This Privacy Notice describes how Incaspin Casino collects, manages, retains, and secures personal data of players located in Germany. The document operates within the context of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino functions as the data controller for personal information provided through its website, mobile applications, and related services. German players enjoy specific statutory rights regarding their data, and this notice specifies the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards used to prevent unauthorised access. The document also describes the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section is prepared to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, offering German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed during the entire customer lifecycle.
5: International Data Transfers
The core data storage infrastructure for Incaspin Casino resides within secure facilities located in the European Economic Area, specifically engineered to serve the German market with low-latency connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For any such transfer, Incaspin Casino implements the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures implemented where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include end-to-end encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who want to know the geographical flow of their information.
Conclusion
Incaspin Casino has structured its data protection framework to meet the high standards anticipated by German players and mandated by the GDPR and the BDSG-neu. From the initial collection of identity and contact information through to the final deletion or anonymisation of records years after account closure, every personal data life cycle stage operates under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino preserves transparent communication channels for rights requests, supplies granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are encouraged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.
Two Classes of Personal Data Gathered
Two Point One Identity Confirmation and User Data
German users must submit specific personal data to set up and maintain an living Incaspin Casino account https://incaspincasino.de.com/legal-and-affiliates/. This group includes full statutory name, residential location, birth date, birthplace, nationality, and sex. For identity verification aims mandatory under Germany’s anti-money laundering rules, the casino gathers government-issued ID files such as passport scans, national identity card scans, and residence permit documentation. The system also records the ID number, issuing authority, expiry date, and a biometrical matching result produced during the automatic validation process. Home validation is finished through latest utility bills, bank statements, or formal mail that plainly displays the player’s full name, registered address, and an issue day within the past three months. Incaspin Casino implements these validation requirements evenly to conform with the Fourth and 5th Anti-Money Laundering Directives as transposed into German law, guaranteeing that all account satisfies the regulatory identity confidence level before any withdrawals are allowed.
Two Point Two Financial and Deal Data
Payment information encompasses all transaction records, including payment instrument data, masked card numbers, e-wallet account email addresses, bank account IBAN details for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino keeps complete transaction histories showing timestamps, amounts in EUR or digital currency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and supporting documents such as payslips, tax returns, or business financial statements are collected when players cross specific deposit thresholds or trigger enhanced due diligence procedures. This data is segregated in encrypted database tables with access limited to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino receiving only the information necessary to credit the player account.
2.3 Technical and Behavioural Data
As German players log into the Incaspin Casino platform, the system automatically collects technical identifiers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data covers login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus enables the casino to deliver optimised gaming experiences, spot fraudulent activity patterns, and honour responsible gambling self-exclusion settings. Behavioural analytics measure betting frequency, average stake sizes, session duration, and deposit velocity to inform the responsible gambling algorithms that create personalised risk alerts. All technical logs are de-identified where possible and stored separately from core identity records, with re-identification possible only through a carefully managed cryptographic lookup procedure available exclusively to the fraud and compliance teams under documented access justification.
První bod: Identita správce údajů a podrobnosti o kontaktu
Správcem údajů for all personal data zpracovávané na platformě the Incaspin Casino platformy is the legal entity působící pod obchodní značkou Incaspin Casino, zapsaná v státě uznávané pro its adherence to standardů ochrany údajů odpovídajících EU. The registered office address a identifikační číslo společnosti are available upon žádost s ověřením totožnosti zasláním e-mailu pracovníkovi pro ochranu osobních údajů, nebo nahlédnutím do části s právními informacemi hlavních webových stránek. Hráči z Německa mohou směřovat veškeré dotazy ohledně ochrany soukromí k určenému pověřenci pro ochranu osobních údajů, jenž pracuje samostatně a je přímo podřízen vrcholovému vedení. The DPO může být kontaktován prostřednictvím vyhrazeného šifrovaného e-mailového kanálu uvedenou v kompletního textu politiky ochrany osobních údajů. Incaspin Casino maintains právního zástupce na území Evropské unie for purposes of ustanovení čl. 27 GDPR, čímž zajišťuje, že německé dozorové úřady i dotčené osoby mají přímé kontaktní místo ohledně regulačních otázek. Správce stanovuje cíle a způsoby zpracování všech osobních údajů collected during account registration, ověřování Know Your Customer, platebních transakcích vkladů a výběrů, and ongoing gameplay activity. Sem patří data generated through souborů cookies, technologií pro identifikaci zařízení, a záznamů serveru. Hráči z Německa by si měli uvědomit, that the controller exercises full decision-making power over data processing operations a zároveň zadává carefully vetted processors k zajištění konkrétních technických služeb jako je hosting, platební brány, a platformy pro řízení vztahů se zákazníky. Each processor relationship se řídí a binding data processing agreement jež vyhovuje podmínkám článku 28 GDPR, s vyhrazenými povinnými právy na audit ze strany Incaspin Casino pro ověření průběžného souladu. Podrobné kontakty of the EU representative byly sděleny the competent German data protection authority v souladu s právními předpisy.
