This Privacy Notice explains how Seite anzeigen obtains, handles, keeps, and secures personal data pertaining to players located in Germany. The document operates within the context of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino serves as the data controller for personal information submitted through its website, mobile applications, and related services. German players enjoy specific statutory rights concerning their data, and this notice specifies the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards implemented to prevent unauthorised access. The document also describes the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section is prepared to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, giving German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed throughout the entire customer lifecycle.

Two Groups of Private Data Obtained

Two Point One Identification Verification and User Data

German players must submit certain private data to set up and maintain an active Incaspin Casino account. This category includes complete official name, home location, date of birth, place of birth, citizenship, and gender. For identity validation reasons required under Germany’s anti-money laundering regulations, the casino gathers government-issued identity files such as copy of passport, national identity card scans, and proof of residency. The system also logs the document number, issuer, expiry date, and a biometric comparison score generated during the automated verification process. Address confirmation is completed through current utility bills, bank statements, or official mail that clearly shows the player’s name, registered location, and an issuing day inside of the past three months. Incaspin Casino implements these confirmation prerequisites uniformly to adhere with the 4th and 5th Anti-Money Laundering Directives as implemented into Germany’s law, making sure that each account satisfies the regulatory identity certainty level ahead of any withdrawals are authorized.

Two Point Two Fiscal and Transaction Data

Financial data encompasses all deposit records, including payment instrument data, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino stores complete transaction histories showing timestamps, amounts in EUR or equivalent cryptocurrency, processing statuses, and any intermediary payment processor references. Source of funds declarations and accompanying documents such as payslips, tax returns, or business financial statements are collected when players reach specific deposit thresholds or trigger enhanced due diligence procedures. This data is segregated in encrypted database tables with access restricted to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino getting only the information necessary to credit the player account.

2.3 Technical and Behavioral Records

As German players access the Incaspin Casino platform, the system automatically collects technical markers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data covers login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus enables the casino to offer optimised gaming experiences, detect fraudulent activity patterns, and respect responsible gambling self-exclusion settings. Behavioural analytics measure betting frequency, average stake sizes, session duration, and deposit velocity to inform the responsible gambling algorithms that generate personalised risk alerts. All technical logs are pseudonymised where possible and stored apart from core identity records, with re-identification possible only through a strictly regulated cryptographic lookup procedure available exclusively to the fraud and compliance teams under documented access justification.

4. Information Sharing and Third Parties

4.1 Internal Data Access Architecture

Inside the Incaspin Casino operational framework, personal data access follows a strict least-privilege model used for four distinct personnel tiers. Customer support agents view basic account information and communication history but cannot view full financial records or identity documents. Compliance officers possess permissions to examine verification documents, transaction patterns, and risk scores. Financial department personnel handle withdrawal requests and view payment instrument details needed to execute transfers. IT security staff monitor system logs and security event data but do not routinely interact with player-identifiable records. Every access event is logged with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is reviewed quarterly by the Data Protection Officer. German players can request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.

4.2 External Providers and Regulatory Bodies

Incaspin Casino engages specialist external processors comprising cloud hosting providers operating ISO 27001-certified data centres within the European Economic Area, payment processors licensed by the German Federal Financial Supervisory Authority, identity verification services that check submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment encompassing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts require data processing solely on documented instructions from Incaspin Casino, with no authority for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles control all third-party data sharing arrangements:

• Processors get only the minimum personal data necessary to carry out their contracted function, with field-level data minimisation applied to every integration.
• Sub-processor engagements demand prior written consent from Incaspin Casino, and any unauthorised subcontracting represents a material breach of the data processing agreement.
• All processors must hold ISO 27001 certification or equivalent independently audited security credentials, with current documentation filed with Incaspin Casino before data flows start.
• No personal data is disclosed to advertising technology platforms, data brokers, or any entity whose primary business centers on monetising personal information.

Summary

Incaspin Casino has organized its data protection system to meet the high standards demanded by German players and mandated by the GDPR and the BDSG-neu. From the preliminary collection of identity and contact information through to the conclusive deletion or anonymisation of records years after account closure, every personal data life cycle stage operates under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino maintains transparent communication channels for rights requests, provides granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are urged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.

