PROTECTION OF YOUR PERSONAL DATA

Table of Contents

1. Introduction

2.Why do we process your data?

3.Which data do we collect and process?

4.How long do we keep your data?

5.How do we protect your data?

6.Who has access to your data and to whom is it disclosed?

7.What are your rights and how can you exercise them?

8.Contact information

9.Recourse

10.Where to find more detailed information

  1. Introduction

    2. This statement concerns the Online Dispute Resolution (ODR) platform. This privacy statement is addressed to you and/or to your representative if you are a trader registered on the platform. A separate specific privacy statement for consumers is available as well.

    The ODR platform was developed and is maintained by unit E3 "Consumer enforcement and Redress" within Directorate General Justice and Consumers of the European Commission.

    The statement explains the reason for the processing, the way of collecting, handling and ensuring protection of all personal data provided, how that information is used and what rights you may exercise in relation to your data (the right to access, rectify, block etc.) and how.

    The European institutions are committed to protecting and respecting your privacy. As this service/application collects and further processes personal data, Regulation (EC) N°2018/1725 [1] ,of the European Parliament and of the Council of 23 october 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, is applicable.

    The platform however is an example of so-called “joint controllership”. This means that the responsibility for data protection is shared between the European Commission, national contact points [2] and the dispute resolution bodies.

  2. Why do we process your data?

    3. Your personal data is collected and processed for two reasons:

    • to authenticate you as an authorised user and therefore grant you access to your disputes/complaints through your personal dashboard

    • if you have sold a good or service online, to deal with complaints related to this sale and to access an alternative dispute resolution body registered on the ODR platform as established by the Regulation (EU) No. 524/2013 on online dispute resolution for consumer dispute

  3. Which data do we collect and process?

    4. The personal data collected and further processed to ensure the secure authentication of users on the ODR platform are:

    • Your name and first name

    • Your e-mail address

    • The language you speak

    The data are processed when you create your account to register on the ODR platform. They are collected and stored in EU Login, which is the authentication system developed by the European Commission for its different IT-systems, including the ODR platform.

    In addition, the following personal data is collected and processed directly on the ODR platform through an electronic complaint form that is the basis of a dispute resolution procedure via the platform:

    • Your corporate name

    • Your contact details: e-mail address, phone number and geographic address (street, street number, postal code, country)

    • Your website address.

    The personal data that are collected through the electronic complaint form are those determined by the Regulation (EU) No 524/2013 on online dispute resolution of consumer disputes.

    If you are already registered on the platform, this data are automatically taken from your registration account.

    Personal data may also be contained in the documents that you may decide to attach to your complaint or that you may be invited to provide by the dispute resolution body during the dispute resolution procedure. There may also be personal data in the documents that are provided by the other party of the dispute.

  4. How long do we keep your data?
    • Personal data processed on the ODR platform

      • All your personal data processed on the ODR platform are automatically deleted six months after the closure of your dispute.

      Disputes are generally closed by the dispute resolution body at the end of the procedure but they may be automatically closed by the system when for some reason the dispute cannot be resolved through the platform (e.g. when you do not agree with the other party on the dispute alternative dispute resolution body that should deal with your complaint).

      If you started to complete a complaint form but do not submit it, the system will automatically delete the draft complaint six months after you started filling in the form.

    • Personal data processed in EU Login, the authentication system used for your registration on the platform

    Please refer to the EU Login privacy statement for your personal data processed for the registration on the ODR platform (point 6 'How long do we keep your data?').

    https://ecas.ec.europa.eu/cas/privacyStatement.html

  5. How do we protect your data?

    6. All data in electronic format (e-mails, documents, uploaded batches of data etc.) are stored either on the servers of the European Commission or of its contractors; the operations of which abide by the European Commission’s security decision of 16 August 2006 [C(2006) 3602] concerning the security of information systems used by the European Commission.

    Please note that it may be that the dispute resolution body that handles your dispute or that the national contact point that you may decide to contact for assistance decides to keep data related to the disputes in which they intervene in files outside of the ODR platform. In this case national data protection laws apply.

    You can find the references the different applicable national regulatory framework here: http://ec.europa.eu/justice/data-protection/law/status-implementation/index_en.htm

  6. Who has access to your data and to whom is it disclosed?

    7. Access to your data is provided to authorised staff in the European Commission, the national contact points and the alternative dispute resolution bodies according to the “need to know” principle only. Such staff abide by statutory, and when required, additional confidentiality agreements.

  7. What are your rights and how can you exercise them?

    8. According to Regulation (EC) n°2018/1725, you are entitled to access your personal data and rectify and/or block it in case the data is inaccurate or incomplete. You can exercise your rights by contacting the data controller, or in case of conflict the Data Protection Officer and if necessary the European Data Protection Supervisor using the contact information given at point 8 below.

    The ODR platform allows you to modify at any time throughout the procedure the personal data that you provide in order to register on the platform: staff working for you and registered on the platform can modify their personal data through EU Login. In addition a local administrator within your organisation can modify its contact details (e.g. e-mail address).

    You are also able to update the details under the “Traders Details” part of the electronic complaint form. Note however, if you are already registered on the ODR platform, this part of the form was automatically pre-filled by the system for the complainant using your registration data

    There may however be personal data in other parts of the dispute file that you cannot modify. They may for instance be contained in the version of the other party to the dispute or in messages exchanged with the dispute resolution body. You may in some cases, in accordance with national data protection laws, supplement that information by a note that can be attached to the dispute file in the platform.

  8. Contact information

    9. If you have comments or questions, any concerns or a complaint regarding the collection and use of your personal data, please feel free to contact the Data Controllers as follows:

    • For the personal data you provide for the registration on the ODR platform

    Please refer to the EU Login privacy statement for your personal data processed for the registration on the ODR platform.

    • For the personal data you provide in the electronic complaint form (under “Trades Details”)

    Please refer to the platform's Data Controller:

    Controller:           Head of Unit

    Unit:                   E3 - "Consumer enforcement and Redress" within Directorate General for Justice and Consumers

    Mail:                    JUST-E3@ec.europa.eu

    • For other personal data contained in the dispute file but not in

    You can address your requests that relate to personal data contained in the dispute file that you cannot modify yourself, directly to the dispute resolution body that is handling your case.

  9. Recourse

    10. You can also address your complaints to:

    The Data Protection Officer (DPO) of the Commission: DATA-PROTECTION-OFFICER@ec.europa.eu

    The European Data Protection Supervisor (EDPS): edps@edps.europa.eu

  10. Where to find more detailed information?

    11. The Commission Data Protection Officer publishes the register of all operations processing personal data. You can access the register on the following link : http://ec.europa.eu/dpo-register

    This specific processing has been notified to the DPO with the following reference: DPO 3814.1.

[2]National contact points established in each Member State to provide assistance to users of ODR platform. They host at least two advisors and have access to your dispute data if you ask for their assistance.