Privacy Policy & Cookies

Custran is an online platform owned and operated by Freight Station Limited, Cork, Ireland (“we”, “us”). This policy explains what personal information we collect when you use our website and our customs declaration software platform, why we collect it, with whom we share it, and the rights you have over your data. It applies to visitors, customers, agents and users of our platform, and covers personal data held both electronically and in manual records.

We are the data controller for the personal data described in this policy. We operate under EU data protection law (the GDPR, Regulation (EU) 2016/679) as it applies in Ireland, and under the UK GDPR and the Data Protection Act 2018 for people in the United Kingdom. This policy replaces all previous versions.

Information we collect

We only ask for information that is needed to operate our platform and to serve you, and it may include:

• Contact details: your name, company, address, email address, telephone or mobile number.
• Account details: your username and password when you register for our software.
• Usage information: pages visited, features used and how you interact with our website or platform.
• Technical data: IP address, browser type, operating system and general internet usage.
• Location or geolocation information, where derived from your IP address or connection.
• Payment information when you purchase our services. Online card payments are processed by Stripe; card details are not stored on our systems.
• Message content from contact forms, email, phone enquiries and the live chat widget.

How and why we use your information

We use your personal data for the following purposes, relying on the legal bases shown:

• Providing our customs software, agency, advice and training services, including account setup and support, processing declarations and delivering notifications (necessary for a contract).
• Responding to enquiries, processing orders and payments, verifying qualifications for services, providing delivery and other notifications, and contacting you (a contract, or our legitimate interests).
• Preventing transactional fraud and meeting customs, tax and accounting obligations (legal obligations).
• Reviewing usage and operations, improving our content, products and services, and protecting the security or integrity of our platform (our legitimate interests).
• Developing new products and services, analysing usage in aggregate form, and managing our network and systems (our legitimate interests).
• Sending you targeted offers, newsletters and promotional material by email, text message or online advertising, where you have signed up for them (your consent).
• As otherwise described to you at the point of data collection.

You must be 18 years or older to register for and use our account-based services. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out on that basis.

Marketing and how to opt out

We and service providers acting on our behalf may use cookies and similar technologies to associate your website activity with information held about you, including your email address, and to send communications and marketing. You can opt out of such advertising at app.retention.com/optout, and you can stop our marketing emails at any time using the unsubscribe link in the email or by contacting us directly.

Who we share information with

We never sell your personal data. We share it only where necessary to run our business:

• Payments: online card payments are processed by Stripe, who process payment data on our behalf (see Stripe’s privacy policy for their processing).
• Hosting and platform suppliers who process data on our instructions under contract.
• Analytics and business information services, including Google Analytics, Bing, Lead Forensics and Ruler Analytics, used to understand website usage.
• HMRC and Revenue for customs declarations where you are our customer or agent, to the extent needed to provide the service.
• Where necessary to protect our rights, to comply with judicial process or legal obligations.

Third parties engaged to process personal data on our behalf (data processors) do so under a written contract, only on our documented instructions and only for the specific purposes agreed. They are required to process that data in compliance with data protection law. If a processor fails to manage our data compliantly, we treat that as a breach of contract.

Cookies on this site

When you first visit this website, a cookie banner asks you to choose between:

• Strictly necessary cookies: required for the site to work, including security, load balancing and remembering your cookie choice. These are always active.
• Functional cookies and tools: such as the Tawk.to live chat widget, which only loads when you press “Accept all”.
• Analytics and measurement cookies: services such as Google Analytics, Bing, Lead Forensics and Ruler Analytics, also used only with your consent.

If you choose “Essential only”, functional and analytics tools will not run and those cookies will not be set. You can change your decision at any time using the “Cookie settings” button below or the cookie banner itself. You can also control or delete cookies through your own browser settings; if you restrict all cookies, parts of this website may not function. General information about cookies is available at www.allaboutcookies.org.

Keeping your data secure

We have appropriate technical and organisational security management systems in place to protect personal data against unauthorised access, disclosure, alteration or destruction, including firewalls, intrusion detection and virus scanning. Encryption (SSL) is used on sections of the site where security is particularly important. Access to staff and customer records is limited to authorised staff with password access, who must keep credentials confidential. Where we have given you (or you have chosen) a password to access parts of our platform, keeping that password confidential is your responsibility.

How long we keep your data

We keep personal data only for as long as necessary to fulfil the purposes it was collected for, including legal, accounting, reporting and customs record-keeping requirements. We maintain a schedule of retention periods by data category, covering data in both manual and automated form. Once each period elapses we securely destroy, erase or otherwise put the data beyond use. Data accuracy is reviewed periodically so records stay complete and up to date.

International transfers

Some of our service providers operate outside the UK and the European Economic Area. Where personal data is transferred outside the UK or the EEA, we ensure an appropriate transfer mechanism is in place, such as an adequacy decision for the destination country, or standard data protection clauses and supplementary safeguarding with the provider.

Your rights

Under data protection law you have the right, in appropriate circumstances, to:

• Request access to the personal data we hold about you (a subject access request).
• Request correction of inaccurate or incomplete personal data.
• Request deletion of your personal data where there is no good reason for us to keep processing it.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Request restriction of processing, for example while we check accuracy or assess an objection.
• Request transfer of your data to you, or to a third party you choose, in a commonly used, machine-readable format.
• Withdraw consent at any time where we rely on it. Withdrawing consent will not affect the lawfulness of anything already done.

To exercise any of these rights contact us using the details below. You can also complain to the regulator in your country if you are unhappy with how we handled your data: the Data Protection Commission (Ireland) at www.dataprotection.ie or the Information Commissioner’s Office (UK) at www.ico.org.uk.

Subject access requests

Formal written requests for a copy of your personal data are passed to the person responsible for data protection and processed as quickly and efficiently as possible, and in any event within one month of receipt of the request. That deadline may be extended where necessary for complex or numerous requests. A subject access request can be made by contacting us, and this policy should be read alongside our retention and data loss notification procedures.

Changes to this policy

Any future changes we make to this Privacy Policy will be posted on this page, and where appropriate you may also be notified by email. Please visit this page periodically to review any changes.

Contact

Questions, concerns or requests about this policy can be sent to info@custran.com by phone on Ireland +353 1 211 8508 or UK +44 330 027 1721, or through our contact page.