This Privacy Notice outlines how mehr herausfinden gathers, processes, retains, and safeguards personal data belonging to players located in Germany. The document operates within the context of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino serves as the data controller for personal information provided through its website, mobile applications, and related services. German players have specific statutory rights relating to their data, and this notice specifies the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards deployed to prevent unauthorised access. The document also details the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been compiled to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, offering German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed during the entire customer lifecycle.

Summary

Incaspin Casino has organized its data protection system to fulfill the high standards demanded by German players and required by the GDPR and the BDSG-neu. From the first collection of identity and contact information through to the ultimate deletion or anonymisation of records years after account closure, every personal data life cycle stage functions under recorded policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino maintains transparent communication channels for rights requests, offers granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are advised to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.

První bod: Data Controller Identity a kontaktní údaje

Správcem údajů za veškeré osobní údaje zpracovávané na platformě the Incaspin Casino webové stránky je právnická osoba vystupující pod obchodní značkou Incaspin Casino, registrovaná v a jurisdiction známé svým its adherence to standardů ekvivalentních ochraně údajů EU. Adresa sídla and company registration number jsou k dispozici na žádost s ověřením totožnosti zasláním e-mailu the Data Protection Officer, případně v sekce otisku hlavních webových stránek. German players may direct veškeré dotazy ohledně ochrany soukromí na the designated Data Protection Officer, jenž pracuje samostatně a je přímo podřízen nejvyššímu managementu. The DPO může být kontaktován přes a dedicated encrypted email channel uvedenou v kompletního textu politiky ochrany osobních údajů. Incaspin Casino má a legal representative within the European Union for purposes of Article 27 GDPR, aby bylo zaručeno, že německé dozorové úřady and data subjects disponují přímým kontaktem ohledně regulačních otázek. Správce určuje cíle a způsoby zpracování veškerých osobních dat collected during vytváření účtu, ověřování Know Your Customer, platebních transakcích vkladů a výběrů, a průběžné aktivitě při hraní. Sem patří informace generované pomocí souborů cookies, technologií pro identifikaci zařízení, and server logs. German players should note, že správce vykonává plnou rozhodovací pravomoc ohledně činností zpracování dat přičemž pověřuje carefully vetted processors for specific technical services jako je hosting, platební brány, and CRM platforms. Každá smluvní dohoda se zpracovatelem je upravena závaznou smlouvou o zpracování údajů that meets the requirements of Article 28 GDPR, with mandatory audit rights reserved pro Incaspin Casino pro ověření průběžného souladu. Podrobné kontakty na zástupce pro Evropskou unii are provided to kompetentnímu německému dozorovému orgánu pro ochranu dat v souladu s právními předpisy.

3. Purposes and Legal Bases for Processing

Incaspin Casino zpracovává osobní data na základě několika různých GDPR legal bases, zvolených according to konkrétní zpracovatelské činnosti. Plnění smlouvy pursuant to Article 6(1)(b) GDPR pokrývá all data processing necessary to create and manage hráčského účtu, zpracování vkladů a výběrů, and deliver interaktivních herních služeb jež German players actively request during registration. This includes zasílání platebních pokynů zúčtovacím bankám a kontrolu že players dosahují minimální věkový požadavek of 18 years dle německé legislativy. Povinné zpracování dle Article 6(1)(c) GDPR zahrnuje anti-money laundering customer due diligence, oznamování podezřelých obchodů relevantním jednotkám finančního zpravodajství, uchovávání záznamů to satisfy commercial and tax law requirements, a soulad with German gambling regulations ohledně norem ochrany hráčů. The applicable legal frameworks zahrnují the Geldwäschegesetz and the stipulations Glücksspielstaatsvertragu kde je to relevantní k mandátům uchovávání údajů.

Oprávněné zájmy prosazované Incaspin Casino dle Article 6(1)(f) GDPR zahrnují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers tam, kde je to dovoleno under Section 7 of the German Act Against Unfair Competition, and business analytics za účelem zlepšení služeb. German players retain the absolute right odmítnout zpracování na základě oprávněných zájmů, včetně profilování for direct marketing purposes, a tyto námitky will be honoured bez zbytečného odkladu. Souhlas under Article 6(1)(a) GDPR is relied upon for optional marketing communications prostřednictvím e-mailu a SMS where hráč se aktivně přihlásil, pro nasazení neesenciálních cookies a sledovacích technologií, a pro zpracování citlivých dat in specific circumstances. Consent withdrawal mechanisms are prominently placed v rámci nastavení účtu and every marketing communication footer, with withdrawal taking effect bez retroaktivních následků pro dříve zákonné zpracování. German players kteří dosud nedosáhli osmácti let are not permitted to open accounts, a veškerá omylem sebraná data nezletilých jsou okamžitě po zjištění smazána.

