Our Privacy Policy

This section describes the purposes of the processing by the ECCs and by the European Commission. The ECCs and the European Commission are joint controllers for the processing.

To fulfil their role, ECCNET2 is used by the ECCs to process relevant data, insofar and as long as necessary, for one or more of the following purposes:

• to enable communication between the ECC and the consumer
• to facilitate the assessment of a request
• to attempt resolving complaints or disputes, whether directly with the trader complained about, or through an 'ADR' entity (this is an impartial organisation that tries to resolve consumer disputes)
• to enable consumers to follow up the status of their requests
• to create aggregated statistics, including on suspected infringements

Further information on ECC-Net can be found at https://ec.europa.eu/info/live-work-travel-eu/consumers/resolve-your-consumer-complaint/european-consumer-centres-network_en

The European Commission

The European Commission provides ECCNET2, the case handling IT tool used by all ECCs. The Commission processes relevant data, insofar and as long as necessary, for one or more of the following purposes:

• To support users of the IT tool in ECCs in its optimal use (monitoring, training, and support)
• To maintain, develop and troubleshoot the case handling IT tool used by the ECCs
• to create anonymised statistics, including on suspected infringements

Your personal data will not be used for any automated decision-making including profiling.

We process your personal data on three legal grounds: first of all, based on your consent (when you seek help from an ECC), and for secondary purposes, when processing is necessary for the performance of a task carried out in the public interest.

To answer your questions or handle your complaint, the processing of your data is based on your consent.

For other purposes mentioned above, including the creation of statistics, and maintenance, development and troubleshooting, the processing is necessary for the performance of a task carried out in the public interest -or in the exercise of official authority vested in the Union institution or body (Art 5(1) a of Regulation (EU) 2018/1725 -or in the exercise of official authority vested in the controller Art 6(1) e of Regulation (EU) 2016/679.

The network (ECC-Net 2) has a legal basis in the following legal instruments:

• Regulation (EU) 2021/690 of the European Parliament and of the Council of 28 April 2021 establishing a programme for single market, competitiveness of enterprises, including small and medium-sized enterprises, including small and medium-sized enterprises, the area of plants, animals, food and feed, and European statistics (Single Market Programme) and repealing Regulations (EU) No 99/2013, (EU) No 1287/2013, (EU) No 254/2014 and (EU) No 652/2014 and, more specifically, articles 3(2)(d), Art 8(2)(b)  and 9(5) of this Regulation.
• Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market and, in particular, article 21.
• Directive 2013/11/EU of the European Parliament and of the Council of 21 May 2013 on alternative dispute resolution for consumer disputes and amending Regulation (EC) No 2006/2004 and Directive 2009/22/EC (Directive on consumer ADR) and, more specifically, article 14 of the Directive.
• Regulation (EU) 2017/2394 of the European Parliament and of the Council of 12 December 2017 on cooperation between national authorities responsible for the enforcement of consumer protection laws and repealing Regulation (EC) No 2006/2004 and, in particular, article 27(1).

To carry out this processing operation, the European Commission collects personal data from the following categories of data subjects:  

• Consumers
  Consumers in the European Union, Norway, Iceland and other countries who approach ECCs for information and assistance
• Trader representatives
  Contact persons for the traders in the European Union, Norway and Iceland involved in consumer complaints or disputes
• ADR representatives
  Contact persons in ADR entities

The ECCs and Commission do not knowingly collect or process data from minors.

The personal data collected and further processed may include: 

Consumers

• Name of the consumer/reporter
• Address
• Postcode
• Country of residence
• Telephone number
• Email
• Gender
• Communication language
• Summary/Description of the request

Further personal data may be collected if provided by the consumer as necassary for handling the complaint.

Trader representatives

Data from individual trader's representatives is rarely stored in the system but, when processed, may include:

• Name of the trader's representative
• Professional address
• Postcode
• Country
• Professional telephone
• Professional email

ADR representatives

Data from individual trader's representatives is rarely stored in the system but, when processed may include:

• Name of the ADR's representative
• Professional address
• Postcode
• Country
• Professional telephone
• Professional email

The provision of the abovementioned data is mandatory to allow us to handle your question of complaint. If you do not provide your personal data, we will not be able to respond to you. 

The Commission as provider of the IT tool has access to your file along with the ECC or ECCs that are directly involved in handling your query. 

