This Privacy Notice explains how Incaspin Casino affiliate partnerschaft obtains, handles, keeps, and safeguards personal data belonging to players located in Germany. The document works within the framework of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino functions as the data controller for personal information submitted through its website, mobile applications, and related services. German players enjoy specific statutory rights regarding their data, and this notice outlines the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards deployed to prevent unauthorised access. The document also explains the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been compiled to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, offering German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed throughout the entire customer lifecycle.

4. Information Sharing and Third Parties

4.1 Internal Data Access Structure

In the Incaspin Casino operational system, personal data access follows a strict least-privilege model used for four distinct personnel tiers. Customer support agents retrieve basic account information and communication history but cannot view full financial records or identity documents. Compliance officers have permissions to review verification documents, transaction patterns, and risk scores. Financial department personnel handle withdrawal requests and view payment instrument details necessary to execute transfers. IT security staff access system logs and security event data but do not typically interact with player-identifiable records. Every access event is recorded with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is reviewed quarterly by the Data Protection Officer. German players can request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.

4.2 Third-Party Services and Authorities

Incaspin Casino utilizes specialist external processors such as cloud hosting providers running ISO 27001-certified data centres within the European Economic Area, payment processors authorised by the German https://www.bild.de/gewinnspiele/bildplus-aktion/leute/hercules-gewinnen-sie-tickets-fuer-das-neue-disney-musical-in-hamburg-87581758.bild.html Federal Financial Supervisory Authority, identity verification services that check submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor passes through a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts stipulate data processing solely on documented instructions from Incaspin Casino, with no authority for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will alert affected players of such disclosures. The following key principles regulate all third-party data sharing arrangements:

• Processors get only the minimum personal data required to perform their agreed function, with field-level data minimisation enforced to every integration.
• Sub-processor engagements need prior written authorisation from Incaspin Casino, and any unapproved subcontracting forms a material breach of the data processing agreement.
• All processors must maintain ISO 27001 certification or similar independently audited security credentials, with current records filed with Incaspin Casino before data flows start.
• No personal data is disclosed to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.

Pátý bod: International Data Transfers

The main data storage infrastructure for Incaspin Casino is located in secure facilities located in the European Economic Area, specifically engineered to serve the German market with low-latency connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino implements the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures utilised where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include full encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who seek to grasp the geographical flow of their information.

9. Cookie Policy and Tracking Technologies

9.1 Core and Operational Cookies

The Incaspin Casino site and mobile platform utilize a range of cookies and similar tracking technologies to ensure core functionality. Strictly necessary cookies handle session state across page loads, keep login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies expire when the browser is closed and do not require prior consent under German law transposing the ePrivacy Directive, as they are necessary for the requested service delivery. Functional cookies keep language preferences, preferred currency displays, and responsible gambling limit settings across visits, ensuring that returning players experience a uniform personalized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they become invalid automatically if the player has not revisited the platform. Incaspin Casino does not use flash cookies, supercookies, or any recreating techniques that evade browser deletion actions.

9.2 Metrics and Marketing Cookies

Analytics and marketing cookies are set only after German players give explicit, freely given consent through the cookie consent management platform displayed on first visit. The consent tool displays clear descriptions of each cookie category, the specific providers involved, the purposes of data collection, and the retention duration for each cookie type. Players may give or deny consent for each category independently, and consent preferences are stored as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service measure aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies enable campaign attribution and frequency capping for promotional banners shown within the logged-in casino environment. German players may adjust their consent choices at any time by using the cookie settings panel located in the website footer. Rejecting analytics or marketing cookies does not impact gameplay functionality or account standing in any manner. The consent tool solicits players annually to update or update their preferences.

Six. Information Storage and Deletion Policies

Incaspin Casino implements a precise data retention policy designed to meet statutory record-keeping obligations while limiting the retention of personal data after its necessary purpose. Player account data and complete transaction records are retained for the full duration of the current business relationship, described as the term from account creation until the account is closed, plus an additional statutory retention term required by German anti-money laundering regulations and commercial law. Under the Geldwäschegesetz, identification records, transaction confirmations, and due diligence documentation must be maintained for at least five years from the end of the calendar year in which the business relationship ended. Accounting records relevant to tax duties are retained for ten years in accordance with the German Fiscal Code. Following the end of these mandatory intervals, personal data is either irrevocably masked so that re-identification becomes impracticable with all methods reasonably likely to be used, or reliably deleted through cryptographic erasure and physical storage media sanitisation procedures. Technical logs and security event data follow a briefer retention cycle of twelve months, after which they are aggregated into anonymised statistical overviews. Inactive accounts exhibiting no login activity for a continuous period of 24 months are designated for dormancy check, and the related personal data is reduced to keep only the core name and transaction records needed for the outstanding statutory retention clock. The casino utilizes automated data lifecycle management routines that operate weekly to locate records over their retention thresholds, starting deletion workflows without human intervention, with the results documented for compliance audit reasons.

