Incaspin Casino Privacy Notice for Germany Players

This Privacy Notice explains how Incaspin Casino obtains, processes, retains, and secures personal data of players located in Germany. The document works within the context of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino serves as the data controller for personal information submitted through its website, mobile applications, and related services. German players possess specific statutory rights regarding their data, and this notice outlines the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards implemented to prevent unauthorised access. The document also details the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been compiled to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, providing German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed across the entire customer lifecycle.

První bod: Kontakt na správce údajů a kontaktní údaje

The data controller for all personal data zpracovávané prostřednictvím the Incaspin Casino webové stránky představuje právnická osoba působící pod the brand name Incaspin Casino, registered in státě uznávané pro přijetím standardů ekvivalentních ochraně údajů EU. The registered office address a identifikační číslo společnosti poskytneme na žádost s ověřením totožnosti by emailing the Data Protection Officer, or by consulting sekce otisku webové prezentace. Němečtí hráči may direct any privacy-related inquiries to jmenovanému pracovníkovi pro ochranu údajů, jenž pracuje samostatně a je přímo podřízen nejvyššímu managementu. Pověřenec může být kontaktován přes a dedicated encrypted email channel zveřejněnou v rámci úplného znění zásad ochrany soukromí. Incaspin Casino udržuje oprávněného zástupce na území Evropské unie z důvodu článku 27 GDPR, čímž zajišťuje, že německé kontrolní orgány i dotčené osoby mají přímé kontaktní místo for regulatory matters. Tento subjekt určuje the purposes and means zpracovávání všech osobních údajů collected during registraci účtu, identifikačním procesu KYC, platebních transakcích vkladů a výběrů, a průběžné aktivitě při hraní. To zahrnuje informace generované pomocí cookies, device fingerprinting technologies, a záznamů serveru. German players should note, that the controller exercises full decision-making power ohledně činností zpracování dat přičemž pověřuje důkladně vybrané zpracovatele pro specifické technické služby jako je hosting, platební brány, a CRM platformy. Každá smluvní dohoda se zpracovatelem je upravena právně závaznou dohodou o zpracování dat která splňuje požadavky Article 28 GDPR, with mandatory audit rights reserved ze strany Incaspin Casino pro ověření průběžného souladu. Kontaktní údaje na zástupce pro Evropskou unii jsou poskytnuty the competent German data protection authority as required by law.

5: International Data Transfers

The primary data storage infrastructure for Incaspin Casino is located in secure facilities located in the European Economic Area, specifically engineered to serve the German market with latency-optimized connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers beyond the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For any such transfer, Incaspin Casino applies the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures applied where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include complete encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who seek to grasp the geographical flow of their information.

4. Information Sharing and Third Parties

4.1 In-House Data Access Model

In the Incaspin Casino operational system, personal data access adheres to a strict least-privilege model applied across four distinct personnel tiers. Customer support agents view basic account information and communication history but cannot view full financial records or identity documents. Compliance officers possess permissions to examine verification documents, transaction patterns, and risk scores. Financial department personnel process withdrawal requests and view payment instrument details necessary to execute transfers. IT security staff access system logs and security event data but do not routinely interact with player-identifiable records. Every access event is recorded with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is examined quarterly by the Data Protection Officer. German players are able to request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.

4.2 External Providers and Regulatory Bodies

Incaspin Casino engages specialist external processors such as cloud hosting providers running ISO 27001-certified data centres inside the European Economic Area, payment processors authorised by the German Federal Financial Supervisory Authority, identity verification services that match submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts mandate data processing solely on documented instructions from Incaspin Casino, with no authority for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators happen only when legally mandated, and unless prohibited by law, the casino will alert affected players of such disclosures. The following key principles govern all third-party data sharing arrangements:

• Processors receive only the minimal personal data needed to execute their specified function, with field-level data minimisation implemented to every integration.
• Sub-processor engagements need prior written approval from Incaspin Casino, and any unauthorised subcontracting forms a material breach of the data processing agreement.
• All processors must have ISO 27001 certification or equivalent independently audited security credentials, with current certificates filed with Incaspin Casino before data flows commence.
• No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business centers on monetising personal information.