3. Důvody a právní základy pro zpracování

Incaspin Casino provádí zpracování personal data under several distinct GDPR legal bases, zvolených according to the specific processing activity. Plnění smlouvy ve smyslu Article 6(1)(b) GDPR zahrnuje all data processing necessary k vytvoření a vedení the player account, process deposits and withdrawals, a doručení služeb interaktivního hraní které German players actively request during registration. This zahrnuje transmitting payment instructions zúčtovacím bankám a kontrolu toho, že players splňují požadavek minimálního věku of 18 years under German law. Zpracování na základě právní povinnosti under Article 6(1)(c) GDPR encompasses anti-money laundering customer due diligence, oznamování podezřelých obchodů příslušným finančním zpravodajským jednotkám, record retention pro splnění požadavků obchodního a daňového práva, a soulad s německými herními předpisy týkajících se standardů ochrany hráčů. The applicable legal frameworks obsahují Geldwäschegesetz a ustanovení státní smlouvy o hazardu kde je to relevantní pro povinnosti krone.at uchovávání dat.

Legitimate interests pursued by Incaspin Casino podle Article 6(1)(f) GDPR obsahují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers tam, kde je to dovoleno podle Section 7 of the German Act Against Unfair Competition, and business analytics for service improvement. German players mají the absolute right vznášet námitky proti zpracování based on legitimate interests, včetně profilování for direct marketing purposes, a takové námitky will be honoured bez zbytečné prodlevy. Povolení dle Article 6(1)(a) GDPR je využíván pro volitelné marketingové komunikace via email and SMS pokud the player has actively opted in, pro umístění nepodstatných cookies a sledovacích technologií, a pro zpracování citlivých dat za specifických okolností. Způsoby zrušení souhlasu are prominently placed v rámci nastavení účtu and every marketing communication footer, with withdrawal taking effect bez zpětných důsledků pro dříve zákonné zpracování. German players who have not yet reached věku 18 let are not permitted to open accounts, and any inadvertently collected minor data jsou okamžitě po zjištění smazána.

5: International Data Transfers

The core data storage infrastructure for Incaspin Casino operates from secure facilities located in the European Economic Area, specifically configured to serve the German market with low-latency connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers beyond the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino implements the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures applied where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include end-to-end encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who wish to understand the geographical flow of their information.

8. Prerogatives of German-resident Data Subjects

German players hold the complete suite of data subject entitlements enumerated in Articles 15 through 21 of the GDPR, together with the entitlement to lodge a grievance with a supervisory authority. The access right permits players to obtain assurance of whether Incaspin Casino processes their personal data and to receive a copy of that data together with information about processing purposes, classes, addressees, holding periods, and the presence of automated decision-making. Access requests are processed within one month, at no cost for the first request, with the reply delivered in a structured, widely used, machine-readable format. The right of correction enables players to amend inaccurate personal data or complete missing documents, a notably applicable right for identity document updates following name alterations or address moves. Incaspin Casino deals with rectification applications within ten business days and confirms corrections to any third-party recipients to whom the incorrect data was revealed. The erasure right holds true where the personal data is no more necessary for the purposes for which it was gathered, where authorization is canceled, where the player objects to processing and no prevailing legitimate grounds are in place, or where processing is unlawful. However, statutory retention duties supersede erasure applications, and data needed for legal compliance will be restricted from further processing rather than removed until the retention period expires. The right of limitation of processing serves as an option where the correctness of data is contested, processing is illegal but the player opposes deletion, or the player necessitates the data for legal claims despite the controller no longer needing it. Data portability entitlements under Article 20 GDPR extend only to data furnished by the player and processed by automated ways based on consent or contract, signifying gameplay history and transaction logs are suitable for portability while fraud detection assessments obtained from internal models do not. Rights applications should be sent to the Data Protection Officer email address, with valid proof of identity required before any data is shared.

7. Security of Data Measures

Incaspin Casino implements a tiered security architecture in accordance with the ISO 27001 control framework and the technical requirements articulated in Article 32 of the GDPR. Network-level protections comprise enterprise-grade firewalls configured with stateful packet inspection, intrusion detection and prevention systems that analyze traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that absorb volumetric attacks before they reach the application layer. All data transmitted between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, preventing retrospective decryption of captured traffic even if long-term private keys are later compromised. Internal administrative interfaces are segmented on a management network unreachable from the public internet, with access allowed solely through multi-factor authenticated VPN tunnels starting from pre-registered static IP addresses owned by authorised personnel. At the application layer, the platform imposes strong password policies demanding minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies initiate step-up authentication challenges or temporary account locks until manual review by the security team. Database-level encryption safeguards data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each managed through a hardware security module that records every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm validate the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are tested through bi-annual tabletop exercises involving the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.

