná v jurisdikci známé svým its adherence to standardů ekvivalentních ochraně údajů EU. Sídlo společnosti a identifikační číslo společnosti jsou k dispozici na verified request zasláním e-mailu pověřenci pro ochranu osobních údajů, případně v sekce otisku hlavních webových stránek. Němečtí hráči may direct jakékoli dotazy týkající se soukromí to the designated Data Protection Officer, jenž pracuje samostatně a je přímo podřízen senior management. Tento pracovník can be reached via a dedicated encrypted email channel zveřejněnou v rámci kompletního textu politiky ochrany osobních údajů. Incaspin Casino má a legal representative within the European Union z důvodu ustanovení čl. 27 GDPR, ensuring that německé kontrolní orgány and data subjects have a direct point of contact for regulatory matters. Tento subjekt určuje the purposes and means zpracování všech osobních údajů získaných při registraci účtu, ověřování Know Your Customer, transakcích vkladů a výběrů, and ongoing gameplay activity. To zahrnuje data generated through souborů cookies, technologií pro identifikaci zařízení, and server logs. German players should note, that the controller exercises absolutní moc nad rozhodováním over data processing operations a zároveň zadává carefully vetted processors k zajištění konkrétních technických služeb jako je hosting, platební brány, a platformy pro řízení vztahů se zákazníky. Každý vztah se zpracovatelem is governed by závaznou smlouvou o zpracování údajů jež vyhovuje podmínkám Article 28 GDPR, s vyhrazenými povinnými právy na audit ze strany Incaspin Casino k ověření trvalého dodržování předpisů. Kontaktní údaje of the EU representative jsou poskytnuty příslušnému německému úřadu pro ochranu osobních údajů as required by law.
2. Classes of Individual Data Gathered
Two Point One Identification Verification and Account Data
German players must submit certain personal data to set up and keep an active Incaspin Casino account. This group includes entire statutory full name, physical address, date of birth, birthplace, citizenship, and sex. For identity confirmation reasons mandatory under German anti-money laundering rules, the casino gathers government-issued ID papers such as passport copies, national identity card scans, and residence permit papers. The system also stores the document number, issuing body, validity end, and a biometric comparison rating produced during the automatic validation process. Home validation is done through latest utility bills, bank statements, or formal mail that evidently presents the member’s name, on-file location, and an issuing date inside of the last three months. Incaspin Casino implements these verification conditions consistently to comply with the Fourth and Fifth Anti-Money Laundering Directives as implemented into German law, ensuring that each account meets the regulatory identification assurance level ahead of any withdrawals are permitted.
Two Point Two Fiscal and Deal Data
Transaction records encompasses all deposit records, including payment instrument data, masked card numbers, e-wallet account email addresses, bank account IBAN details for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino retains complete transaction histories showing timestamps, amounts in EUR or equivalent cryptocurrency, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players reach specific deposit thresholds or trigger enhanced due diligence procedures. This data is separated in encrypted database tables with access restricted to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino receiving only the information necessary to credit the player account.
2.3 Technical and Behavioural Data
When German players access the Incaspin Casino platform, the system automatically collects technical markers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data includes login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus permits the casino to provide optimised gaming experiences, detect fraudulent activity patterns, and uphold responsible gambling self-exclusion settings. Behavioural analytics track betting frequency, average stake sizes, session duration, and deposit velocity to supply the responsible gambling algorithms that produce personalised risk alerts. All technical logs are de-identified where possible and stored separately from core identity records, with re-identification possible only through a tightly controlled cryptographic lookup procedure accessible exclusively to the fraud and compliance teams under documented access justification.
7. Security of Data Controls
Incaspin Casino implements a multilevel security architecture aligned with the ISO 27001 control framework and the technical requirements specified in Article 32 of the GDPR. Network-level protections include enterprise-grade firewalls set up with stateful packet inspection, intrusion detection and prevention systems that watch traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that withstand volumetric attacks before they reach the application layer. All data transmitted between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, preventing retrospective decryption of captured traffic even if long-term private keys are subsequently exposed. Internal administrative interfaces are segmented on a management network not accessible from the public internet, with access allowed solely through multi-factor authenticated VPN tunnels starting from pre-registered static IP addresses belonging to authorised personnel. At the application layer, the platform enforces strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks awaiting manual review by the security team. Database-level encryption secures data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each managed through a hardware security module that records every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm validate the effectiveness of these controls, with critical findings resolved within 48 hours. Security incident response procedures are tested through bi-annual tabletop exercises engaging the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.
