This Privacy Notice describes how Incaspin Casino gathers, processes, keeps, and secures personal data belonging to players located in Germany. The document operates within the scope of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino functions as the data controller for personal information furnished through its website, mobile applications, and related services. German players enjoy specific statutory rights relating to their data, and this notice outlines the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards used to prevent unauthorised access. The document also explains the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been compiled to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, offering German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed throughout the entire customer lifecycle.

1. Kontakt na správce údajů a podrobnosti o kontaktu

Správcem údajů za veškeré osobní údaje zpracovávané prostřednictvím the Incaspin Casino platformy is subjekt působící pod the brand name Incaspin Casino, registered in státě známé svým přijetím standardů ekvivalentních ochraně údajů EU. Adresa sídla and company registration number jsou k dispozici na žádost s ověřením totožnosti e-mailem na adresu pracovníkovi pro ochranu osobních údajů, or by consulting the imprint section webové prezentace. Hráči z Německa may direct jakékoli dotazy týkající se soukromí k the designated Data Protection Officer, který působí nezávisle a podává zprávy přímo senior management. The DPO je k zastižení via vyhrazeného šifrovaného e-mailového kanálu zveřejněnou v rámci úplného znění zásad ochrany soukromí. Incaspin Casino udržuje a legal representative na území Evropské unie z důvodu ustanovení čl. 27 GDPR, aby bylo zaručeno, že German supervisory authorities i dotčené osoby disponují přímým kontaktem ohledně regulačních otázek. Tento subjekt určuje cíle a způsoby zpracovávání všech osobních údajů shromážděných během account registration, Know Your Customer verification, transakcích vkladů a výběrů, and ongoing gameplay activity. Sem patří údaje vytvářené prostřednictvím cookies, technologií otisku zařízení, and server logs. Němečtí hráči by měli vzít na vědomí, že tento subjekt uplatňuje plnou rozhodovací pravomoc nad operacemi zpracování údajů přičemž pověřuje carefully vetted processors pro specifické technické služby such as hosting, payment gateways, a CRM platformy. Každá smluvní dohoda se zpracovatelem je upravena a binding data processing agreement jež vyhovuje podmínkám ustanovení čl. 28 GDPR, s možností provádět povinné audity by Incaspino Casino k ověření trvalého dodržování předpisů. Kontaktní údaje na zástupce pro Evropskou unii jsou poskytnuty the competent German data protection authority jak vyžaduje zákon.

4. Information Sharing and Third Parties

4.1 Internal Data Access Architecture

Within the Incaspin Casino operational structure, personal data access adheres to a strict least-privilege model used for four distinct personnel tiers. Customer support agents view basic account information and communication history but cannot view full financial records or identity documents. Compliance officers hold permissions to inspect verification documents, transaction patterns, and risk scores. Financial department personnel manage withdrawal requests and view payment instrument details needed to execute transfers. IT security staff monitor system logs and security event data but do not regularly interact with player-identifiable records. Every access event is logged with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is examined quarterly by the Data Protection Officer. German players may request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.

4.2 Third-Party Services and Authorities

Incaspin Casino employs specialist external processors such as cloud hosting providers operating ISO 27001-certified data centres within the European Economic Area, payment processors regulated by the German Federal Financial Supervisory Authority, identity verification services that match submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment covering technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Website besuchen Contracts require data processing solely on documented instructions from Incaspin Casino, with no right for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles regulate all third-party data sharing arrangements:

• Processors receive only the least personal data needed to execute their specified function, with field-level data minimisation implemented to every integration.
• Sub-processor engagements need prior written consent from Incaspin Casino, and any unlicensed subcontracting constitutes a material breach of the data processing agreement.
• All processors must hold ISO 27001 certification or similar independently audited security credentials, with current certificates filed with Incaspin Casino before data flows commence.
• No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.

Six. Information Storage and Deletion Rules

Incaspin Casino implements a precise data retention policy aimed to satisfy statutory record-keeping duties while limiting the storage of personal data past its intended purpose https://incaspincasino.de.com/legal-and-affiliates/. Player account data and entire transaction logs are stored for the full length of the current business relationship, described as the time from account creation up to the account is deactivated, plus an additional statutory retention period stipulated by German anti-money laundering legislation and commercial law. Under the Geldwäschegesetz, identification records, transaction vouchers, and due diligence papers must be maintained for at least five years following the end of the calendar year in which the business relationship ended. Accounting records relevant to tax obligations are retained for ten years in compliance with the German Fiscal Code. Following the conclusion of these mandatory intervals, personal data is either irreversibly masked so that re-identification becomes unfeasible with all means reasonably expected to be applied, or securely erased through cryptographic erasure and physical storage media wiping processes. Technical logs and security event data observe a shorter retention interval of twelve months, after which they are aggregated into anonymised statistical summaries. Inactive accounts showing no login activity for a continuous period of 24 months are marked for dormancy review, and the related personal data is limited to retain only the core ID and transaction records needed for the outstanding statutory retention schedule. The casino utilizes automated data lifecycle management routines that operate weekly to find records over their retention thresholds, triggering deletion procedures without human intervention, with the results recorded for compliance audit objectives.