3. Důvody a právní základy pro zpracování

Incaspin Casino zpracovává osobních údajů podle několika odlišných GDPR legal bases, zvolených v závislosti na dané činnosti zpracování. Realizace smlouvy pursuant to Article 6(1)(b) GDPR pokrývá všechna zpracování dat potřebné k vytvoření a vedení hráčského účtu, process deposits and withdrawals, and deliver interaktivních herních služeb that German players actively request při registraci. This includes transmitting payment instructions to acquiring banks and verifying that players dosahují požadavek minimálního věku osmácti let podle německého práva. Zpracování na základě právní povinnosti under Article 6(1)(c) GDPR pokrývá anti-money laundering customer due diligence, hlášení podezřelých transakcí příslušným finančním zpravodajským jednotkám, uchovávání záznamů pro splnění commercial and tax law requirements, and compliance s německými herními předpisy ohledně norem ochrany hráčů. The applicable legal frameworks include Geldwäschegesetz and the stipulations státní smlouvy o hazardu pokud je to relevantní k mandátům uchovávání údajů.

Legitimní zájmy pursued by Incaspin Casino under Article 6(1)(f) GDPR include network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted podle Section 7 of the German Act Against Unfair Competition, and business analytics za účelem zlepšení služeb. German players retain the absolute right vznášet námitky proti zpracování based on legitimate interests, včetně vytváření profilů for direct marketing purposes, and such objections budou ctěny without undue delay. Souhlas dle Article 6(1)(a) GDPR je využíván pro volitelné marketingové komunikace via email and SMS pokud hráč se aktivně přihlásil, pro umístění nepodstatných cookies a sledovacích technologií, a pro zpracování citlivých dat v konkrétních případech. Způsoby zrušení souhlasu jsou výrazně umístěny v rámci nastavení účtu a v zápatí každé marketingové komunikace, s tím, že odvolání má účinek bez retroaktivních následků pro dříve zákonné zpracování. German players kteří dosud nedosáhli věku 18 let are not permitted to open accounts, a veškerá omylem sebraná data nezletilých jsou okamžitě po zjištění smazána.

9. Cookie Policy and Tracking Technologies

9.1 Core and Operational Cookies

The Incaspin Casino platform and mobile platform deploy a set of cookies and similar tracking technologies to deliver core functionality. Strictly necessary cookies handle session state across page loads, maintain login authentication tokens, and preserve security context for CSRF protection. These first-party session cookies terminate when the browser is closed and do not require prior consent under German law implementing the ePrivacy Directive, as they are necessary for the desired service delivery. Functional cookies store language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players find a coherent personalised environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they become invalid automatically if the player has not accessed the platform. Incaspin Casino does not use flash cookies, supercookies, or any respawning techniques that circumvent browser deletion actions.

9.2 Metrics and Marketing Cookies

Analytics and marketing cookies are set only after German players give explicit, freely given consent through the cookie consent management platform displayed on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers participating, the purposes of data collection, and the retention duration for each cookie type. Players may grant or refuse consent for each category independently, and consent preferences are logged as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service track aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies support campaign attribution and frequency capping for promotional banners shown within the logged-in casino environment. German players may change their consent choices at any time by using the cookie settings panel linked in the website footer. Rejecting analytics or marketing cookies does not impact gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to update or update their preferences.

7. Information Security Measures

Incaspin Casino utilizes a tiered security architecture aligned with the ISO 27001 control framework and the technical requirements specified in Article 32 of the GDPR. Network-level protections include enterprise-grade firewalls equipped with stateful packet inspection, intrusion detection and prevention systems that monitor traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that absorb volumetric attacks before they reach the application layer. All data transferred between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, preventing retrospective decryption of captured traffic even if long-term private keys are later compromised. Internal administrative interfaces are separated on a management network not accessible from the public internet, with access permitted exclusively through multi-factor authenticated VPN tunnels coming from pre-registered static IP addresses assigned to authorised personnel. At the application layer, the platform enforces strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies trigger step-up authentication challenges or temporary account locks pending manual review by the security team. Database-level encryption secures data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each administered through a hardware security module that logs every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm confirm the effectiveness of these controls, with critical findings remediated within 48 hours. Security incident response procedures are tested through bi-annual tabletop exercises including the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline mandated by GDPR.

