This Privacy Notice explains how incaspincasino affiliate partnerschaft collects, processes, retains, and secures personal data pertaining to players located in Germany. The document functions within the framework of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino acts as the data controller for personal information furnished through its website, mobile applications, and related services. German players possess specific statutory rights regarding their data, and this notice outlines the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards deployed to prevent unauthorised access. The document also explains the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section is prepared to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, giving German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed across the entire customer lifecycle.
9. Cookie Policy and Tracking Technologies
9.1 Necessary and Functional Cookies
The Incaspin Casino website and mobile platform utilize a range of cookies and similar tracking technologies to provide core functionality. Strictly necessary cookies handle session state across page loads, preserve login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies expire when the browser is closed and do not require prior consent under German law implementing the ePrivacy Directive, as they are essential for the requested service delivery. Functional cookies store language preferences, preferred currency displays, and responsible gambling limit settings across visits, guaranteeing that returning players encounter a consistent personalised environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they become invalid automatically if the player has not accessed the platform. Incaspin Casino does not use flash cookies, supercookies, or any regenerating techniques that bypass browser deletion actions.
9.2 Metrics and Marketing Cookies
Analytics and marketing cookies are set only after German players grant explicit, freely given consent through the cookie consent management platform shown on first visit. The consent tool presents clear descriptions of each cookie category, the specific providers involved, the purposes of data collection, and the retention duration for each cookie type. Players may grant or refuse consent for each category independently, and consent preferences are logged as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service measure aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies enable campaign attribution and frequency capping for promotional banners shown within the logged-in casino environment. German players may change their consent choices at any time by visiting the cookie settings panel located in the website footer. Declining analytics or marketing cookies does not influence gameplay functionality or account standing in any manner. The consent tool solicits players annually to reaffirm or update their preferences.
Two Categories of Individual Data Gathered
2.1 Identity Validation and Account Data
German players must provide certain individual data to create and sustain an current Incaspin Casino account. This class includes complete legal name, home address, date of birth, birthplace, citizenship, and gender. For identity confirmation purposes mandatory under Germany’s anti-money laundering laws, the casino collects government-issued identity documents such as passport copies, national ID copies, and residence permit papers. The program also records the document number, issuing body, expiration date, and a biometrical comparison result created during the automated verification process. Address confirmation is completed through latest utility bills, bank statements, or formal communication that clearly displays the user’s name, on-file location, and an issuing day within the previous three months. Incaspin Casino applies these validation conditions evenly to comply with the Fourth and Fifth Anti-Money Laundering Directives as implemented into German law, making sure that each account meets the legal identity assurance level prior to any withdrawals are allowed.
Two Point Two Monetary and Payment Data
Financial data encompasses all transaction records, including payment instrument data, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and digital wallet addresses where applicable. Incaspin Casino retains complete transaction histories showing timestamps, amounts in EUR or equivalent cryptocurrency, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is segregated in encrypted database tables with access confined to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino getting only the information necessary to credit the player account.
2.3 Technical and Behavioural Data
While German players visit the Incaspin Casino platform, the system gathers technical identifiers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data encompasses login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus enables the casino to provide optimised gaming experiences, detect fraudulent activity patterns, and uphold responsible gambling self-exclusion settings. Behavioural analytics track betting frequency, average stake sizes, session duration, and deposit velocity to supply the responsible gambling algorithms that create personalised risk alerts. All technical logs are de-identified where possible and stored apart from core identity records, with re-identification possible only through a strictly regulated cryptographic lookup procedure accessible exclusively to the fraud and compliance teams under documented access justification.
7. Information Security Safeguards
Incaspin Casino utilizes a tiered security architecture conforming to the ISO 27001 control framework and the technical requirements articulated in Article 32 of the GDPR. Network-level protections encompass enterprise-grade firewalls configured with stateful packet inspection, intrusion detection and prevention systems that analyze traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that absorb volumetric attacks before they arrive at the application layer. All data sent between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, preventing retrospective decryption of captured traffic even if long-term private keys are later compromised. Internal administrative interfaces are isolated on a management network not accessible from the public internet, with access granted only through multi-factor authenticated VPN tunnels starting from pre-registered static IP addresses belonging to authorised personnel. At the application layer, the platform mandates strong password policies demanding minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies initiate step-up authentication challenges or temporary account locks until manual review by the security team. Database-level encryption protects data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each controlled through a hardware security module that records every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm confirm the effectiveness of these controls, with critical findings resolved within 48 hours. Security incident response procedures are tested through bi-annual tabletop exercises including the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.
