This privacy statement provides information about the processing and the protection of your personal data.
Processing operation: ECCNET2 (IT tool of the European Consumer Centres Network)
Data Controller (European Consumer Centre): ECC-Spain, Príncipe de Vergara, 54, 28006, Madrid. Telephone: +34/ 91 822 45 55. E-mail: cec@consumo.gob.es
Data Controller (European Commission): Directorate-General Justice and Consumers, Directorate E: Consumers Directorate, Unit B3 “Consumer Enforcement and Redress”
Record reference: DPR-EC-01406
Table of Contents
- Introduction
- Why and how do we process your personal data?
- On what legal ground(s) do we process your personal data?
- Which personal data do we collect and further process?
- How long do we keep your personal data?
- How do we protect and safeguard your personal data?
- Who has access to your personal data and to whom is it disclosed?
- What are your rights and how can you exercise them?
- Contact information
- Where to find more detailed information?
1. Introduction
The European Consumer Centres (hereinafter ECCs) and the European Commission (hereafter ‘the Commission’) are committed to protect your personal data and to respect your privacy.
ECCs work together to provide consumers with information and advice on their rights and assist them with cross-border complaints and disputes within the EU/EEA, so that consumers can take full advantage of the internal market.
ECCs collect and further processes personal data pursuant to Regulation (EU) 2016/679Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data,.
The European Commission is the civil service of the European Union. Within this organisation, the Consumer Enforcement and Redress Unit (unit B3) in DG JUST is responsible for providing the case handling IT tool and supporting its use in the handling of consumer queries made to ECCs. In providing the tool, this unit works with DIGIT, a directorate general that provides IT services within the Commission. Unit B3 is the owner of the tool and is responsible for its strategic development and supporting its users, DIGIT is responsible for technical functioning and infrastructural support.
The Commission collects and further processes personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (repealing Regulation (EC) No 45/2001).
This privacy statement explains the reasons for the processing of your personal data, the way the Commission and the ECC collect, handle, and ensure protection of the personal data you have provided, how that information is used and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Data Controller with whom you may exercise your rights, the Data Protection Officer, and the contact details of both the European Data Protection Supervisor as well as the national supervisory authority.
2. Why and how do we process your personal data?
Purposes of the data processing
This section describes the purposes of the processing by the ECCs and by the European Commission. The ECCs and the European Commission are joint controllers for the processing.
To fulfil their role, ECCNET2 is used by the ECCs to process relevant data, insofar and as long as necessary, for one or more of the following purposes:
- to enable communication between the ECC and the consumer
- to facilitate the assessment of a request
- to attempt resolving complaints or disputes, whether directly with the trader complained about, or through an Alternative Dispute Resolution entity or “ADR” entity (this is an impartial organisation that tries to resolve consumer disputes)
- to enable consumers to follow up the status of their requests
- to create aggregated statistics, including on suspected infringements.
Further information on ECC-Net can be found at European Consumer Centres Network - ECC Net - European Commission
The European Commission
The European Commission provides ECCNET2, the case handling IT tool used by all ECCs. The Commission processes relevant data, insofar and as long as necessary, for one or more of the following purposes:
- To support users of the IT tool in ECCs in its optimal use (monitoring, training, and support)
- To maintain, develop and troubleshoot the case handling IT tool used by the ECCs
- to create anonymised statistics, including on suspected infringements
Your personal data will not be used for any automated decision-making including profiling.
3. On what legal ground(s) do we process your personal data
We process your personal data on three legal grounds: first of all, based on your consent (when you seek help from an ECC), and for secondary purposes, when processing is necessary for the performance of a task carried out in the public interest.
To answer your questions or handle your complaint, the processing of your data is based on your consent.
For other purposes mentioned above, including the creation of statistics, and maintenance, development and troubleshooting, the processing is necessary for the performance of a task carried out in the public interest -or in the exercise of official authority vested in the Union institution or body (Art 5(1) a of Regulation (EU) 2018/1725 -or in the exercise of official authority vested in the controller Art 6(1) e of Regulation (EU) 2016/679.
