This Privacy Notice describes how partner casino incaspin obtains, processes, retains, and safeguards personal data belonging to players located in Germany. The document operates within the context of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino functions as the data controller for personal information submitted through its website, mobile applications, and related services. German players have specific statutory rights regarding their data, and this notice outlines the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards deployed to prevent unauthorised access. The document also describes the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been compiled to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, providing German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed during the entire customer lifecycle.
Number 6. Data Archiving and Deletion Rules
Incaspin Casino operates a precise data retention schedule designed to meet statutory record-keeping requirements while reducing the keeping of personal data beyond its necessary purpose. Player account data and complete transaction logs are stored for the full duration of the active business relationship, described as the term from account creation up to the account is closed, plus an additional statutory retention period required by German anti-money laundering regulations and commercial law. Under the Geldwäschegesetz, identification documents, transaction vouchers, and due diligence materials must be preserved for at least five years after the end of the calendar year in which the business relationship ended. Accounting records applicable to tax requirements are retained for ten years in conformity with the German Fiscal Code. Following the conclusion of these mandatory periods, personal data is either permanently masked so that re-identification becomes unfeasible with all ways reasonably probable to be employed, or securely removed through cryptographic erasure and physical storage media sanitisation procedures. Technical logs and security event data follow a briefer retention cycle of twelve months, after which they are compiled into anonymised statistical reports. Inactive accounts exhibiting no login activity for a continuous period of 24 months are designated for dormancy check, and the connected personal data is minimised to store only the core identifier and transaction records needed for the remaining statutory retention schedule. The casino uses automated data lifecycle management scripts that operate weekly to locate records over their retention deadlines, starting deletion workflows without human involvement, with the results recorded for compliance audit objectives.
7. Data Security Controls
Incaspin Casino implements a multilevel security architecture conforming to the ISO 27001 control framework and the technical requirements articulated in Article 32 of the GDPR. Network-level protections comprise enterprise-grade firewalls equipped with stateful packet inspection, intrusion detection and prevention systems that analyze traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that neutralize volumetric attacks before they hit the application layer. All data sent between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, preventing retrospective decryption of captured traffic even if long-term private keys are later compromised. Internal administrative interfaces are segmented on a management network inaccessible from the public internet, with access granted only through multi-factor authenticated VPN tunnels coming from pre-registered static IP addresses belonging to authorised personnel. At the application layer, the platform enforces strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies initiate step-up authentication challenges or temporary account locks awaiting manual review by the security team. Database-level encryption protects data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each managed through a hardware security module that records every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm verify the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are tested through bi-annual tabletop exercises including the Data Protection Officer, with a documented breach notification workflow ensuring German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.
Číslo 5: International Data Transfers
The primary data storage infrastructure for Incaspin Casino is located in secure facilities located in the European Economic Area, specifically designed to serve the German market with low-latency connectivity while maintaining full GDPR jurisdictional coverage. Specific specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino applies the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures implemented where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include end-to-end encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who wish to understand the geographical flow of their information.
8. Prerogatives of German Data Subjects
German gamblers hold the complete set of data subject rights specified in Articles 15 through 21 of the GDPR, as well as the entitlement to file a appeal with a supervisory authority. The right of access permits players to receive verification of if Incaspin Casino processes their private data and to receive a duplicate of that data along with information about processing objectives, classes, recipients, holding terms, and the existence of automated decision-making. Access requests are fulfilled within one month, free of charge for the first request, with the reply supplied in a organized, commonly used, machine-readable structure. The right to rectification enables players to correct inaccurate personal data or supplement partial documents, a notably pertinent entitlement for identity document changes following name alterations or address moves. Incaspin Casino processes rectification applications within ten business days and acknowledges corrections to any third-party recipients to whom the incorrect data was revealed. The right to erasure holds true where the personal data is no more needed for the objectives for which it was obtained, where authorization is withdrawn, where the player opposes to processing and no dominant legitimate grounds are in place, or where processing is unlawful. wie es funktioniert However, statutory retention obligations supersede erasure requests, and data needed for legal compliance will be limited from further processing rather than deleted until the retention period ends. The restriction right of processing serves as an option where the precision of data is contested, processing is contrary to law but the player is against deletion, or the player necessitates the data for legal demands despite the controller no longer needing it. Data portability rights under Article 20 GDPR are limited to data provided by the player and dealt with by automated ways based on consent or agreement, meaning gameplay history and transaction logs are eligible for portability while fraud detection assessments obtained from internal systems do not. Rights requests should be sent to the Data Protection Officer email address, with proper proof of identity required before any data is released.
