This Privacy Notice outlines how casino incaspin affiliate-partnerschaft collects, handles, stores, and secures personal data pertaining to players located in Germany. The document operates within the scope of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino serves as the data controller for personal information submitted through its website, mobile applications, and related services. German players possess specific statutory rights regarding their data, and this notice specifies the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards used to prevent unauthorised access. The document also explains the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been drafted to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, giving German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed during the entire customer lifecycle.
5: International Data Transfers
The primary data storage infrastructure for Incaspin Casino resides within secure facilities located in the European Economic Area, specifically configured to serve the German market with latency-optimised connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers beyond the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For any such transfer, Incaspin Casino enforces the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures utilised where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include complete encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who seek to grasp the geographical flow of their information.
9. Cookie Policy and Tracking Technologies
9.1 Core and Operational Cookies
The Incaspin Casino platform and mobile platform implement a set of cookies and similar tracking technologies to deliver core functionality. Strictly necessary cookies control session state across page loads, keep login authentication tokens, and preserve security context for CSRF protection. These first-party session cookies expire when the browser is closed and do not require prior consent under German law implementing the ePrivacy Directive, as they are necessary for the required service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players encounter a coherent personalised environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they expire automatically if the player has not returned to the platform. Incaspin Casino does not use flash cookies, supercookies, or any recreating techniques that circumvent browser deletion actions.
9.2 Metrics and Marketing Cookies
Analytics and marketing cookies are set only after German players provide explicit, freely given consent through the cookie consent management platform displayed on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers involved, the purposes of data collection, and the retention duration for each cookie type. Players may give or refuse consent for each category independently, and consent preferences are recorded as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service track aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies facilitate campaign attribution and frequency capping for promotional banners displayed within the logged-in casino environment. German players may modify their consent choices at any time by using the cookie settings panel referenced in the website footer. Rejecting analytics or marketing cookies does not impact gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to reconfirm or update their preferences.
1. Kontakt na správce údajů and Contact Details
The data controller pro všechny osobní údaje zpracovávané na platformě the Incaspin Casino platformy je právnická osoba působící pod obchodní značkou Incaspin Casino, zapsaná v jurisdikci recognised for přijetím standardů ochrany údajů odpovídajících EU. The registered office address and company registration number are available upon ověřenou žádost zasláním e-mailu the Data Protection Officer, nebo nahlédnutím do části s právními informacemi hlavních webových stránek. Němečtí hráči may direct jakékoli dotazy týkající se soukromí to jmenovanému pracovníkovi pro ochranu údajů, jenž pracuje samostatně a podává zprávy přímo nejvyššímu managementu. Pověřenec can be reached přes speciální šifrovanou e-mailovou adresu zveřejněnou v rámci the full privacy policy text. Incaspin Casino má právního zástupce within the European Union z důvodu článku 27 GDPR, ensuring that německé dozorové úřady and data subjects have a direct point of contact for regulatory matters. Správce determines cíle a způsoby of processing all personal data získaných při account registration, identifikačním procesu KYC, deposit and withdrawal transactions, a průběžné aktivitě při hraní. To zahrnuje data generated through souborů cookies, technologií pro identifikaci zařízení, and server logs. Hráči z Německa by si měli uvědomit, that the controller exercises full decision-making power nad operacemi zpracování údajů a zároveň zadává pečlivě prověřené zpracovatele k zajištění konkrétních technických služeb such as hosting, payment gateways, and CRM platforms. Each processor relationship se řídí a binding data processing agreement jež vyhovuje podmínkám článku 28 GDPR, s možností provádět povinné audity ze strany Incaspin Casino to verify ongoing compliance. The contact details zástupce v EU byly sděleny the competent German data protection authority jak vyžaduje zákon.
7. Information Security Controls
Incaspin Casino implements a tiered security architecture aligned with the ISO 27001 control framework and the technical requirements set forth in Article 32 of the GDPR. Network-level protections comprise enterprise-grade firewalls configured with stateful packet inspection, intrusion detection and prevention systems that analyze traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that neutralize volumetric attacks before they arrive at the application layer. All data transmitted between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, avoiding retrospective decryption of captured traffic even if long-term private keys are eventually leaked. Internal administrative interfaces are separated on a management network not accessible from the public internet, with access granted only through multi-factor authenticated VPN tunnels originating from pre-registered static IP addresses owned by authorised personnel. At the application layer, the platform enforces strong password policies demanding minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks until manual review by the security team. Database-level encryption secures data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each managed through a hardware security module that logs every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm validate the effectiveness of these controls, with critical findings remediated within 48 hours. Security incident response procedures are practiced through bi-annual tabletop exercises including the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline mandated by GDPR.
