Privacy
Privacy Notice
Meltoys | YellowPack V.O.F. | Version: 21 October 2026
1. Who is responsible for your data?
Meltoys is operated by YellowPack, a Dutch general partnership (V.O.F.), Chamber of Commerce number 90467841, VAT number NL865326514B01. YellowPack is the controller of the personal data described in this notice.
Address: Techniekstraat 28, 4571 BJ Terneuzen, The Netherlands.
Email for privacy questions and requests: hello@meltoys.com.
This notice explains how we process personal data of website visitors, trade-account applicants, business contacts and customers. Business information can also be personal data where it identifies a sole trader or an individual contact. This notice provides information; it does not ask you to consent to processing that relies on another legal basis.
2. What data do we process?
Depending on your interaction with us, we process:
Contact and company details: contact name, business name, email address, telephone number if supplied, country, VAT number and business registration number.
Account details: login email, a password hash, application and approval status, and information supplied to verify trade-account eligibility. We store password hashes rather than readable passwords.
Billing and delivery details: business and warehouse addresses, delivery contacts and instructions.
Requests and orders: products, quantities, prices, pallets, freight, VAT, proformas, invoices, status updates, tracking references, payment references and information needed to confirm payment.
Communications: messages, enquiries, complaints, relevant correspondence and internal customer or order notes used to manage the business relationship.
Technical and security information: session identifiers, IP addresses or IP-derived security identifiers, request timestamps and technical information contained in security or error logs where needed to run and protect the service. The hosting environment may also keep operational access logs.
We do not ask you to provide sensitive personal data or identity-document copies through the website. Please do not place unnecessary personal information in order notes or messages.
3. Where does the information come from?
Most information comes directly from you when you register, update your account, submit a request or contact us. A colleague may provide your contact or delivery details on behalf of your business. We may also receive relevant delivery or payment information from carriers or banking records and check business identifiers against public business registers or VAT verification services where necessary. If you give us another person's details, inform them about this notice and only share details needed for the transaction.
4. Why do we use data and on what basis?
Trade-account applications and approval: to assess whether an applicant is a business customer, verify details, manage access and prevent misuse. Our legal basis is our legitimate interest in operating a reliable business-only platform. Where the applicant is personally the contracting party, steps requested before entering a contract may also apply.
Quotations, orders and customer service: to prepare proformas, agree freight or collection, process orders and payment, arrange delivery and resolve queries. Where you are personally a party to the agreement, the legal basis is performance of the contract or steps you request before entering it. Where you act for a company, we rely on our legitimate interest in conducting and administering that business relationship.
Accounting, tax and legal obligations: to keep required financial records, comply with lawful requests and fulfil applicable product-safety and traceability obligations. The basis is compliance with legal obligations.
Account and order emails: to send application decisions, account-security messages, order updates, proformas and dispatch information. The basis is the relevant contract, legal obligation or legitimate interest described above, depending on the message. These are service communications, not newsletter subscriptions.
Security, operational maintenance and legal claims: to maintain the website, prevent unauthorised access, investigate faults or misuse and establish, exercise or defend legal claims. Our basis is our legitimate interest in protecting the service, our customers and our legal rights, balanced against the rights of the people concerned.
Required company and address fields are needed to assess an application or process a request. Without them we may be unable to approve trade access or fulfil an order. Optional fields are identified in the form. You may object to processing based on legitimate interests as explained below.
5. Who receives data?
Only authorised people who need the information for their work have access to it. We handle our own bookkeeping, invoicing and transport coordination.
We use Devnomads.nl for email services. Website hosting, database infrastructure, maintenance and other necessary IT providers may process data on our behalf under appropriate confidentiality, security and data-processing arrangements where required. Their access must be limited to the services they provide.
Where transport is carried out by an external carrier, we share the delivery address, relevant contact details and shipment information needed for that delivery. This also applies to a carrier appointed by the customer. A carrier or bank may act as an independent controller for its own legal and operational purposes.