2. Groups of Personal Data Gathered
2.1 Identity Validation and Account Data
German players must supply specific private data to set up and maintain an living Incaspin Casino account. This class covers entire statutory name, home location, birth date, place of birth, nationality, and sex. schnelle Fakten For identity confirmation purposes mandatory under Germany’s anti-money laundering rules, the casino gathers government-issued identity documents such as copy of passport, national ID copies, and residence permit papers. The platform also logs the ID number, issuing authority, validity end, and a biometrical matching result created during the automatic verification process. Home verification is finished through latest utility bills, bank statements, or official correspondence that plainly presents the member’s name, recorded address, and an creation day inside the past three months. Incaspin Casino implements these verification prerequisites uniformly to conform with the 4th and 5th Anti-Money Laundering Directives as transposed into Germany’s law, making sure that every account satisfies the regulatory identification certainty level ahead of any withdrawals are authorized.
2.2 Fiscal and Deal Data
Financial data encompasses all transaction records, including payment method details, masked card numbers, e-wallet account email addresses, bank account IBAN details for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino keeps complete transaction histories showing timestamps, amounts in EUR or cryptocurrency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is isolated in encrypted database tables with access limited to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino obtaining only the information necessary to credit the player account.
2.3 Behavioral and Technical Information
While German players access the Incaspin Casino platform, the system gathers technical markers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data encompasses login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus enables the casino to deliver optimised gaming experiences, detect fraudulent activity patterns, and uphold responsible gambling self-exclusion settings. Behavioural analytics monitor betting frequency, average stake sizes, session duration, and deposit velocity to supply the responsible gambling algorithms that create personalised risk alerts. All technical logs are de-identified where possible and stored independently from core identity records, with re-identification possible only through a carefully managed cryptographic lookup procedure reserved exclusively to the fraud and compliance teams under documented access justification.
4. Data Sharing and Third-Party Recipients
4.1 Internal Data Access Structure
In the Incaspin Casino operational system, personal data access adheres to a strict least-privilege model implemented across four distinct personnel tiers. Customer support agents retrieve basic account information and communication history but cannot view full financial records or identity documents. Compliance officers possess permissions to inspect verification documents, transaction patterns, and risk scores. Financial department personnel handle withdrawal requests and view payment instrument details necessary to execute transfers. IT security staff review system logs and security event data but do not routinely interact with player-identifiable records. Every access event is tracked with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is examined quarterly by the Data Protection Officer. German players can request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Service Providers and Authorities
Incaspin Casino engages specialist external processors comprising cloud hosting providers running ISO 27001-certified data centres within the European Economic Area, payment processors authorised by the German Federal Financial Supervisory Authority, identity verification services that match submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts stipulate data processing solely on documented instructions from Incaspin Casino, with no entitlement for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles regulate all third-party data sharing arrangements:
- Processors obtain only the least personal data required to carry out their contracted function, with field-level data minimisation applied to every integration.
- Sub-processor engagements demand prior written consent from Incaspin Casino, and any unapproved subcontracting represents a material breach of the data processing agreement.
- All processors must have ISO 27001 certification or similar independently audited security credentials, with current records filed with Incaspin Casino before data flows start.
- No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.
1. Data Controller Identity a kontaktní údaje
The data controller za veškeré osobní údaje processed through the Incaspin Casino webové stránky je the legal entity vystupující pod the brand name Incaspin Casino, registered in státě recognised for dodržováním standardů ochrany údajů odpovídajících EU. The registered office address and company registration number are available upon verified request zasláním e-mailu pracovníkovi pro ochranu osobních údajů, nebo nahlédnutím do části s právními informacemi webové prezentace. Hráči z Německa mohou adresovat veškeré dotazy ohledně ochrany soukromí k the designated Data Protection Officer, jenž pracuje samostatně and reports directly to nejvyššímu managementu. Pověřenec can be reached via vyhrazeného šifrovaného e-mailového kanálu zveřejněnou v rámci kompletního textu politiky ochrany osobních údajů. Incaspin Casino má právního zástupce v Evropské unii z důvodu Article 27 GDPR, čímž zajišťuje, že German supervisory authorities a subjekty údajů mají přímé kontaktní místo pro regulační záležitosti. Správce stanovuje the purposes and means zpracování všech osobních údajů shromážděných během registraci účtu, identifikačním procesu KYC, platebních transakcích vkladů a výběrů, a probíhající herní činnosti. To zahrnuje informace generované pomocí cookies, technologií otisku zařízení, and server logs. Němečtí hráči by měli vzít na vědomí, že tento subjekt uplatňuje plnou rozhodovací pravomoc over data processing operations a zároveň zadává carefully vetted processors for specific technical services např. hosting, platební brány, a platformy pro řízení vztahů se zákazníky. Každá smluvní dohoda se zpracovatelem je upravena právně závaznou dohodou o zpracování dat která splňuje požadavky Article 28 GDPR, with mandatory audit rights reserved pro Incaspin Casino k ověření trvalého dodržování předpisů. The contact details of the EU representative jsou poskytnuty the competent German data protection authority v souladu s právními předpisy.
