This Privacy Notice describes how Incaspin Casino obtains, processes, stores, and protects personal data pertaining to players located in Germany https://incaspincasino.de.com/legal-and-affiliates/. The document operates within the context of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino serves as the data controller for personal information provided through its website, mobile applications, and related services. German players enjoy specific statutory rights regarding their data, and this notice details the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards implemented to prevent unauthorised access. The document also explains the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section is prepared to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, giving German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed throughout the entire customer lifecycle.

1. Kontakt na správce údajů a kontaktní údaje

Osobou odpovědnou za zpracování údajů for all personal data zpracovávané na platformě the Incaspin Casino webové stránky představuje the legal entity působící pod the brand name Incaspin Casino, registrovaná v státě uznávané pro dodržováním standardů ekvivalentních ochraně údajů EU. Adresa sídla a registrační číslo are available upon verified request by emailing pověřenci pro ochranu osobních údajů, případně v části s právními informacemi of the main website. German players mohou adresovat veškeré dotazy ohledně ochrany soukromí k určenému pověřenci pro ochranu osobních údajů, jenž pracuje samostatně a je přímo podřízen vrcholovému vedení. Pověřenec je k zastižení via a dedicated encrypted email channel uvedenou v kompletního textu politiky ochrany osobních údajů. Incaspin Casino má oprávněného zástupce v Evropské unii z důvodu Article 27 GDPR, ensuring that German supervisory authorities and data subjects mají přímé kontaktní místo pro regulační záležitosti. Správce určuje cíle a způsoby of processing all personal data shromážděných během registraci účtu, ověřování Know Your Customer, deposit and withdrawal transactions, a probíhající herní činnosti. To zahrnuje data generated through souborů cookies, technologií pro identifikaci zařízení, and server logs. German players should note, že správce vykonává plnou rozhodovací pravomoc nad operacemi zpracování údajů while commissioning carefully vetted processors k zajištění konkrétních technických služeb např. hosting, platební brány, a CRM platformy. Každá smluvní dohoda se zpracovatelem is governed by závaznou smlouvou o zpracování údajů jež vyhovuje podmínkám ustanovení čl. 28 GDPR, s možností provádět povinné audity pro Incaspin Casino to verify ongoing compliance. Kontaktní údaje na zástupce pro Evropskou unii are provided to the competent German data protection authority v souladu s právními předpisy.

6. Data Retention and Deletion Policies

Incaspin Casino runs a granular data retention plan aimed to satisfy statutory record-keeping requirements while limiting the keeping of personal data beyond its necessary purpose. Player account data and entire transaction logs are retained for the complete duration of the ongoing business relationship, defined as the time from account creation until the account is closed, plus an additional statutory retention term stipulated by German anti-money laundering legislation and commercial law. Under the Geldwäschegesetz, identification records, transaction confirmations, and due diligence materials must be maintained for at least five years from the end of the calendar year in which the business relationship terminated. Accounting records applicable to tax requirements are stored for ten years in conformity with the German Fiscal Code. Following the conclusion of these mandatory terms, personal data is either irrevocably anonymised so that re-identification becomes impracticable with all methods reasonably probable to be applied, or safely removed through cryptographic erasure and physical storage media wiping processes. Technical logs and security event data follow a briefer retention period of twelve months, after which they are aggregated into anonymised statistical overviews. Inactive accounts exhibiting no login activity for a continuous period of 24 months are marked for dormancy review, and the associated personal data is minimised to keep only the core ID and transaction records required for the leftover statutory retention schedule. The casino utilizes automated data lifecycle management processes that operate weekly to identify records beyond their retention deadlines, triggering deletion procedures without human involvement, with the results documented for compliance audit purposes.

7. Data Security Controls

Incaspin Casino utilizes a multi-layered security architecture in accordance with the ISO 27001 control framework and the technical requirements articulated in Article 32 of the GDPR. Network-level protections comprise enterprise-grade firewalls equipped with stateful packet inspection, intrusion detection and prevention systems that watch traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that neutralize volumetric attacks before they hit the application layer. All data transferred between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, avoiding retrospective decryption of captured traffic even if long-term private keys are subsequently exposed. Internal administrative interfaces are segmented on a management network not accessible from the public internet, with access granted only through multi-factor authenticated VPN tunnels originating from pre-registered static IP addresses belonging to authorised personnel. At the application layer, the platform mandates strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies initiate step-up authentication challenges or temporary account locks until manual review by the security team. Database-level encryption secures data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each managed through a hardware security module that tracks every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm confirm the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are practiced through bi-annual tabletop exercises engaging the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline mandated by GDPR.

