Privacy
What this site and the customs product process, who processes it and where.Draft, last updated 26 September 2026
Visiting this site
athren.nl is served by Vercel and loads PostHog and Google Analytics 4 to understand site visits and interactions. PostHog uses its EU cloud endpoint. Analytics services receive usage and technical data and may use cookies or browser storage. Fonts are served from our own origin. The hosting infrastructure also keeps standard access logs.
Booking a call
Booking links open Lucas Duys's calendar on Cal.com. Cal.com processes the contact details, answers and meeting time you enter, and makes the booking available to Lucas. Its own privacy policy applies to that service. We use the information you share to arrange and follow up on the conversation.
Writing to us
Mail to lucas@athren.nl reaches us, and we use what you send to answer you. Past cases you send us are not read by the product until your agency has signed the data processing agreement below.
The customs product
- What it processes
- The shipment emails your agency gives it and their attachments: invoices, packing lists, bills of lading and other transport documents. From them it builds the case: the header, the lines with their values and origins, the proposed codes, the open questions and the source of every value. It also keeps your declarant’s decisions, from answers and corrections to releases, and the declarations they download.
- Personal data in it
- Most of it is company data. It can still contain personal data: the names, email addresses and phone numbers of contact people, and the details of sole traders or private importers.
- Our role
- For case data your agency is the controller. Athren processes it only on your agency’s instructions, under a data processing agreement signed before the first case of yours is read.
- Who processes it
- Athren runs on Google Cloud in the Netherlands. Reading documents and proposing codes uses language models from outside providers. The agreement names each of them as a sub-processor, with where it processes, and no case document of yours reaches one before your agency has accepted it in writing.
- What we do not do
- We do not use your case data to train models, and we never use one agency’s cases for another. Athren sends nothing to your customers, suppliers or forwarders.
- How long it is kept
- How long case documents and case data are kept is set per agency in the data processing agreement.
The earlier workspace
Athren’s earlier product, the invite-only workspace at app.athren.nl, keeps its own processing until it is retired. Sign-in and its database are on a Supabase project in the EU. It mirrors the sources a workspace connects, with the scopes each provider’s consent screen shows. Questions and the evidence retrieved for them go to the OpenAI API. Google Cloud embeds text with Vertex AI and recognises captured meeting audio with Speech-to-Text, both in an EU region, and no recording is kept. Its API runs on Google Cloud in the Netherlands, and the app is served by Vercel.
Your requests
Questions, access requests and erasure requests go to lucas@athren.nl. For case data we act on your agency’s instructions, so a request about a case goes through your agency.
What this page does not say yet
Some of the formal facts a privacy policy normally carries are still being settled with counsel: the legal entity behind the working name and its registered address, exact retention periods, the formal list of sub-processors, and the legal bases for each processing purpose. Until they are settled they are not stated here, because a fact this page invents is worse than a gap it admits.