Privacy Policy – Version: 12 October 2026

1. Controller

The controller responsible for data processing on this website is: Volker Strugalla, pumpedpongo, Feldweg 13, 31559 Hohnhorst, Germany, email: info@pumpedpongo.com. We are not required to appoint a data protection officer.

2. Overview

We process personal data only to the extent necessary to provide this website and our online shop and to process your orders. Personal data is any information relating to an identified or identifiable person, such as your name, address, email address or IP address.

3. Hosting and server log files

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you visit our website, the server automatically records technical data: IP address, date and time of access, page accessed, referrer URL, browser and operating system. This is necessary to deliver the website and to ensure its security. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website). Log files are deleted after 7 days at the latest. We have concluded a data processing agreement with IONOS pursuant to Art. 28 GDPR.

4. Cookies and consent management

We use cookies and similar technologies. Technically necessary cookies (e.g. shopping cart, login, currency selection, consent status) are set on the basis of § 25(2) TDDDG and Art. 6(1)(b) and (f) GDPR. All other cookies, e.g. for statistics or marketing, are only set with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). We use the consent tool Complianz, which runs on our own server, to manage your consent. You can change or withdraw your consent at any time via “Manage consent” at the bottom of each page. Details are in our Cookie Policy.

5. Location-based currency display

To display prices in your local currency, our shop determines your approximate country from your IP address using a database stored on our server. No data is transmitted to third parties for this purpose. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a user-friendly shop).

6. Fonts

Fonts are loaded from our own server. No connection to Google servers is established for this purpose.

7. Orders and customer account

When you place an order, we process your name, billing and shipping address, email address, telephone number (optional), order details and payment information. We need this data to conclude and perform the contract. The legal basis is Art. 6(1)(b) GDPR. If you create a customer account, we additionally store your login data and order history until you delete your account. You can order without a customer account.

8. Production and shipping (Printful)

Our products are produced and shipped by Printful (US: Printful, Inc., 11025 Westlake Dr., Charlotte, NC 28273, USA; EU: Printful Latvia, Raiņa bulvāris 25, Riga, LV-1050, Latvia). To fulfil your order, we transmit your name, your shipping address and the ordered items to Printful. We only transmit your email address and telephone number if this is necessary for delivery. The legal basis is Art. 6(1)(b) GDPR. Printful acts as our processor under a data processing agreement pursuant to Art. 28 GDPR and processes the data only on our instructions. Printful hands over your name and shipping address to the shipping company for delivery.

9. Payment

Payment data is processed directly by the payment service provider you choose. The legal basis is Art. 6(1)(b) GDPR.

• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. Privacy policy: paypal.com/privacy
• Credit card (WooPayments): Card payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, on behalf of Automattic Inc. (WooPayments). Privacy policy: stripe.com/privacy

The payment service providers may carry out identity and fraud checks. Data may also be processed in the United States (see section 13).

10. Tax calculation

To calculate the correct VAT, our shop transmits your shipping address and the order amount to the WooCommerce Tax service of Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. The legal basis is Art. 6(1)(c) GDPR (legal obligation to charge the correct VAT) and Art. 6(1)(b) GDPR.

11. Google for WooCommerce

We use Google for WooCommerce to present our products in Google services (Google Merchant Center, Google Ads) and to measure the success of ads. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tracking and conversion measurement only take place with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google may process data in the United States (see section 13). Privacy policy: policies.google.com/privacy

11a. Order attribution (WooCommerce)

With your consent, our shop software WooCommerce records how you found our shop, e.g. via a search engine, a social media link or by entering the address directly. For this purpose, cookies beginning with “sbjs_” are stored in your browser for the duration of your visit (they expire after 30 minutes of inactivity). The information is attached to your order so that we can see which channels lead to purchases. The data is processed exclusively on our own server and is not passed on to third parties. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw your consent at any time via “Manage consent” at the bottom of each page.

12. Contact

If you contact us by email or via our contact form or withdrawal form, we process the data you provide (e.g. name, email address, order number, message) to handle your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract, otherwise Art. 6(1)(f) GDPR. Form entries are stored on our own server.

13. Transfers to third countries

Some of our service providers process personal data outside the European Economic Area, in particular in the United States. Printful may transfer data to its parent company in the United States and to affiliated companies in the EU and the United Kingdom. For the United Kingdom, there is an adequacy decision of the European Commission (Art. 45 GDPR). For providers in the United States that are certified under the EU-U.S. Data Privacy Framework (Google, PayPal, Stripe, Automattic), the transfer is based on the Commission’s adequacy decision of 10 July 2023. Printful is not certified under this framework; for transfers to Printful we have agreed on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) pursuant to Art. 46(2)(c) GDPR. You can request a copy of these safeguards via info@pumpedpongo.com.

14. Storage period

We delete personal data as soon as it is no longer needed for the purpose for which it was collected. Order and invoice data is retained for the statutory retention periods under German commercial and tax law (up to 10 years). Data of a customer account is deleted when you delete the account, subject to these retention obligations.

15. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw any consent you have given at any time with effect for the future. To exercise your rights, contact info@pumpedpongo.com.

You also have the right to lodge a complaint with a supervisory authority, e.g. the authority responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

16. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

17. Changes

We may update this privacy policy if our services or the legal situation change. The current version is always available on this page.