The network has a legal basis in the following legal instruments:
- Regulation (EU) 2021/690 of the European Parliament and of the Council of 28 April 2021establishing a programme for single market, competitiveness of enterprises, including small and medium-sized enterprises, including small and medium-sized enterprises, the area of plants, animals, food and feed, and European statistics (Single Market Programme) and repealing Regulations (EU) No 99/2013, (EU) No 1287/2013, (EU) No 254/2014 and (EU) No 652/2014 and, more specifically, articles 3(2)(d), Art 8(2)(b) and 9(5) of this Regulation.
- Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market and, in particular, article 21.
- Directive 2013/11/EU of the European Parliament and of the Council of 21 May 2013 on alternative dispute resolution for consumer disputes and amending Regulation (EC) No 2006/2004 and Directive 2009/22/EC (Directive on consumer ADR) and, more specifically, article 14 of the Directive.
- Regulation (EU) 2017/2394 of the European Parliament and of the Council of 12 December 2017 on cooperation between national authorities responsible for the enforcement of consumer protection laws and repealing Regulation (EC) No 2006/2004 and, in particular, article 27(1).
4. Which personal data do we collect and further process?
To carry out this processing operation, the European Commission collects personal data from the following categories of data subjects:
- Consumers in the European Union, Norway, Iceland and other countries who approach ECCs for information and assistance (Consumers);
- Contact persons for the traders in the European Union, Norway and Iceland involved in consumer complaints or disputes (Trader representatives);
- Contact persons in ADR entities (ADR representatives);
The ECCs and Commission do not knowingly collect or process data from minors.
The personal data collected and further processed may include:
a) For Consumers:
- Name of the consumer/reporter
- Address
- Post code
- Country of residence
- Telephone
- Gender
- Communication language
- Summary/Description of the request
Further personal data may be collected if provided by the consumer as necessary for handling the complaint.
b) For Trader representatives:
Data from individual trader's representatives is rarely stored in the system but, when processed may include:
- Name of the trader's representative
- Professional address
- Post code
- Country
- Professional Telephone
- Professional email
c) For ADR representatives:
Data from individual ADR representatives is rarely stored in the system but, when processed may include:
- Name of the ADR's representative;
- Professional address;
- Post code;
- Country;
- Professional Telephone;
- Professional email;
The provision of the abovementioned data is mandatory to allow us to handle your question of complaint. If you do not provide your personal data, we will not be able to respond to you.
The Commission as provider of the IT tool has access to your file along with the ECC or ECCs that are directly involved in handling your query.
5. How long do we keep your personal data?
Personal data of the consumers, traders' and ADRs' representatives shall be kept as long as a case remains open, and for three years has been closed. This is to allow follow-up if there are new developments after the closure of the case. Once the retention period expires, all personal data relating to that case will be automatically deleted from the IT tool and only anonymous statistical information is retained. This deletion occurs by the full deletion of contents of all fields where personal data can be entered or stored.
6. How do we protect and safeguard your personal data?
All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored on the servers of the European Commission, or on the servers of ECC offices or their host organisation of ECCs. Storage on host organisation servers may occur on mail servers and in the mail clients of the ECC offices or their host organisation, and (temporarily) in other Office productivity tools for text processing.
To protect your personal data, the Commission and ECCs have put in place several technical and organisational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.
7. Who has access to your personal data and to whom are they disclosed?
Access to your personal data is provided to the Commission staff responsible for carrying out this processing operation and to authorised staff of your ECC (case handlers) according to the “need to know” principle. This means that only staff who have a compelling purpose for having access to your data will have access. Such staff abide by statutory, and additional confidentiality requirements.
To resolve your request, it may subsequently be shared, with your express consent, with the authorised staff (case handlers) at the ECC where the trader is based or, where appropriate, with relevant public or private bodies such as an ADR entity or a National Enforcement Body (NEB).