3. Účely a právní základy zpracování

Incaspin Casino processes osobní data under several distinct GDPR legal bases, selected podle dané činnosti zpracování. Plnění smlouvy ve smyslu Article 6(1)(b) GDPR pokrývá všechna zpracování dat potřebné k vytvoření a vedení the player account, zpracování vkladů a výběrů, a doručení interaktivních herních služeb které German players aktivně požadují při registraci. This includes předávání platebních instrukcí zúčtovacím bankám a kontrolu toho, že players dosahují the minimum age requirement of 18 years dle německé legislativy. Zpracování na základě právní povinnosti under Article 6(1)(c) GDPR zahrnuje anti-money laundering customer due diligence, hlášení podezřelých transakcí to relevant Financial Intelligence Units, uchovávání záznamů to satisfy požadavků obchodního a daňového práva, a dodržování with German gambling regulations ohledně norem ochrany hráčů. Relevantní právní rámce obsahují zákon o praní špinavých peněz a předpisy of the Glücksspielstaatsvertrag kde je to relevantní to data retention mandates.

Legitimate interests prosazované Incaspin Casino dle Article 6(1)(f) GDPR zahrnují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted under Section 7 of the German Act Against Unfair Competition, a obchodní analýzy pro zlepšení služeb. German players zachovávají si nezpochybnitelné právo to object to processing na základě oprávněných zájmů, včetně vytváření profilů k přímým marketingovým účelům, and such objections will be honoured bez zbytečného odkladu. Souhlas dle Article 6(1)(a) GDPR je spoléháno for optional marketing communications e-mailem a SMS kde hráč se aktivně přihlásil, pro umístění nepodstatných cookies a sledovacích technologií, a pro zpracování citlivých dat za specifických okolností. Způsoby zrušení souhlasu jsou nápadně umístěny within account settings a v zápatí každé marketingové komunikace, s tím, že odvolání má účinek without retroactive consequences pro dříve zákonné zpracování. German players kteří ještě nedosáhli the age of 18 nemají povoleno otevírat účty, and any inadvertently collected minor data je ihned po odhalení odstraněna.

2. Categories of Personal Data Obtained

Two Point One Identification Validation and Account Data

Players from Germany must supply particular individual data to set up and keep an living Incaspin Casino account. This category contains entire official name, physical address, DOB, place of birth, citizenship, and sex. For identity verification reasons needed under Germany’s anti-money laundering rules, the casino collects government-issued ID documents such as copy of passport, national ID copies, and residence permit papers. The program also logs the document number, issuer, validity end, and a biometric matching result generated during the automated verification process. Residential confirmation is done through recent utility bills, bank statements, or authorized mail that clearly displays the user’s name, recorded location, and an creation day within the last three months. Incaspin Casino applies these verification prerequisites uniformly to comply with the 4th and Fifth Anti-Money Laundering Orders as implemented into Germany’s law, ensuring that all account fulfills the regulatory identification assurance level before any withdrawals are allowed.

2.2 Monetary and Deal Data

Financial data encompasses all deposit records, including payment method identifiers, masked card numbers, e-wallet account email addresses, bank account IBAN details for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino stores complete transaction histories showing timestamps, amounts in EUR or equivalent cryptocurrency, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players cross specific deposit thresholds or trigger enhanced due diligence procedures. This data is separated in encrypted database tables with access confined to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino getting only the information necessary to credit the player account.

2.3 Technical and Behavioural Data

While German players log into the Incaspin Casino platform, the system automatically collects technical identifiers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data includes login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus permits the casino to deliver optimised gaming experiences, spot fraudulent activity patterns, and honour responsible gambling self-exclusion settings. Behavioural analytics monitor betting frequency, average stake sizes, session duration, and deposit velocity to supply the responsible gambling algorithms that create personalised risk alerts. All technical logs are pseudonymised where possible and stored separately from core identity records, with re-identification possible only through a strictly regulated cryptographic lookup procedure available exclusively to the fraud and compliance teams under documented access justification.