3. bod Účely a právní základy zpracování
Incaspin Casino processes personal data under several distinct GDPR právních důvodů, selected podle the specific processing activity. The performance of a contract pursuant to Article 6(1)(b) GDPR covers all data processing potřebné k vytvoření a vedení hráčského účtu, zpracování vkladů a výběrů, a doručení interaktivních herních služeb that German players aktivně vyžadují během registrace. This obsahuje zasílání platebních pokynů zúčtovacím bankám and verifying že players meet požadavek minimálního věku 18 let under German law. Legal obligation processing dle Article 6(1)(c) GDPR pokrývá anti-money laundering customer due diligence, suspicious transaction reporting relevantním jednotkám finančního zpravodajství, retence záznamů to satisfy obchodně-právních a daňových požadavků, a soulad s německými herními předpisy týkajících se standardů ochrany hráčů. Použitelné právní rámce zahrnují the Geldwäschegesetz a ustanovení státní smlouvy o hazardu where relevant pro povinnosti uchovávání dat.
Legitimate interests prosazované Incaspin Casino dle Article 6(1)(f) GDPR obsahují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted podle Section 7 of the German Act Against Unfair Competition, a obchodní analýzy za účelem zlepšení služeb. German players zachovávají si the absolute right to object to processing založeném na oprávněných zájmech, včetně profilování for direct marketing purposes, a tyto námitky will be honoured bez zbytečné prodlevy. Consent under Article 6(1)(a) GDPR je využíván for optional marketing communications via email and SMS kde the player has actively opted in, pro nasazení neesenciálních cookies a sledovacích technologií, and for sensitive data processing v konkrétních případech. Mechanismy pro odvolání souhlasu jsou výrazně umístěny within account settings a v zápatí každé marketingové komunikace, s tím, že odvolání má účinek without retroactive consequences for previously lawful processing. German players who have not yet reached osmácti let nesmějí otevírat účty, and any inadvertently collected minor data jsou okamžitě po zjištění smazána.
9. Cookie Policy and Tracking Technologies
9.1 Essential and Operational Cookies
The Incaspin Casino website and mobile platform implement a range of cookies and similar tracking technologies to deliver core functionality. Strictly necessary cookies control session state across page loads, preserve login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies end when the browser is closed and do not require prior consent under German law transposing the ePrivacy Directive, as they are necessary for the required service delivery. Functional cookies store language preferences, preferred currency displays, and responsible gambling limit settings across visits, ensuring that returning players find a consistent personalized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they become invalid automatically if the player has not returned to the platform. Incaspin Casino does not use flash cookies, supercookies, or any recreating techniques that circumvent browser deletion actions.
9.2 Analysis and Marketing Cookies
Analytics and marketing cookies are set only after German players give explicit, freely given consent through the cookie consent management platform displayed on first visit. The consent tool displays clear descriptions of each cookie category, the specific providers engaged, the purposes of data collection, and the retention duration for each cookie type. Players may grant or deny consent for each category independently, and consent preferences are logged as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service track aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies support campaign attribution and frequency capping for promotional banners presented within the logged-in casino environment. German players may change their consent choices at any time by visiting the cookie settings panel linked in the website footer. Declining analytics or marketing cookies does not impact gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to reconfirm or update their preferences.
Conclusion
Incaspin Casino has organized its data protection system to meet the high standards anticipated by German players and mandated by the GDPR and the BDSG-neu. From the preliminary collection of identity and contact details through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage functions under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino preserves transparent communication channels for rights requests, provides granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are advised to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.