1.        
Prize draw: “Project 500 Bras”

The controller responsible for data processing is Vorfreude
GmbH, Wilhelm-Mauser-Str. 14-16, 50827 Cologne, Germany, email: fraguns@erlich-textil.com.

1.1.       
Data processed

The following personal data is processed as part of the promotion:
email address, first name, Instagram handle (if provided) and
interaction data such as points, referral activity and ranking position.
In addition, the content of messages and interactions may be processed
as part of communication via Instagram.

1.2.       
Purposes and legal bases of processing

Processing is carried out to run the promotion,
in particular to manage participation, to calculate points and
placings, and to provide and redeem discount codes.
The legal basis is Art. 6(1)(b) GDPR.

Where data is processed to prevent abuse, to check
eligibility requirements and to ensure a fair process,
this is done on the basis of Art. 6(1)(f) GDPR. The
legitimate interest lies in running the promotion properly and
free from manipulation.

As part of the promotion, an automated,
points-based ranking is created, which is based solely on the criteria described in the
terms of participation and has no legal or
similarly significant effects on the data subjects.

1.3.       
Recipients of the data

The following service providers are used
to run the promotion:

1.3.1.1.       
Email dispatch and campaign management: Klaviyo

We use Klaviyo to send emails and to manage and
evaluate campaigns.

In particular, email address, first name and usage and
interaction data (e.g. opens and clicks) are processed.

Processing is carried out to run the promotion under
Art. 6(1)(b) GDPR and for efficient communication and
campaign management under Art. 6(1)(f) GDPR.

Klaviyo processes personal data as a
processor on the basis of Art. 28 GDPR.

1.3.1.2.       
Referral and campaign tracking: Viral Loops

We use Viral
Loops to manage referral programmes.

In particular, email address, first name and
referral, usage and interaction data are processed.

Processing is carried out to run the promotion under
Art. 6(1)(b) GDPR and to ensure a proper and fair
process under Art. 6(1)(f) GDPR.

Viral Loops processes personal data as a
processor on the basis of Art. 28 GDPR.

1.3.1.3.       
Communication via Instagram: ManyChat and Meta
Platforms Ireland Ltd.

For communication with participants via Instagram and
for automated messaging processes, we use ManyChat and the
Instagram platform.

In particular, Instagram handle,
message content and interaction data are processed.

Processing is carried out to run the promotion and
to communicate with participants under Art. 6(1)(b) GDPR and for
the efficient handling of enquiries under Art. 6(1)(f) GDPR.

Where ManyChat processes personal data on our behalf,
this is done on the basis of Art. 28 GDPR. In addition,
ManyChat may process data under its own data protection
responsibility.

Personal data is processed by Instagram
under the independent data protection responsibility of Meta Platforms
Ireland Ltd.

1.4.       
Transfers to third countries

When the services mentioned are used, personal data may be
transferred to countries outside the EU/EEA,
in particular to the USA, where service providers based there are used.

Transfers are based on appropriate safeguards
under Art. 44 et seq. GDPR, in particular standard contractual clauses of the
European Commission.

1.5.       
Storage period

The data is deleted as soon as it is no longer required to run
and complete the promotion, but no later than 6
months after the promotion ends, unless statutory
retention obligations apply.

1.6.       
Obligation to provide data

Providing the data is required for
participation. Without this data, participation is not possible.

1.7.       
Data subject rights:

Data subjects have the right of access,
rectification, erasure, restriction of processing and
data portability.

They also have the right to object at any time to
processing based on Art. 6(1)(f) GDPR.

1.8.       
Right to lodge a complaint

There is a right to lodge a complaint with a
data protection supervisory authority.