Number 6. Information Retention and Removal Policies

Incaspin Casino operates a detailed data retention plan aimed to satisfy statutory record-keeping obligations while limiting the storage of personal data beyond its intended purpose. Player account data and full transaction records are retained for the entire duration of the ongoing business relationship, described as the period from account creation until the account is closed, plus an additional statutory retention term mandated by German anti-money laundering laws and commercial law. Under the Geldwäschegesetz, identification files, transaction vouchers, and due diligence documentation must be maintained for at least five years following the end of the calendar year in which the business relationship terminated. Accounting records pertinent to tax requirements are retained for ten years in compliance with the German Fiscal Code. Following the end of these mandatory periods, personal data is either permanently de-identified so that re-identification becomes impracticable with all methods reasonably expected to be applied, or reliably deleted through cryptographic erasure and physical storage media sanitisation processes. Technical logs and security event data observe a shorter retention period of twelve months, after which they are combined into anonymised statistical summaries. Inactive accounts showing no login activity for a consecutive period of 24 months are designated for dormancy check, and the associated personal data is minimised to keep only the core identifier and transaction records needed for the remaining statutory retention timeline. The casino deploys automated data lifecycle management processes that run weekly to find records beyond their retention deadlines, initiating deletion workflows without human involvement, with the results documented for compliance audit objectives.

Kapitola 1. Identita správce údajů a podrobnosti o kontaktu

The data controller pro všechny osobní údaje zpracovávané na platformě the Incaspin Casino platformy představuje the legal entity operating under názvem značky Incaspin Casino, registrovaná v státě recognised for its adherence to EU data protection equivalence standards. Adresa sídla a registrační číslo are available upon žádost s ověřením totožnosti by emailing pověřenci pro ochranu osobních údajů, or by consulting sekce otisku hlavních webových stránek. Němečtí hráči mohou adresovat jakékoli dotazy týkající se soukromí k the designated Data Protection Officer, who operates independently a podává zprávy přímo senior management. Pověřenec může být kontaktován prostřednictvím a dedicated encrypted email channel zveřejněnou v rámci the full privacy policy text. Incaspin Casino udržuje právního zástupce within the European Union z důvodu Article 27 GDPR, ensuring that German supervisory authorities and data subjects mají přímé kontaktní místo pro regulační záležitosti. Tento subjekt určuje the purposes and means zpracování all personal data získaných při account registration, Know Your Customer verification, platebních transakcích vkladů a výběrů, a průběžné aktivitě při hraní. Sem patří informace generované pomocí cookies, device fingerprinting technologies, and server logs. Němečtí hráči by měli vzít na vědomí, že tento subjekt uplatňuje full decision-making power over data processing operations while commissioning carefully vetted processors for specific technical services such as hosting, payment gateways, a CRM platformy. Each processor relationship je upravena právně závaznou dohodou o zpracování dat that meets the requirements of ustanovení čl. 28 GDPR, s vyhrazenými povinnými právy na audit by Incaspino Casino to verify ongoing compliance. Kontaktní údaje zástupce v EU are provided to the competent German data protection authority jak vyžaduje zákon.

9. Cookie Policy and Tracking Technologies

9.1 Core and Operational Cookies

The Incaspin Casino platform and mobile platform utilize a set of cookies and similar tracking technologies to provide core functionality. Strictly necessary cookies manage session state across page loads, keep login authentication tokens, and preserve security context for CSRF protection. These first-party session cookies end when the browser is closed and do not require prior consent under German law transposing the ePrivacy Directive, as they are necessary for the desired service delivery. Functional cookies save language preferences, preferred currency displays, and responsible gambling limit settings across visits, ensuring that returning players find a uniform customized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they are deleted automatically if the player has not returned to the platform. Incaspin Casino does not use flash cookies, supercookies, or any respawning techniques that evade browser deletion actions.

9.2 Analytics and Marketing Cookies

Analytics and marketing cookies are set only after German players provide explicit, freely given consent through the cookie consent management platform presented on first visit. The consent tool displays clear descriptions of each cookie category, the specific providers involved, the purposes of data collection, and the retention duration for each cookie type. Players may grant or deny consent for each category independently, and consent preferences are stored as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service measure aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies facilitate campaign attribution and frequency capping for promotional banners presented within the logged-in casino environment. German players may change their consent choices at any time by accessing the cookie settings panel linked in the website footer. Rejecting analytics or marketing cookies does not affect gameplay functionality or account standing in any manner. The consent tool asks again players annually to reaffirm or update their preferences.