Personal data of the consumers, traders' and ADRs' representatives shall be kept as long as a case remains open, and for three years after it has been closed. This is to allow follow-up if there are new developments after the closure of the case. Once the retention period expires, all personal data relating to that case will be automatically deleted from the IT tool and only anonymous statistical information is retained. This deletion occurs by the full deletion of contents of all fields where personal data can be entered or stored.

All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored on the servers of the European Commission, or on the servers of ECC offices or their host organisation of ECCs. Storage on host organisation servers may occur on mail servers and in the mail clients of the ECC offices or their host organisation, and (temporarily) in other Office productivity tools for text processing.

To protect your personal data, the Commission and ECCs have put in place several technical and organisational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.

Access to your personal data is provided to the Commission staff responsible for carrying out this processing operation and to authorised staff of your ECC (case handlers) according to the “need to know” principle.  This means that only staff who have a compelling purpose for having access to your data will have access. Such staff abide by statutory, and additional confidentiality requirements.

To resolve your request, it may subsequently be shared, with your express consent, with the authorised staff (case handlers) at the ECC where the trader is based or, where appropriate, with relevant public or private bodies such as an ADR entity or a National Enforcement Body (NEB).

Shared requests may result in contact with the trader. When such contact is made, your data may be shared too insofar as necessary to resolve the request.

Other than that, the information we collect will not be given to any third party, except to the extent and for the purpose we may be required to do so by law.

Norway and Iceland are EEA/EFTA countries. This means these countries have entered into agreement with the EU to be part of what is called a European Economic Area or the European Free Trade Association.  ECC offices in Norway and Iceland are members of the European Consumer Centres Network.

You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular, the right to access your personal data and to rectify them in case your personal data are inaccurate or incomplete. Where applicable, you have the right to erase your personal data, to restrict the processing of your personal data, to object to the processing, and the right to data portability.

You have consented to provide your personal data to your ECC and to the European Commission, directorate-General Justice and Consumers, Directorate E: Consumers Directorate, Unit E3 “Consumer Enforcement and Redress”.

You can withdraw your consent at any time by notifying the Data Controller. For consumers that have lodged a query with an ECC, the data controller to be notified is the ECC where the query was lodged. The withdrawal will not affect the lawfulness of the processing carried out before you have withdrawn the consent.

You can exercise your rights by contacting the Data Controller whom you originally contacted (the ECC), or in case of a conflict, the Data Protection Officer supervising your local ECC. If you wish, you may alternatively contact the European Data Protection Supervisor (contact details under Section 9 below) although your primary point of contact is the national ECC where you filed a complaint, and its Data Protection Officer.

If you wish to exercise your rights in the context of one or several specific processing operations, please provide a specific description of the data in your request.

- Two joint data controllers

If you would like to exercise your rights under Regulation (EU) 2018/1725 or under Regulation (EU) 2016/679, if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please contact the relevant Data Controller. Normally, this would be the ECC that you have contacted: European Consumer Centre.

Alternatively, you may contact the data controller below, 

Unit E3 “Consumer Enforcement and Redress”, Consumer Directorate, Directorate-General Justice and Consumers

E-mail: JUST-E3@ec.europa.eu

The Data Protection Officer (DPO)

You may contact the Data Protection Officer (DATA-PROTECTION-OFFICER@ec.europa.eu) with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725

The European Data Protection Supervisor (EDPS)

You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor (edps@edps.europa.eu) if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.

The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission, which have been documented and notified to him. You may access the register via the following link: http://ec.europa.eu/dpo-register.

This specific processing operation has been included in the DPO’s public register with the following Record reference: DPR-EC-01406

Personal data are processed via the website www.eccnet.eu. The European Consumer Centres Network (hereafter: ECC-Net) attaches great importance to the careful treatment of these personal data. Personal data are processed and secured by us with the utmost care. When processing data, we comply with the requirements set by the privacy legislation. That means, among other things, that:

• in this privacy statement we clearly state the purpose for which we are processing personal data;
• we never collect more personal data than is necessary for the purposes described in this privacy statement;
• we first ask for explicit permission to process your personal data in cases where your consent is required;
• we take appropriate security measures to protect your personal data and also require parties that process personal data on our orders to do the same;
• we respect your rights under the GDPR, for instance to request that your personal data be provided to you for inspection, correction or removal.