1. Identita správce údajů a kontaktní údaje
The data controller for all personal data zpracovávané prostřednictvím the Incaspin Casino platform is the legal entity operating under názvem značky Incaspin Casino, registrovaná v a jurisdiction uznávané pro its adherence to standardů ekvivalentních ochraně údajů EU. Adresa sídla a registrační číslo are available upon ověřenou žádost e-mailem na adresu pověřenci pro ochranu osobních údajů, nebo nahlédnutím do sekce otisku of the main website. German players mohou adresovat veškeré dotazy ohledně ochrany soukromí to the designated Data Protection Officer, který působí nezávisle and reports directly to vrcholovému vedení. The DPO může být kontaktován via a dedicated encrypted email channel uvedenou v kompletního textu politiky ochrany osobních údajů. Incaspin Casino udržuje oprávněného zástupce within the European Union for purposes of článku 27 GDPR, aby bylo zaručeno, že German supervisory authorities i dotčené osoby mají přímé kontaktní místo for regulatory matters. The controller určuje cíle a způsoby zpracování all personal data shromážděných během vytváření účtu, ověřování Know Your Customer, deposit and withdrawal transactions, and ongoing gameplay activity. To zahrnuje data generated through souborů cookies, technologií pro identifikaci zařízení, and server logs. Němečtí hráči by měli vzít na vědomí, že tento subjekt uplatňuje full decision-making power nad operacemi zpracování údajů while commissioning důkladně vybrané zpracovatele k zajištění konkrétních technických služeb např. hosting, platební brány, and CRM platforms. Each processor relationship se řídí a binding data processing agreement that meets the requirements of Article 28 GDPR, s vyhrazenými povinnými právy na audit pro Incaspin Casino to verify ongoing compliance. Podrobné kontakty zástupce v EU byly sděleny the competent German data protection authority jak vyžaduje zákon.
4. Data Sharing and Third-Party Recipients
4.1 Internal Data Access Structure
Within the Incaspin Casino operational structure, personal data access adheres to a strict least-privilege model used for four distinct personnel tiers. Customer support agents view basic account information and communication history but cannot view full financial records or identity documents. Compliance officers possess permissions to examine verification documents, transaction patterns, and risk scores. Financial department personnel handle withdrawal requests and view payment instrument details needed to execute transfers. IT security staff review system logs and security event data but do not typically interact with player-identifiable records. Every access event is logged with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is checked quarterly by the Data Protection Officer. German players are able to request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 Third-Party Services and Authorities
Incaspin Casino utilizes specialist external processors comprising cloud hosting providers managing ISO 27001-certified data centres inside the European Economic Area, payment processors licensed by the German Federal Financial Supervisory Authority, identity verification services that check submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts mandate data processing solely on documented instructions from Incaspin Casino, with no right for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators occur only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles regulate all third-party data sharing arrangements:
- Processors receive only the minimum personal data required to perform their agreed function, with field-level data minimisation implemented to every integration.
- Sub-processor engagements need prior written authorisation from Incaspin Casino, and any unapproved subcontracting constitutes a material breach of the data processing agreement.
- All processors must have ISO 27001 certification or equivalent independently audited security qualifications, with current certificates filed with Incaspin Casino before data flows begin.
- No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business centers on monetising personal information.
5: International Data Transfers
The primary data storage infrastructure for Incaspin Casino resides within secure facilities located in the European Economic Area, specifically configured to serve the German market with latency-optimised connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers beyond the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino implements the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures applied where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include end-to-end encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who wish to understand the geographical flow of their information.
8. Entitlements of Germany-based Data Subjects
German gamblers possess the complete suite of data subject prerogatives enumerated in Articles 15 through 21 of the GDPR, along with the entitlement to submit a appeal with a supervisory authority. The right of access enables players to obtain verification of as to whether Incaspin Casino processes their private data and to get a duplicate of that data together with particulars about processing aims, categories, receivers, storage periods, and the occurrence of automated decision-making. Access applications are processed within one month, free of charge for the first request, with the answer provided in a structured, generally used, machine-readable layout. The right to rectification enables players to amend incorrect personal data or complete incomplete records, a particularly applicable prerogative for identity document updates following name alterations or address moves. Incaspin Casino processes rectification requests within ten business days and acknowledges corrections to any third-party addressees to whom the inaccurate data was revealed. The erasure right applies where the personal data is not anymore required for the aims for which it was collected, where authorization is revoked, where the player raises objection to processing and no overriding legitimate grounds are in place, or where processing is unlawful. Nevertheless, statutory retention obligations override erasure applications, and data necessary for legal compliance will be restricted from further processing rather than erased until the retention period lapses. The right of limitation of processing functions as an alternative where the correctness of data is challenged, processing is illegal but the player opposes deletion, or the player necessitates the data for legal demands despite the controller no longer demanding it. Data portability prerogatives under Article 20 GDPR extend only to data furnished by the player and handled by automated ways based on permission or contract, meaning gameplay history and transaction logs are suitable for portability while fraud detection ratings coming from internal models do not. Rights inquiries should be directed to the Data Protection Officer email address, with valid proof of identity needed before any data is shared.
