PROTECTION OF YOUR PERSONAL DATA
Table of Contents
- Why do we process your data?
This statement concerns the Online Dispute Resolution (ODR) platform. This privacy statement is addressed to you and/or to your representative if you are a consumer. A separate specific privacy statement for traders is available as well.
The ODR platform was developed and is maintained by unit E3 "Consumer enforcement and Redress" within Directorate General Justice and Consumers of the European Commission.
The statement explains the reason for the processing, the way of collecting, handling and ensuring protection of all personal data provided, how that information is used and what rights you may exercise in relation to your data (the right to access, rectify, block etc.) and how.
The European institutions are committed to protecting and respecting your privacy. As this service/application collects and further processes personal data, Regulation (EC) N°2018/1725  ,of the European Parliament and of the Council of 23 october 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, is applicable.
The platform however is an example of so-called “joint controllership”. This means that the responsibility for data protection is shared between the European Commission, national contact points  and the dispute resolution bodies.
Your personal data is collected and processed for two reasons:
to authenticate you as an authorised user and therefore grant you access to your disputes/complaints through your personal dashboard
if you have purchased a good or service online, to complain to and access an alternative dispute resolution body registered on the ODR platform as established by the Regulation (EU) No. 524/2013 on online dispute resolution for consumer dispute.
The personal data collected and further processed to ensure the secure authentication of users on the ODR platform are:
Your name and first name
Your e-mail address
The language you speak
The data are processed when you create your account to register on the ODR platform. They are collected and stored in EU Login, which is the authentication system developed by the European Commission for its different IT-systems, including the ODR platform.
In addition, the following personal data is collected and processed directly on the ODR platform through an electronic complaint form that is the basis of a dispute resolution procedure via the platform:
Your name and first name
Your contact details: e-mail address, phone number and geographic address (street, street number, postal code, country)
Language in which you would like to receive the notifications from the ODR platform. These notifications are messages that alert you when something has happened in relation to your dispute and that therefore invite you to connect to your personal dashboard.
The personal data that are collected through the electronic complaint form are those determined by the Regulation (EU) No 524/2013 on online dispute resolution of consumer disputes.
Personal data may also be contained in the documents that you may decide to attach to your complaint or that you may be invited to provide by the dispute resolution body during the dispute resolution procedure. There may also be personal data in the documents that are provided by the other party of the dispute.
- Personal data processed on the ODR platform
- Personal data processed in EU Login, the authentication system used for your registration on the platform
All your personal data processed on the ODR platform are automatically deleted six months after the closure of your dispute.
Disputes are generally closed by the dispute resolution body at the end of the procedure but they may be automatically closed by the system when for some reason the dispute cannot be resolved through the platform (e.g. when you do not agree with the other party on the dispute alternative dispute resolution body that should deal with your complaint).
If you started to complete a complaint form but do not submit it, the system will automatically delete the draft complaint six months after you started filling in the form.
Please refer to the EU Login privacy statement for your personal data processed for the registration on the ODR platform (point 6 'How long do we keep your data?').
All data in electronic format (e-mails, documents, uploaded batches of data etc.) are stored either on the servers of the European Commission or of its contractors; the operations of which abide by the European Commission’s security decision of 16 August 2006 [C(2006) 3602] concerning the security of information systems used by the European Commission.
Please note that it may be that the dispute resolution body that handles your dispute or that the national contact point that you may decide to contact for assistance decides to keep data related to the disputes in which they intervene in files outside of the ODR platform. In this case national data protection laws apply.
You can find the references the different applicable national regulatory framework here: http://ec.europa.eu/justice/data-protection/law/status-implementation/index_en.htm
Access to your data is provided to authorised staff in the European Commission, the national contact points and the alternative dispute resolution bodies according to the “need to know” principle only. Such staff abide by statutory, and when required, additional confidentiality agreements.
According to Regulation (EC) n°2018/1725, you are entitled to access your personal data and rectify and/or block it in case the data is inaccurate or incomplete.You can exercise your rights by contacting the data controller, or in case of conflict the Data Protection Officer and if necessary the European Data Protection Supervisor using the contact information given at point 8 below.
The ODR platform allows you to modify at any time throughout the procedure the personal data that you provide in order to register on the platform and under the “Personal information” part of the electronic complaint form.
There may however be personal data in other parts of the dispute file that you cannot modify. They may for instance be contained in the version of the other party to the dispute or in messages exchanged with the dispute resolution body. You may in some cases, in accordance with national data protection laws, supplement that information by a note that can be attached to the dispute file in the platform.
If you have comments or questions, any concerns or a complaint regarding the collection and use of your personal data, please feel free to contact the Data Controllers as follows:
- For the personal data you provide for the registration on the ODR platform ("authentication")
Please refer to the EU Login privacy statement for your personal data processed for the registration on the ODR platform.
- For the personal data you provide in the electronic complaint form (under “Personal Information”)
Please refer to the platform's Data Controller:
Controller: Head of Unit
Unit: E3 - "Consumer enforcement and Redress" within Directorate General for Justice and Consumers
- For other personal data contained in the dispute file
You can address your requests that relate to personal data contained in the dispute file that you cannot modify yourself, directly to the dispute resolution body that is handling your case.
You can also address your complaints to:
The Data Protection Officer (DPO) of the Commission: DATA-PROTECTION-OFFICER@ec.europa.eu
The European Data Protection Supervisor (EDPS): firstname.lastname@example.org
The Commission Data Protection Officer publishes the register of all operations processing personal data. You can access the register on the following link : http://ec.europa.eu/dpo-register
This specific processing has been notified to the DPO with the following reference: DPO 3814.1.
National contact points established in each Member State to provide assistance to users of ODR platform. They host at least two advisors and have access to your dispute data if you ask for their assistance.