7. Security of Data Safeguards

Incaspin Casino implements a multi-layered security architecture in accordance with the ISO 27001 control framework and the technical requirements set forth in Article 32 of the GDPR. Network-level protections comprise enterprise-grade firewalls configured with stateful packet inspection, intrusion detection and prevention systems that monitor traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that withstand volumetric attacks before they reach the application layer. All data transferred between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, avoiding retrospective decryption of captured traffic even if long-term private keys are eventually leaked. Internal administrative interfaces are separated on a management network inaccessible from the public internet, with access permitted exclusively through multi-factor authenticated VPN tunnels coming from pre-registered static IP addresses belonging to authorised personnel. At the application layer, the platform enforces strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies initiate step-up authentication challenges or temporary account locks pending manual review by the security team. Database-level encryption safeguards data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each controlled through a hardware security module that tracks every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm validate the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are practiced through bi-annual tabletop exercises including the Data Protection Officer, with a documented breach notification workflow guaranteeing German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.

Kapitola 1. Kontakt na správce údajů a podrobnosti o kontaktu

Správcem údajů pro všechny osobní údaje zpracovávané na platformě the Incaspin Casino platformy is subjekt působící pod názvem značky Incaspin Casino, registrovaná v jurisdikci známé svým přijetím EU data protection equivalence standards. The registered office address a identifikační číslo společnosti are available upon žádost s ověřením totožnosti e-mailem na adresu the Data Protection Officer, případně v the imprint section webové prezentace. Hráči z Německa mohou směřovat veškeré dotazy ohledně ochrany soukromí to the designated Data Protection Officer, who operates independently and reports directly to nejvyššímu managementu. Tento pracovník je k zastižení přes speciální šifrovanou e-mailovou adresu published within the full privacy policy text. Incaspin Casino maintains a legal representative within the European Union for purposes of článku 27 GDPR, ensuring that German supervisory authorities a subjekty údajů disponují přímým kontaktem pro regulační záležitosti. The controller stanovuje účely a prostředky of processing all personal data získaných při registraci účtu, Know Your Customer verification, transakcích vkladů a výběrů, and ongoing gameplay activity. This includes informace generované pomocí souborů cookies, technologií pro identifikaci zařízení, a serverových logů. German players should note, že tento subjekt uplatňuje absolutní moc nad rozhodováním over data processing operations přičemž pověřuje důkladně vybrané zpracovatele pro specifické technické služby such as hosting, payment gateways, a CRM platformy. Each processor relationship is governed by a binding data processing agreement jež vyhovuje podmínkám článku 28 GDPR, s možností provádět povinné audity by Incaspino Casino pro ověření průběžného souladu. Kontaktní údaje of the EU representative byly sděleny příslušnému německému úřadu pro ochranu osobních údajů as required by law.

Summary

Incaspin Casino has organized its data protection framework to fulfill the high standards anticipated by German players and required by the GDPR and the BDSG-neu. From the first collection of identity and contact data through to the final deletion or anonymisation of records years after account closure, every personal data life cycle stage works under recorded policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino maintains transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are encouraged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.

2. Groups of Personal Data Collected

Two Point One Identity Confirmation and Account Data

German players must provide particular individual data to establish and maintain an active Incaspin Casino account. This group includes full official name, home address, date of birth, place of birth, nationality, and gender. For identification verification aims mandatory under Germany’s anti-money laundering rules, the casino collects government-issued identity papers such as copy of passport, national identity card scans, and proof of residency. The system also logs the document number, issuer, expiration date, and a biometric matching rating created during the automated confirmation process. Home validation is done through latest utility bills, bank statements, or official mail that evidently displays the user’s name, registered location, and an creation date within the past three months. Incaspin Casino uses these validation conditions evenly to conform with the Fourth and Fifth Anti-Money Laundering Orders as incorporated into German law, ensuring that every account fulfills the regulatory identification assurance level prior to any withdrawals are allowed.