7. Security of Data Safeguards

Incaspin Casino deploys a multi-layered security architecture in accordance with the ISO 27001 control framework and the technical requirements specified in Article 32 of the GDPR. Network-level protections comprise enterprise-grade firewalls configured with stateful packet inspection, intrusion detection and prevention systems that analyze traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that absorb volumetric attacks before they arrive at the application layer. All data transmitted between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, blocking retrospective decryption of captured traffic even if long-term private keys are later compromised. Internal administrative interfaces are separated on a management network not accessible from the public internet, with access granted only through multi-factor authenticated VPN tunnels originating from pre-registered static IP addresses belonging to authorised personnel. At the application layer, the platform imposes strong password policies requiring minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks awaiting manual review by the security team. Database-level encryption secures data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each administered through a hardware security module that logs every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm validate the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are practiced through bi-annual tabletop exercises involving the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline mandated by GDPR.

8. Rights of Germany-based Data Subjects

German players enjoy the full set of data subject entitlements enumerated in Articles 15 through 21 of the GDPR, together with the right to lodge a appeal with a supervisory authority. The access right allows players to acquire confirmation of whether Incaspin Casino processes their personal data and to get a copy of that data along with particulars about processing purposes, classes, recipients, storage periods, and the presence of automated decision-making. Access requests are fulfilled within one month, without charge for the initial request, with the answer provided in a ordered, commonly used, machine-readable structure. The rectification right allows players to rectify inaccurate personal data or complete partial files, a notably relevant entitlement for identity document updates following name modifications or address transfers. Incaspin Casino handles rectification applications within ten business days and acknowledges corrections to any third-party receivers to whom the inaccurate data was shared. The right to erasure applies where the personal data is no longer needed for the objectives for which it was gathered, where consent is withdrawn, where the player raises objection to processing and no prevailing legitimate grounds are present, or where processing is illegal. However, statutory retention duties take precedence over erasure inquiries, and data required for legal compliance will be restricted from further processing rather than removed until the retention period lapses. The restriction right of processing acts as an option where the accuracy of data is disputed, processing is illegal but the player is against deletion, or the player needs the data for legal assertions despite the controller no longer demanding it. Data portability entitlements under Article 20 GDPR extend only to data provided by the player and handled by automated ways based on consent or contract, signifying gameplay history and transaction logs are suitable for portability while fraud detection assessments derived from internal models do not. Rights inquiries should be directed to the Data Protection Officer email address, with valid proof of identity required before any data is released.

9. Cookie Policy and Tracking Technologies

9.1 Core and Functional Cookies

The Incaspin Casino website and mobile platform implement a set of cookies and similar tracking technologies to deliver core functionality. Strictly necessary cookies control session state across page loads, maintain login authentication tokens, and uphold security context for CSRF protection. These first-party session cookies end when the browser is closed and do not require prior consent under German law transposing the ePrivacy Directive, as they are essential for the requested service delivery. Functional cookies store language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players encounter a consistent customized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they expire automatically if the player has not accessed the platform. Incaspin Casino does not use flash cookies, supercookies, or any respawning techniques that evade browser deletion actions.

9.2 Analytics and Marketing Cookies

Analytics and marketing cookies are set only after German players provide explicit, freely given consent through the cookie consent management platform presented on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers participating, the purposes of data collection, and the retention duration for each cookie type. Players may grant or deny consent for each category independently, and consent preferences are logged as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service measure aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies enable campaign attribution and frequency capping for promotional banners presented within the logged-in casino environment. German players may modify their consent choices at any time by visiting the cookie settings panel referenced in the website footer. Rejecting analytics or marketing cookies does not impact gameplay functionality or account standing in any manner. The consent tool solicits players annually to reconfirm or update their preferences.

5: International Data Transfers

The main data storage infrastructure for Incaspin Casino resides within secure facilities located in the European Economic Area, specifically engineered to serve the German market with latency-optimised connectivity while maintaining full GDPR jurisdictional coverage. Some specialised processing activities may involve international data transfers beyond the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino enforces the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures utilised where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include full encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who wish to understand the geographical flow of their information.

Conclusion

Incaspin Casino has structured its data protection structure to satisfy the high standards expected by German players and required by the GDPR and the BDSG-neu. From the initial collection of identity and contact details through to the final deletion or anonymisation of records years after account closure, every personal data life cycle stage functions under recorded policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino maintains transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are encouraged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.