9. Cookie Policy and Tracking Technologies

9.1 Essential and Technical Cookies

The Incaspin Casino website and mobile platform utilize a variety of cookies and similar tracking technologies to provide core functionality. Strictly necessary cookies control session state across page loads, maintain login authentication tokens, and preserve security context for CSRF protection. These first-party session cookies terminate when the browser is closed and do not require prior consent under German law enforcing the ePrivacy Directive, as they are indispensable for the requested service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, making sure that returning players find a uniform personalised environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they become invalid automatically if the player has not revisited the platform. Incaspin Casino does not use flash cookies, supercookies, or any regenerating techniques that evade browser deletion actions.

9.2 Analytics and Marketing Cookies

Analytics and marketing cookies are set only after German players grant explicit, freely given consent through the cookie consent management platform presented on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers participating, the purposes of data collection, and the retention duration for each cookie type. Players may grant or withhold consent for each category independently, and consent preferences are logged as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service monitor aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies support campaign attribution and frequency capping for promotional banners presented within the logged-in casino environment. German players may adjust their consent choices at any time by accessing the cookie settings panel located in the website footer. Refusing analytics or marketing cookies does not impact gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to reconfirm or update their preferences.

Pátý bod: International Data Transfers

The primary data storage infrastructure for Incaspin Casino operates from secure facilities located in the European Economic Area, specifically designed to serve the German market with latency-optimized connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For any such transfer, Incaspin Casino applies the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures utilised where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include complete encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who seek to grasp the geographical flow of their information.

4. Data Sharing and External Recipients

4.1 Internal Data Access Architecture

Inside the Incaspin Casino operational framework, personal data access adheres to a strict least-privilege model used for four distinct personnel tiers. Customer support agents retrieve basic account information and communication history but cannot view full financial records or identity documents. Compliance officers hold permissions to examine verification documents, transaction patterns, and risk scores. Financial department personnel handle withdrawal requests and view payment instrument details required to execute transfers. IT security staff access system logs and security event data but do not regularly interact with player-identifiable records. Every access event is logged with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is reviewed quarterly by the Data Protection Officer. German players can request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.

4.2 External Providers and Regulatory Bodies

Incaspin Casino engages specialist external processors including cloud hosting providers running ISO 27001-certified data centres within the European Economic Area, payment processors regulated by the German Federal Financial Supervisory Authority, identity verification services that match submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts require data processing solely on documented instructions from Incaspin Casino, with no right for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles govern all third-party data sharing arrangements:

• Processors receive only the minimum personal data needed to perform their contracted function, with field-level data minimisation implemented to every integration.
• Sub-processor engagements require prior written authorisation from Incaspin Casino, and any unlicensed subcontracting forms a material breach of the data processing agreement.
• All processors must maintain ISO 27001 certification or similar independently audited security credentials, with current records filed with Incaspin Casino before data flows begin.
• No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.

8. Rights of Germany-based Data Subjects

German users hold the entire range of data subject rights enumerated in Articles 15 through 21 of the GDPR, along with the entitlement to file a complaint with a supervisory authority. The right to access allows players to receive verification of whether Incaspin Casino processes their private data and to get a duplicate of that data together with details about processing aims, classes, addressees, retention periods, and the existence of automated decision-making. Access inquiries are completed within one month, without charge for the primary request, with the answer delivered in a ordered, generally used, machine-readable format. The right to rectification permits players to correct incorrect personal data or supplement partial files, a especially pertinent entitlement for identity document updates following name modifications or address relocations. Incaspin Casino processes rectification applications within ten business days and verifies amendments to any third-party addressees to whom the incorrect data was shared. The erasure right is applicable where the personal data is no more required for the purposes for which it was collected, where consent is withdrawn, where the player raises objection to processing and no dominant legitimate grounds are in place, or where processing is unlawful. However, statutory retention requirements take precedence over erasure inquiries, and data necessary for legal compliance will be limited from further processing rather than removed until the retention period lapses. The restriction right of processing serves as an substitute where the correctness of data is contested, processing is contrary to law but the player opposes deletion, or the player needs the data for legal demands despite the controller no longer requiring it. Data portability prerogatives under Article 20 GDPR extend only to data furnished by the player and handled by automated ways based on permission or agreement, meaning gameplay history and transaction logs are eligible for portability while fraud detection assessments coming from internal models do not. Rights requests should be directed to the Data Protection Officer email address, with legitimate proof of identity required before any data is shared.

