Privacy Policy

1) Controller & contact

For GDPR purposes, ZGenerator is the data controller for the processing described in this policy.

• Controller: case.de GmbH
• Address: Wittestr. 60, D-53225 Bonn
• Email: zgen@case.de

Legal notice details are available on the imprint.

2) What data we process

Depending on your usage, we may process:

• Instagram account data you connect (e.g., account ID, username, profile information made available through Meta/Instagram APIs).
• Giveaway post selection details (e.g., post ID/URL) and comments needed to pick a winner.
• Commenter data required for winner selection (e.g., comment text, comment ID, timestamp, and the commenter’s public username/ID as provided by the API).
• Technical and usage data (e.g., IP address, device/browser information, timestamps, and basic logs) for security and reliability.

3) Why we process data (purposes)

• To connect your Instagram account and fetch eligible posts.
• To retrieve comments and select a random giveaway winner as requested.
• To prevent abuse, troubleshoot issues, and secure our services.
• To comply with legal obligations (e.g., responding to lawful requests).

4) Legal bases (GDPR)

We rely on one or more of the following legal bases under GDPR, depending on the processing:

• Contract (Art. 6(1)(b)): to provide the winner selection functionality you request.
• Legitimate interests (Art. 6(1)(f)): to secure, maintain, and improve the service.
• Legal obligation (Art. 6(1)(c)): when we must comply with applicable laws.
• Consent (Art. 6(1)(a)): where required (for example, non-essential cookies).

5) Sharing of data

We may share personal data with:

• Meta Platforms, Inc. and its affiliates (Instagram/Facebook) where you choose to connect your account, and to access data through their APIs.
• Service providers (processors) who help us operate the service (e.g., hosting, logging, and analytics), under contractual protections.
• Authorities or third parties when required by law or to protect rights and security.

6) International transfers

Your data may be processed outside the European Economic Area (EEA) (for example, by Meta or infrastructure providers). Where applicable, we rely on appropriate safeguards (such as Standard Contractual Clauses) or other lawful transfer mechanisms.

7) Data retention

We keep personal data only as long as necessary for the purposes described above, including:

• Winner selection session data: retained for as short a period as practical, then deleted or anonymized.
• Security and operational logs: retained for a limited period to detect and prevent abuse.

8) Your rights (GDPR)

If you are in the EU/EEA, you may have the right to request access, rectification, deletion, restriction, portability, and to object to processing. You may also withdraw consent where processing is based on consent.

To exercise rights, contact: zgen@case.de

You also have the right to lodge a complaint with your local data protection authority.

9) Security

We use reasonable technical and organizational measures to protect personal data. No method of transmission or storage is 100% secure.

10) Data deletion instructions (Meta/Facebook requirement)

If you connected your Instagram account and want data deleted:

1. Remove ZGenerator’s access in your Meta/Instagram settings (Apps and Websites / Business Integrations).
2. Email zgen@case.de with the subject “Data Deletion Request” and include the Instagram username you used to connect.

We will verify the request and delete or anonymize associated data unless we are required to retain it by law.

11) Cookies

We may use essential cookies for security and session management. If we use non-essential cookies/analytics, we will request consent where required.

12) Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new effective date.