By 
This Privacy Notice describes how Incaspin Casino collects, manages, retains, and safeguards personal data pertaining to players located in Germany. The document functions within the framework of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino serves as the data controller for personal information submitted through its website, mobile applications, and related services. German players have specific statutory rights concerning their data, and this notice details the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards used to prevent unauthorised access. The document also describes the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been drafted to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, offering German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed across the entire customer lifecycle.
Kapitola 1. Data Controller Identity and Contact Details
The data controller za veškeré osobní údaje zpracovávané prostřednictvím the Incaspin Casino platform is právnická osoba působící pod the brand name Incaspin Casino, registered in a jurisdiction uznávané pro its adherence to standardů ekvivalentních ochraně údajů EU. The registered office address a identifikační číslo společnosti jsou k dispozici na žádost s ověřením totožnosti e-mailem na adresu pověřenci pro ochranu osobních údajů, případně v the imprint section hlavních webových stránek. Hráči z Německa may direct jakékoli dotazy týkající se soukromí k the designated Data Protection Officer, who operates independently a je přímo podřízen nejvyššímu managementu. Pověřenec je k zastižení prostřednictvím vyhrazeného šifrovaného e-mailového kanálu zveřejněnou v rámci the full privacy policy text. Incaspin Casino udržuje a legal representative v Evropské unii z důvodu ustanovení čl. 27 GDPR, ensuring that německé dozorové úřady i dotčené osoby disponují přímým kontaktem ohledně regulačních otázek. Tento subjekt determines cíle a způsoby zpracovávání all personal data získaných při account registration, identifikačním procesu KYC, transakcích vkladů a výběrů, a průběžné aktivitě při hraní. This includes informace generované pomocí cookies, technologií otisku zařízení, a serverových logů. German players should note, that the controller exercises absolutní moc nad rozhodováním ohledně činností zpracování dat přičemž pověřuje pečlivě prověřené zpracovatele for specific technical services jako je hosting, platební brány, a platformy pro řízení vztahů se zákazníky. Každá smluvní dohoda se zpracovatelem is governed by právně závaznou dohodou o zpracování dat která splňuje požadavky článku 28 GDPR, with mandatory audit rights reserved ze strany Incaspin Casino pro ověření průběžného souladu. Kontaktní údaje of the EU representative byly sděleny kompetentnímu německému dozorovému orgánu pro ochranu dat as required by law.
Six. Information Storage and Removal Guidelines
Incaspin Casino runs a precise data retention schedule designed to satisfy statutory record-keeping obligations while reducing the storage of personal data past its useful purpose incaspincasino.de.com. Player account data and full transaction records are kept for the full duration of the ongoing business relationship, described as the term from account creation up to the account is terminated, plus an additional statutory retention duration stipulated by German anti-money laundering laws and commercial law. Under the Geldwäschegesetz, identification documents, transaction vouchers, and due diligence materials must be maintained for at least five years following the end of the calendar year in which the business relationship ended. Accounting records applicable to tax requirements are retained for ten years in compliance with the German Fiscal Code. Following the conclusion of these mandatory intervals, personal data is either irreversibly anonymised so that re-identification becomes unfeasible with all means reasonably likely to be employed, or securely erased through cryptographic erasure and physical storage media sanitisation processes. Technical logs and security event data follow a shorter retention interval of twelve months, after which they are combined into anonymised statistical reports. Inactive accounts exhibiting no login activity for a consecutive period of 24 months are marked for dormancy review, and the associated personal data is limited to store only the core ID and transaction records needed for the remaining statutory retention clock. The casino uses automated data lifecycle management processes that run weekly to locate records over their retention deadlines, starting deletion workflows without human input, with the results logged for compliance audit objectives.
7. Security of Data Measures
Incaspin Casino utilizes a multilevel security architecture in accordance with the ISO 27001 control framework and the technical requirements set forth in Article 32 of the GDPR. Network-level protections encompass enterprise-grade firewalls set up with stateful packet inspection, intrusion detection and prevention systems that monitor traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that absorb volumetric attacks before they reach the application layer. All data sent between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, blocking retrospective decryption of captured traffic even if long-term private keys are later compromised. Internal administrative interfaces are segmented on a management network unreachable from the public internet, with access permitted exclusively through multi-factor authenticated VPN tunnels originating from pre-registered static IP addresses owned by authorised personnel. At the application layer, the platform mandates strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks awaiting manual review by the security team. Database-level encryption protects data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each controlled through a hardware security module that records every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm confirm the effectiveness of these controls, with critical findings remediated within 48 hours. Security incident response procedures are evaluated through bi-annual tabletop exercises engaging the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline required by GDPR.
