Granular Grape

This Privacy Notice outlines how Incaspin Casino collects, processes, retains, and safeguards personal data pertaining to players located in Germany. The document works within the scope of the European Union’s General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG-neu). Incaspin Casino serves as the data controller for personal information furnished through its website, mobile applications, and related services. German players have specific statutory rights relating to their data, and this notice outlines the lawful bases for processing, data retention periods, third-party sharing protocols, and the technical safeguards implemented to prevent unauthorised access. The document also details the responsibilities of the Data Protection Officer and the supervisory authority contact procedures. Every section has been compiled to ensure transparency and compliance with Article 13 and Article 14 of the GDPR, giving German users with a complete overview of how their casino account data, payment details, identification documents, and behavioural analytics are managed throughout the entire customer lifecycle.

První bod: Identita správce údajů and Contact Details

The data controller for all personal data zpracovávané na platformě the Incaspin Casino webové stránky představuje the legal entity operating under the brand name Incaspin Casino, zapsaná v státě uznávané pro přijetím EU data protection equivalence standards. The registered office address a registrační číslo poskytneme na žádost s ověřením totožnosti zasláním e-mailu the Data Protection Officer, nebo nahlédnutím do sekce otisku webové prezentace. Hráči z Německa mohou adresovat any privacy-related inquiries na jmenovanému pracovníkovi pro ochranu údajů, který působí nezávisle and reports directly to nejvyššímu managementu. The DPO can be reached via vyhrazeného šifrovaného e-mailového kanálu published within the full privacy policy text. Incaspin Casino maintains a legal representative within the European Union pro účely článku 27 GDPR, čímž zajišťuje, že německé kontrolní orgány i dotčené osoby have a direct point of contact ohledně regulačních otázek. Správce determines the purposes and means of processing all personal data collected during vytváření účtu, Know Your Customer verification, platebních transakcích vkladů a výběrů, and ongoing gameplay activity. To zahrnuje data generated through cookies, technologií otisku zařízení, and server logs. Hráči z Německa by si měli uvědomit, that the controller exercises full decision-making power nad operacemi zpracování údajů while commissioning pečlivě prověřené zpracovatele pro specifické technické služby such as hosting, payment gateways, a platformy pro řízení vztahů se zákazníky. Každá smluvní dohoda se zpracovatelem se řídí závaznou smlouvou o zpracování údajů jež vyhovuje podmínkám článku 28 GDPR, s možností provádět povinné audity pro Incaspin Casino k ověření trvalého dodržování předpisů. Podrobné kontakty zástupce v EU byly sděleny the competent German data protection authority as required by law.

Číslo 5: International Data Transfers

The primary data storage infrastructure for Incaspin Casino resides within secure facilities located in the European Economic Area, specifically designed to serve the German market with low-latency connectivity while maintaining full GDPR jurisdictional coverage. Certain specialised processing activities may involve international data transfers outside the EEA, including fraud detection services operating from certified facilities in third countries and customer support continuity arrangements during peak demand periods. For every such transfer, Incaspin Casino applies the safeguards mandated by Chapter V of the GDPR. Standard contractual clauses approved by the European Commission form the foundational transfer mechanism for processor relationships, with supplementary technical and organisational measures utilised where the recipient country lacks an adequacy decision from the European Commission. German players should understand that supplementary measures include complete encryption of data in transit and at rest using AES-256 standards, strict key management policies that prevent the foreign processor from accessing plaintext data, and contractual obligations requiring the processor to challenge any government access request and notify Incaspin Casino immediately when legally permitted. Transfer impact assessments are conducted prior to onboarding any non-EEA processor and are reviewed whenever the legal landscape of the recipient jurisdiction changes materially. The Data Protection Officer maintains a current register of all international transfers, which is made available to the competent German data protection authority upon request and can be summarised for data subjects who seek to grasp the geographical flow of their information.

