Privacy Policy

Effective Date: September 22, 2026‌

This Privacy Policy is issued by WF Kleidung Fahjen GmbH (“we”, “us”, “our”), located at Heidkamp 19, 27404 Zeven-Oldendorf, Germany. It applies to all personal data processing activities carried out through our official website www.wfkleidung.com and all related services we provide to users and customers. We take the protection of your personal privacy extremely seriously, and this document outlines clearly how we collect, store, use, share and protect your personal data, as well as the rights you hold as a data subject under applicable laws including the EU General Data Protection Regulation (GDPR, DSGVO in German) and the German Federal Data Protection Act (BDSG).

1. Data Controller Information

For all personal data processing activities described in this Privacy Policy, the data controller as defined under Article 4 of the GDPR is:
WF Kleidung Fahjen GmbH
Heidkamp 19, 27404 Zeven-Oldendorf, Germany
Contact Email: quant@wfkleidung.com
Contact Telephone: +49 4281 3139

If you have any inquiries, concerns or requests related to your personal data, you can reach out to our data protection team directly via the contact methods listed above at any time. We will respond to all legitimate communications from data subjects within 30 days as required by applicable law.

2. Scope of Personal Data We Collect

We only collect personal data that is necessary to deliver our minimalist apparel products and related services to you, strictly following the data minimization principle set out in Article 5 of the GDPR. The categories of personal data we may process include:

  • ‌Data you actively provide to us‌: When you create a user account, place an order, subscribe to our newsletter, submit a contact form or reach out to our customer support team, you may provide us with your full name, billing and shipping address, email address, contact phone number, payment details (including bank account information or payment service provider identifiers you share for order settlement), and any optional personal preferences you voluntarily share, such as clothing size, style preferences and notes for your orders.
  • ‌Data we collect automatically when you visit our website‌: When you browse www.wfkleidung.com, our systems automatically collect certain technical data to ensure the stable, secure and optimized operation of the site. This includes your device IP address, browser type and version, operating system information, timestamp of your access, pages you view on our site, links you click, duration of your visit, geolocation region (at city level only, no precise positioning data) and other diagnostic data related to your browsing behavior.
  • ‌Data we obtain from legitimate third parties‌: In limited circumstances, we may receive supplementary data from payment service providers, logistics partners and anti-fraud service providers to verify transaction legitimacy, complete order delivery and prevent fraudulent activities, provided that these third parties have obtained your explicit consent or have legal authorization to share such data with us.

We will never collect special categories of personal data (including racial origin, religious beliefs, health status, biometric data and other sensitive information) without your explicit, written, freely given, specific and unambiguous consent.

3. Legal Bases and Purposes of Data Processing

All our personal data processing activities are supported by a valid legal basis under Article 6 of the GDPR, and we only process your data for the explicitly stated, legitimate purposes notified to you at or before the moment of collection:

  1. ‌Processing based on Article 6(1)(b) GDPR: Performance of Contract‌
    We process your full name, delivery address, contact information and payment data primarily to fulfill the purchase contract we enter into with you when you place an order on our website. This processing is necessary to confirm your order details, process payment, arrange product production and shipment, track delivery status, handle after-sales inquiries, process returns and refunds, and fully execute all contractual obligations related to your purchase of our minimalist apparel products. Without this data, we will not be able to complete your order and deliver the goods you have requested.
  2. ‌Processing based on Article 6(1)(a) GDPR: Your Explicit Consent‌
    For activities that are not strictly necessary for the performance of our purchase contract, we will only process your personal data after we obtain your opt-in, explicit prior consent. This includes sending our marketing newsletter with information about new arrivals, best seller collections and exclusive offers (you can withdraw your consent to newsletter subscription at any time via the unsubscribe link included in every marketing email, or by sending a message to our contact email), and using anonymized or pseudonymized browsing tracking tools to analyze user behavior on our website for experience optimization, as long as such processing is not covered by our legitimate interests clause.
  3. ‌Processing based on Article 6(1)(f) GDPR: Our Legitimate Interests‌
    Under this legal basis, we process your technical browsing data, IP address and basic transaction records to pursue our legitimate interests of ensuring the long-term stable, secure and efficient operation of our e-commerce website. This includes preventing unauthorized access, detecting malicious cyber activities and fraud, troubleshooting technical malfunctions, optimizing website loading speed and user interface experience, generating aggregated, non-personal statistical reports about overall user visiting trends that cannot identify any individual, and enforcing our website terms and conditions. We confirm that all processing activities carried out under this legitimate interest clause do not override your fundamental privacy rights and freedoms, and we always balance our operational needs against your privacy interests.
  4. ‌Processing based on Article 6(1)(c) GDPR: Compliance with Legal Obligations‌
    We may process your personal data when it is necessary for us to comply with legal obligations that we are subject to under the laws of the Federal Republic of Germany, EU consumer protection regulations, tax laws and commercial code requirements. This includes retaining transaction records for tax audit purposes, providing necessary data to competent regulatory authorities when we receive legally binding official requests, and fulfilling information disclosure requirements stipulated by the 2026 German Consumer Law Amendment Act which implements Directive (EU) 2024/825 and Directive (EU) 2023/2673.