4. Data Sharing and External Recipients
4.1 Internal Data Access Architecture
Inside the Incaspin Casino operational framework, personal data access adheres to a strict least-privilege model applied across four distinct personnel tiers. Customer support agents view basic account information and communication history but cannot view full financial records or identity documents. Compliance officers have permissions to review verification documents, transaction patterns, and risk scores. Financial department personnel process withdrawal requests and view payment instrument details necessary to execute transfers. IT security staff monitor system logs and security event data but do not regularly interact with player-identifiable records. Every access event is logged with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is examined quarterly by the Data Protection Officer. German players may request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Providers and Regulatory Bodies
Incaspin Casino engages specialist external processors including cloud hosting providers operating ISO 27001-certified data centres within the European Economic Area, payment processors licensed by the German Federal Financial Supervisory Authority, identity verification services that match submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor passes through a rigorous vendor assessment covering technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts require data processing solely on documented instructions from Incaspin Casino, with no right for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators happen only when legally mandated, and unless prohibited by law, the casino will inform affected players of such disclosures. The following key principles regulate all third-party data sharing arrangements:
- Processors receive only the least personal data required to perform their contracted function, with field-level data minimisation applied to every integration.
- Sub-processor engagements demand prior written approval from Incaspin Casino, and any unapproved subcontracting constitutes a material breach of the data processing agreement.
- All processors must have ISO 27001 certification or comparable independently audited security credentials, with current certificates filed with Incaspin Casino before data flows start.
- No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business centers on monetising personal information.
8. Rights of Germany-based Data Subjects
German gamblers possess the full suite of data subject rights enumerated in Articles 15 through 21 of the GDPR, together with the right to file a appeal with a supervisory authority. The right to access enables players to acquire confirmation of as to whether Incaspin Casino processes their personal data and to obtain a duplicate of that data along with details about processing purposes, classes, recipients, retention durations, and the presence of automated decision-making. Access inquiries are processed within one month, free of charge for the primary request, with the response provided in a ordered, commonly used, machine-readable structure. The right of correction allows players to amend wrong personal data or supplement partial documents, a particularly relevant entitlement for identity document changes following name changes or address relocations. Incaspin Casino deals with rectification inquiries within ten business days and acknowledges corrections to any third-party recipients to whom the incorrect data was disclosed. The right to erasure holds true where the personal data is no more needed for the objectives for which it was gathered, where authorization is withdrawn, where the player objects to processing and no dominant legitimate grounds are present, or where processing is not permitted. However, statutory retention duties supersede erasure inquiries, and data required for legal compliance will be restricted from further processing rather than erased until the retention period lapses. The right to restriction of processing serves as an substitute where the correctness of data is challenged, processing is illegal but the player objects to deletion, or the player requires the data for legal demands despite the controller no longer requiring it. Data portability rights under Article 20 GDPR apply solely to data furnished by the player and processed by automated methods based on permission or agreement, meaning gameplay history and transaction logs are suitable for portability while fraud detection ratings obtained from internal systems do not. Rights requests should be directed to the Data Protection Officer email address, with proper proof of identity necessary before any data is disclosed.
2. Classes of Individual Data Obtained
2.1 Identification Verification and Player Data
German players must provide specific private data to set up and keep an active Incaspin Casino account. This class covers full statutory full name, residential location, DOB, place of birth, citizenship, and sex. For identity verification aims mandatory under German anti-money laundering rules, the casino collects government-issued identity papers such as passport scans, national identity card scans, and proof of residency. The platform also logs the document number, issuing body, validity end, and a biometric comparison score produced during the automated validation process. Residential validation is done through latest utility bills, bank statements, or authorized correspondence that plainly shows the player’s name, registered address, and an issue date within the previous three months. Incaspin Casino applies these validation conditions consistently to comply with the Fourth and Fifth Anti-Money Laundering Directives as transposed into Germany’s law, guaranteeing that every account satisfies the statutory identity assurance level before any withdrawals are allowed.
2.2 Financial and Deal Data
Transaction records encompasses all deposit records, including payment method identifiers, masked card numbers, e-wallet account email addresses, bank account IBAN details for SEPA transfers, and crypto wallet addresses where estv.admin.ch applicable. Incaspin Casino stores complete transaction histories showing timestamps, amounts in EUR or digital currency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is separated in encrypted database tables with access confined to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino obtaining only the information necessary to credit the player account.