7. Information Security Measures

Incaspin Casino deploys a multilevel security architecture aligned with the ISO 27001 control framework and the technical requirements specified in Article 32 of the GDPR. Network-level protections include enterprise-grade firewalls set up with stateful packet inspection, intrusion detection and prevention systems that watch traffic patterns for indicators of compromise, and distributed denial-of-service mitigation services that absorb volumetric attacks before they reach the application layer. All data transferred between German player devices and casino servers is encrypted using Transport Layer Security version 1.3 with forward secrecy enabled, avoiding retrospective decryption of captured traffic even if long-term private keys are subsequently exposed. Internal administrative interfaces are segmented on a management network inaccessible from the public internet, with access allowed solely through multi-factor authenticated VPN tunnels starting from pre-registered static IP addresses belonging to authorised personnel. At the application layer, the platform imposes strong password policies necessitating minimum character lengths and complexity standards, with passwords hashed using bcrypt with per-user salts before storage. Account access anomalies activate step-up authentication challenges or temporary account locks until manual review by the security team. Database-level encryption protects data at rest, with separate encryption keys for personal data columns, financial fields, and identity document stores, each controlled through a hardware security module that logs every key access operation. Regular vulnerability scanning and annual penetration testing by an independent CREST-accredited security firm validate the effectiveness of these controls, with critical findings resolved within 48 hours. Security incident response procedures are tested through bi-annual tabletop exercises involving the Data Protection Officer, with a documented breach notification workflow ensuring German players and the supervisory authority receive notification within the 72-hour deadline stipulated by GDPR.

3. bod Purposes and Legal Bases for Processing

Incaspin Casino zpracovává osobní data under several distinct GDPR právních základů, selected according to konkrétní zpracovatelské činnosti. The performance of a contract ve smyslu Article 6(1)(b) GDPR pokrývá veškeré zpracování údajů nezbytné k vytvoření a vedení účtu hráče, process deposits and withdrawals, a doručení the interactive gaming services které German players actively request při registraci. This zahrnuje transmitting payment instructions zúčtovacím bankám and verifying že players splňují the minimum age requirement of 18 years dle německé legislativy. Legal obligation processing under Article 6(1)(c) GDPR pokrývá anti-money laundering customer due diligence, hlášení podezřelých transakcí příslušným finančním zpravodajským jednotkám, uchovávání záznamů to satisfy obchodně-právních a daňových požadavků, a dodržování with German gambling regulations concerning player protection standards. Použitelné právní rámce obsahují zákon o praní špinavých peněz a předpisy Glücksspielstaatsvertragu pokud je to relevantní pro povinnosti uchovávání dat.

Legitimate interests sledované Incaspin Casino under Article 6(1)(f) GDPR zahrnují network and information security monitoring, fraud prevention and detection, direct marketing of similar products to existing customers tam, kde je to dovoleno podle Section 7 of the German Act Against Unfair Competition, a obchodní analýzy za účelem zlepšení služeb. German players retain nezpochybnitelné právo to object to processing based on legitimate interests, včetně profilování pro účely přímého marketingu, a tyto námitky will be honoured bez zbytečného odkladu. Souhlas dle Article 6(1)(a) GDPR is relied upon pro nepovinná marketingová sdělení e-mailem a SMS pokud hráč aktivně souhlasil, pro umístění nepodstatných cookies a sledovacích technologií, and for sensitive data processing v konkrétních případech. Consent withdrawal mechanisms jsou nápadně umístěny v nastavení účtu and every marketing communication footer, with withdrawal taking effect bez zpětných důsledků pro dříve zákonné zpracování. German players kteří ještě nedosáhli věku 18 let nesmějí otevírat účty, a jakákoli neúmyslně shromážděná data nezletilých je ihned po odhalení odstraněna.

6. Data Storage and Erasure Rules

Incaspin Casino runs a detailed data retention policy intended to fulfill statutory record-keeping duties while minimising the retention of personal data beyond its useful purpose. Player account data and full transaction histories are retained for the complete duration of the current business relationship, defined as the period from account creation until the account is terminated, plus an supplementary statutory retention duration stipulated by German anti-money laundering regulations and commercial law. Under the Geldwäschegesetz, identification documents, transaction receipts, and due diligence documentation must be kept for at least five years following the end of the calendar year in which the business relationship concluded. Accounting records pertinent to tax duties are retained for ten years in conformity with the German Fiscal Code. Following the end of these mandatory periods, personal data is either irreversibly anonymised so that re-identification becomes impossible with all means reasonably likely to be used, or safely removed through cryptographic erasure and physical storage media sanitisation procedures. Technical logs and security event data adhere to a briefer retention interval of twelve months, after which they are compiled into anonymised statistical reports. Inactive accounts exhibiting no login activity for a unbroken period of 24 months are marked for dormancy check, and the related personal data is minimised to keep only the core ID and transaction records necessary for the leftover statutory retention clock. The casino utilizes automated data lifecycle management routines that operate weekly to find records over their retention thresholds, triggering deletion procedures without human involvement, with the results logged for compliance audit purposes.