Shared requests may result in contact with the trader. When such contact is made, your data may be shared too insofar as necessary to resolve the request.
Other than that, the information we collect will not be given to any third party, except to the extent and for the purpose we may be required to do so by law.
Norway and Iceland are EEA/EFTA countries. This means these countries have entered into agreement with the EU to be part of what is called a European Economic Area or the European Free Trade Association. ECC offices in Norway and Iceland are members of the European Consumer Centres Network.
8. What are your rights and how can you exercise them?
You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular, the right to access your personal data and to rectify them in case your personal data are inaccurate or incomplete. Where applicable, you have the right to erase your personal data, to restrict the processing of your personal data, to object to the processing, and the right to data portability.
You have consented to provide your personal data to your ECC and to the European Commission, directorate-General Justice and Consumers, Directorate E: Consumers Directorate, Unit E3 “Consumer Enforcement and Redress”.
You can withdraw your consent at any time by notifying the Data Controller. For consumers that have lodged a query with an ECC, the data controller to be notified is the ECC where the query was lodged. The withdrawal will not affect the lawfulness of the processing carried out before you have withdrawn the consent.
You can exercise your rights by contacting the Data Controller whom you originally contacted (the ECC), or in case of a conflict, the Data Protection Officer supervising your local ECC. If you wish, you may alternatively contact the European Data Protection Supervisor (contact details under Section 9 below) although your primary point of contact is the national ECC where you filed a complaint, and its Data Protection Officer.
If you wish to exercise your rights in the context of one or several specific processing operations, please provide a specific description of the data in your request.
9. Contact information
- Two joint data controllers
If you would like to exercise your rights under Regulation (EU) 2018/1725 or under Regulation (EU) 2016/679, if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please contact the relevant Data Controller. Normally, this would be the ECC that you have contacted:
ECC-Spain
Príncipe de Vergara, 54, 28006, Madrid. Telephone: +34/ 91 822 45 55. E-mail: cec@consumo.gob.es
- Data Protection Delegate of the Ministry of Social Rights, Consumer Affairs and Agenda 2030
To exercise your rights in relation to the processing of personal data related to Consumer Affairs and Gambling, click here.
Additionally, you can exercise your right to complain to the Spanish Data Protection Agency, Calle Jorge Juan 6, 28001 MADRID.
The Data Protection Delegate
You can contact the Data Protection Delegate of the Ministry of Social Rights, Consumer Affairs and Agenda 2030 by e-mail at dpd@dsca.gob.es or at the address Paseo del Prado 18-20, 28014 Madrid.
Alternatively, you may contact the data controller below,
Unit E3 “Consumer Enforcement and Redress”, Consumer Directorate, Directorate-General Justice and Consumers
E-mail: JUST-E3@ec.europa.eu
The Data Protection Officer (DPO) of the Commission
You may contact the Data Protection Officer (DATA-PROTECTION-OFFICER@ec.europa.eu) with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.
- The European Data Protection Supervisor (EDPS)
You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor (edps@edps.europa.eu) if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.
10. Where to find more detailed information?
The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission, which have been documented and notified to him. You may access the register via the following link: http://ec.europa.eu/dpo-register.
This specific processing operation has been included in the DPO’s public register with the following Record reference: DPR-EC-01406
