This Privacy Notice describes how Incaspin Casino gathers, handles, keeps, and protects personal data belonging to players located in Germany incaspincasino.de.com. The document functions within the scope of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino serves as the data controller for personal information submitted through its website, mobile applications, and related services. German players enjoy specific statutory rights relating to their data, and this notice specifies the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards used to prevent unauthorised access. The document also explains the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section is prepared to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, offering German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed during the entire customer lifecycle.

Kapitola 1. Kontakt na správce údajů a podrobnosti o kontaktu

Osobou odpovědnou za zpracování údajů pro všechny osobní údaje processed through the Incaspin Casino webové stránky is subjekt operating under obchodní značkou Incaspin Casino, zapsaná v a jurisdiction uznávané pro přijetím standardů ekvivalentních ochraně údajů EU. Sídlo společnosti a identifikační číslo společnosti are available upon žádost s ověřením totožnosti e-mailem na adresu pověřenci pro ochranu osobních údajů, nebo nahlédnutím do části s právními informacemi of the main website. Hráči z Německa mohou směřovat any privacy-related inquiries k určenému pověřenci pro ochranu osobních údajů, který působí nezávisle a podává zprávy přímo vrcholovému vedení. Tento pracovník je k zastižení prostřednictvím a dedicated encrypted email channel zveřejněnou v rámci the full privacy policy text. Incaspin Casino má oprávněného zástupce v Evropské unii for purposes of článku 27 GDPR, čímž zajišťuje, že German supervisory authorities a subjekty údajů mají přímé kontaktní místo for regulatory matters. Tento subjekt determines účely a prostředky zpracovávání všech osobních údajů shromážděných během account registration, identifikačním procesu KYC, deposit and withdrawal transactions, a průběžné aktivitě při hraní. To zahrnuje údaje vytvářené prostřednictvím souborů cookies, technologií pro identifikaci zařízení, and server logs. German players should note, že tento subjekt uplatňuje plnou rozhodovací pravomoc over data processing operations a zároveň zadává carefully vetted processors for specific technical services např. hosting, platební brány, a CRM platformy. Každá smluvní dohoda se zpracovatelem se řídí právně závaznou dohodou o zpracování dat that meets the requirements of Article 28 GDPR, s možností provádět povinné audity pro Incaspin Casino to verify ongoing compliance. The contact details of the EU representative are provided to příslušnému německému úřadu pro ochranu osobních údajů as required by law.

8. Rights of Germany-based Data Subjects

German gamblers possess the entire range of data subject entitlements specified in Articles 15 through 21 of the GDPR, together with the right to file a grievance with a supervisory authority. The access right enables players to acquire verification of as to whether Incaspin Casino processes their personal data and to get a copy of that data along with details about processing aims, categories, recipients, holding durations, and the occurrence of automated decision-making. Access inquiries are fulfilled within one month, at no cost for the initial request, with the answer delivered in a structured, commonly used, machine-readable layout. The right of correction enables players to amend wrong personal data or supplement missing documents, a particularly relevant right for identity document changes following name modifications or address transfers. Incaspin Casino handles rectification inquiries within ten business days and acknowledges amendments to any third-party recipients to whom the wrong data was revealed. The right to erasure holds true where the personal data is not anymore required for the purposes for which it was collected, where permission is revoked, where the player raises objection to processing and no dominant legitimate grounds are present, or where processing is illegal. However, statutory retention obligations override erasure inquiries, and data needed for legal compliance will be limited from further processing rather than deleted until the retention period expires. The restriction right of processing acts as an alternative where the correctness of data is challenged, processing is contrary to law but the player is against deletion, or the player needs the data for legal claims despite the controller no longer requiring it. Data portability entitlements under Article 20 GDPR extend only to data provided by the player and processed by automated means based on consent or agreement, meaning gameplay history and transaction logs are eligible for portability while fraud detection ratings derived from internal algorithms do not. Rights inquiries should be directed to the Data Protection Officer email address, with legitimate proof of identity required before any data is shared.

9. Cookie Policy and Tracking Technologies

9.1 Necessary and Functional Cookies

The Incaspin Casino website and mobile platform deploy a range of cookies and similar tracking technologies to ensure core functionality. Strictly necessary cookies control session state across page loads, maintain login authentication tokens, and uphold security context for CSRF protection. These first-party session cookies expire when the browser is closed and do not require prior consent under German law transposing the ePrivacy Directive, as they are necessary for the required service delivery. Functional cookies save language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players find a consistent personalised environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they expire automatically if the player has not accessed the platform. Incaspin Casino does not use flash cookies, supercookies, or any recreating techniques that circumvent browser deletion actions.

