This Privacy Notice explains how Incaspin Casino gathers, processes, keeps, and safeguards personal data belonging to players located in Germany. The document functions within the context of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino serves as the data controller for personal information furnished through its website, mobile applications, and related services. German players have specific statutory rights concerning their data, and this notice outlines the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards implemented to prevent unauthorised access. The document also details the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been compiled to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, providing German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed during the entire customer lifecycle.
8. Entitlements of German-resident Data Subjects
German users hold the full range of data subject prerogatives listed in Articles 15 through 21 of the GDPR, along with the entitlement to lodge a complaint with a supervisory authority. The right of access enables players to obtain confirmation of whether Incaspin Casino processes their individual data and to get a version of that data including information about processing objectives, classes, recipients, storage terms, and the presence of automated decision-making. Access requests are fulfilled within one month, at no cost for the initial request, with the response provided in a organized, widely used, machine-readable layout. The right of correction permits players to rectify incorrect personal data or complete missing records, a notably applicable entitlement for identity document revisions following name changes or address transfers. Incaspin Casino handles rectification requests within ten business days and confirms rectifications to any third-party receivers to whom the incorrect data was disclosed. The right to erasure holds true where the personal data is no longer necessary for the objectives for which it was collected, where consent is withdrawn, where the player raises objection to processing and no dominant legitimate grounds exist, or where processing is not permitted. Nevertheless, statutory retention requirements override erasure inquiries, and data needed for legal compliance will be restricted from further processing rather than removed until the retention period ends. The restriction right of processing acts as an substitute where the accuracy of data is challenged, processing is unlawful but the player objects to deletion, or the player necessitates the data for legal assertions despite the controller no longer needing it. Data portability entitlements under Article 20 GDPR apply solely to data furnished by the player and dealt with by automated methods based on authorization or agreement, meaning gameplay history and transaction logs are suitable for portability while fraud detection ratings obtained from internal algorithms do not. Rights inquiries should be addressed to the Data Protection Officer email address, with proper proof of identity necessary before any data is shared.
7. Information Security Controls
Incaspin Casino utilizes a multilevel security architecture aligned with the ISO 27001 control framework and the technical requirements specified in Article 32 of the GDPR. Network-level protections encompass enterprise-grade firewalls configured with stateful packet inspection, intrusion detection and prevention systems that analyze traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that neutralize volumetric attacks before they arrive at the application layer. All data transmitted between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, preventing retrospective decryption of captured traffic even if long-term private keys are subsequently exposed. Internal administrative interfaces are isolated on a management network inaccessible from the public internet, with access permitted exclusively through multi-factor authenticated VPN tunnels starting from pre-registered static IP addresses belonging to authorised personnel. At the application layer, the platform enforces strong password policies demanding minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies initiate step-up authentication challenges or temporary account locks pending manual review by the security team. Database-level encryption protects data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each managed through a hardware security module that logs every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm validate the effectiveness of these controls, with critical findings remediated within 48 hours. Security incident response procedures are practiced through bi-annual tabletop exercises including the Data Protection Officer, with a documented breach notification workflow ensuring German players and the supervisory authority receive notification within the 72-hour deadline required by GDPR.
Two Groups of Private Data Gathered
Two Point One Identification Verification and Player Data
German users must supply specific personal data to create and maintain an active Incaspin Casino account. This class includes entire statutory name, residential address, DOB, birthplace, citizenship, and gender. For identification confirmation aims needed under German anti-money laundering rules, the casino gathers government-issued ID papers such as passport scans, scans of national ID, and residence permit documentation. The program also records the document number, issuing authority, validity end, and a biometric comparison score generated during the automatic validation process. Address validation is finished through current utility bills, bank statements, or formal mail that clearly shows the user’s name, on-file address, and an creation date within the past three months. Incaspin Casino applies these confirmation requirements uniformly to adhere with the 4th and Fifth Anti-Money Laundering Directives as implemented into German law, making sure that all account satisfies the statutory identity assurance level ahead of any withdrawals are allowed. lotto.spiegel.de
Two Point Two Monetary and Payment Data
Financial data encompasses all deposit records, including payment method identifiers, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and digital wallet addresses where applicable. Incaspin Casino retains complete transaction histories showing timestamps, amounts in EUR or digital currency equivalents, processing statuses, and any intermediary payment processor references. Source of funds declarations and backing documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is separated in encrypted database tables with access limited to compliance personnel and senior financial officers. Artikel lesen German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino receiving only the information necessary to credit the player account.