We may disclose relevant data to competent authorities where legally required, or to professional advisers and parties involved in a genuine legal claim where necessary and lawful. We do not sell personal data or share it for third-party advertising.
6. Processing outside the European Economic Area
A European delivery area does not by itself mean that every IT service processes data exclusively within the European Economic Area (EEA). International processing may arise through the service providers used for the website or email.
If personal data is transferred outside the EEA, we will only do so where permitted by the GDPR, for example on the basis of an applicable adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses, together with additional measures where required. Contact hello@meltoys.com for information about any relevant transfer arrangements and how to obtain a copy of applicable safeguards, subject to lawful redactions.
7. How long do we keep data?
We use the following periods or criteria rather than keeping all information indefinitely:
Financial administration, including invoices and the order and payment information needed to support them: generally seven years in accordance with Dutch tax rules, or longer where another specific legal retention duty applies. The start and calculation of the period follow the applicable tax rules.
Trade-account and approval information: while the account and business relationship remain active. After an application is rejected or an account is closed, we retain only information still needed to handle related correspondence, explain an approval decision, address misuse, comply with a legal duty or manage a specific claim. We delete or anonymise other account data when those purposes end.
Enquiries, communications and internal notes: for as long as needed to resolve the matter and carry out relevant follow-up. Where they form part of a transaction, tax record, complaint, safety matter or legal claim, the relevant retention requirements apply. We remove irrelevant or outdated notes.
Technical logs and security information: for the limited period needed for routine operation, fault diagnosis and investigation of a security incident. Information relevant to an active incident may be kept until it is resolved and any necessary legal follow-up is complete.
Backup copies: for the recovery period applicable to the backup system. Deleted data may remain in protected backups until those copies expire; it must not be restored to normal use except where needed for legitimate recovery and then subject to the applicable deletion requirements.
A specific dispute, statutory duty or product-safety obligation may justify keeping relevant records longer than the ordinary business need. Access to retained records is restricted to that purpose. You can ask us about the retention criteria applicable to your information.
8. Cookies and similar technology
We use functional cookies necessary to run the trade platform. The application uses the meltoys_session cookie to link your browser to its session, support login and basket functions, and help protect forms against misuse. It is configured as a session cookie. Its browser lifetime normally ends when the browser session ends, although browser session-restoration features may affect this. The application expires an inactive session after two hours when a further request is made.
We do not use analytics, advertising pixels, behavioural tracking or newsletter tools on this website. Functional session data is not used to build advertising profiles. You can block or remove cookies through your browser settings, but login, basket and ordering features may then stop working. Any necessary infrastructure cookies must be limited to their operational purpose.
9. Security
We use measures intended to protect personal data, including HTTPS, password hashing, restricted administrator access and checks on access to account, order and document information. Organisational measures and secure provider arrangements are also needed. No website, email service or storage system can be guaranteed completely secure. If you suspect misuse of your account or a security incident involving your information, contact us promptly.
10. Your rights
Subject to the conditions in the GDPR, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing or transfer of data where the right to portability applies. You may object to processing based on legitimate interests on grounds relating to your situation. Where processing relies on consent, you may withdraw that consent without affecting processing already carried out lawfully. We do not rely on newsletter or advertising consent for the activities described here.
Send a request to hello@meltoys.com. We may ask for information reasonably necessary to verify your identity, without requesting more than needed. We normally respond within one month. Where the law permits an extension for a complex or multiple request, we will explain this within that first month. Some information may need to be retained despite an erasure request, for example to meet tax duties or establish or defend a legal claim.
You may complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at www.autoriteitpersoonsgegevens.nl, or to the competent supervisory authority in your country. You do not have to contact us first, although we welcome the opportunity to address your concern.
11. Automated decisions and changes
Trade-account approval is reviewed by an administrator. We do not use solely automated decisions that produce legal or similarly significant effects, or behavioural profiling for marketing.
We may update this notice when our services or processing change. The version date appears above. Where required, we will tell you about a material change before the new processing starts. The latest notice is available on meltoys.com.