4. Sharing and Disclosure of Your Personal Data

We will never sell, rent or lease your personal data to unrelated third parties for commercial marketing purposes without your separate explicit consent. We may only share your personal data with carefully selected third parties in the limited circumstances outlined below, and all such sharing activities will be fully compliant with applicable data protection laws:

  • ‌Authorized data processors we cooperate with‌: We work with trusted third-party service providers who act as data processors on our behalf, to perform tasks necessary for the operation of our business. These providers include cloud hosting service providers that store our website and order data, logistics and shipping partners that deliver your ordered apparel products to your designated address, payment service providers that process your payment transactions securely, IT maintenance service providers that assist us with website technical upgrades, and anti-fraud service providers that help us prevent payment fraud. Before we engage any such data processor, we sign a formal Data Processing Agreement (Auftragsverarbeitungsvertrag) in full compliance with Article 28 of the GDPR, which binds the processor to strict data protection obligations, requires them to only process personal data according to our explicit documented instructions, and mandates that they implement equivalent technical and organizational security measures to protect your data.
  • ‌Legal successors and authorized third parties in transaction scenarios‌: In the event of a full or partial merger, acquisition, corporate restructuring, asset sale or other business transfer involving our company, your personal data held by us may be transferred to the relevant successor entity. We will require the receiving party to continue to process your personal data in full compliance with the terms of this Privacy Policy and all applicable data protection laws, and we will give you reasonable advance notice if the transfer will materially change the way we process your personal data.
  • ‌Disclosure required by law or legitimate official requests‌: We may disclose your personal data if we are required to do so by binding legal provisions, valid court orders, or official requests issued by competent German or European regulatory authorities. We will verify the legitimacy of every such disclosure request strictly before releasing any of your personal data, to ensure that the disclosure is necessary, proportionate and fully compliant with legal requirements.

5. Cross-Border Transfer of Personal Data

As a Germany-based e-commerce brand operating primarily within the European Economic Area (EEA), most of your personal data is stored and processed on servers located in Germany and other EEA member states. In very limited scenarios, some of your personal data may be transferred to jurisdictions located outside the EEA. In all such cases, we will strictly comply with Chapter V of the GDPR, and ensure that the cross-border transfer provides an adequate level of protection for your personal data that is equivalent to the standards required under European data protection law:

  • If the third country outside the EEA has received an adequacy decision from the European Commission confirming its overall adequate level of personal data protection, we will carry out the transfer in accordance with relevant regulations.
  • For third countries that do not have an adequacy decision, we will put in place appropriate safeguards as specified under Article 46 of the GDPR, most commonly the standard data protection clauses (Standardvertragsklauseln) officially adopted by the European Commission, to sign a legally binding agreement with the recipient of your personal data, to enforce sufficient protection for your rights related to the transferred data.
  • If you wish to obtain a copy of the relevant cross-border transfer safeguard documents, you can contact us via the contact information provided in Section 1 of this Privacy Policy at any time.

6. Data Retention Period

We do not retain your personal data for longer than is strictly necessary to fulfill the specific purposes for which the data was originally collected. We set different clear, time-limited retention periods for different categories of personal data in accordance with legal requirements:

  • Personal data related to your completed orders (including name, delivery address, payment records and order history) will be retained for the full statutory period required by German commercial law and tax law, which is generally 10 years after the completion of your transaction, to fulfill our legal record-keeping and audit obligations.
  • Data processed for our legitimate website operation interests, such as browsing log data, will be retained for a maximum period of 30 days, after which these records will be fully anonymized or securely deleted, unless there is a specific ongoing security incident that requires extended retention for investigation purposes.
  • Personal data related to your newsletter subscription will be retained for as long as you remain subscribed to our marketing communications, and we will delete this data within 7 working days after you withdraw your subscription consent.
  • If your personal data is no longer necessary for the original processing purposes, and there is no remaining legal obligation or legitimate legal claim that requires us to retain the data, we will securely erase, anonymize or irreversibly destroy the relevant data in accordance with our internal data management policies.

