Privacy Policy

As of: October 2026. This policy explains how we process personal data when you visit 100for10.com, shop with us or subscribe to our mailing list.

1. Controller

Melville Brand Design GmbH, Goethestraße 20, 80336 München, Germany
Phone: +49 89 189279110 · Email: info@100for10.com
Managing Director: Michael Schmidt

We are not legally required to appoint a data protection officer. For all privacy questions, please contact us at the address above.

2. Hosting and server log files

Our website is hosted by RAIDBOXES GmbH, Hafenstraße 32, 48153 Münster, Germany, on servers in Germany. We have concluded a data processing agreement with Raidboxes.

When you visit our website, the server automatically records technical data: IP address, date and time of access, page requested, referrer URL, browser and operating system. We need this data to deliver the website securely and to detect attacks (Art. 6(1)(f) GDPR). Log files are deleted automatically after a short period, unless they are needed to investigate an incident.

All data is transmitted encrypted via TLS (https).

3. Cookies and consent management

We use the consent tool Borlabs Cookie (Borlabs GmbH, Hamburg) to obtain and document your consent. It stores a cookie (“borlabs-cookie”) with your choice and a consent ID. Legal basis: Art. 6(1)(c) GDPR in conjunction with § 25 TDDDG.

Cookies and similar technologies that are not strictly necessary (statistics and marketing) are only used with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Strictly necessary cookies, e.g. for the shopping cart and checkout, are used on the basis of § 25(2) TDDDG and Art. 6(1)(b) GDPR.

You can change or withdraw your consent at any time via “cookie settings” in the footer of our website.

4. Online shop and orders

When you order, we process the data you enter (name, billing and shipping address, email, phone number if provided, order details) to conclude and fulfil the contract (Art. 6(1)(b) GDPR). We use WooCommerce and Germanized to run the shop and create invoices.

You can order as a guest or create a customer account. Account data is stored until you delete the account or ask us to do so.

We keep order and invoice data for as long as required by commercial and tax law (generally 6 or 10 years, § 257 HGB, § 147 AO).

Payment via PayPal

If you pay with PayPal (including credit card via PayPal), your payment data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal may carry out identity and credit checks. Legal basis: Art. 6(1)(b) GDPR. See PayPal’s privacy statement: paypal.com.

Shipping

To deliver your order we pass your name and shipping address to the shipping company we use (Deutsche Post / DHL Group or another carrier). We only share your email address or phone number with the carrier if you have agreed to this during checkout, so the carrier can notify you about delivery (Art. 6(1)(a) GDPR).

5. Withdrawal function

If you use our online withdrawal function, we process your name, contact details, order number and the information you provide to handle your withdrawal and send you a confirmation of receipt (Art. 6(1)(c) GDPR in conjunction with § 356a BGB, Art. 6(1)(b) GDPR).

6. Contact by email

If you contact us by email, we process your message and contact details to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the data when it is no longer needed, unless statutory retention periods apply. Emails from our website and shop are sent via the email service of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, with whom we have concluded a data processing agreement.

7. Mailing list (Mailchimp)

If you subscribe to our mailing list, we use Mailchimp, a service of The Rocket Science Group LLC / Intuit Inc., 405 N Angier Ave. NE, Atlanta, GA 30308, USA. We process your email address and, if provided, your name, as well as the date, time and IP address of your registration. Subscription uses the double opt-in procedure: you will receive an email asking you to confirm.

Legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email. Our mailings contain tracking pixels so we can see whether emails are opened and which links are clicked; you can object to this by unsubscribing.

Mailchimp may process data in the USA. Intuit is certified under the EU-US Data Privacy Framework; in addition, we have concluded EU standard contractual clauses with Mailchimp.

8. Web analytics: Google Analytics 4

With your consent, we use Google Analytics 4 (via the MonsterInsights plugin), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse how visitors use our website. IP addresses are not stored in Google Analytics 4. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Data is deleted automatically according to the retention period set in Google Analytics (at most 14 months). You can withdraw your consent at any time via “cookie settings”.

9. Product catalogue on Facebook and Instagram

We use the plugin “Meta for WooCommerce” to transmit our product data (titles, images, prices, availability) to Meta Platforms Ireland Ltd., Merrie Hart, Dublin 2, Ireland, so that we can tag our products in posts on Instagram and Facebook. No personal data of visitors to our website is transmitted for this purpose. We do not use the Meta Pixel or the Meta Conversions API. If you click on a product tag on Instagram or Facebook, you will be forwarded to our shop; on Meta’s platforms, Meta’s privacy policy applies.

10. Order attribution

WooCommerce stores in your browser how you reached our shop (e.g. from a search engine or a newsletter) and attaches this information to your order. We only use this function with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

11. Embedded videos (Vimeo, YouTube)

Some blog posts contain videos from Vimeo (Vimeo.com, Inc., New York, USA) or YouTube (Google Ireland Limited). These are only loaded after you click on them and agree; until then no data is transmitted. Once loaded, the provider receives your IP address and may set cookies; data may be transferred to the USA. Legal basis: Art. 6(1)(a) GDPR.

12. Social media links

Our website links to our profiles on Instagram and Facebook. These are simple links; no data is transmitted to Meta until you click on them. After that, Meta’s privacy policy applies.

13. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)).

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de.

14. Storage period

Unless stated otherwise above, we delete personal data as soon as it is no longer needed for the purpose for which it was collected and no statutory retention obligations apply.

15. Changes

We update this privacy policy when our website or the legal requirements change. The current version is always available on this page.