Privacy notice for giveaways

Last updated: 20/04/2026

This privacy notice supplements our general privacy policy and informs you, in accordance with Art. 13 GDPR, how we process personal data in the context of our giveaways. The version valid at the time of entry applies.

1. Controller

The controller responsible for processing data in connection with our giveaways is:

Brendler, Hardtke, Hardtke GbR
Mondring 28
56410 Montabaur
Germany
Email: kontakt@flavour-heaven.de

2. What data do we process?

Depending on the giveaway and platform, we process the following categories of personal data:

  • For Instagram and other social-media giveaways: your public username, your profile picture URL, your interactions with the giveaway post (like, comment, tagging other users, following our profile), and any content you publicly post or send to us by direct message in the context of your entry.
  • For website or email giveaways: first and last name, email address and any other information you provide in the entry form.
  • If you win, additionally: full name and delivery address for sending physical prizes, or email address for sending voucher codes.

3. Purposes and legal bases of the processing

  • Running and handling the giveaway (identifying participants, drawing the winner, notifying winners, sending the prize): the legal basis is Art. 6(1)(b) GDPR (initiation and performance of a contract).
  • Transparent and traceable identification of the winner and documentation for fraud prevention: the legal basis is Art. 6(1)(f) GDPR (legitimate interest).
  • Publishing the winner's name or similar on our channels: only takes place with your express consent under Art. 6(1)(a) GDPR. Consent is voluntary and can be withdrawn at any time with effect for the future.
  • Compliance with statutory retention obligations (e.g. when shipping physical prizes to winners): the legal basis is Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB.

4. Voluntary nature of the information

Taking part in our giveaways and providing the associated personal data are voluntary. However, without the required data, taking part in the giveaway or having a prize delivered is not possible.

5. Recipients of the data

Your data will not be shared with third parties for advertising purposes. It will only be transferred:

  • to shipping providers (e.g. DHL), insofar as this is necessary for delivering the prize;
  • to IT service providers (in particular Shopify in connection with our shop and Meta Platforms Ireland Ltd. in connection with Instagram), who support us with the technical implementation;
  • to authorities or courts, insofar as we are legally obliged to do so.

6. Special note regarding Instagram giveaways

If you take part in a giveaway on Instagram, your public profile data and interactions are also processed by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We have only limited influence over this processing. Information about data protection at Instagram can be found at https://privacycenter.instagram.com/policy.

Our giveaways are in no way associated with Instagram or Meta and are not sponsored, supported or organised by Instagram.

7. Storage period

  • Entry data of non-winning participants will be deleted no later than six months after the end of the respective giveaway, unless statutory retention obligations require otherwise.
  • Winners' data will be stored for the purpose of shipping and subsequently retained in accordance with statutory retention obligations (up to 10 years pursuant to § 147 AO, § 257 HGB).
  • Records of consent (e.g. for publishing the winner's name) will be retained for the duration of publication and for three years thereafter, in order to comply with our accountability obligation under Art. 5(2) GDPR.

8. Your rights

As a data subject, you have the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing based on legitimate interests (Art. 21 GDPR)
  • Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)
  • Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for us is: The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, www.datenschutz.rlp.de.

To exercise your rights, an informal message to kontakt@flavour-heaven.de is sufficient.

9. No automated decision-making

Automated decision-making within the meaning of Art. 22 GDPR does not take place. Winners are determined randomly by drawing.

10. Changes to this notice

We reserve the right to amend this privacy notice if changes to legal or factual circumstances make this necessary. The current version is available on this page.