1.
Sweepstakes – "Project 500 Bras"

The company responsible for data processing is Vorfreude
GmbH, Wilhelm-Mauser-Str. 14–16, 50827 Cologne, Germany, Email: fraguns@erlich-textil.com.

1.1.
Processed Data

The following personal data will be processed as part of the promotion:
email address, first name, Instagram handle (if provided), and
interaction data such as points, referral activities, and ranking placement.
Additionally, content from messages and interactions may be processed during communication via Instagram.

1.2.
Purposes and Legal Bases of Processing

Processing is carried out for the purpose of conducting the promotion,
in particular for managing participation, calculating points and
rankings, and for providing and redeeming discount codes.
The legal basis is Art. 6 para. 1 b GDPR.

Insofar as data is processed for abuse prevention, to verify
eligibility, and to ensure fair conduct, this is done on the basis of Art. 6 para. 1 f GDPR. The
legitimate interest lies in the proper and manipulation-free
execution of the promotion.

As part of the promotion, an automated, point-based ranking
will be created, which is based exclusively on the criteria described in the
terms and conditions of participation and has no legal or
similarly significant impact on the data subjects.

1.3.
Recipients of the Data

The following service providers are used to carry out the promotion:

1.3.1.1.
Email dispatch and campaign management – Klaviyo

We use Klaviyo for sending emails and for managing and
evaluating campaigns.

In particular, email address, first name, and usage-
interaction data (e.g., opens and clicks) are processed.

Processing is carried out for the purpose of conducting the promotion according to
Art. 6 para. 1 b GDPR, and for efficient communication and
campaign management according to Art. 6 para. 1 f GDPR.

Klaviyo processes personal data as a processor on the basis of Art. 28 GDPR.

1.3.1.2.
Referral and Campaign Tracking – Viral Loops

We use Viral Loops for managing referral programs.

In particular, email address, first name, and
referral, usage, and interaction data are processed.

Processing is carried out for the purpose of conducting the promotion according to
Art. 6 para. 1 b GDPR, and to ensure proper and fair
conduct according to Art. 6 para. 1 f GDPR.

Viral Loops processes personal data as a processor on the basis of Art. 28 GDPR.

1.3.1.3.
Communication via Instagram – ManyChat and Meta
Platforms Ireland Ltd.

For communication with participants via Instagram and
for automated messaging processes, we use ManyChat and the Instagram
platform.

In particular, Instagram handle, message content, and interaction data are processed.

Processing is carried out for the purpose of conducting the promotion and
for communication with participants according to Art. 6 para. 1 b GDPR, and for
efficient processing of inquiries according to Art. 6 para. 1 f GDPR.

Insofar as ManyChat processes personal data on our behalf,
this is done on the basis of Art. 28 GDPR. Furthermore,
processing by ManyChat may occur under its own data protection responsibility.

The processing of personal data by Instagram is carried out
under the sole data protection responsibility of Meta Platforms
Ireland Ltd.

1.4.
Third Country Transfer

When using the aforementioned services, personal data may be transferred to countries outside the EU/EEA, in particular to the USA, if service providers based there are used.

The transfer is based on appropriate safeguards pursuant to
Art. 44 et seq. GDPR, in particular through standard contractual clauses of the
European Commission.

1.5.
Storage Duration

The data will be deleted as soon as it is no longer required for the execution
and settlement of the promotion, but no later than 6
months after the completion of the promotion, unless there are legal
retention obligations.

1.6.
Obligation to Provide

The provision of data is required for participation. Without this data, participation is not possible.

1.7.
Data Subject Rights:

Data subjects have the right to information,
rectification, erasure, restriction of processing, and
data portability.

Furthermore, there is a right to object to processing based on Art. 6 para. 1 f GDPR at any time.

1.8.
Right to Lodge a Complaint

There is a right to lodge a complaint with a data protection supervisory authority.