2.3 Technical and Behavioural Data
As German players visit the Incaspin Casino platform, the system captures technical markers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data includes login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus enables the casino to provide optimised gaming experiences, identify fraudulent activity patterns, and uphold responsible gambling self-exclusion settings. Behavioural analytics monitor betting frequency, average stake sizes, session duration, and deposit velocity to feed the responsible gambling algorithms that produce personalised risk alerts. All technical logs are pseudonymised where possible and stored separately from core identity records, with re-identification possible only through a carefully managed cryptographic lookup procedure accessible exclusively to the fraud and compliance teams under documented access justification.
Číslo 5: International Data Transfers
The core data storage infrastructure for Incaspin Casino resides within secure facilities located in the European Economic Area, specifically designed to serve the German market with latency-optimized connectivity while maintaining full GDPR jurisdictional coverage. Some specialised processing activities may involve international data transfers beyond the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For each such transfer, Incaspin Casino enforces the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures applied where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include complete encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who seek to grasp the geographical flow of their information.
3. bod Purposes and Legal Bases for Processing
Incaspin Casino zpracovává osobních údajů podle několika odlišných GDPR právních důvodů, selected podle dané činnosti zpracování. The performance of a contract ve smyslu Article 6(1)(b) GDPR pokrývá veškeré zpracování údajů potřebné to create and manage účtu hráče, process deposits and withdrawals, a poskytování interaktivních herních služeb jež German players aktivně požadují during registration. This obsahuje předávání platebních instrukcí akvizičním bankám a ověřování toho, že players meet požadavek minimálního věku osmácti let under German law. Zpracování na základě právní povinnosti dle Article 6(1)(c) GDPR pokrývá anti-money laundering customer due diligence, oznamování podezřelých obchodů to relevant Financial Intelligence Units, record retention pro splnění commercial and tax law requirements, and compliance s německou regulací hazardu týkajících se standardů ochrany hráčů. Použitelné právní rámce zahrnují Geldwäschegesetz a předpisy státní smlouvy o hazardu kde je to relevantní pro povinnosti uchovávání dat.
Legitimní zájmy prosazované Incaspin Casino podle Article 6(1)(f) GDPR zahrnují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers where permitted dle Section 7 of the German Act Against Unfair Competition, and business analytics for service improvement. German players retain absolutní právo odmítnout zpracování založeném na oprávněných zájmech, včetně vytváření profilů for direct marketing purposes, a tyto námitky budou ctěny bez zbytečného odkladu. Povolení dle Article 6(1)(a) GDPR je spoléháno pro volitelné marketingové komunikace e-mailem a SMS pokud hráč aktivně souhlasil, pro nasazení neesenciálních cookies a sledovacích technologií, a pro zpracování citlivých údajů in specific circumstances. Mechanismy pro odvolání souhlasu are prominently placed v nastavení účtu a v patičce každého marketingového sdělení, with withdrawal taking effect without retroactive consequences for previously lawful processing. German players kteří dosud nedosáhli the age of 18 nesmějí otevírat účty, a veškerá omylem sebraná data nezletilých je ihned po odhalení odstraněna.
9. Cookie Policy and Tracking Technologies
9.1 Necessary and Operational Cookies
The Incaspin Casino platform and mobile platform implement a set of cookies and similar tracking technologies to provide core functionality. Strictly necessary cookies handle session state across page loads, maintain login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies end when the browser is closed and do not require prior consent under German law transposing the ePrivacy Directive, as they are indispensable for the required service delivery. Functional cookies store language preferences, preferred currency displays, and responsible gambling limit settings across visits, ensuring that returning players experience a coherent personalised environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they are deleted automatically if the player has not accessed the platform. Incaspin Casino does not use flash cookies, supercookies, or any respawning techniques that evade browser deletion actions.
9.2 Analytics and Marketing Cookies
Analytics and marketing cookies are set only after German players grant explicit, freely given consent through the cookie consent management platform shown on first visit. The consent tool displays clear descriptions of each cookie category, the specific providers engaged, the purposes of data collection, and the retention duration for each cookie type. Players may grant or withhold consent for each category independently, and consent preferences are stored as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service measure aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies support campaign attribution and frequency capping for promotional banners presented within the logged-in casino environment. German players may change their consent choices at any time by using the cookie settings panel linked in the website footer. Rejecting analytics or marketing cookies does not influence gameplay functionality or account standing in any manner. The consent tool asks again players annually to reaffirm or update their preferences.
