Privacy Statement

he personal data statement includes the purpose of processing, how we collect, handle, and ensure the protection of all personal data provided, how this information is used, and the rights you can exercise regarding your data (right of access, etc.).

The European institutions are committed to protecting and respecting your personal data. Since this service collects and processes your personal data, Regulation (EC) No. 45/2001 of the European Parliament and of the Council of 18 December 2000, concerning the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, applies.

The ECC Network aims to promote consumer trust by advising citizens on their rights as consumers and providing easy access to redress mechanisms in cases where a consumer has purchased something from a country other than their own (cross-border). The ECCs offer consumers a wide range of services, from providing information about their rights to advising on cross-border complaints and offering information about dispute resolution. ECCs also provide advice on Alternative Dispute Resolution (ADR) methods for consumers across Europe and ensure easy and informed access to such procedures when direct agreements with traders cannot be reached, provided an ADR entity is available.

To enable the ECC Network to provide the above services to citizens, an IT tool called ECC-Net 2 is used for the collection and handling of complaints and the necessary data, including your personal data. The IT tool is operated by the European Commission.

The collection and processing of the aforementioned personal data through ECC-Net 2 follow the provisions of Regulation (EC) No. 45/2001 of the European Parliament and of the Council of 18 December 2000, concerning the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, specifically under Article 5, points (a) and (b).

We collect data from the following users:

Consumers from the EU, Norway, and Iceland who contact ECCs for information and assistance (Consumers).
Company representatives in the EU, Norway, and Iceland involved in consumer complaints or disputes (Company Representatives).
Contact points for Alternative Dispute Resolution (ADR) entities (ADR Representatives).
The personal data collected and further processed are as follows:

a) For Consumers:
(i) The collected data includes:

Full name of the consumer
Address
Postal code
Country of residence
Telephone number
Email address
Gender
Preferred communication language
Summary/description of the request
(ii) Additional personal data may be collected if necessary for handling the complaint, subject to explicit consent, such as bank details.

b) For Company Representatives:
Data from company representatives is rarely stored in the system, but during processing, the following may be included:

Name of the company representative
Business address
Postal code
Country
Company telephone number
Business email address
c) For ADR Representatives:
Data from ADR representatives is rarely stored in the system, but during processing, the following may be included:

Name of the ADR representative
Business address
Postal code
Country
Company telephone number
Business email address

All data in electronic form (emails, documents, data uploads, etc.) is stored either on the servers of the European Commission or with external contractors, whose operations comply with the European Commission’s Security Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of information systems used by the European Commission (C/2016/8998).

Contact Information

To resolve your request, it must be shared, with your explicit consent, with the ECC where the trader is based or, where applicable, with relevant organizations such as the ADR entity or the national enforcement body.

Information requests may require contact with the trader. In such cases, your data may be shared as necessary to resolve the request.

Access to your data is provided to authorized personnel on a "need-to-know" basis. This personnel complies with legal provisions and, where required, additional confidentiality agreements.

Authorized personnel includes:

• Case handlers at the European Consumer Centres.
• Officials of the European Commission responsible for managing ECC-Net2 products or operations.

Norway and Iceland are EEA/EFTA countries and members of the European Consumer Centres Network. Transfers between ECCs in the EU and ECCs in Norway or Iceland are therefore considered transfers under Article 8 of Regulation No. 45/2001.

You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular, the right to access your personal data and to rectify them in case your personal data are inaccurate or incomplete. Where applicable, you have the right to erase your personal data, to restrict the processing of your personal data, to object to the processing, and the right to data portability.

You have consented to provide your personal data to your ECC and to the European Commission, directorate-General Justice and Consumers, Directorate E: Consumers Directorate, Unit E3 “Consumer Enforcement and Redress”.

You can withdraw your consent at any time by notifying the Data Controller. For consumers that have lodged a query with an ECC, the data controller to be notified is the ECC where the query was lodged. The withdrawal will not affect the lawfulness of the processing carried out before you have withdrawn the consent.

You can exercise your rights by contacting the Data Controller whom you originally contacted (the ECC), or in case of a conflict, the Data Protection Officer supervising your local ECC. If you wish, you may alternatively contact the European Data Protection Supervisor (contact details under Section 9 below) although your primary point of contact is the national ECC where you filed a complaint, and its Data Protection Officer.

If you wish to exercise your rights in the context of one or several specific processing operations, please provide a specific description of the data in your request.