3. bod Účely a právní základy zpracování
Incaspin Casino processes osobních údajů na základě několika různých GDPR legal bases, selected v závislosti na konkrétní zpracovatelské činnosti. Realizace smlouvy pursuant to Article 6(1)(b) GDPR pokrývá all data processing necessary to create and manage the player account, process deposits and withdrawals, a poskytování the interactive gaming services jež German players aktivně požadují při registraci. This includes transmitting payment instructions to acquiring banks a kontrolu toho, že players dosahují minimální věkový požadavek 18 let under German law. Legal obligation processing under Article 6(1)(c) GDPR pokrývá anti-money laundering customer due diligence, oznamování podezřelých obchodů relevantním jednotkám finančního zpravodajství, record retention k uspokojení commercial and tax law requirements, a soulad with German gambling regulations concerning player protection standards. The applicable legal frameworks zahrnují zákon o praní špinavých peněz and the stipulations of the Glücksspielstaatsvertrag pokud je to relevantní to data retention mandates.
Oprávněné zájmy pursued by Incaspin Casino podle Article 6(1)(f) GDPR zahrnují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers tam, kde je to dovoleno under Section 7 of the German Act Against Unfair Competition, a obchodní analýzy pro zlepšení služeb. German players zachovávají si the absolute right odmítnout zpracování založeném na oprávněných zájmech, including profiling pro účely přímého marketingu, and such objections will be honoured bez zbytečného odkladu. Consent podle Article 6(1)(a) GDPR is relied upon pro volitelné marketingové komunikace e-mailem a SMS kde hráč se aktivně přihlásil, pro nasazení neesenciálních cookies a sledovacích technologií, and for sensitive data processing v konkrétních případech. Mechanismy pro odvolání souhlasu are prominently placed within account settings a v patičce každého marketingového sdělení, přičemž odvolání nabývá účinnosti bez retroaktivních následků for previously lawful processing. German players who have not yet reached osmácti let nemají povoleno otevírat účty, a jakákoli neúmyslně shromážděná data nezletilých je ihned po odhalení odstraněna.
Number 6. Information Storage and Erasure Policies
Incaspin Casino operates a detailed data retention schedule aimed to fulfill statutory record-keeping duties while minimising the storage of personal data after its necessary purpose. Player account data and entire transaction logs are kept for the complete duration of the ongoing business relationship, defined as the term from account creation until the account is terminated, plus an extra statutory retention term required by German anti-money laundering laws and commercial law. Under the Geldwäschegesetz, identification files, transaction vouchers, and due diligence documentation must be preserved for at least five years following the end of the calendar year in which the business relationship ended. Accounting records relevant to tax duties are stored for ten years in accordance with the German Fiscal Code. Following the conclusion of these mandatory intervals, personal data is either permanently anonymised so that re-identification becomes unfeasible with all ways reasonably expected to be employed, or reliably deleted through cryptographic erasure and physical storage media sanitisation methods. Technical logs and security event data adhere to a reduced retention interval of twelve months, after which they are compiled into anonymised statistical summaries. Inactive accounts demonstrating no login activity for a consecutive period of 24 months are marked for dormancy assessment, and the connected personal data is minimised to retain only the core ID and transaction records necessary for the leftover statutory retention timeline. The casino utilizes automated data lifecycle management scripts that execute weekly to find records past their retention thresholds, initiating deletion procedures without human input, with the results documented for compliance audit objectives.
Summary
Incaspin Casino has organized its data protection framework to meet the high standards anticipated by German players and required by the GDPR and the BDSG-neu. From the first collection of identity and contact details through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage operates under documented policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino maintains transparent communication channels for rights requests, provides granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are advised to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.