9. Cookie Policy and Tracking Technologies
9.1 Necessary and Technical Cookies
The Incaspin Casino platform and mobile platform utilize a range of cookies and similar tracking technologies to deliver core functionality. Strictly necessary cookies control session state across page loads, maintain login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies expire when the browser is closed and do not require prior consent under German law enforcing the ePrivacy Directive, as they are indispensable for the desired service delivery. Functional cookies store language preferences, preferred currency displays, and responsible gambling limit settings across visits, making sure that returning players encounter a consistent personalized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they become invalid automatically if the player has not accessed the platform. Incaspin Casino does not use flash cookies, supercookies, or any recreating techniques that evade browser deletion actions.
9.2 Metrics and Marketing Cookies
Analytics and marketing cookies are set only after German players grant explicit, freely given consent through the cookie consent management platform shown on first visit. The consent tool offers clear descriptions of each cookie category, the specific providers involved, the purposes of data collection, and the retention duration for each cookie type. Players may allow or deny consent for each category independently, and consent preferences are recorded as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service measure aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies support campaign attribution and frequency capping for promotional banners presented within the logged-in casino environment. German players may adjust their consent choices at any time by visiting the cookie settings panel linked in the website footer. Declining analytics or marketing cookies does not influence gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to reaffirm or update their preferences.
5: International Data Transfers
The primary data storage infrastructure for Incaspin Casino operates from secure facilities located in the European Economic Area, specifically designed to serve the German market with latency-optimised connectivity while maintaining full GDPR jurisdictional coverage https://incaspincasino.de.com/legal-and-affiliates/. Certain specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For every such transfer, Incaspin Casino enforces the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures utilised where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include complete encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who want to know the geographical flow of their information.
8. Rights of Germany-based Data Subjects
German gamblers enjoy the entire set of data subject rights enumerated in Articles 15 through 21 of the GDPR, along with the entitlement to lodge a appeal with a supervisory authority. The access right permits players to obtain verification of as to whether Incaspin Casino processes their personal data and to get a copy of that data together with information about processing aims, categories, receivers, retention durations, and the existence of automated decision-making. Access requests are fulfilled within one month, without charge for the primary request, with the reply delivered in a organized, commonly used, machine-readable layout. The rectification right permits players to rectify inaccurate personal data or complete missing documents, a especially pertinent right for identity document changes following name changes or address moves. Incaspin Casino processes rectification requests within ten business days and acknowledges amendments to any third-party recipients to whom the inaccurate data was revealed. The erasure right applies where the personal data is not anymore necessary for the objectives for which it was gathered, where permission is canceled, where the player opposes to processing and no overriding legitimate grounds are in place, or where processing is not permitted. Nonetheless, statutory retention obligations take precedence over erasure inquiries, and data required for legal compliance will be restricted from further processing rather than erased until the retention period expires. The restriction right of processing functions as an alternative where the correctness of data is disputed, processing is contrary to law but the player objects to deletion, or the player necessitates the data for legal assertions despite the controller no longer demanding it. Data portability prerogatives under Article 20 GDPR are limited to data provided by the player and dealt with by automated ways based on authorization or contract, meaning gameplay history and transaction logs qualify for portability while fraud detection ratings derived from internal models do not. Rights inquiries should be addressed to the Data Protection Officer email address, with valid proof of identity needed before any data is shared.
3. Purposes and Legal Bases for Processing
Incaspin Casino processes personal data na základě několika různých GDPR právních základů, selected v závislosti na konkrétní zpracovatelské činnosti. Realizace smlouvy ve smyslu Article 6(1)(b) GDPR covers všechna zpracování dat potřebné pro vytvoření a správu hráčského účtu, zpracování vkladů a výběrů, a doručení služeb interaktivního hraní které German players aktivně vyžadují during registration. This zahrnuje předávání platebních instrukcí zúčtovacím bankám a ověřování toho, že players meet požadavek minimálního věku 18 let podle německého práva. Legal obligation processing under Article 6(1)(c) GDPR encompasses anti-money laundering customer due diligence, hlášení podezřelých transakcí příslušným finančním zpravodajským jednotkám, uchovávání záznamů pro splnění požadavků obchodního a daňového práva, a soulad s německými herními předpisy týkajících se standardů ochrany hráčů. Relevantní právní rámce zahrnují the Geldwäschegesetz a ustanovení Glücksspielstaatsvertragu kde je to relevantní to data retention mandates.
