This Privacy Notice explains how Incaspin Casino obtains, handles, retains, and protects personal data of players located in Germany. The document works within the scope of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino acts as the data controller for personal information submitted through its website, mobile applications, and related services. German players have specific statutory rights relating to their data, and this notice specifies the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards implemented to prevent unauthorised access. The document also explains the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been compiled to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, giving German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed during the entire customer lifecycle.
Kapitola 1. Kontakt na správce údajů a kontaktní údaje
The data controller za veškeré osobní údaje zpracovávané na platformě the Incaspin Casino platformy je the legal entity vystupující pod názvem značky Incaspin Casino, registered in státě recognised for dodržováním standardů ekvivalentních ochraně údajů EU. Adresa sídla and company registration number jsou k dispozici na žádost s ověřením totožnosti by emailing the Data Protection Officer, případně v části s právními informacemi hlavních webových stránek. Němečtí hráči mohou adresovat jakékoli dotazy týkající se soukromí k jmenovanému pracovníkovi pro ochranu údajů, jenž pracuje samostatně and reports directly to senior management. Pověřenec může být kontaktován via speciální šifrovanou e-mailovou adresu zveřejněnou v rámci the full privacy policy text. Incaspin Casino udržuje a legal representative within the European Union pro účely ustanovení čl. 27 GDPR, čímž zajišťuje, že německé kontrolní orgány a subjekty údajů have a direct point of contact ohledně regulačních otázek. Správce determines účely a prostředky zpracování veškerých osobních dat shromážděných během account registration, Know Your Customer verification, platebních transakcích vkladů a výběrů, a probíhající herní činnosti. This includes data generated through souborů cookies, technologií pro identifikaci zařízení, a serverových logů. Hráči z Německa by si měli uvědomit, že tento subjekt uplatňuje absolutní moc nad rozhodováním ohledně činností zpracování dat přičemž pověřuje pečlivě prověřené zpracovatele pro specifické technické služby such as hosting, payment gateways, a CRM platformy. Each processor relationship je upravena a binding data processing agreement která splňuje požadavky Article 28 GDPR, s vyhrazenými povinnými právy na audit by Incaspino Casino to verify ongoing compliance. Podrobné kontakty zástupce v EU byly sděleny příslušnému německému úřadu pro ochranu osobních údajů jak vyžaduje zákon.
7. Information Security Measures
Incaspin Casino deploys a multi-layered security architecture conforming to the ISO 27001 control framework and the technical requirements specified in Article 32 of the GDPR. Network-level protections comprise enterprise-grade firewalls set up with stateful packet inspection, intrusion detection and prevention systems that watch traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that neutralize volumetric attacks before they arrive at the application layer. All data sent between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, blocking retrospective decryption of captured traffic even if long-term private keys are eventually leaked. Internal administrative interfaces are separated on a management network inaccessible from the public internet, with access allowed solely through multi-factor authenticated VPN tunnels originating from pre-registered static IP addresses owned by authorised personnel. At the application layer, the platform enforces strong password policies demanding minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks until manual review by the security team. Database-level encryption secures data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each administered through a hardware security module that records every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm verify the effectiveness of these controls, with critical findings remediated within 48 hours. Security incident response procedures are evaluated through bi-annual tabletop exercises engaging the Data Protection Officer, with a documented breach notification workflow ensuring German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.
5: International Data Transfers
The main data storage infrastructure for Incaspin Casino operates from secure facilities located in the European Economic Area, specifically engineered to serve the German market with latency-optimized connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For every such transfer, Incaspin Casino implements the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures implemented where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include end-to-end encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who wish to understand the geographical flow of their information.
9. Cookie Policy and Tracking Technologies
9.1 Necessary and Operational Cookies
The Incaspin Casino platform and mobile platform implement a variety of cookies and similar tracking technologies to ensure core functionality. Strictly necessary cookies control session state across page loads, preserve login authentication tokens, and preserve security context for CSRF protection. These first-party session cookies end when the browser is closed and do not require prior consent under German law implementing the ePrivacy Directive, as they are indispensable for the required service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, ensuring that returning players encounter a coherent customized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they expire automatically if the player has not revisited the platform. Incaspin Casino does not use flash cookies, supercookies, or any respawning techniques that circumvent browser deletion actions.