2.3 Technical and Behavioral Records
While German players visit the Incaspin Casino platform, the system gathers technical data points including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data encompasses login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus allows the casino to offer optimised gaming experiences, identify fraudulent activity patterns, and uphold responsible gambling self-exclusion settings. Behavioural analytics monitor betting frequency, average stake sizes, session duration, and deposit velocity to supply the responsible gambling algorithms that generate personalised risk alerts. All technical logs are anonymised where possible and stored separately from core identity records, with re-identification possible only through a tightly controlled cryptographic lookup procedure available exclusively to the fraud and compliance teams under documented access justification.
3. Důvody a právní základy pro zpracování
Incaspin Casino processes osobních údajů under several distinct GDPR právních základů, zvolených according to dané činnosti zpracování. Plnění smlouvy pursuant to Article 6(1)(b) GDPR covers veškeré zpracování údajů necessary to create and manage the player account, provádění vkladů a výběrů, a poskytování the interactive gaming services jež German players aktivně požadují při registraci. This obsahuje předávání platebních instrukcí akvizičním bankám a kontrolu toho, že players meet the minimum age requirement osmácti let podle německého práva. Povinné zpracování podle Article 6(1)(c) GDPR zahrnuje anti-money laundering customer due diligence, suspicious transaction reporting příslušným finančním zpravodajským jednotkám, retence záznamů pro splnění commercial and tax law requirements, and compliance with German gambling regulations concerning player protection standards. Použitelné právní rámce include the Geldwäschegesetz a předpisy státní smlouvy o hazardu pokud je to relevantní pro povinnosti uchovávání dat.
Legitimní zájmy sledované Incaspin Casino dle Article 6(1)(f) GDPR zahrnují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted podle Section 7 of the German Act Against Unfair Competition, a obchodní analýzy pro zlepšení služeb. German players zachovávají si the absolute right to object to processing based on legitimate interests, včetně vytváření profilů k přímým marketingovým účelům, a tyto námitky will be honoured bez zbytečné prodlevy. Povolení podle Article 6(1)(a) GDPR is relied upon pro volitelné marketingové komunikace e-mailem a SMS pokud hráč aktivně souhlasil, for the placement of non-essential cookies and tracking technologies, a pro zpracování citlivých údajů v konkrétních případech. Consent withdrawal mechanisms jsou výrazně umístěny v nastavení účtu a v zápatí každé marketingové komunikace, s tím, že odvolání má účinek without retroactive consequences for previously lawful processing. German players who have not yet reached osmácti let nemají povoleno otevírat účty, and any inadvertently collected minor data jsou okamžitě po zjištění smazána.
Číslo 5: International Data Transfers
The core data storage infrastructure for Incaspin Casino resides within secure facilities located in the European Economic Area, specifically configured to serve the German market with latency-optimised connectivity while maintaining full GDPR jurisdictional coverage. Specific specialised processing activities may involve international data transfers beyond the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino implements the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures applied where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include end-to-end encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who seek to grasp the geographical flow of their information.
9. Cookie Policy and Tracking Technologies
9.1 Essential and Functional Cookies
The Incaspin Casino platform and mobile platform utilize a variety of cookies and similar tracking technologies to deliver core functionality. Strictly necessary cookies manage session state across page loads, maintain login authentication tokens, and uphold security context for CSRF protection. These first-party session cookies terminate when the browser is closed and do not require prior consent under German law transposing the ePrivacy Directive, as they are indispensable for the desired service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players encounter a coherent customized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they are deleted automatically if the player has not accessed the platform. Incaspin Casino does not use flash cookies, supercookies, or any regenerating techniques that bypass browser deletion actions.
9.2 Analytics and Marketing Cookies
Analytics and marketing cookies are set only after German players grant explicit, freely given consent through the cookie consent management platform presented on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers engaged, the purposes of data collection, and the retention duration for each cookie type. Players may grant or refuse consent for each category independently, rp-online.de and consent preferences are stored as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service monitor aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies support campaign attribution and frequency capping for promotional banners displayed within the logged-in casino environment. German players may modify their consent choices at any time by accessing the cookie settings panel located in the website footer. Rejecting analytics or marketing cookies does not impact gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to update or update their preferences.
Conclusion
Incaspin Casino has arranged its data protection system to satisfy the high standards demanded by German players and required by the GDPR and the BDSG-neu. From the initial collection of identity and contact data through to the ultimate deletion or anonymisation of records years after account closure, every personal data life cycle stage works under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino keeps transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are urged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.