Privacy policy.

This privacy policy informs you about how we process personal data when you visit wompfel.com, place orders, contact us and request the printable sheet for our pairs game. Personal data is information relating to an identified or identifiable person.

1.Controller

The controller responsible for the data processing described below is anfema GmbH, Pienzenauerstr. 86, 81925 München, Germany, represented by its managing director Markus Reimer.

Phone: +49 89 55269932

E-mail: contact@anfe.ma

You can also reach us at this e-mail address with questions about data protection and to exercise your rights.

2.Hosting and server logs

We use CGHostGroup – Philipp Skorpil, Biberkopfstr. 9, 86163 Augsburg, Germany, to host this website. The server infrastructure is provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as a sub-processor. Processing by the host is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

When the website is accessed, technical access data is processed. This includes the IP address, date and time of the request, browser type and version, operating system, referrer URL and the host name of the accessing computer. This data is used to provide the website, analyse errors and fend off attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the website.

Server logs are deleted after three months at the latest. Where individual logs are required to investigate a specific security incident or to establish, enforce or defend legal claims, they are retained for the period necessary for that purpose.

3.Local storage and consent

For the shopping cart function and to store your consent choices, we use your browser's local storage, known as localStorage. Access to strictly necessary information takes place under Section 25(2) no. 2 TDDDG. Insofar as personal data is processed in this context, this is based on Art. 6(1)(b) GDPR for the shopping cart and on Art. 6(1)(f) GDPR for managing your choices. Our legitimate interest lies in respecting your privacy settings.

Shopping cart data is initially stored in your browser. When you place an order, the order information required to process it is transmitted. You can delete locally stored information via your browser settings; this may also cause your shopping cart to be lost.

Via the consent management you can select the categories “Statistics” for Google Analytics and “Marketing” for the Meta Pixel and TikTok Pixel separately, or reject both. We only load the respective services after you have consented to the corresponding category. The legal bases are Section 25(1) TDDDG for storing and accessing information on your device and Art. 6(1)(a) GDPR for the subsequent processing of personal data. Consent is voluntary. You can also use the shop without consenting to web analytics.

Your choice is stored for a maximum of three months; after that, we will ask for your decision again on your next visit. You can change it at any time via “Cookie settings” in the page footer and withdraw your consent with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected. You can additionally delete cookies that have already been stored via your browser.

4.Google Analytics 4

With your consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service helps us evaluate how our shop is used and improve what we offer.

In particular, information about device and browser, pages visited, origin and duration of the visit, and an approximate location derived from the IP address is processed. In addition, there are shop events such as figures viewed, sizes selected, cart actions, start of checkout and confirmed purchases including order number, order value, shipping costs and item data. Google uses the cookies _ga and _ga_* with identifiers to recognise a browser. These identifiers and order numbers may constitute personal data.

According to Google, IP addresses are not stored in Google Analytics 4. Names, e-mail addresses and delivery addresses are not part of the shop events we transmit to Google Analytics.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. The analytics cookies generally have a lifetime of up to two years; this may be renewed through repeated use. The retention period for user and event data set in our property is two months. Extending the period for user identifiers upon new activity is disabled. This retention setting does not apply to aggregated standard reports.

Google processes data on our behalf on the basis of a data processing agreement. Data may also be transferred to Google LLC in the USA. For transfers to recipients certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision pursuant to Art. 45 GDPR applies. The standard contractual clauses agreed with Google provide for additional safeguards. You can find information and contact options at https://policies.google.com/privacy and https://business.safety.google/adsprocessorterms/.

5.Meta Pixel

With your consent to the “Marketing” category, we use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. This allows us to measure the effectiveness of our advertising on Facebook and Instagram and to build audiences for interest-based advertising. In particular, we can re-target people who have visited our website or viewed certain items.

The IP address, device and browser information, pages visited, time of use, cookie identifiers and, where applicable, ad click identifiers are processed. In addition, the events “Product viewed”, “Added to cart”, “Checkout started” and “Purchase” are processed with item information, quantity, price, order value, currency and order identifier. Meta may combine this information with other data and associate it with a Facebook or Instagram account. The processing may also affect visitors who do not have such an account.

Meta uses in particular the cookie _fbp to recognise the browser and, where applicable, _fbc to attribute an ad click. These cookies usually have a lifetime of up to 90 days; repeated use may renew the lifetime. The lifetime of the cookies is not the same as the retention of the data transmitted to Meta. Further storage is governed by the purposes and criteria explained in Meta's privacy notices.

The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Use for marketing purposes requires your consent. You can withdraw it at any time via “Cookie settings”. Meta offers further settings for personalised advertising in the respective user account.