Two Categories of Individual Data Gathered
Two Point One Identification Confirmation and Account Data
German users must submit specific personal data to create and sustain an active Incaspin Casino account. This group includes full legal full name, physical address, DOB, birthplace, citizenship, and gender. For identity verification aims needed under German anti-money laundering rules, the casino gathers government-issued ID papers such as copy of passport, national identity card scans, and residence permit papers. The system also logs the document number, issuing body, expiration date, and a biometric comparison rating generated during the automatic confirmation process. Home confirmation is done through latest utility bills, bank statements, or formal mail that clearly presents the player’s name, recorded address, and an issue day within the previous three months. Incaspin Casino uses these verification requirements evenly to adhere with the Fourth and 5th Anti-Money Laundering Orders as incorporated into German law, guaranteeing that every account meets the legal identification certainty level prior to any withdrawals are authorized.
2.2 Fiscal and Transaction Data
Payment information encompasses all deposit and withdrawal records, including payment method identifiers, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino stores complete transaction histories showing timestamps, amounts in EUR or cryptocurrency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is isolated in encrypted database tables with access confined to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino obtaining only the information necessary to credit the player account.
2.3 Technical and Behavioral Records
While German players visit the Incaspin Casino platform, the system captures technical data points including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data covers login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus allows the casino to provide optimised gaming experiences, detect fraudulent activity patterns, and uphold responsible gambling self-exclusion settings. Behavioural analytics monitor betting frequency, average stake sizes, session duration, and deposit velocity to supply the responsible gambling algorithms that create personalised risk alerts. All technical logs are de-identified where possible and stored apart from core identity records, with re-identification possible only through a strictly regulated cryptographic lookup procedure reserved exclusively to the fraud and compliance teams under documented access justification.
8. Entitlements of Germany-based Data Subjects
German players possess the full suite of data subject prerogatives listed in Articles 15 through 21 of the GDPR, along with the option to submit a complaint with a supervisory authority. The right of access enables players to acquire assurance of if Incaspin Casino processes their personal data and to obtain a copy of that data along with information about processing objectives, types, addressees, holding periods, and the occurrence of automated decision-making. Access requests are completed within one month, at no cost for the primary request, with the answer provided in a ordered, commonly used, machine-readable format. The right to rectification enables players to rectify inaccurate personal data or supplement partial records, a particularly applicable right for identity document changes following name changes or address relocations. Incaspin Casino handles rectification inquiries within ten business days and acknowledges rectifications to any third-party addressees to whom the inaccurate data was revealed. The right to erasure is applicable where the personal data is no more required for the purposes for which it was collected, where consent is withdrawn, where the player raises objection to processing and no dominant legitimate grounds are present, or where processing is illegal. Nevertheless, statutory retention obligations take precedence over erasure inquiries, and data necessary for legal compliance will be confined from further processing rather than deleted until the retention period lapses. The right of limitation of processing functions as an option where the correctness of data is challenged, processing is unlawful but the player opposes deletion, or the player needs the data for legal assertions despite the controller no longer needing it. Data portability prerogatives under Article 20 GDPR are limited to data supplied by the player and handled by automated ways based on authorization or contract, meaning gameplay history and transaction logs are eligible for portability while fraud detection assessments coming from internal systems do not. Rights inquiries should be addressed to the Data Protection Officer email address, with legitimate proof of identity required before any data is released.
Closing Thoughts
Incaspin Casino has arranged its data protection system to meet the high standards anticipated by German players and stipulated by the GDPR and the BDSG-neu. From the initial collection of identity and contact details through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage functions under recorded policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino keeps transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are urged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.
