I'd say she is breaking gdpr regulations:
She is running a giveaway. She is being a touch careful with her words but she says "I want to give this away" and "Just pop your address in the box if you'd like to [receive this box of stuff]". She's collecting addresses which are classed as personal data under gdpr regs and she is doing so for the purpose of running a giveaway.
As a small business she does not have to keep as stringent gdpr records as a larger organisation must do. However if she passes any data onto a larger organisation ie LookFantastic, Ymu etc then she becomes liable for tighter record keeping. It is also advised that even small businesses follow the rules as closely as they can to protect themselves if they get caught with a data breach as the fines are seriously high.
When running a giveaway a business she should do the following:
Understand and document what data you collect
Get implicit consent for data collection
Implement procedures for data requests
Update your own privacy policy
More info here -
https://blog.woobox.com/2018/05/how-to-run-gdpr-compliant-giveaways-contests-and-quizzes/
And here (for larger organisations) -
https://ico.org.uk/for-organisation...-document-under-article-30-of-the-gdpr/#what2
So, she's running a give away:
She's not asking for consent to store addresses and she has to store them to be able to choose a winner
She is not saying if the addresses will be used for any other purposes eg used to work out some demographics of her followers
She is not saying how long she will keep the addresses for
She is not telling anyone how they can get their address removed from her records.