We and Meta Ireland are joint controllers pursuant to Art. 26 GDPR for the collection of event data on our website and its transmission to Meta. The allocation of responsibilities is set out in the Controller Addendum: https://www.facebook.com/legal/controller_addendum. We are responsible in particular for obtaining consent and for integrating the pixel on our website. Under this agreement, Meta is responsible in particular for handling data subject rights regarding the jointly processed data and for the security of processing at Meta. Regardless of this allocation of responsibilities, you can exercise your rights against both controllers. The subsequent processing by Meta takes place under its own responsibility.

Data may be transferred to Meta Platforms, Inc. in the USA. This company is certified under the EU-US Data Privacy Framework; such transfers are based on Art. 45 GDPR. Further international transfers are subject to the safeguards provided by Meta, in particular standard contractual clauses pursuant to Art. 46 GDPR. You can find information on processing, retention, recipients and contact options at https://www.facebook.com/privacy/policy/ and https://www.facebook.com/privacy/policies/cookies/.

6.TikTok Pixel

With your consent to the “Marketing” category, we use the TikTok Pixel from TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. This allows us to measure whether our advertising on TikTok leads to visits and purchases, optimise advertising campaigns and build audiences for interest-based advertising and for re-targeting website visitors.

The IP address, device and browser information, pages visited, times, cookie identifiers and, where applicable, the ad click identifier ttclid are processed. In addition, there are the events “Product viewed”, “Added to cart”, “Checkout started” and “Purchase” with item information, quantity, price, order value, currency and order identifier. TikTok may link this information with other information and associate it with a TikTok account. Technical usage data may be processed even without a TikTok account.

The pixel uses in particular _ttp and, depending on the pixel version used, further identifiers such as ttcsid and ttcsid_<Pixel-ID>. TikTok generally states a lifetime of up to 13 months from storage or last use for pixel cookies. The actual lifetime may be shortened by browser restrictions. These provider lifetimes must be distinguished from our own three-month retention period; they do not mean that TikTok deletes the transmitted data after three months. Storage by TikTok is governed by its own purposes and retention criteria.

The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Without marketing consent, the pixel is not loaded. You can withdraw your consent at any time with effect for the future via “Cookie settings”. You can make further settings for personalised advertising in your TikTok account.

For processing for personalised advertising and for optimising ad delivery, the joint controllership provisions pursuant to Art. 26 GDPR in the TikTok Business Products (Data) Terms and the Jurisdiction Specific Terms apply. These govern the respective obligations regarding information, security and data subject rights. We are responsible in particular for consent and the technical integration on our website; TikTok assumes the obligations provided for in the terms for its processing. You can also exercise your rights with us. Further processing by TikTok is governed by its privacy notices. The terms are available at https://ads.tiktok.com/i18n/official/policy/business-products-terms and https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms.

TikTok also processes data outside the European Economic Area. Transfers and access may take place in the USA, Singapore and China, among others. For transfers to countries without a relevant adequacy decision, TikTok provides in particular for standard contractual clauses pursuant to Art. 46(2)(c) GDPR. In such countries, the options for enforcing your data protection rights may be limited. You can find further information on recipients, processing locations, safeguards and retention at https://www.tiktok.com/legal/page/eea/privacy-policy/de and https://ads.tiktok.com/i18n/official/policy/privacy.

7.Orders and shipping

When you place an order, we process your name, your delivery and billing address, your e-mail address, your telephone number where applicable, and details of the ordered items, sizes, prices and the order number. The processing serves to accept and carry out your order, for delivery, invoicing and handling queries or warranty claims. The legal basis is Art. 6(1)(b) GDPR.

For delivery, we transmit your name and delivery address as well as the necessary shipment details to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. The legal basis is Art. 6(1)(b) GDPR. Your e-mail address is only transmitted for voluntary electronic shipment notifications if you have separately consented to this. The legal basis is then Art. 6(1)(a) GDPR; you can withdraw this consent with us at any time with effect for the future.

You must provide the information required for the purchase so that we can fulfil the contract. Without delivery and payment information, we cannot process the order. Voluntary information is not required to conclude the contract.

8.Payment processing via Stripe

We use Stripe Payments Europe, Ltd., Ireland, for payment processing. During checkout, you are redirected to a Stripe payment page. Stripe processes in particular payment data, name, address and contact data, transaction data and technical information required for payment processing and fraud prevention. We receive the information necessary to match and confirm the payment.