6. Data Storage and Erasure Rules
Incaspin Casino runs a detailed data retention policy designed to satisfy statutory record-keeping duties while reducing the retention of personal data past its intended purpose. Player account data and entire transaction histories are retained for the entire length of the active business relationship, characterized as the period from account creation up to the account is deactivated, plus an extra statutory retention duration stipulated by German anti-money laundering laws and commercial law. Under the Geldwäschegesetz, identification records, transaction vouchers, and due diligence documentation must be kept for at least five years following the end of the calendar year in which the business relationship ended. Accounting records relevant to tax requirements are stored for ten years in conformity with the German Fiscal Code. Following the conclusion of these mandatory intervals, personal data is either permanently de-identified so that re-identification becomes unfeasible with all means reasonably expected to be applied, or securely removed through cryptographic erasure and physical storage media cleaning methods. Technical logs and security event data observe a shorter retention cycle of twelve months, after which they are compiled into anonymised statistical summaries. Inactive accounts demonstrating no login activity for a continuous period of 24 months are designated for dormancy assessment, and the related personal data is reduced to keep only the core ID and transaction records needed for the remaining statutory retention clock. The casino utilizes automated data lifecycle management scripts that execute weekly to locate records beyond their retention thresholds, starting deletion procedures without human involvement, with the results recorded for compliance audit purposes.
3. Důvody a právní základy pro zpracování
Incaspin Casino provádí zpracování osobních údajů na základě několika různých GDPR právních základů, zvolených according to the specific processing activity. Plnění smlouvy ve smyslu Article 6(1)(b) GDPR covers all data processing nezbytné k vytvoření a vedení the player account, process deposits and withdrawals, and deliver interaktivních herních služeb that German players actively request během registrace. This obsahuje předávání platebních instrukcí akvizičním bankám and verifying that players meet požadavek minimálního věku of 18 years dle německé legislativy. Povinné zpracování podle Article 6(1)(c) GDPR pokrývá anti-money laundering customer due diligence, oznamování podezřelých obchodů to relevant Financial Intelligence Units, record retention to satisfy commercial and tax law requirements, and compliance s německými herními předpisy ohledně norem ochrany hráčů. The applicable legal frameworks include zákon o praní špinavých peněz and the stipulations státní smlouvy o hazardu kde je to relevantní k mandátům uchovávání údajů.
Oprávněné zájmy prosazované Incaspin Casino podle Article 6(1)(f) GDPR zahrnují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers tam, kde je to dovoleno under Section 7 of the German Act Against Unfair Competition, a obchodní analýzy za účelem zlepšení služeb. German players mají absolutní právo odmítnout zpracování založeném na oprávněných zájmech, včetně profilování k přímým marketingovým účelům, and such objections budou ctěny bez zbytečné prodlevy. Povolení dle Article 6(1)(a) GDPR je využíván pro volitelné marketingové komunikace via email and SMS kde the player has actively opted in, pro umístění nepodstatných cookies a sledovacích technologií, a pro zpracování citlivých dat v konkrétních případech. Mechanismy pro odvolání souhlasu jsou nápadně umístěny v rámci nastavení účtu a v zápatí každé marketingové komunikace, s tím, že odvolání má účinek bez retroaktivních následků pro dříve legální zpracování. German players kteří ještě nedosáhli osmácti let are not permitted to open accounts, a jakákoli neúmyslně shromážděná data nezletilých jsou okamžitě po zjištění smazána.
4. Data Sharing and Third-Party Recipients
4.1 Internal Data Access Structure
In the Incaspin Casino operational system, personal data access adheres to a strict least-privilege model applied across four distinct personnel tiers. Customer support agents retrieve basic account information and communication history but are unable to view full financial records or identity documents. Compliance officers hold permissions to review verification documents, transaction patterns, and risk scores. Financial department personnel handle withdrawal requests and view payment instrument details necessary to execute transfers. IT security staff monitor system logs and security event data but do not routinely interact with player-identifiable records. Every access event is logged with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is examined quarterly by the Data Protection Officer. German players may request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Service Providers and Authorities
Incaspin Casino engages specialist external processors such as cloud hosting providers operating ISO 27001-certified data centres inside the European Economic Area, payment processors authorised by the German Federal Financial Supervisory Authority, identity verification services that match submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment encompassing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts mandate data processing solely on documented instructions from Incaspin Casino, with no right for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators happen only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles control all third-party data sharing arrangements:
- Processors obtain only the minimum personal data necessary to execute their contracted function, with field-level data minimisation implemented to every integration.
- Sub-processor engagements demand prior written consent from Incaspin Casino, and any unauthorised subcontracting forms a material breach of the data processing agreement.
- All processors must hold ISO 27001 certification or similar independently audited security standards, with current records filed with Incaspin Casino before data flows commence.
- No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business focuses on monetising personal information.