9.2 Analysis and Marketing Cookies

Analytics and marketing cookies are set only after German players provide explicit, freely given consent through the cookie consent management platform presented on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers engaged, the purposes of data collection, and the retention duration for each cookie type. Players may allow or deny consent for each category independently, and consent preferences are recorded as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service monitor aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies facilitate campaign attribution and frequency capping for promotional banners displayed within the logged-in casino environment. German players may change their consent choices at any time by visiting the cookie settings panel linked in the website footer. Refusing analytics or marketing cookies does not affect gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to reconfirm or update their preferences.

Pátý bod: International Data Transfers

The primary data storage infrastructure for Incaspin Casino operates from secure facilities located in the European Economic Area, specifically configured to serve the German market with low-latency connectivity while maintaining full GDPR jurisdictional coverage. Some specialised processing activities may involve international data transfers beyond the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino enforces the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures utilised where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include full encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who seek to grasp the geographical flow of their information.

3. Důvody a právní základy pro zpracování

Incaspin Casino zpracovává osobních údajů podle několika odlišných GDPR legal bases, vybraných according to konkrétní zpracovatelské činnosti. The performance of a contract podle Article 6(1)(b) GDPR pokrývá všechna zpracování dat potřebné k vytvoření a vedení hráčského účtu, provádění vkladů a výběrů, and deliver interaktivních herních služeb jež German players aktivně vyžadují during registration. This zahrnuje transmitting payment instructions zúčtovacím bankám a ověřování že players dosahují the minimum age requirement 18 let podle německého práva. Legal obligation processing under Article 6(1)(c) GDPR pokrývá anti-money laundering customer due diligence, suspicious transaction reporting příslušným finančním zpravodajským jednotkám, record retention pro splnění obchodně-právních a daňových požadavků, a dodržování s německou regulací hazardu týkajících se standardů ochrany hráčů. Relevantní právní rámce obsahují Geldwäschegesetz a ustanovení státní smlouvy o hazardu kde je to relevantní k mandátům uchovávání údajů.

Oprávněné zájmy prosazované Incaspin Casino podle Article 6(1)(f) GDPR obsahují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted podle Section 7 of the German Act Against Unfair Competition, a obchodní analýzy pro zlepšení služeb. German players retain nezpochybnitelné právo vznášet námitky proti zpracování založeném na oprávněných zájmech, včetně vytváření profilů pro účely přímého marketingu, and such objections budou ctěny bez zbytečné prodlevy. Souhlas under Article 6(1)(a) GDPR je spoléháno pro nepovinná marketingová sdělení prostřednictvím e-mailu a SMS kde hráč se aktivně přihlásil, pro nasazení neesenciálních cookies a sledovacích technologií, a pro zpracování citlivých údajů in specific circumstances. Způsoby zrušení souhlasu jsou výrazně umístěny v nastavení účtu a v patičce každého marketingového sdělení, with withdrawal taking effect without retroactive consequences pro dříve legální zpracování. German players who have not yet reached věku 18 let nesmějí otevírat účty, and any inadvertently collected minor data jsou okamžitě po zjištění smazána.

4. Data Sharing and External Recipients

4.1 In-House Data Access Model

Inside the Incaspin Casino operational framework, personal data access follows a strict least-privilege model applied across four distinct personnel tiers. Customer support agents retrieve basic account information and communication history but cannot view full financial records or identity documents. Compliance officers possess permissions to review verification documents, transaction patterns, and risk scores. Financial department personnel process withdrawal requests and view payment instrument details needed to execute transfers. IT security staff monitor system logs and security event data but do not typically interact with player-identifiable records. Every access event is recorded with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is reviewed quarterly by the Data Protection Officer. German players may request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.

4.2 Third-Party Services and Authorities

Incaspin Casino engages specialist external processors such as cloud hosting providers operating ISO 27001-certified data centres within the European Economic Area, payment processors regulated by the German Federal Financial Supervisory Authority, identity verification services that compare submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor passes through a rigorous vendor assessment encompassing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts require data processing solely on documented instructions from Incaspin Casino, with no entitlement for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators happen only when legally mandated, and unless prohibited by law, the casino will inform affected players of such disclosures. The following key principles regulate all third-party data sharing arrangements:

• Processors obtain only the minimal personal data necessary to execute their contracted function, with field-level data minimisation enforced to every integration.
• Sub-processor engagements require prior written consent from Incaspin Casino, and any unauthorised subcontracting represents a material breach of the data processing agreement.
• All processors must maintain ISO 27001 certification or comparable independently audited security standards, with current certificates filed with Incaspin Casino before data flows commence.
• No personal data is transferred to advertising technology platforms, data brokers, or any entity whose primary business focuses on monetising personal information.