Two Classes of Personal Data Collected

2.1 Identification Validation and User Data

German users must submit particular individual data to set up and sustain an current Incaspin Casino account. This category includes complete statutory full name, home address, DOB, birthplace, nationality, and gender. For identity validation reasons required under German anti-money laundering regulations, the casino collects government-issued ID papers such as passport scans, national ID copies, and residence permit papers. The system also records the ID number, issuer, expiry date, and a biometrical comparison rating generated during the automated verification process. Residential validation is finished through recent utility bills, bank statements, or formal mail that plainly shows the user’s name, recorded location, and an creation day inside the last three months. Incaspin Casino implements these validation conditions consistently to comply with the 4th and Fifth Anti-Money Laundering Directives as transposed into German law, ensuring that all account satisfies the statutory identity assurance level prior to any withdrawals are permitted.

2.2 Monetary and Transaction Data

Transaction records encompasses all transaction records, including payment method identifiers, masked card numbers, e-wallet account email addresses, bank account IBAN numbers for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino stores complete transaction histories showing timestamps, amounts in EUR or equivalent cryptocurrency, processing statuses, and any intermediary payment processor references. Source of funds declarations and supporting documents such as payslips, tax returns, or business financial statements are collected when players exceed specific deposit thresholds or trigger enhanced due diligence procedures. This data is segregated in encrypted database tables with access restricted to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino getting only the information necessary to credit the player account.

2.3 Technical and Behavioural Data

As German players access the Incaspin Casino platform, the system captures technical identifiers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data encompasses login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus enables the casino to provide optimised gaming experiences, identify fraudulent activity patterns, and respect responsible gambling self-exclusion settings. Behavioural analytics measure betting frequency, average stake sizes, session duration, and deposit velocity to supply the responsible gambling algorithms that produce personalised risk alerts. All technical logs are pseudonymised where possible and stored separately from core identity records, with re-identification possible only through a tightly controlled cryptographic lookup procedure accessible exclusively to the fraud and compliance teams under documented access justification.

7. Information Security Measures

Incaspin Casino deploys a tiered security architecture in accordance with the ISO 27001 control framework and the technical requirements set forth in Article 32 of the GDPR. Network-level protections encompass enterprise-grade firewalls equipped with stateful packet inspection, intrusion detection and prevention systems that analyze traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that neutralize volumetric attacks before they arrive at the application layer. All data transferred between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, blocking retrospective decryption of captured traffic even if long-term private keys are eventually leaked. Internal administrative interfaces are segmented on a management network unreachable from the public internet, with access allowed solely through multi-factor authenticated VPN tunnels starting from pre-registered static IP addresses owned by authorised personnel. At the application layer, the platform imposes strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks until manual review by the security team. Database-level encryption protects data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each administered through a hardware security module that records every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm validate the effectiveness of these controls, with critical findings fixed within 48 hours. Security incident response procedures are tested through bi-annual tabletop exercises involving the Data Protection Officer, with a documented breach notification workflow ensuring German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.

6. Information Retention and Removal Policies

Incaspin Casino runs a precise data retention plan intended to meet statutory record-keeping requirements while limiting the keeping of personal data past its necessary purpose. Player account data and entire transaction records are retained for the full length of the current business relationship, characterized as the time from account creation up to the account is closed, plus an additional statutory retention term stipulated by German anti-money laundering legislation and commercial law. Under the Geldwäschegesetz, identification records, transaction confirmations, and due diligence papers must be maintained for at least five years from the end of the calendar year in which the business relationship terminated. Accounting records pertinent to tax requirements are stored for ten years in accordance with the German Fiscal Code. Following the expiration of these mandatory periods, personal data is either irreversibly masked so that re-identification becomes impossible with all means reasonably probable to be applied, or reliably deleted through cryptographic erasure and physical storage media wiping procedures. Technical logs and security event data adhere to a reduced retention period of twelve months, after which they are compiled into anonymised statistical reports. Inactive accounts demonstrating no login activity for a consecutive period of 24 months are marked for dormancy review, and the associated personal data is minimised to keep only the core identifier and transaction records required for the leftover statutory retention clock. The casino deploys automated data lifecycle management scripts that execute weekly to find records over their retention limits, triggering deletion procedures without human input, with the results logged for compliance audit reasons.