4. Data Sharing and Third-Party Recipients

4.1 Internal Data Access Structure

Within the Incaspin Casino operational structure, personal data access utilizes a strict least-privilege model used for four distinct personnel tiers https://incaspincasino.de.com/legal-and-affiliates. Customer support agents access basic account information and communication history but cannot view full financial records or identity documents. Compliance officers have permissions to inspect verification documents, transaction patterns, and risk scores. Financial department personnel process withdrawal requests and view payment instrument details required to execute transfers. IT security staff review system logs and security event data but do not regularly interact with player-identifiable records. Every access event is tracked with a timestamp, user identifier, and purpose code, creating an immutable audit trail that is checked quarterly by the Data Protection Officer. German players may request a copy of the access log entries pertaining to their account by submitting a subject access request through the designated privacy channel.

4.2 Third-Party Services and Authorities

Incaspin Casino employs specialist external processors including cloud hosting providers operating ISO 27001-certified data centres in the European Economic Area, payment processors authorised by the German Federal Financial Supervisory Authority, identity verification services that compare submitted documents against authoritative databases, email delivery platforms for transactional communications, and CRM software vendors for customer engagement analytics. Each processor undergoes a rigorous vendor assessment addressing technical security measures, sub-processor transparency, international transfer safeguards, and business continuity capabilities. Contracts stipulate data processing solely on documented instructions from Incaspin Casino, with no right for the processor to repurpose data for its own objectives. Regulatory disclosures to German law enforcement agencies, tax authorities, or gambling regulators happen only when legally mandated, and unless prohibited by law, the casino will inform affected players of such disclosures. The following key principles govern all third-party data sharing arrangements:

• Processors receive only the least personal data required to perform their agreed function, with field-level data minimisation implemented to every integration.
• Sub-processor engagements demand prior written consent from Incaspin Casino, and any unapproved subcontracting represents a material breach of the data processing agreement.
• All processors must have ISO 27001 certification or similar independently audited security qualifications, with current documentation filed with Incaspin Casino before data flows commence.
• No personal data is sold to advertising technology platforms, data brokers, or any entity whose primary business involves monetising personal information.

9. Cookie Policy and Tracking Technologies

9.1 Essential and Functional Cookies

The Incaspin Casino platform and mobile platform utilize a set of cookies and similar tracking technologies to ensure core functionality. Strictly necessary cookies manage session state across page loads, preserve login authentication tokens, and preserve security context for CSRF protection. These first-party session cookies end when the browser is closed and do not require prior consent under German law transposing the ePrivacy Directive, as they are necessary for the requested service delivery. Functional cookies store language preferences, preferred currency displays, and responsible gambling limit settings across visits, ensuring that returning players encounter a uniform personalized environment without reconfiguring their preferences. The maximum lifespan of functional cookies is 365 days, after which they expire automatically if the player has not returned to the platform. Incaspin Casino does not use flash cookies, supercookies, or any regenerating techniques that bypass browser deletion actions.

9.2 Metrics and Marketing Cookies

Analytics and marketing cookies are set only after German players give explicit, freely given consent through the cookie consent management platform presented on first visit. The consent tool displays clear descriptions of each cookie category, the specific providers involved, the purposes of data collection, and the retention duration for each cookie type. Players may give or deny consent for each category independently, and consent preferences are recorded as documentary evidence in an encrypted consent log with timestamp and IP address. Analytics cookies from a privacy-focused measurement service track aggregated page interaction metrics without cross-site tracking or user-level profiling. Marketing cookies support campaign attribution and frequency capping for promotional banners shown within the logged-in casino environment. German players may adjust their consent choices at any time by visiting the cookie settings panel located in the website footer. Rejecting analytics or marketing cookies does not influence gameplay functionality or account standing in any manner. The consent tool asks again players annually to update or update their preferences.

Summary

Incaspin Casino has structured its data protection structure to satisfy the high standards expected by German players and required by the GDPR and the BDSG-neu. From the initial collection of identity and contact information through to the ultimate deletion or anonymisation of records years after account closure, every personal data life cycle stage works under written policies, contractual safeguards, and technical controls that are regularly audited and improved. The casino preserves transparent communication channels for rights requests, provides granular cookie consent options, and limits data sharing to vetted processors and legally mandated disclosures. German players are urged to read this Privacy Notice alongside the general Terms and Conditions and the Responsible Gambling Policy available on the Incaspin Casino website, and to contact the Data Protection Officer with any questions about how their personal information is handled.