8. Rights of German Data Subjects

German players enjoy the complete suite of data subject prerogatives enumerated in Articles 15 through 21 of the GDPR, along with the right to submit a grievance with a supervisory authority. The access right permits players to receive assurance of if Incaspin Casino processes their personal data and to obtain a version of that data together with particulars about processing objectives, classes, recipients, holding terms, and the occurrence of automated decision-making. Access requests are completed within one month, free of charge for the initial request, with the reply supplied in a structured, commonly used, machine-readable layout. The rectification right enables players to correct wrong personal data or supplement incomplete documents, a especially pertinent entitlement for identity document changes following name changes or address relocations. Incaspin Casino processes rectification requests within ten business days and acknowledges corrections to any third-party addressees to whom the incorrect data was disclosed. The right to erasure applies where the personal data is not anymore required for the aims for which it was obtained, where authorization is canceled, where the player raises objection to processing and no overriding legitimate grounds are in place, or where processing is unlawful. However, statutory retention obligations override erasure applications, and data required for legal compliance will be confined from further processing rather than deleted until the retention period lapses. The right of limitation of processing serves as an alternative where the accuracy of data is challenged, processing is illegal but the player objects to deletion, or the player necessitates the data for legal claims despite the controller no longer needing it. Data portability entitlements under Article 20 GDPR apply solely to data provided by the player and handled by automated means based on authorization or contract, meaning gameplay history and transaction logs are suitable for portability while fraud detection scores obtained from internal models do not. Rights requests should be directed to the Data Protection Officer email address, with legitimate proof of identity necessary before any data is disclosed.

Two Classes of Personal Data Collected

2.1 Identity Confirmation and User Data

German players must supply specific private data to set up and keep an living Incaspin Casino account. This category covers entire legal name, physical address, birth date, place of birth, nationality, and gender. For identification confirmation reasons required under German anti-money laundering rules, the casino collects government-issued identification papers such as copy of passport, national identity card scans, and residence permit papers. The system also records the document number, issuer, validity end, and a biometric matching rating produced during the automatic validation process. Address validation is finished through recent utility bills, bank statements, or official mail that plainly displays the player’s full name, recorded address, and an issue date inside of the last three months. Incaspin Casino applies these verification conditions consistently to comply with the Fourth and Fifth Anti-Money Laundering Orders as incorporated into Germany’s law, guaranteeing that each account fulfills the statutory identity assurance level ahead of any withdrawals are authorized.

Two Point Two Monetary and Payment Data

Transaction records encompasses all deposit and withdrawal records, including payment method identifiers, masked card numbers, e-wallet account email addresses, bank account IBAN details for SEPA transfers, and crypto wallet addresses where applicable. Incaspin Casino keeps complete transaction histories showing timestamps, amounts in EUR or cryptocurrency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and supporting documents such as payslips, tax returns, or business financial statements are collected when players cross specific deposit thresholds or trigger enhanced due diligence procedures. This data is separated in encrypted database tables with access limited to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino obtaining only the information necessary to credit the player account.

2.3 Behavioral and Technical Information

As German players log into the Incaspin Casino platform, the system gathers technical identifiers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data covers login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus permits the casino to provide optimised gaming experiences, spot fraudulent activity patterns, and honour responsible gambling self-exclusion settings. Behavioural analytics measure betting frequency, average stake sizes, session duration, and deposit velocity to feed the responsible gambling algorithms that generate personalised risk alerts. All technical logs are pseudonymised where possible and stored apart from core identity records, with re-identification possible only through a strictly regulated cryptographic lookup procedure reserved exclusively to the fraud and compliance teams under documented access justification.

Number 6. Data Retention and Deletion Guidelines

Incaspin Casino operates a precise data retention schedule aimed to fulfill statutory record-keeping obligations while reducing the storage of personal data after its necessary purpose. Player account data and entire transaction records are stored for the entire length of the active business relationship, defined as the time from account creation till the account is terminated, plus an supplementary statutory retention period mandated by German anti-money laundering laws and commercial law. Under the Geldwäschegesetz, identification records, transaction vouchers, and due diligence materials must be preserved for at least five years following the end of the calendar year in which the business relationship terminated. Accounting records applicable to tax duties are kept for ten years in compliance with the German Fiscal Code. Following the conclusion of these mandatory intervals, personal data is either irreversibly anonymised so that re-identification becomes impracticable with all methods reasonably expected to be employed, or securely deleted through cryptographic erasure and physical storage media cleaning processes. Technical logs and security event data observe a reduced retention period of twelve months, after which they are combined into anonymised statistical overviews. Inactive accounts showing no login activity for a unbroken period of 24 months are designated for dormancy check, and the connected personal data is reduced to keep only the core identifier and transaction records required for the remaining statutory retention timeline. The casino utilizes automated data lifecycle management processes that run weekly to identify records beyond their retention thresholds, initiating deletion processes without human involvement, with the results recorded for compliance audit reasons.

Conclusion

Incaspin Casino has organized its data protection framework to meet the high standards anticipated by German players and required by the GDPR and the BDSG-neu. From the preliminary collection of identity and contact data through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage operates under documented policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino maintains transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are encouraged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.