Two Point Two Financial and Deal Data

Payment information encompasses all deposit records, including payment instrument data, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and digital wallet addresses where applicable. Incaspin Casino stores complete transaction histories showing timestamps, amounts in EUR or cryptocurrency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players reach specific deposit thresholds or trigger enhanced due diligence procedures. This data is isolated in encrypted database tables with access limited to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino obtaining only the information necessary to credit the player account.

2.3 Technical and Behavioural Data

As German players access the Incaspin Casino platform, the system gathers technical identifiers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data covers login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus allows the casino to offer optimised gaming experiences, identify fraudulent activity patterns, and respect responsible gambling self-exclusion settings. Behavioural analytics measure betting frequency, average stake sizes, session duration, and deposit velocity to feed the responsible gambling algorithms that generate personalised risk alerts. All technical logs are anonymised where possible and stored apart from core identity records, with re-identification possible only through a strictly regulated cryptographic lookup procedure reserved exclusively to the fraud and compliance teams under documented access justification.

8. Rights of German-resident Data Subjects

German gamblers enjoy the full set of data subject entitlements listed in Articles 15 through 21 of the GDPR, together with the option to file a complaint with a supervisory authority. The right of access allows players to obtain verification of if Incaspin Casino processes their personal data and to receive a duplicate of that data together with information about processing purposes, classes, addressees, storage terms, and the occurrence of automated decision-making. Access requests are processed within one month, without charge for the primary request, with the answer provided in a organized, generally used, machine-readable format. The rectification right permits players to rectify inaccurate personal data or fill in partial files, a especially pertinent right for identity document changes following name changes or address transfers. Incaspin Casino processes rectification inquiries within ten business days and verifies amendments to any third-party addressees to whom the wrong data was revealed. The erasure right holds true where the personal data is not anymore required for the aims for which it was collected, where permission is withdrawn, where the player opposes to processing and no dominant legitimate grounds are in place, or where processing is illegal. Nevertheless, statutory retention requirements take precedence over erasure inquiries, and data needed for legal compliance will be confined from further processing rather than deleted until the retention period expires. The right to restriction of processing serves as an alternative where the precision of data is challenged, processing is illegal but the player opposes deletion, or the player needs the data for legal claims despite the controller no longer needing it. Data portability rights under Article 20 GDPR extend only to data provided by the player and processed by automated ways based on consent or contract, meaning gameplay history and transaction logs are suitable for portability while fraud detection assessments coming from internal systems do not. Rights inquiries should be sent to the Data Protection Officer email address, with proper proof of identity necessary before any data is disclosed.

3. Účely a právní základy zpracování

Incaspin Casino zpracovává personal data podle několika odlišných GDPR právních důvodů, zvolených according to konkrétní zpracovatelské činnosti. Plnění smlouvy ve smyslu Article 6(1)(b) GDPR covers všechna zpracování dat nezbytné k vytvoření a vedení the player account, provádění vkladů a výběrů, a doručení the interactive gaming services jež German players aktivně požadují během registrace. This includes předávání platebních instrukcí zúčtovacím bankám and verifying toho, že players meet the minimum age requirement osmácti let podle německého práva. Povinné zpracování dle Article 6(1)(c) GDPR encompasses anti-money laundering customer due diligence, oznamování podezřelých obchodů relevantním jednotkám finančního zpravodajství, uchovávání záznamů to satisfy požadavků obchodního a daňového práva, a soulad s německou regulací hazardu ohledně norem ochrany hráčů. The applicable legal frameworks include Geldwäschegesetz a předpisy státní smlouvy o hazardu kde je to relevantní pro povinnosti uchovávání dat.

Oprávněné zájmy pursued by Incaspin Casino dle Article 6(1)(f) GDPR obsahují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted under Section 7 of the German Act Against Unfair Competition, and business analytics za účelem zlepšení služeb. German players retain absolutní právo vznášet námitky proti zpracování na základě oprávněných zájmů, včetně profilování pro účely přímého marketingu, and such objections will be honoured without undue delay. Consent under Article 6(1)(a) GDPR je spoléháno for optional marketing communications e-mailem a SMS pokud hráč se aktivně přihlásil, pro umístění nepodstatných cookies a sledovacích technologií, a pro zpracování citlivých dat za specifických okolností. Způsoby zrušení souhlasu jsou nápadně umístěny v nastavení účtu a v patičce každého marketingového sdělení, s tím, že odvolání má účinek without retroactive consequences pro dříve zákonné zpracování. German players kteří ještě nedosáhli osmácti let nesmějí otevírat účty, a veškerá omylem sebraná data nezletilých je ihned po odhalení odstraněna.