Processing to carry out the payment is based on Art. 6(1)(b) GDPR. Insofar as we process data to prevent payment fraud, this is based on Art. 6(1)(f) GDPR; our legitimate interest lies in secure payment processing. Depending on the respective activity, Stripe processes data as a processor or as an independent controller, in particular to fulfil its own legal obligations and for fraud prevention.

Data may be transferred to Stripe, Inc. in the USA and other recipients within the Stripe group. For international transfers, Stripe uses in particular the EU-US Data Privacy Framework for appropriately certified recipients as well as standard contractual clauses. You can find information on recipients, transfer safeguards, retention and rights at https://stripe.com/de/privacy and https://stripe.com/legal/data-privacy-framework.

9.Pairs game printable sheet

If you request the printable sheet for our pairs game, we process your e-mail address, the selected language and the time of the request in order to send you the printable sheet and handle any delivery problems. The legal basis is Art. 6(1)(b) GDPR. Without your e-mail address, sending by e-mail is not possible. We do not use the address for this purpose for advertising or a newsletter.

To send e-mails, we use Brevo, a service of Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France. Processing takes place on our behalf on the basis of an agreement pursuant to Art. 28 GDPR. The servers used for this service are located in the European Union.

To protect against abusive repeated requests, we use a hash value derived from the IP address and count the requests per internet connection within a one-hour time window. Such a hash value is no guarantee of anonymisation. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the sending service from abuse.

Your e-mail address and the associated request data are deleted as soon as sending and the handling of any delivery problems have been completed and no further retention is required, at the latest three months after the request. Abuse protection data is subject to the general rule on storage periods in the section “Retention period”.

10.Contact and service providers

If you contact us by e-mail, we process your contact details and the content of your message to handle the request. For contract-related requests, Art. 6(1)(b) GDPR is the legal basis. For other requests, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in responding to incoming enquiries.

Access is granted to the persons entrusted with handling and to the technical service providers used for this purpose, in particular hosting and e-mail service providers. Processors are engaged pursuant to Art. 28 GDPR. We pass data on to authorities or other recipients if there is a legal obligation or another legal basis under data protection law permits this.

11.Retention period

For personal data that we store ourselves or have stored by processors for our purposes, a maximum period of three months generally applies. We delete it earlier if the respective purpose has already been fulfilled. Exceptions exist for contract processing that is still necessary, statutory retention obligations and the necessary establishment, enforcement or defence of legal claims. Cookie lifetimes on your device must be distinguished from this. Data that other providers process as independent controllers is subject to their own retention rules, over which we do not have full control. We delete contact requests once they have been fully handled, provided there are no statutory retention obligations and the data is no longer required to enforce or defend legal claims. Data for preventing abuse is deleted as soon as it is no longer needed for that purpose.

For documents that must be retained by law, Art. 6(1)(c) GDPR applies. Under Section 257 HGB and Section 147 AO, invoices and other accounting vouchers are generally retained for eight years, commercial and business letters for six years, and books, inventories and annual financial statements for ten years. The periods generally begin at the end of the respective calendar year. Statutory extensions, in particular due to pending tax proceedings, remain reserved.

During a retention obligation, use is restricted to the respective retention purpose. After it expires, we delete the data unless there is another legal basis for further storage.

12.Your rights and withdrawal

Subject to the statutory requirements, you have the right of access under Art. 15 GDPR, rectification under Art. 16 GDPR, erasure under Art. 17 GDPR and restriction of processing under Art. 18 GDPR. The right to data portability under Art. 20 GDPR applies to data you have provided to us if the processing is based on consent or a contract and is carried out by automated means.

You can withdraw any consent you have given at any time with effect for the future. The lawfulness of processing before the withdrawal remains unaffected. A message to contact@anfe.ma is sufficient for your requests. You can also change the web analytics settings via “Cookie settings”.

13.Separate notice of your right to object

If we process personal data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. This also applies to profiling based on this legal basis. We will then no longer process the data concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims.

You can object at any time, without giving reasons, to the processing of your data for direct marketing. This also applies to profiling insofar as it is related to such direct marketing. After such an objection, the data will no longer be processed for these purposes. You can send your objection to contact@anfe.ma.

14.Right to lodge a complaint

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

The supervisory authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany. Further information: https://www.lda.bayern.de.

15.Security and updates

Our website uses TLS encryption for data transmission. The fonts used are loaded locally from our server; no connection is made to external font providers for this.

Within the scope of the website processing described here, we ourselves do not make any solely automated decisions with legal or similarly significant effects pursuant to Art. 22 GDPR. You can find information on independent checks by payment service providers in their privacy notices.

We update this privacy policy if the processing operations described change. Translations are intended to accurately reflect the content of this German version; your statutory data protection rights are not restricted by them.

Last updated: 9 October 2026