Privacy Policy
Last updated: 1 August 2026
1. Who we are
CSTMS.EU is a sole proprietorship registered in the Netherlands, specialising in customs and trade compliance for EU importers and exporters.
| Trading name | CSTMS.EU |
| Owner | Wesley Bal |
| Address | Escudostraat 2, 2991 XV Barendrecht, The Netherlands |
| Chamber of Commerce | 94785325 |
| VAT number | NL005111895B21 |
| info@cstms.eu |
We are the data controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR).
2. What personal data we process
We only process data that is necessary for the purposes described below. At present, this concerns data collected via Google Analytics when you visit this website:
- Anonymised IP address (Google Analytics 4 does not store full IP addresses)
- Pages visited, scroll depth, and click behaviour
- Session duration and return frequency
- Device type, browser type, and operating system
- Referring URL and search engine (where applicable)
- Country and city derived from IP address (not traceable to a street address)
In addition, we process personal data that you provide to us directly:
- Contact form or email: your name, email address and the content of your message. The contact form is technically handled by Formspree.
- Newsletter: your name and email address, processed via MailerLite. You can unsubscribe directly in every newsletter.
- Scheduling a call: your name, email address and the selected time slot, processed via the Calendly scheduler on this website.
This data is not processed via Google Analytics and is only shared with the processors listed in section 5. We never sell your data to third parties.
3. Purposes and legal basis
| Purpose | Legal basis | Details |
|---|---|---|
| Website analytics via Google Analytics | Consent (Art. 6(1)(a) GDPR) | Only active after you have given consent via the cookie banner. You may withdraw your consent at any time. |
| Responding to contact requests | Performance of contract / legitimate interest (Art. 6(1)(b) and (f) GDPR) | Necessary to answer your enquiry and initiate a potential business relationship. |
| Sending the newsletter | Consent (Art. 6(1)(a) GDPR) | Only after you sign up. You can unsubscribe in every newsletter or withdraw consent via info@cstms.eu. |
| Scheduling an (introductory) call | Performance of contract / pre-contractual phase (Art. 6(1)(b) GDPR) | Necessary to confirm and hold the appointment you schedule yourself. |
4. Cookies
We use analytical cookies via Google Analytics 4. These cookies are only placed after you have given explicit consent via the cookie banner.
Analytical cookies (Google Analytics 4)
| Cookie | Provider | Purpose | Retention |
|---|---|---|---|
_ga |
Google LLC | Distinguishes unique visitors | 2 years |
_ga_[ID] |
Google LLC | Stores session state | 2 years |
You can adjust or withdraw your cookie preferences at any time by clicking "Cookie preferences" in the footer of this page.
No third-party marketing or tracking cookies are active on this website. If you open the Calendly scheduler, Calendly may place functional cookies that are necessary for the scheduler to work.
5. Processors and recipients
We engage the following service providers that process personal data on our behalf as processors within the meaning of Article 28 GDPR. A data processing agreement is in place with each of them.
| Processor | Purpose | Location |
|---|---|---|
| Google LLC | Website analytics (Google Analytics 4) | US |
| Formspree Inc. | Contact form handling | US |
| MailerLite (UAB) | Newsletter and email marketing | EU (Lithuania) |
| Calendly LLC | Scheduling calls | US |
| HubSpot, Inc. | Relationship management (CRM) | EU / US |
| Microsoft Corporation | Email and office automation | EU |
Where data is processed outside the European Economic Area (such as by Google, Formspree and Calendly in the US), this is done on the basis of appropriate safeguards within the meaning of Chapter V GDPR, such as the Standard Contractual Clauses adopted by the European Commission or an adequacy decision (EU-US Data Privacy Framework). More information on how Google handles personal data can be found in Google's privacy policy.
6. Retention periods
We do not retain personal data longer than necessary for the purpose for which it was collected:
- Analytical data via Google Analytics: maximum 14 months (configured in the GA4 property)
- Contact data (name, email, CRM): up to 2 years after the last contact, unless a longer retention obligation applies
- Newsletter data: until you unsubscribe or withdraw your consent
- Scheduling data (Calendly): up to 2 years after the appointment
7. Your rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR): you may request which data we hold about you
- Right to rectification (Art. 16 GDPR): you may have incorrect data corrected
- Right to erasure (Art. 17 GDPR): you may request that your data be deleted
- Right to restriction (Art. 18 GDPR): you may request that processing be restricted
- Right to data portability (Art. 20 GDPR): you may request your data in a standard format
- Right to object (Art. 21 GDPR): you may object to processing based on legitimate interest
- Withdrawal of consent (Art. 7(3) GDPR): you may withdraw consent for analytical cookies at any time via the cookie banner, without affecting the lawfulness of processing prior to withdrawal
To exercise any of these rights, contact us at info@cstms.eu. We will respond within 30 days.
8. Complaints
If you believe we are not handling your personal data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
- Website: www.autoriteitpersoonsgegevens.nl/en
- Phone: +31 88 1805 250
We appreciate being contacted first so we can resolve the matter directly.
9. Changes to this policy
We may update this privacy policy from time to time. The most recent version is always on this page, with the date of the last update shown at the top. For material changes, we will notify you via a notice on the website.