Meltoys | YellowPack V.O.F. | Version: 21 October 2026
1. Who is responsible for your data?
Meltoys is operated by YellowPack, a Dutch general partnership (V.O.F.), Chamber of Commerce number 90467841, VAT number NL865326514B01. YellowPack is the controller of the personal data described in this notice.
Address: Techniekstraat 28, 4571 BJ Terneuzen, The Netherlands.
Email for privacy questions and requests: hello@meltoys.com.
This notice explains how we process personal data of website visitors, trade-account applicants, business contacts and customers. Business information can also be personal data where it identifies a sole trader or an individual contact. This notice provides information; it does not ask you to consent to processing that relies on another legal basis.
2. What data do we process?
Depending on your interaction with us, we process:
Contact and company details: contact name, business name, email address, telephone number if supplied, country, VAT number and business registration number.
Account details: login email, a password hash, application and approval status, and information supplied to verify trade-account eligibility. We store password hashes rather than readable passwords.
Billing and delivery details: business and warehouse addresses, delivery contacts and instructions.
Requests and orders: products, quantities, prices, pallets, freight, VAT, proformas, invoices, status updates, tracking references, payment references and information needed to confirm payment.
Communications: messages, enquiries, complaints, relevant correspondence and internal customer or order notes used to manage the business relationship.
Technical and security information: session identifiers, IP addresses or IP-derived security identifiers, request timestamps and technical information contained in security or error logs where needed to run and protect the service. The hosting environment may also keep operational access logs.
We do not ask you to provide sensitive personal data or identity-document copies through the website. Please do not place unnecessary personal information in order notes or messages.
3. Where does the information come from?
Most information comes directly from you when you register, update your account, submit a request or contact us. A colleague may provide your contact or delivery details on behalf of your business. We may also receive relevant delivery or payment information from carriers or banking records and check business identifiers against public business registers or VAT verification services where necessary. If you give us another person's details, inform them about this notice and only share details needed for the transaction.
4. Why do we use data and on what basis?
Trade-account applications and approval: to assess whether an applicant is a business customer, verify details, manage access and prevent misuse. Our legal basis is our legitimate interest in operating a reliable business-only platform. Where the applicant is personally the contracting party, steps requested before entering a contract may also apply.
Quotations, orders and customer service: to prepare proformas, agree freight or collection, process orders and payment, arrange delivery and resolve queries. Where you are personally a party to the agreement, the legal basis is performance of the contract or steps you request before entering it. Where you act for a company, we rely on our legitimate interest in conducting and administering that business relationship.
Accounting, tax and legal obligations: to keep required financial records, comply with lawful requests and fulfil applicable product-safety and traceability obligations. The basis is compliance with legal obligations.
Account and order emails: to send application decisions, account-security messages, order updates, proformas and dispatch information. The basis is the relevant contract, legal obligation or legitimate interest described above, depending on the message. These are service communications, not newsletter subscriptions.
Security, operational maintenance and legal claims: to maintain the website, prevent unauthorised access, investigate faults or misuse and establish, exercise or defend legal claims. Our basis is our legitimate interest in protecting the service, our customers and our legal rights, balanced against the rights of the people concerned.
Required company and address fields are needed to assess an application or process a request. Without them we may be unable to approve trade access or fulfil an order. Optional fields are identified in the form. You may object to processing based on legitimate interests as explained below.
5. Who receives data?
Only authorised people who need the information for their work have access to it. We handle our own bookkeeping, invoicing and transport coordination.
We use Devnomads.nl for email services. Website hosting, database infrastructure, maintenance and other necessary IT providers may process data on our behalf under appropriate confidentiality, security and data-processing arrangements where required. Their access must be limited to the services they provide.
Where transport is carried out by an external carrier, we share the delivery address, relevant contact details and shipment information needed for that delivery. This also applies to a carrier appointed by the customer. A carrier or bank may act as an independent controller for its own legal and operational purposes.