2. Groups of Private Data Collected

Two Point One Identification Verification and Player Data

Players from Germany must provide particular individual data to set up and keep an living Incaspin Casino account. This category contains full official full name, physical address, DOB, place of birth, nationality, and sex. For identification verification reasons needed under Germany’s anti-money laundering laws, the casino obtains government-issued identity papers such as copy of passport, scans of national ID, and proof of residency. The program also logs the ID number, issuing body, validity end, and a biometrical comparison score created during the automated verification process. Home validation is done through latest utility bills, bank statements, or formal mail that plainly shows the member’s full name, registered address, and an issuing day inside the last three months. Incaspin Casino uses these verification requirements uniformly to conform with the Fourth and Fifth Anti-Money Laundering Orders as transposed into German law, making sure that every account fulfills the legal identity assurance level prior to any withdrawals are allowed.

Two Point Two Fiscal and Transaction Data

Transaction records encompasses all transaction records, including payment instrument data, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and digital wallet addresses where applicable. Incaspin Casino retains complete transaction histories showing timestamps, amounts in EUR or digital currency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players cross specific deposit thresholds or trigger enhanced due diligence procedures. This data is segregated in encrypted database tables with access confined to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino getting only the information necessary to credit the player account.

2.3 Technical and Behavioural Data

When German players access the Incaspin Casino platform, the system automatically collects technical data points including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data includes login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus enables the casino to provide optimised gaming experiences, spot fraudulent activity patterns, and uphold responsible gambling self-exclusion settings. Behavioural analytics monitor betting frequency, average stake sizes, session duration, and deposit velocity to inform the responsible gambling algorithms that generate personalised risk alerts. All technical logs are pseudonymised where possible and stored separately from core identity records, with re-identification possible only through a strictly regulated cryptographic lookup procedure reserved exclusively to the fraud and compliance teams under documented access justification.

3. Důvody a právní základy pro zpracování

Incaspin Casino provádí zpracování osobní data podle několika odlišných GDPR legal bases, zvolených v závislosti na dané činnosti zpracování. The performance of a contract ve smyslu Article 6(1)(b) GDPR zahrnuje all data processing necessary pro vytvoření a správu hráčského účtu, provádění vkladů a výběrů, a poskytování the interactive gaming services jež German players actively request během registrace. This zahrnuje zasílání platebních pokynů to acquiring banks a ověřování that players meet minimální věkový požadavek 18 let dle německé legislativy. Povinné zpracování under Article 6(1)(c) GDPR zahrnuje anti-money laundering customer due diligence, hlášení podezřelých transakcí příslušným finančním zpravodajským jednotkám, uchovávání záznamů to satisfy obchodně-právních a daňových požadavků, a dodržování s německými herními předpisy týkajících se standardů ochrany hráčů. The applicable legal frameworks zahrnují Geldwäschegesetz a předpisy of the Glücksspielstaatsvertrag where relevant k mandátům uchovávání údajů.

Legitimate interests prosazované Incaspin Casino under Article 6(1)(f) GDPR include network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted under Section 7 of the German Act Against Unfair Competition, and business analytics for service improvement. German players mají absolutní právo vznášet námitky proti zpracování založeném na oprávněných zájmech, včetně vytváření profilů pro účely přímého marketingu, a takové námitky will be honoured without undue delay. Souhlas under Article 6(1)(a) GDPR is relied upon for optional marketing communications prostřednictvím e-mailu a SMS pokud the player has actively opted in, for the placement of non-essential cookies and tracking technologies, a pro zpracování citlivých dat za specifických okolností. Mechanismy pro odvolání souhlasu jsou výrazně umístěny v nastavení účtu and every marketing communication footer, přičemž odvolání nabývá účinnosti bez zpětných důsledků pro dříve legální zpracování. German players kteří ještě nedosáhli věku 18 let are not permitted to open accounts, a jakákoli neúmyslně shromážděná data nezletilých jsou okamžitě po zjištění smazána.

Closing Thoughts

Incaspin Casino has arranged its data protection framework to satisfy the high standards demanded by German players and mandated by the GDPR and the BDSG-neu. From the first collection of identity and contact data through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage works under documented policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino maintains transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are urged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.