1. Identita správce údajů and Contact Details
Správcem údajů pro všechny osobní údaje zpracovávané prostřednictvím the Incaspin Casino platform představuje the legal entity působící pod obchodní značkou Incaspin Casino, registrovaná v jurisdikci uznávané pro its adherence to standardů ekvivalentních ochraně údajů EU https://incaspincasino.de.com/legal-and-affiliates/. Adresa sídla and company registration number poskytneme na ověřenou žádost e-mailem na adresu pracovníkovi pro ochranu osobních údajů, nebo nahlédnutím do the imprint section webové prezentace. Hráči z Německa mohou adresovat jakékoli dotazy týkající se soukromí to jmenovanému pracovníkovi pro ochranu údajů, jenž pracuje samostatně a je přímo podřízen vrcholovému vedení. The DPO je k zastižení prostřednictvím a dedicated encrypted email channel uvedenou v úplného znění zásad ochrany soukromí. Incaspin Casino maintains právního zástupce na území Evropské unie z důvodu ustanovení čl. 27 GDPR, čímž zajišťuje, že německé kontrolní orgány i dotčené osoby mají přímé kontaktní místo ohledně regulačních otázek. Tento subjekt určuje the purposes and means of processing veškerých osobních dat shromážděných během registraci účtu, identifikačním procesu KYC, platebních transakcích vkladů a výběrů, a průběžné aktivitě při hraní. This includes informace generované pomocí cookies, device fingerprinting technologies, a serverových logů. Hráči z Německa by si měli uvědomit, that the controller exercises absolutní moc nad rozhodováním ohledně činností zpracování dat while commissioning pečlivě prověřené zpracovatele k zajištění konkrétních technických služeb jako je hosting, platební brány, a platformy pro řízení vztahů se zákazníky. Each processor relationship se řídí závaznou smlouvou o zpracování údajů jež vyhovuje podmínkám Article 28 GDPR, s vyhrazenými povinnými právy na audit ze strany Incaspin Casino pro ověření průběžného souladu. Kontaktní údaje of the EU representative byly sděleny the competent German data protection authority v souladu s právními předpisy.
6. Information Archiving and Deletion Policies
Incaspin Casino runs a detailed data retention plan intended to satisfy statutory record-keeping obligations while limiting the retention of personal data beyond its useful purpose. Player account data and entire transaction histories are retained for the complete duration of the active business relationship, characterized as the term from account creation till the account is closed, plus an supplementary statutory retention term mandated by German anti-money laundering laws and commercial law. Under the Geldwäschegesetz, identification files, transaction vouchers, and due diligence papers must be preserved for at least five years after the end of the calendar year in which the business relationship ended. Accounting records pertinent to tax duties are retained for ten years in compliance with the German Fiscal Code. Following the expiration of these mandatory periods, personal data is either irrevocably anonymised so that re-identification becomes impracticable with all methods reasonably probable to be applied, or securely removed through cryptographic erasure and physical storage media wiping methods. Technical logs and security event data observe a briefer retention cycle of twelve months, after which they are compiled into anonymised statistical overviews. Inactive accounts showing no login activity for a consecutive period of 24 months are flagged for dormancy review, and the associated personal data is minimised to store only the core identifier and transaction records necessary for the leftover statutory retention schedule. The casino deploys automated data lifecycle management routines that run weekly to identify records over their retention thresholds, triggering deletion workflows without human input, with the results recorded for compliance audit purposes.
4. Information Sharing and Third Parties
4.1 In-House Data Access Model
In the Incaspin Casino operational system, personal data access utilizes a strict least-privilege model implemented across four distinct personnel tiers. Customer support agents access basic account information and communication history but cannot view full financial records or identity documents. Compliance officers hold permissions to examine verification documents, transaction patterns, and risk scores. Financial department personnel handle withdrawal requests and view payment instrument details needed to execute transfers. IT security staff monitor system logs and security event data but do not typically interact with player-identifiable records. Every access event is recorded with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is examined quarterly by the Data Protection Officer. German players are able to request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.
4.2 External Providers and Regulatory Bodies
Incaspin Casino engages specialist external processors comprising cloud hosting providers operating ISO 27001-certified data centres within the European Economic Area, payment processors authorised by the German Federal Financial Supervisory Authority, identity verification services that match submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment covering technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts mandate data processing solely on documented instructions from Incaspin Casino, with no right for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators happen only when legally mandated, and unless prohibited by law, the casino will notify affected players of such disclosures. The following key principles control all third-party data sharing arrangements:
- Processors receive only the minimum personal data required to perform their specified function, with field-level data minimisation applied to every integration.
- Sub-processor engagements require prior written authorisation from Incaspin Casino, and any unauthorised subcontracting represents a material breach of the data processing agreement.
- All processors must hold ISO 27001 certification or comparable independently audited security credentials, with current records filed with Incaspin Casino before data flows begin.
- No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.
Summary
Incaspin Casino has organized its data protection system to satisfy the high standards expected by German players and required by the GDPR and the BDSG-neu. From the first collection of identity and contact information through to the final deletion or anonymisation of records years after account closure, every personal data life cycle stage works under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino keeps transparent communication channels for rights requests, provides granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are advised to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.