9.2 Analytics and Marketing Cookies
Analytics and marketing cookies are set only after German players give explicit, freely given consent through the cookie consent management platform displayed on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers involved, the purposes of data collection, and the retention duration for each cookie type. Players may allow or deny consent for each category independently, and consent preferences are recorded as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service measure aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies facilitate campaign attribution and frequency capping for promotional banners shown within the logged-in casino environment. German players may change their consent choices at any time by using the cookie settings panel located in the website footer. Declining analytics or marketing cookies does not influence gameplay functionality or account standing in any manner. ansehen The consent tool re-prompts players annually to reconfirm or update their preferences.
4. Information Sharing and Third Parties
4.1 Internal Data Access Structure
Inside the Incaspin Casino operational framework, personal data access utilizes a strict least-privilege model applied across four distinct personnel tiers. Customer support agents access basic account information and communication history but cannot view full financial records or identity documents. Compliance officers possess permissions to inspect verification documents, transaction patterns, and risk scores. Financial department personnel handle withdrawal requests and view payment instrument details required to execute transfers. IT security staff monitor system logs and security event data but do not routinely interact with player-identifiable records. Every access event is recorded with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is examined quarterly by the Data Protection Officer. German players may request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Providers and Regulatory Bodies
Incaspin Casino engages specialist external processors such as cloud hosting providers operating ISO 27001-certified data centres within the European Economic Area, payment processors authorised by the German Federal Financial Supervisory Authority, identity verification services that check submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment covering technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts mandate data processing solely on documented instructions from Incaspin Casino, with no right for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators happen only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles govern all third-party data sharing arrangements:
- Processors receive only the minimal personal data needed to carry out their specified function, with field-level data minimisation implemented to every integration.
- Sub-processor engagements require prior written consent from Incaspin Casino, and any unauthorised subcontracting constitutes a material breach of the data processing agreement.
- All processors must have ISO 27001 certification or similar independently audited security credentials, with current records filed with Incaspin Casino before data flows commence.
- No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business centers on monetising personal information.
8. Prerogatives of German-resident Data Subjects
German players hold the entire set of data subject prerogatives listed in Articles 15 through 21 of the GDPR, together with the entitlement to lodge a complaint with a supervisory authority. The right of access allows players to receive verification of whether Incaspin Casino processes their personal data and to receive a copy of that data including details about processing aims, classes, recipients, holding durations, and the existence of automated decision-making. Access inquiries are fulfilled within one month, rp-online.de without charge for the first request, with the answer provided in a ordered, widely used, machine-readable structure. The right of correction permits players to rectify inaccurate personal data or supplement partial files, a notably pertinent entitlement for identity document updates following name alterations or address moves. Incaspin Casino handles rectification applications within ten business days and acknowledges corrections to any third-party recipients to whom the inaccurate data was revealed. The right to erasure is applicable where the personal data is no longer necessary for the aims for which it was collected, where consent is revoked, where the player raises objection to processing and no overriding legitimate grounds exist, or where processing is unlawful. However, statutory retention obligations override erasure applications, and data needed for legal compliance will be restricted from further processing rather than deleted until the retention period expires. The right of limitation of processing functions as an option where the precision of data is disputed, processing is unlawful but the player opposes deletion, or the player requires the data for legal assertions despite the controller no longer needing it. Data portability rights under Article 20 GDPR apply solely to data furnished by the player and handled by automated methods based on authorization or contract, meaning gameplay history and transaction logs qualify for portability while fraud detection scores derived from internal models do not. Rights requests should be addressed to the Data Protection Officer email address, with proper proof of identity required before any data is disclosed.
Six. Information Retention and Erasure Rules
Incaspin Casino implements a granular data retention plan intended to meet statutory record-keeping requirements while reducing the storage of personal data past its necessary purpose https://incaspincasino.de.com/legal-and-affiliates. Player account data and complete transaction records are kept for the full length of the ongoing business relationship, characterized as the time from account creation till the account is closed, plus an extra statutory retention term stipulated by German anti-money laundering legislation and commercial law. Under the Geldwäschegesetz, identification records, transaction vouchers, and due diligence materials must be maintained for at least five years following the end of the calendar year in which the business relationship terminated. Accounting records pertinent to tax requirements are stored for ten years in accordance with the German Fiscal Code. Following the conclusion of these mandatory periods, personal data is either irreversibly masked so that re-identification becomes impracticable with all methods reasonably likely to be employed, or reliably deleted through cryptographic erasure and physical storage media sanitisation procedures. Technical logs and security event data follow a briefer retention interval of twelve months, after which they are combined into anonymised statistical summaries. Inactive accounts showing no login activity for a continuous period of 24 months are marked for dormancy check, and the connected personal data is reduced to retain only the core name and transaction records necessary for the remaining statutory retention schedule. The casino uses automated data lifecycle management scripts that execute weekly to identify records beyond their retention thresholds, starting deletion procedures without human intervention, with the results recorded for compliance audit reasons.