Number 6. Information Storage and Removal Rules

Incaspin Casino implements a granular data retention schedule designed to meet statutory record-keeping requirements while limiting the keeping of personal data after its useful purpose. Player account data and full transaction logs are retained for the full duration of the ongoing business relationship, defined as the term from account creation until the account is terminated, plus an supplementary statutory retention period stipulated by German anti-money laundering legislation and commercial law. Under the Geldwäschegesetz, identification records, transaction receipts, and due diligence documentation must be kept for at least five years from the end of the calendar year in which the business relationship concluded. Accounting records relevant to tax obligations are retained for ten years in compliance with the German Fiscal Code. Following the conclusion of these mandatory intervals, personal data is either irrevocably de-identified so that re-identification becomes impossible with all means reasonably likely to be used, or safely deleted through cryptographic erasure and physical storage media cleaning procedures. Technical logs and security event data follow a briefer retention interval of twelve months, after which they are compiled into anonymised statistical summaries. Inactive accounts showing no login activity for a consecutive period of 24 months are marked for dormancy assessment, and the associated personal data is minimised to retain only the core name and transaction records needed for the remaining statutory retention timeline. The casino deploys automated data lifecycle management processes that execute weekly to find records over their retention limits, triggering deletion processes without human input, with the results logged for compliance audit purposes.

7. Data Security Measures

Incaspin Casino deploys a multilevel security architecture conforming to the ISO 27001 control framework and the technical requirements set forth in Article 32 of the GDPR. Network-level protections encompass enterprise-grade firewalls set up with stateful packet inspection, intrusion detection and prevention systems that monitor traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that neutralize volumetric attacks before they hit the application layer. All data transferred between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, preventing retrospective decryption of captured traffic even if long-term private keys are subsequently exposed. Internal administrative interfaces are segmented on a management network inaccessible from the public internet, with access permitted exclusively through multi-factor authenticated VPN tunnels originating from pre-registered static IP addresses owned by authorised personnel. At the application layer, the platform imposes strong password policies requiring minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies initiate step-up authentication challenges or temporary account locks until manual review by the security team. Database-level encryption protects data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each managed through a hardware security module that records every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm verify the effectiveness of these controls, with critical findings resolved within 48 hours. Security incident response procedures are evaluated through bi-annual tabletop exercises including the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.

Two Classes of Individual Data Obtained

2.1 Identification Confirmation and Player Data

German players must provide certain personal data to set up and maintain an living Incaspin Casino account. This category includes entire legal name, home location, birth date, birthplace, nationality, and sex. For identification validation purposes mandatory under Germany’s anti-money laundering regulations, the casino collects government-issued identification documents such as copy of passport, national identity card scans, and residence permit documentation. The platform also logs the document number, issuing body, expiration date, and a biometrical comparison score generated during the automated confirmation process. Address confirmation is done through latest utility bills, bank statements, or formal communication that evidently displays the member’s name, registered location, and an issuing day inside the past three months. Incaspin Casino applies these validation prerequisites uniformly to adhere with the 4th and 5th Anti-Money Laundering Directives as implemented into German law, ensuring that every account satisfies the legal identification confidence level before any withdrawals are allowed.

Two Point Two Fiscal and Deal Data

Transaction records encompasses all deposit records, including payment instrument data, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and crypto wallet addresses where applicable. Incaspin Casino keeps complete transaction histories showing timestamps, amounts in EUR or cryptocurrency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is segregated in encrypted database tables with access confined to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino obtaining only the information necessary to credit the player account.

2.3 Behavioral and Technical Information

When German players visit the Incaspin Casino platform, the system gathers technical markers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data encompasses login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus permits the casino to provide optimised gaming experiences, identify fraudulent activity patterns, and honour responsible gambling self-exclusion settings. Behavioural analytics monitor betting frequency, average stake sizes, session duration, and deposit velocity to feed the responsible gambling algorithms that generate personalised risk alerts. All technical logs are pseudonymised where possible and stored apart from core identity records, with re-identification possible only through a strictly regulated cryptographic lookup procedure accessible exclusively to the fraud and compliance teams under documented access justification.

Conclusion

Incaspin Casino has structured its data protection structure to satisfy the high standards anticipated by German players and mandated by the GDPR and the BDSG-neu. From the first collection of identity and contact information through to the final deletion or anonymisation of records years after account closure, every personal data life cycle stage works under documented policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino maintains transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are encouraged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.