This website is maintained by the European Consumer Centre of the Netherlands on behalf of the European Consumer Centres Network. The Dutch centre is therefore responsible for data processing. In this privacy statement we explain what personal data we collect and use and for what purpose. This privacy statement was last updated: August, 2022.

When you use our website, we may obtain certain data from you. We only keep and use the personal data provided directly by you in the context of your request, or where it is clear this has been provided to us to be processed.

You can use our website without providing personal data. On specific pages of the website, however, you will be asked to provide personal data. The data we can collect on these pages are:

• first and last name
• place of residence (country)
• telephone number
• email address

The information above is used solely for the following purposes:

• Sending us a question or request via the online contact form
• Providing us with feedback
• Signing up to our digital newsletter

Our website offers you the opportunity to send requests and inquires through a contact form. This contact form asks you to enter certain details in order to handle your request:

• first and last name
• place of residence (country)
• telephone number
• email address

We will keep your personal data as long as, depending on the nature of the question, is necessary for a complete response to the question and treatment thereof, but no longer than one year after we have processed your request.

Once the retention period expires, the information is anonymised and only kept for statistical purposes. See ‘Protection of your personal data ECC-Net 2’.

At ECC-Net we are eager to learn from feedback provided by our website visitors. Therefore, we are open to receiving any feedback, suggestions and/or other ideas on how we can improve our site and tailor it to your needs even more.

With that in mind we have a specific section on our site with information on where to reach us to do so. While the personal data you share may be limited to your email address and your (full) name, any other personal data you disclose in your feedback or suggestions may also be processed by us.

Our website offers you the opportunity to send requests and inquiries through to your local ECC, by linking you through to your ECC of choice. While your local ECC might process personal data in the process of handling your request, it is important to check the privacy statement of that specific ECC to read about their handling of your personal data.

On our website, we provide the option to sign up for our monthly email newsletter, which we use to inform interested parties about our services and latest consumer news. Every newsletter contains a link with which you can easily unsubscribe. Your email address will only be added to the list of subscribers with your permission.

We offer an insite search functionality. With this functionality, you can search for specific content on our website. Once you enter a key word, relevant pages and content will be shown. We take inventory of topics that are popular and tailor our content accordingly.

We take appropriate security measures to limit the abuse of and unauthorized access to personal data. Specifically, ECC-Net has taken the following measures:

• We make use of secure connections (SSL/TLS) to protect all information between you and our website when you enter personal data.
• Access only on ‘need-to-know-basis’.
• Website service providers are ISO27001-certified.
• (If needed) critical security patches are deployed within 24 hours.

The personal data described above will be stored for up to 1 year after you have provided us with the data. This will differ only if it is necessary to keep the data longer to provide the service you have requested to you (for instance if you have signed up for our digital newsletter), or if there is a statutory obligation that requires longer storage.

This privacy statement does not apply to third party websites that are connected to our service by means of links. We cannot guarantee that these third parties handle your personal data in a trustworthy or secure manner. We encourage you to read the privacy statement of these websites before using them.

In his section we inform you about the data processing in connection with the third-party platforms on which we are present. We would like to point out that ECC-Net is not aware of the data processing of third-party platforms and has no influence on it. We also do not have access to the personal data of users, as long as they do not make it public themselves.

Processing of personal data and purposes of the processing

If ECC-Net opens an account on a third-party platform, the operator may set cookies as soon as the user visits ECC-Net’s account on that platform.

We only receive anonymous evaluations of account usage from third-party platforms. This anonymous data is used for the analysis of user behavior for statistical purposes, so that we can better adapt our offers of help and support to the needs and interests of consumers. This is necessary to fulfill the mission of ECC-Net and to reach the largest possible number of users with its contents. As anonymized data cannot be related to you as a natural person, it does not fall within the scope of the GDPR.

ECC-Net may receive the following anonymous data from social media platforms:

• Age group
• Gender
• Place of residence (city and country)
• Language
• Mobile and stationary page views (and device type for YouTube)
• Interactions on posts (e.g., reactions, comments, shares, clicks, views, length of time the video was used)
• Time of use

We do not know what personal data is collected beyond our control and responsibility by the operators of third-party platforms and for what other purposes they process user data. We can therefore only inform you about what we know about the data processing by these platforms. We thank you for your understanding.

ECC-Net draws your attention to the fact that the operators of the platforms are usually American companies and that their data may therefore be processed outside the European Union. This may result in risks, as it could make it more difficult to enforce users' rights.