We may disclose relevant data to competent authorities where legally required, or to professional advisers and parties involved in a genuine legal claim where necessary and lawful. We do not sell personal data or share it for third-party advertising.
6. Processing outside the European Economic Area
A European delivery area does not by itself mean that every IT service processes data exclusively within the European Economic Area (EEA). International processing may arise through the service providers used for the website or email.
If personal data is transferred outside the EEA, we will only do so where permitted by the GDPR, for example on the basis of an applicable adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses, together with additional measures where required. Contact hello@meltoys.com for information about any relevant transfer arrangements and how to obtain a copy of applicable safeguards, subject to lawful redactions.
7. How long do we keep data?
We use the following periods or criteria rather than keeping all information indefinitely:
Financial administration, including invoices and the order and payment information needed to support them: generally seven years in accordance with Dutch tax rules, or longer where another specific legal retention duty applies. The start and calculation of the period follow the applicable tax rules.
Trade-account and approval information: while the account and business relationship remain active. After an application is rejected or an account is closed, we retain only information still needed to handle related correspondence, explain an approval decision, address misuse, comply with a legal duty or manage a specific claim. We delete or anonymise other account data when those purposes end.
Enquiries, communications and internal notes: for as long as needed to resolve the matter and carry out relevant follow-up. Where they form part of a transaction, tax record, complaint, safety matter or legal claim, the relevant retention requirements apply. We remove irrelevant or outdated notes.
Technical logs and security information: for the limited period needed for routine operation, fault diagnosis and investigation of a security incident. Information relevant to an active incident may be kept until it is resolved and any necessary legal follow-up is complete.
Backup copies: for the recovery period applicable to the backup system. Deleted data may remain in protected backups until those copies expire; it must not be restored to normal use except where needed for legitimate recovery and then subject to the applicable deletion requirements.
A specific dispute, statutory duty or product-safety obligation may justify keeping relevant records longer than the ordinary business need. Access to retained records is restricted to that purpose. You can ask us about the retention criteria applicable to your information.
8. Cookies and similar technology
We use functional cookies necessary to run the trade platform. The application uses the meltoys_session cookie to link your browser to its session, support login and basket functions, and help protect forms against misuse. It is configured as a session cookie. Its browser lifetime normally ends when the browser session ends, although browser session-restoration features may affect this. The application expires an inactive session after two hours when a further request is made.
We do not use analytics, advertising pixels, behavioural tracking or newsletter tools on this website. Functional session data is not used to build advertising profiles. You can block or remove cookies through your browser settings, but login, basket and ordering features may then stop working. Any necessary infrastructure cookies must be limited to their operational purpose.
9. Security
We use measures intended to protect personal data, including HTTPS, password hashing, restricted administrator access and checks on access to account, order and document information. Organisational measures and secure provider arrangements are also needed. No website, email service or storage system can be guaranteed completely secure. If you suspect misuse of your account or a security incident involving your information, contact us promptly.
10. Your rights
Subject to the conditions in the GDPR, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing or transfer of data where the right to portability applies. You may object to processing based on legitimate interests on grounds relating to your situation. Where processing relies on consent, you may withdraw that consent without affecting processing already carried out lawfully. We do not rely on newsletter or advertising consent for the activities described here.
Send a request to hello@meltoys.com. We may ask for information reasonably necessary to verify your identity, without requesting more than needed. We normally respond within one month. Where the law permits an extension for a complex or multiple request, we will explain this within that first month. Some information may need to be retained despite an erasure request, for example to meet tax duties or establish or defend a legal claim.
You may complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at www.autoriteitpersoonsgegevens.nl, or to the competent supervisory authority in your country. You do not have to contact us first, although we welcome the opportunity to address your concern.
11. Automated decisions and changes
Trade-account approval is reviewed by an administrator. We do not use solely automated decisions that produce legal or similarly significant effects, or behavioural profiling for marketing.
We may update this notice when our services or processing change. The version date appears above. Where required, we will tell you about a material change before the new processing starts. The latest notice is available on meltoys.com.