8. Entitlements of German Data Subjects

German gamblers enjoy the full range of data subject rights listed in Articles 15 through 21 of the GDPR, together with the option to file a appeal with a supervisory authority. The access right allows players to receive verification of as to whether Incaspin Casino processes their private data and to get a copy of that data along with information about processing objectives, classes, addressees, retention periods, and the presence of automated decision-making. Access applications are processed within one month, free of charge for the primary request, with the response delivered in a ordered, generally used, machine-readable layout. The rectification right allows players to correct incorrect personal data or complete incomplete records, a particularly relevant prerogative for identity document revisions following name alterations or address transfers. Incaspin Casino deals with rectification inquiries within ten business days and confirms corrections to any third-party recipients to whom the inaccurate data was shared. The erasure right applies where the personal data is no longer needed for the objectives for which it was gathered, where consent is withdrawn, where the player opposes to processing and no prevailing legitimate grounds are present, or where processing is illegal. Nonetheless, statutory retention obligations take precedence over erasure requests, and data necessary for legal compliance will be restricted from further processing rather than removed until the retention period ends. The right of limitation of processing serves as an option where the precision of data is challenged, processing is unlawful but the player objects to deletion, or the player needs the data for legal assertions despite the controller no longer requiring it. Data portability entitlements under Article 20 GDPR extend only to data provided by the player and handled by automated means based on permission or contract, implying gameplay history and transaction logs qualify for portability while fraud detection scores derived from internal algorithms do not. Rights requests should be directed to the Data Protection Officer email address, with proper proof of identity needed before any data is released.

2. Categories of Personal Data Collected

Two Point One Identity Confirmation and Player Data

German users must supply specific individual data to set up and maintain an living Incaspin Casino account. This category covers full legal full name, physical address, DOB, place of birth, citizenship, and gender. For identification validation purposes needed under German anti-money laundering laws, the casino collects government-issued identity papers such as passport scans, national identity card scans, and residence permit papers. The system also records the ID number, issuing authority, expiration date, and a biometrical comparison score produced during the automated verification process. im Detail Residential confirmation is done through current utility bills, bank statements, or formal communication that plainly shows the user’s full name, recorded address, and an creation day within the last three months. Incaspin Casino applies these validation prerequisites evenly to comply with the 4th and 5th Anti-Money Laundering Orders as incorporated into German law, ensuring that all account meets the regulatory identity certainty level before any withdrawals are authorized.

Two Point Two Financial and Deal Data

Financial data encompasses all transaction records, including payment method identifiers, masked card numbers, e-wallet account email addresses, bank account IBAN details for SEPA transfers, and cryptocurrency wallet addresses where applicable. Incaspin Casino stores complete transaction histories showing timestamps, amounts in EUR or equivalent cryptocurrency, processing statuses, and any intermediary payment processor references. Source of funds declarations and supporting documents such as payslips, tax returns, or business financial statements are collected when players reach specific deposit thresholds or trigger enhanced due diligence procedures. This data is isolated in encrypted database tables with access limited to compliance personnel and senior financial officers. German players using Sofort, Giropay, or other local payment methods should be aware that the chosen payment provider will also process transaction data according to its own privacy policy, with Incaspin Casino obtaining only the information necessary to credit the player account.

2.3 Technical and Behavioural Data

While German players access the Incaspin Casino platform, the system captures technical identifiers including IP addresses, device types, operating system versions, browser fingerprints, screen resolutions, language settings, and mobile carrier details. Session data includes login timestamps, page navigation paths, game launches, bet amounts, win and loss records, and in-game feature activations. This technical corpus permits the casino to provide optimised gaming experiences, spot fraudulent activity patterns, and respect responsible gambling self-exclusion settings. Behavioural analytics monitor betting frequency, average stake sizes, session duration, and deposit velocity to feed the responsible gambling algorithms that create personalised risk alerts. All technical logs are anonymised where possible and stored separately from core identity records, with re-identification possible only through a strictly regulated cryptographic lookup procedure available exclusively to the fraud and compliance teams under documented access justification.