ANNEX: List of Joint Controllers
ECC Austria
Mariahilfer Strasse 81
A-1060 Wien
+43/1 588 77 81
info@europakonsument.at
ECC Belgium
Hollandstraat 13
1060 Brussels
+32 (0)2 542 33 46
info@eccbelgium.be
ECC Bulgaria
1000 Sofia
14 Bacho Kiro Str.
+359 2 986 76 72
info@ecc.bg
ECC Cyprus
Ministry of Energy, Commerce and , Industry and Tourism
6, Α. Αraouzou ,
1421 Nicosia
+357 22 86 7177, 22 200 94400
ecccyprus@mecimcit.gov.cy
ECC Czech Republic
Czech Trade Inspectorate - Štěpánská 15
120 00 Prague
+420/269 366 155
esc@coi.cz
ECC Croatia
Hrvatska Ulica grada Vukovara 78
10000 Zagreb
+385 1 610 97 44
ecc-croatia@mingo.hr
ECC Denmark
Carl Jacobsens Vej 35
DK-2500 Valby
+45 4171 5000
info@forbrugereuropa.dk
ECC Estonia
Pronksi 12
Tallinn 10117
+372/6201 708
consumer@consumer.ee
ECC Finland
The Finnish Competition and Consumer Authority
Lintulahdenkuja 2
FIN-00531 Helsinki
+358 (0)29 553 9500
ekk@kkv.fi
ECC France
Bahnhofsplatz 3
D-77694 Kehl
+49/78 51 991 48 0
info@cec-zev.eu
ECC Germany
Bahnhofsplatz 3
77694 Kehl
+49/78 51 991 48 0
info@cec-zev.eu
ECC Greece
144 Alexandras Av.,
PC: 114 71, Athens
+30 210646 0862, +30 210 646 0814
info@eccgreece.gr
ECC Ireland
MACRO Building
1 Green Street - Dublin 7
01- 8797620
info@eccireland.ie
ECC Iceland
Hverfisgötu 105
101 Reykjavik
+354 545 1200
ecc@ecciceland.is
ECC Italy
Via G.M. Lancisi n. 25
00161 Roma
+39 06 44238090
info@ecc-netitalia.it
Via Brennero, 3
39100 Bolzano
+39 0471 980939
info@euroconsumatori.org
ECC Latvia
Brivibas Street 55 - 207
Riga, LV- 1010
+371 6738 8625
info@ecclatvia.lv
ECC Lithuania
Vilniaus str. 25,
LT-01402 Vilnius
+370/5/2650368
info@ecc.lt
ECC Luxembourg
2A, rue Kalchesbrück
L-1852 Luxembourg
+352 26 84 64 -1
info@cecluxembourg.lu
ECC Malta
47A, South Street,
Valletta VLT 1101
+356 21 22 19 01
ecc.malta@gov.mt
ECC Netherlands
Postbus 487
3500 AL Utrecht
+31/30 232 6440
info@eccnederland.nl
Forbruker Europa
Postboks 2862 Kjørbekk
3702 Skien
+47 23 400 508
post@forbrukereuropa.no
ECC Poland
Plac Powstańców Warszawy 1
00-950 Warsaw
+48 22 55 60 118
info@konsument.gov.pl
ECC Portugal
Praça Duque de Saldanha, 31-1°
1069-013 Lisboa
+351/21 356 47 50
euroconsumo@dg.consumidor.pt
ECC Romania
44 Mr. Av. Stefan Sanatescu Street, floor 1, room 2,
Sector 1, Bucharest - RO-011478
021.315.71.49
office@eccromania.ro
ECC Slovakia
Mlynské nivy 44/a
SK - 827 15 Bratislava 212
+421 2 4854 2019
info@esc-sr.sk
ECC Slovenia
Kotnikova 5
Si - 1000 Ljubljana
+386 1 400 3729
epc.mgrt@gov.si
ECC Spain
C/ Príncipe de Vergara, 54
28006 Madrid
+34/ 91 822 45 55
cec@consumo.gob.es
ECC SwedenTage Erlandergatan 8A
651 02 Karlstad
+46 (0)54 19 41 50
info@konsumenteuropa.se
UK International Consumer Centre,
1 Sylvan Court, Sylvan Way, Southfields Business Park
BASILDON Essex UK SS15 6TH
+44 (0) 1268 886690
ecc@tsi.org.uk
European Commission
Directorate-General Justice and Consumers,
Directorate E: Consumers Directorate,
Unit B3 “Consumer Enforcement and Redress”
1049 Bruxelles/Brussel
Belgium
Press contacts
JUST-B3@europa.eu