9. Cookie Policy and Tracking Technologies

9.1 Core and Operational Cookies

The Incaspin Casino website and mobile platform utilize a range of cookies and similar tracking technologies to provide core functionality. Strictly necessary cookies handle session state across page loads, preserve login authentication tokens, and maintain security context for CSRF protection. These first-party session cookies terminate when the browser is closed and do not require prior consent under German law implementing the ePrivacy Directive, as they are essential for the required service delivery. Functional cookies store language preferences, preferred currency displays, and responsible gambling limit settings across visits, making sure that returning players experience a consistent personalized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they expire automatically if the player has not revisited the platform. Incaspin Casino does not use flash cookies, supercookies, or any respawning techniques that circumvent browser deletion actions.

9.2 Metrics and Marketing Cookies

Analytics and marketing cookies are set only after German players give explicit, freely given consent through the cookie consent management platform displayed on first visit. The consent tool displays clear descriptions of each cookie category, the specific providers engaged, the purposes of data collection, and the retention duration for each cookie type. Players may give or refuse consent for each category independently, and consent preferences are stored as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service monitor aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies support campaign attribution and frequency capping for promotional banners shown within the logged-in casino environment. German players may change their consent choices at any time by visiting the cookie settings panel referenced in the website footer. Declining analytics or marketing cookies does not affect gameplay functionality or account standing in any manner. The consent tool re-prompts players annually to update or update their preferences.

8. Entitlements of Germany-based Data Subjects

German players hold the complete range of data subject prerogatives specified in Articles 15 through 21 of the GDPR, as well as the entitlement to file a appeal with a supervisory authority. The right to access permits players to receive confirmation of whether Incaspin Casino processes their private data and to receive a duplicate of that data including information about processing purposes, types, receivers, storage durations, and the occurrence of automated decision-making. Access inquiries are completed within one month, at no cost for the primary request, with the response delivered in a structured, widely used, machine-readable format. The right of correction enables players to amend incorrect personal data or supplement incomplete documents, a particularly relevant prerogative for identity document updates following name alterations or address relocations. Incaspin Casino handles rectification requests within ten business days and acknowledges corrections to any third-party recipients to whom the inaccurate data was revealed. The right to erasure applies where the personal data is not anymore required for the purposes for which it was collected, where authorization is withdrawn, where the player raises objection to processing and no prevailing legitimate grounds exist, or where processing is illegal. Nonetheless, statutory retention requirements supersede erasure requests, and data needed for legal compliance will be confined from further processing rather than deleted until the retention period expires. The right to restriction of processing serves as an substitute where the accuracy of data is challenged, processing is illegal but the player opposes deletion, or the player needs the data for legal assertions despite the controller no longer requiring it. Data portability entitlements under Article 20 GDPR extend only to data provided by the player and dealt with by automated ways based on permission or agreement, meaning gameplay history and transaction logs are suitable for portability while fraud detection assessments obtained from internal algorithms do not. Rights inquiries should be directed to the Data Protection Officer email address, with proper proof of identity required before any data is disclosed.

4. Data Sharing and Third-Party Recipients

4.1 Internal Data Access Architecture

Inside the Incaspin Casino operational framework, personal data access utilizes a strict least-privilege model used for four distinct personnel tiers. Customer support agents retrieve basic account information and communication history but cannot view full financial records or identity documents. Compliance officers hold permissions to review verification documents, transaction patterns, and risk scores. Financial department personnel process withdrawal requests and view payment instrument details needed to execute transfers. IT security staff monitor system logs and security event data but do not typically interact with player-identifiable records. Every access event is recorded with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is examined quarterly by the Data Protection Officer. German players can request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.

4.2 External Providers and Regulatory Bodies

Incaspin Casino employs specialist external processors such as cloud hosting providers operating ISO 27001-certified data centres within the European Economic Area, payment processors authorised by the German Federal Financial Supervisory Authority, identity verification services that match submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment encompassing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts mandate data processing solely on documented instructions from Incaspin Casino, with no authority for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators take place only when legally mandated, and unless prohibited by law, the casino will alert affected players of such disclosures. The following key principles regulate all third-party data sharing arrangements:

• Processors receive only the least personal data needed to perform their agreed function, with field-level data minimisation applied to every integration.
• Sub-processor engagements require prior written consent from Incaspin Casino, and any unlicensed subcontracting constitutes a material breach of the data processing agreement.
• All processors must maintain ISO 27001 certification or comparable independently audited security qualifications, with current documentation filed with Incaspin Casino before data flows begin.
• No personal data is disclosed to advertising technology platforms, data brokers, or any entity whose primary business centers on monetising personal information.

Číslo 5: International Data Transfers

The core data storage infrastructure for Incaspin Casino operates from secure facilities located in the European Economic Area, specifically designed to serve the German market with latency-optimised connectivity while maintaining full GDPR jurisdictional coverage. Some specialised processing activities may involve international data transfers to countries outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For any such transfer, Incaspin Casino applies the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures implemented where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include complete encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who want to know the geographical flow of their information. Referenz