8. Prerogatives of Germany-based Data Subjects
German gamblers enjoy the full range of data subject entitlements specified in Articles 15 through 21 of the GDPR, together with the entitlement to lodge a appeal with a supervisory authority. The right of access enables players to receive verification of as to whether Incaspin Casino processes their individual data and to receive a version of that data together with information about processing purposes, classes, receivers, storage periods, and the presence of automated decision-making. Access applications are processed within one month, free of charge for the initial request, with the answer supplied in a structured, widely used, machine-readable structure. The rectification right permits players to correct inaccurate personal data or fill in partial documents, a particularly applicable entitlement for identity document revisions following name modifications or address relocations. Incaspin Casino deals with rectification applications within ten business days and confirms amendments to any third-party addressees to whom the inaccurate data was disclosed. The right of deletion holds true where the personal data is no more needed for the purposes for which it was gathered, where authorization is withdrawn, where the player raises objection to processing and no prevailing legitimate grounds are in place, or where processing is not permitted. Nevertheless, statutory retention duties take precedence over erasure requests, and data necessary for legal compliance will be restricted from further processing rather than removed until the retention period ends. The right of limitation of processing serves as an substitute where the correctness of data is challenged, processing is contrary to law but the player opposes deletion, or the player requires the data for legal claims despite the controller no longer demanding it. Data portability entitlements under Article 20 GDPR are limited to data supplied by the player and handled by automated ways based on consent or agreement, signifying gameplay history and transaction logs qualify for portability while fraud detection assessments obtained from internal algorithms do not. Rights inquiries should be sent to the Data Protection Officer email address, with proper proof of identity needed before any data is released.
9. Cookie Policy and Tracking Technologies
9.1 Essential and Operational Cookies
The Incaspin Casino website and mobile platform implement a variety of cookies and similar tracking technologies to provide core functionality. Strictly necessary cookies control session state across page loads, preserve login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies expire when the browser is closed and do not require prior consent under German law enforcing the ePrivacy Directive, as they are essential for the desired service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players experience a uniform personalised environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they expire automatically if the player has not returned to the platform. Incaspin Casino does not use flash cookies, supercookies, or any recreating techniques that bypass browser deletion actions.
9.2 Analysis and Marketing Cookies
Analytics and marketing cookies are set only after German players grant explicit, freely given consent through the cookie consent management platform shown on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers participating, the purposes of data collection, and the retention duration for each cookie type. Players may grant or deny consent for each category independently, and consent preferences are recorded as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service measure aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies enable campaign attribution and frequency capping for promotional banners presented within the logged-in casino environment. German players may change their consent choices at any time by accessing the cookie settings panel located in the website footer. Refusing analytics or marketing cookies does not impact gameplay functionality or account standing in any manner. The consent tool asks again players annually to update or update their preferences.
4. Data Sharing and Third-Party Recipients
4.1 Internal Data Access Structure
Within the Incaspin Casino operational structure, personal data access adheres to a strict least-privilege model used for four distinct personnel tiers. Customer support agents access basic account information and communication history but cannot view full financial records or identity documents. Compliance officers possess permissions to review verification documents, transaction patterns, and risk krone.at scores. Financial department personnel handle withdrawal requests and view payment instrument details needed to execute transfers. IT security staff access system logs and security event data but do not routinely interact with player-identifiable records. Every access event is tracked with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is reviewed quarterly by the Data Protection Officer. German players can request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Providers and Regulatory Bodies
Incaspin Casino employs specialist external processors including cloud hosting providers managing ISO 27001-certified data centres inside the European Economic Area, payment processors regulated by the German Federal Financial Supervisory Authority, identity verification services that check submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment encompassing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts stipulate data processing solely on documented instructions from Incaspin Casino, with no entitlement for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators occur only when legally mandated, and unless prohibited by law, the casino will inform affected players of such disclosures. The following key principles govern all third-party data sharing arrangements:
- Processors get only the minimal personal data required to perform their contracted function, with field-level data minimisation enforced to every integration.