2. Categories of Private Data Gathered
Two Point One Identification Confirmation and User Data
German players must provide specific individual data to set up and maintain an active Incaspin Casino account. This category includes complete official name, physical location, DOB, place of birth, nationality, and gender. For identity verification aims needed under German anti-money laundering laws, the casino obtains government-issued identity documents such as copy of passport, national identity card scans, and residence permit papers. The program also logs the document number, issuing body, expiration date, and a biometric matching rating produced during the automatic verification process. Residential confirmation is finished through current utility bills, bank statements, or official mail that clearly shows the member’s full name, registered address, and an issue date inside of the previous three months. Incaspin Casino implements these validation requirements uniformly to conform with the 4th and Fifth Anti-Money Laundering Orders as incorporated into German law, ensuring that every account satisfies the statutory identity certainty level prior to any withdrawals are allowed.
Two Point Two Financial and Payment Data
Financial data encompasses all deposit and withdrawal records, including payment method identifiers, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and digital wallet addresses where applicable. Incaspin Casino stores complete transaction histories showing timestamps, amounts in EUR or equivalent cryptocurrency, processing statuses, and any intermediary payment processor references. Source of funds declarations and supporting documents such as payslips, tax returns, or business financial statements are collected when players cross specific deposit thresholds or trigger enhanced due diligence procedures. This data is isolated in encrypted database tables with access restricted to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino obtaining only the information necessary to credit the player account.
2.3 Behavioral and Technical Information
While German players access the Incaspin Casino platform, the system captures technical identifiers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data covers login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus permits the casino to offer optimised gaming experiences, detect fraudulent activity patterns, and honour responsible gambling self-exclusion settings. Behavioural analytics measure betting frequency, average stake sizes, session duration, and deposit velocity to supply the responsible gambling algorithms that generate personalised risk alerts. All technical logs are pseudonymised where possible and stored independently from core identity records, with re-identification possible only through a carefully managed cryptographic lookup procedure accessible exclusively to the fraud and compliance teams under documented access justification.
Třetím Účely a právní základy zpracování
Incaspin Casino provádí zpracování osobní data under several distinct GDPR legal bases, vybraných according to konkrétní zpracovatelské činnosti. The performance of a contract podle Article 6(1)(b) GDPR covers všechna zpracování dat potřebné pro vytvoření a správu the player account, provádění vkladů a výběrů, a poskytování the interactive gaming services jež German players aktivně vyžadují during registration. This zahrnuje zasílání platebních pokynů akvizičním bankám a ověřování toho, že players dosahují požadavek minimálního věku osmácti let under German law. Zpracování na základě právní povinnosti dle Article 6(1)(c) GDPR zahrnuje anti-money laundering customer due diligence, hlášení podezřelých transakcí to relevant Financial Intelligence Units, uchovávání záznamů pro splnění commercial and tax law requirements, a soulad s německou regulací hazardu concerning player protection standards. Použitelné právní rámce include Geldwäschegesetz and the stipulations státní smlouvy o hazardu where relevant to data retention mandates.
Oprávněné zájmy sledované Incaspin Casino podle Article 6(1)(f) GDPR obsahují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers tam, kde je to dovoleno podle Section 7 of the German Act Against Unfair Competition, and business analytics za účelem zlepšení služeb. German players retain absolutní právo vznášet námitky proti zpracování based on legitimate interests, včetně profilování k přímým marketingovým účelům, a tyto námitky will be honoured without undue delay. Consent podle Article 6(1)(a) GDPR is relied upon pro volitelné marketingové komunikace e-mailem a SMS kde the player has actively opted in, pro umístění nepodstatných cookies a sledovacích technologií, a pro zpracování citlivých údajů in specific circumstances. Způsoby zrušení souhlasu jsou nápadně umístěny v nastavení účtu a v zápatí každé marketingové komunikace, přičemž odvolání nabývá účinnosti bez zpětných důsledků pro dříve legální zpracování. German players kteří ještě nedosáhli věku 18 let nemají povoleno otevírat účty, a jakákoli neúmyslně shromážděná data nezletilých is deleted immediately upon discovery.
Conclusion
Incaspin Casino has structured its data protection system to satisfy the high standards demanded by German players and mandated by the GDPR and the BDSG-neu. From the preliminary collection of identity and contact data through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage functions under recorded policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino keeps transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are advised to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.