Legitimate interests pursued by Incaspin Casino dle Article 6(1)(f) GDPR include network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted podle Section 7 of the German Act Against Unfair Competition, a analýzy podnikání za účelem zlepšení služeb. German players zachovávají si absolutní právo odmítnout zpracování založeném na oprávněných zájmech, včetně vytváření profilů for direct marketing purposes, and such objections will be honoured without undue delay. Souhlas dle Article 6(1)(a) GDPR is relied upon pro volitelné marketingové komunikace e-mailem a SMS where hráč se aktivně přihlásil, for the placement of non-essential cookies and tracking technologies, a pro zpracování citlivých dat v konkrétních případech. Způsoby zrušení souhlasu are prominently placed v nastavení účtu a v patičce každého marketingového sdělení, with withdrawal taking effect without retroactive consequences pro dříve zákonné zpracování. German players kteří ještě nedosáhli osmácti let nesmějí otevírat účty, a jakákoli neúmyslně shromážděná data nezletilých jsou okamžitě po zjištění smazána.
6. Data Storage and Erasure Guidelines
Incaspin Casino implements a detailed data retention policy intended to fulfill statutory record-keeping duties while reducing the storage of personal data beyond its useful purpose. Player account data and complete transaction logs are kept for the full period of the active business relationship, defined as the period from account creation till the account is deactivated, plus an extra statutory retention period required by German anti-money laundering laws and commercial law. Under the Geldwäschegesetz, identification files, transaction receipts, and due diligence materials must be kept for at least five years from the end of the calendar year in which the business relationship terminated. Accounting records applicable to tax obligations are kept for ten years in conformity with the German Fiscal Code. Following the expiration of these mandatory terms, personal data is either irreversibly de-identified so that re-identification becomes impossible with all methods reasonably probable to be used, or securely deleted through cryptographic erasure and physical storage media cleaning methods. Technical logs and security event data follow a shorter retention period of twelve months, after which they are aggregated into anonymised statistical overviews. Inactive accounts exhibiting no login activity for a consecutive period of 24 months are designated for dormancy review, and the connected personal data is minimised to store only the core ID and transaction records required for the outstanding statutory retention clock. The casino uses automated data lifecycle management processes that execute weekly to identify records over their retention limits, triggering deletion procedures without human input, with the results logged for compliance audit reasons.
4. Data Sharing and External Recipients
4.1 Internal Data Access Architecture
In the Incaspin Casino operational system, personal data access follows a strict least-privilege model used for four distinct personnel tiers. Customer support agents access basic account information and communication history but cannot view full financial records or identity documents. Compliance officers have permissions to examine verification documents, transaction patterns, and risk scores. Financial department personnel handle withdrawal requests and view payment instrument details required to execute transfers. IT security staff monitor system logs and security event data but do not regularly interact with player-identifiable records. Every access event is logged with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is checked quarterly by the Data Protection Officer. German players can request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Service Providers and Authorities
Incaspin Casino engages specialist external processors including cloud hosting providers operating ISO 27001-certified data centres within the European Economic Area, payment processors licensed by the German Federal Financial Supervisory Authority, identity verification services that match submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor passes through a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts require data processing solely on documented instructions from Incaspin Casino, with no authority for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will inform affected players of such disclosures. The following key principles control all third-party data sharing arrangements:
- Processors obtain only the minimal personal data required to execute their contracted function, with field-level data minimisation enforced to every integration.
- Sub-processor engagements require prior written consent from Incaspin Casino, and any unauthorised subcontracting constitutes a material breach of the data processing agreement.
- All processors must hold ISO 27001 certification or similar independently audited security qualifications, with current records filed with Incaspin Casino before data flows commence.
- No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business focuses on monetising personal information.
Closing Thoughts
Incaspin Casino has organized its data protection system to meet the high standards anticipated by German players and stipulated by the GDPR and the BDSG-neu. From the first collection of identity and contact information through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage works under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino keeps transparent communication channels for rights requests, supplies granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are urged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.