Article 12

1. Access to information, including personal data, related to a dispute and stored in the database referred to in Article 11 shall be granted, for the purposes referred to in Article 10, only to the ADR entity to which the dispute was transmitted in accordance with Article 9. Access to the same information shall be granted also to ODR contact points, in so far as it is necessary, for the purposes referred to in Article 7(2) and (4). 2. The Commission shall have access to information processed in accordance with Article 10 for the purposes of monitoring the use and functioning of the ODR platform and drawing up the reports referred to in Article 21. It shall process personal data of the users of the ODR platform in so far as it is necessary for the operation and maintenance of the ODR platform, including for the purposes of monitoring the use of the ODR platform by ADR entities and ODR contact points. 3. Personal data related to a dispute shall be kept in the database referred to in paragraph 1 of this Article only for the time necessary to achieve the purposes for which they were collected and to ensure that data subjects are able to access their personal data in order to exercise their rights, and shall be automatically deleted, at the latest, six months after the date of conclusion of the dispute which has been transmitted to the ODR platform in accordance with point (iii) of point (c) of Article 10. That retention period shall also apply to personal data kept in national files by the ADR entity or the ODR contact point which dealt with the dispute concerned, except if the procedural rules applied by the ADR entity or any specific provisions of national law provide for a longer retention period. 4. Each ODR advisor shall be regarded as a controller with respect to its data processing activities under this Regulation, in accordance with point (d) of Article 2 of Directive 95/46/EC, and shall ensure that those activities comply with national legislation adopted pursuant to Directive 95/46/EC in the Member State of the ODR contact point hosting the ODR advisor. 5. Each ADR entity shall be regarded as a controller with respect to its data processing activities under this Regulation, in accordance with point (d) of Article 2 of Directive 95/46/EC, and shall ensure that those activities comply with national legislation adopted pursuant to Directive 95/46/EC in the Member State where the ADR entity is established. 6. In relation to its responsibilities under this Regulation and the processing of personal data involved therein, the Commission shall be regarded as a controller in accordance with point (d) of Article 2 of Regulation (EC) No 45/2001.

← art_11__para · All articles · art_12__para_1 →

Source: EUR-Lex (Cellar) · retrieved 2026-11-05 · Text as adopted (Official Journal); later amendments are not incorporated in this text.