- Sub-processor engagements demand prior written consent from Incaspin Casino, and any unapproved subcontracting represents a material breach of the data processing agreement.
- All processors must maintain ISO 27001 certification or equivalent independently audited security standards, with current records filed with Incaspin Casino before data flows commence.
- No personal data is disclosed to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.
7. Data Security Controls
Incaspin Casino implements a multi-layered security architecture aligned with the ISO 27001 control framework and the technical requirements set forth in Article 32 of the GDPR. Network-level protections include enterprise-grade firewalls set up with stateful packet inspection, intrusion detection and prevention systems that analyze traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that neutralize volumetric attacks before they reach the application layer. All data transferred between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, blocking retrospective decryption of captured traffic even if long-term private keys are later compromised. Internal administrative interfaces are isolated on a management network unreachable from the public internet, with access granted only through multi-factor authenticated VPN tunnels coming from pre-registered static IP addresses assigned to authorised personnel. At the application layer, the platform mandates strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies trigger step-up authentication challenges or temporary account locks awaiting manual review by the security team. Database-level encryption safeguards data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each controlled through a hardware security module that tracks every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm validate the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are practiced through bi-annual tabletop exercises including the Data Protection Officer, with a documented breach notification workflow ensuring German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.
3. bod Účely a právní základy zpracování
Incaspin Casino processes osobní data na základě několika různých GDPR legal bases, selected according to dané činnosti zpracování. The performance of a contract ve smyslu Article 6(1)(b) GDPR zahrnuje všechna zpracování dat potřebné pro vytvoření a správu the player account, zpracování vkladů a výběrů, a poskytování the interactive gaming services jež German players aktivně požadují during registration. This obsahuje transmitting payment instructions zúčtovacím bankám and verifying že players splňují požadavek minimálního věku 18 let podle německého práva. Povinné zpracování dle Article 6(1)(c) GDPR pokrývá anti-money laundering customer due diligence, suspicious transaction reporting relevantním jednotkám finančního zpravodajství, uchovávání záznamů to satisfy commercial and tax law requirements, and compliance with German gambling regulations ohledně norem ochrany hráčů. The applicable legal frameworks include the Geldwäschegesetz a předpisy Glücksspielstaatsvertragu pokud je to relevantní pro povinnosti uchovávání dat.
Legitimní zájmy prosazované Incaspin Casino podle Article 6(1)(f) GDPR zahrnují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers tam, kde je to dovoleno dle Section 7 of the German Act Against Unfair Competition, a analýzy podnikání pro zlepšení služeb. German players mají bild.de the absolute right odmítnout zpracování based on legitimate interests, včetně vytváření profilů for direct marketing purposes, a tyto námitky budou respektovány bez zbytečné prodlevy. Povolení podle Article 6(1)(a) GDPR je využíván for optional marketing communications prostřednictvím e-mailu a SMS where the player has actively opted in, pro nasazení neesenciálních cookies a sledovacích technologií, a pro zpracování citlivých dat za specifických okolností. Způsoby zrušení souhlasu are prominently placed v nastavení účtu and every marketing communication footer, with withdrawal taking effect without retroactive consequences pro dříve legální zpracování. German players who have not yet reached osmácti let are not permitted to open accounts, and any inadvertently collected minor data jsou okamžitě po zjištění smazána.
Six. Information Archiving and Erasure Rules
Incaspin Casino operates a detailed data retention plan intended to satisfy statutory record-keeping duties while limiting the storage of personal data beyond its necessary purpose. Player account data and entire transaction histories are kept for the entire length of the active business relationship, described as the term from account creation up to the account is terminated, plus an additional statutory retention period mandated by German anti-money laundering regulations and commercial law. Under the Geldwäschegesetz, identification documents, transaction confirmations, and due diligence materials must be maintained for at least five years after the end of the calendar year in which the business relationship terminated. Accounting records applicable to tax obligations are stored for ten years in accordance with the German Fiscal Code. Following the expiration of these mandatory terms, personal data is either irreversibly de-identified so that re-identification becomes impossible with all ways reasonably probable to be used, or safely erased through cryptographic erasure and physical storage media sanitisation methods. Technical logs and security event data follow a reduced retention period of twelve months, after which they are compiled into anonymised statistical overviews. Inactive accounts exhibiting no login activity for a consecutive period of 24 months are marked for dormancy review, and the associated personal data is minimised to store only the core name and transaction records necessary for the leftover statutory retention clock. The casino uses automated data lifecycle management routines that run weekly to find records beyond their retention thresholds, initiating deletion workflows without human involvement, with the results logged for compliance audit purposes.