On our website we use social media buttons, which redirect you to such third party platforms like social media platforms. The buttons are active because of bits of code that come from the social media networks. If you want to know what the social media platforms do with your personal data, please read the relevant privacy statement.

Meta Platforms Ireland Limited

4 Grand Canal Square
Grand Canal Harbour
Dublin 2, Ierland
Privacy on Instagram
Privacy on Facebook
Opt-out advertising preferences

YouTube

YouTube LLC
901 Cherry Ave.
San Bruno, CA 94066, USA
YouTube Privacy

Twitter

Twitter, Inc.
1355 Market Street, Suite 900
San Francisco, CA 94103, USA
Privacy on Twitter

LinkedIn Ireland Unlimited Company

Attn: Legal Dept (Privacy Policy and User Agreement)
Wilton Plaza
Wilton Place, Dublin 2
Ireland
Privacy on LinkedIn

We only share your data with third parties when this is necessary and only if allowed by current legislation. It may happen that we provide your personal information to third parties, because:

• we have engaged them to process certain data; 
• it is necessary to carry out the agreement with you;
• you give permission for this; 
• we have a legitimate interest in this;
• we are legally obliged to do so (e.g. if the police demand this in case of a suspicion of a crime).

The parties that process your personal data on your or our assignment are:

• Cookie service providers
• IT suppliers and service providers
• E-commerce tools

To provide its service, ECC-Net may provide your personal data to parties established outside the European Economic Area (EEA). We will only do this if there is an adequate level of protection for the processing of personal data. This means, for example, that we use a model agreement from the European Commission or make agreements about the handling of personal data.

Please check our cookie statement for detailed information about cookies. 

We take appropriate security measures to limit the abuse of and unauthorized access to personal data. Specifically, ECC-Net has taken the following measures:

• We make use of secure connections (SSL/TLS) to protect all information between you and our website when you enter personal data
• Access only on ‘need-to-know-basis’
• Website service providers are ISO27001-certified
• (If needed) critical security patches are deployed within 24 hours

For questions about our privacy statement or questions regarding the inspection of and changes to (or removal of) your personal data, feel free to contact us at any time by sending an email to communication@eccnederland.nl. You can also send us a request to follow up to one of your rights under the GDPR:

• Right of access: you have the right to see what kind of personal data we processed about you.
• Right of rectification: you have the right to rectify any personal data we have processed about you, if this information is (partially) wrong.
• Right to revoke your consent, when we process your data based on your consent. 
• Right to object: you have the right to object against the processing of your personal data by us.
• Right to be forgotten: you can file a request with us to remove any personal data we have processed of you.
• Right to data portability: if technically possible, you have the right to ask us to transfer your processed personal data to a third party.
• Right to restriction of processing: you can file a request with us to (temporarily) restrict the processing of your personal data. This means that we will process less personal data from you.

If you wish to exercise any of these rights, we may ask you to identify yourself. For this purpose, we need some information about you, to make sure that you are the right person to whom the personal data belongs. 

We will usually respond to your request within one month. This term can be extended with two months if the request is proven to be complex or tied to a specific right. You will be notified about a possible extension of this term within the first month.

Contact details of the European Consumer Centre the Netherlands

European Consumer Centre the Netherlands

Moreelsepark 1, 3511 EP Utrecht

Communication@eccnederland.nl

+31 30 - 232 64 40

We reserve the right to make changes to this privacy statement. We recommend you check this privacy statement regularly to stay informed of these changes.

• Last change: August, 2022.

We are happy to help with any complaints you may have concerning the processing of your personal data on www.eccnet.eu. You can contact us if you want to:

• find out more about how we use your personal information
• tell us you’re concerned about how we use information - for example if you think we’ve shared your information when we shouldn’t have

This website is maintained by the European Consumer Centre of the Netherlands on behalf of the European Consumer Centres Network. Therefore, you can lodge your complaint with our Dutch centre. Contact details: 

• European Consumer Centre the Netherlands
  Moreelsepark 1, 3511 EP Utrecht
  Communication@eccnederland.nl
  +31 30 - 232 64 40

If you have a question or complaint concerning the processing of your personal data by an ECC centre, please read the privacy statement of that specific ECC to learn about their handling of your personal data.

The privacy legislation also gives you the right to lodge a complaint with the Data Protection Authority against the processing of your personal data.