7. Your Rights as a Data Subject

Under the GDPR, BDSG and other applicable data protection laws, you hold a comprehensive set of legal rights regarding our processing of your personal data:

  1. ‌Right of Access‌: You have the right to request a free confirmation from us about whether we are processing your personal data, and to obtain a copy of all the personal data we hold about you, along with detailed information about the processing purposes, categories of data, recipients of the data, retention period and other relevant details.
  2. ‌Right to Rectification‌: If you find that any personal data we hold about you is inaccurate or incomplete, you have the right to request us to correct the incorrect information or supplement the incomplete data without undue delay.
  3. ‌Right to Erasure (“Right to be Forgotten”)‌: You have the right to request us to delete your personal data under legally permitted circumstances, such as when the data is no longer necessary for the original purposes for which it was collected, you withdraw your consent that was the legal basis for processing, or the processing is no longer compliant with applicable laws. We will carry out the deletion request without undue delay, unless we are legally obligated to retain certain specific data for legitimate legal reasons.
  4. ‌Right to Restriction of Processing‌: You have the right to require us to restrict the processing of your personal data in scenarios where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer need the data for the original processing purposes but you require the data for the establishment, exercise or defense of legal claims, or you have objected to our processing based on legitimate interests pending verification of our legitimate grounds.
  5. ‌Right to Data Portability‌: You have the right to receive the personal data that you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another data controller without any obstruction from us, for all processing activities that are based on your consent or the performance of a contract.
  6. ‌Right to Objection‌: You have the right to object at any time to processing of your personal data that we carry out based on our legitimate interests as stated in Article 6(1)(f) GDPR. If you raise a valid objection, we will stop processing your personal data immediately, unless we can demonstrate compelling legitimate grounds for the processing that override your privacy rights, or the processing is necessary for the establishment, exercise or defense of legal claims. You also have the full right to object to our processing of your personal data for direct marketing purposes at any time, free of charge.
  7. ‌Right to Withdraw Consent‌: You can withdraw any consent you previously granted to us for processing your personal data, at any time, free of charge. The withdrawal of your consent will not affect the lawfulness of any processing activities that we carried out based on your consent before the date of withdrawal.
  8. ‌Right to Lodge a Complaint‌: If you believe that our processing of your personal data violates applicable data protection laws, you have the right to submit a complaint to the competent data protection supervisory authority in the German federal state of Lower Saxony, or the data protection authority in the EU member state where you normally reside or work.

You can submit any of the above requests by contacting us via the email quant@wfkleidung.com, or sending a letter to our physical address listed in Section 1. We will not charge you any fees for legitimate, non-excessive data subject access requests, and we will respond to your request within one month of receipt, in line with GDPR requirements.

8. Data Security Measures

To protect your personal data against accidental, unauthorized or unlawful destruction, loss, alteration, unauthorized disclosure or access, we have implemented strict technical and organizational measures (technische und organisatorische Maßnahmen) that meet the security requirements of Article 32 of the GDPR:

  • All data transmissions between your browser and our website www.wfkleidung.com use encrypted HTTPS connections with up-to-date TLS protocols, to prevent your data from being intercepted during transmission over public networks.
  • Our servers that store personal data are located in ISO 27001 certified secure data centers in Germany, with 24/7 physical access control, firewall protection, real-time threat monitoring and regular security vulnerability scanning.
  • All our internal staff who have access to personal data have signed formal confidentiality agreements, and they are only granted the minimum level of data access permissions that are strictly necessary to perform their job duties. We conduct regular data protection compliance training for all relevant employees.
  • We maintain a documented data breach response plan, which sets out clear procedures to detect, report and investigate any potential personal data security incident. In the event that a personal data breach is likely to pose a high risk to your rights and freedoms, we will notify the relevant supervisory authority and affected data subjects without undue delay, in full compliance with GDPR Article 33 and 34.

9. Cookie Policy and Website Tracking

Our website uses cookies and similar tracking technologies to improve your browsing experience. Small essential functional cookies that are strictly necessary for the operation of the site (such as cookies that remember your shopping cart status and your login session) are stored on your device automatically when you visit the site, as they are required for the website to function properly. For all non-essential cookies including analytical and marketing cookies, we will only place them on your device after we obtain your separate, explicit opt-in consent via our cookie consent banner. You can adjust your cookie preferences at any time through the cookie settings function on our website, or disable cookies directly through your browser configuration, though this may affect some functional features of the site. We do not use any hidden tracking tools that collect your personal data without your explicit knowledge.

10. Updates to This Privacy Policy

We may update and revise this Privacy Policy from time to time, to reflect changes in our business operations, new legal regulatory requirements, or adjustments to our data processing practices. When we make material changes to this document, we will update the “Effective Date” at the top of the Privacy Policy, and post the revised version publicly on a dedicated page of www.wfkleidung.com. For changes that will have a significant negative impact on your privacy rights, we will also send you a prominent notice via email or a clear pop-up notification on our website before the revised policy takes effect, to give you sufficient time to review the changes. By continuing to access our website and use our services after the revised Privacy Policy takes effect, you confirm that you agree to the updated terms of the policy.

11. Final Provisions

This Privacy Policy shall be governed by and construed in accordance with the laws of the Federal Republic of Germany. For any questions or concerns that are not explicitly addressed in this document, you can contact our data protection team at quant@wfkleidung.com at any time, and we will respond to you as soon as possible with personalized, clear guidance related to your personal data protection.