Privacy Notice

Under this privacy notice (hereinafter the “notice”), European Commodity Clearing AG (hereinafter “ECC”, “we” or “us”) informs you how We process your personal data. Personal data is any information that relates to you, your employees or other individuals (hereinafter: “personal data”). We pay special attention to the processing of personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable national data protection laws

1. Our identity and contact details

The person responsible within the meaning of the GDPR, within other data protection laws in force in the Member States of the European Union and within other provisions of a data protection nature is:

European Commodity Clearing AG
Augustusplatz 9
04109 Leipzig
Germany

Phone: +49 341 24680 0
Fax:      +49 341 24680 409
E-Mail:  info@ecc.com

Link to imprint: https://www.ecc.de/en/imprint

2. Contact details of our Data Protection Officer

Our Data Protection Officer is:

European Commodity Clearing AG 
Data Protection Officer 
Augustusplatz 9 
04109 Leipzig 
Germany 

E-Mail: dataprotection@eex.com

If you have any questions or comments on the subject of data protection, please contact the data protection officer.

3. Purpose, categories of personal data legal basis and retention

3.1 Categories of your personal data, purposes of our processing and their legal basis

3.1.1 General contact by e-mail, post or telephone

We collect your personal data when you provide it through our contact forms or contact us directly by e-mail, post or telephone. We process the information you provide, in particular your name, business affiliation and contact details, as well as the date, reason and content of the communication, to process and respond to your enquiry. The legal basis is Article 6 para. 1 lit. (f) GDPR. Our legitimate interest is the efficient handling of enquiries and business communications. Data is retained for as long as necessary to handle the enquiry and in accordance with applicable statutory retention requirements.

If you contact us by telephone, conversations on dedicated trading, clearing, and operational support lines may be recorded where required by statutory regulatory obligations in accordance with Article 6 para. 1 lit. (c) GDPR. The records are retained in accordance with applicable statutory retention requirements (typically up to ten years). In all other cases (e.g. for quality assurance, training, or general documentation), telephone conversations are recorded exclusively on the basis of your prior explicit consent pursuant to Article 6 para. 1 lit. (a) GDPR. You are informed of any recording beforehand and can withhold or withdraw your consent at any time.

3.1.2 Sales, Marketing and invitations

We may use your personal data (name, first name, address, company, telephone number, e-mail address) to send you information about our services, partners, promotions and events that we think may be of interest to you. We may contact you by e-mail based on our legitimate interests under Article 6 para. 1 lit. (f) GDPR if we have a direct business relationship with you or with the company for which you work, and if you have not objected. We may contact you by telephone if you have given your consent (Article 6 para. 1 lit. (a) GDPR) or on the basis of a presumed consent on the condition that you will welcome the call. We may contact you by post on the basis of our legitimate interests under Article 6 para. 1 lit. (f) GDPR as long as you do not object. In such cases, it is our legitimate interest to inform business partners or potential customers about such services and products that may be of interest to them and thus to maintain our existing or future business relationship. You have the right to object to the processing of your personal data for direct marketing purposes at any time, or to withdraw your consent with effect for the future. Your personal data processed in this respect will be stored by us for as long as it is necessary to carry out our relationship (communication) with you and in accordance with the applicable legal storage regulations.

3.1.3 Webinars

With the ECC Webinars, you can participate in interactive presentations and live discussions and exchange views with renowned experts on current topics in the clearing and commodity markets. If you would like to participate, you can register online for a webinar. Please enter your e-mail address, first name and surname (as well as company, job title and country). If you participate in the webinar with questions or comments, these will be saved. To help structure discussions, your name, job title, company name and country may be shared with speakers, moderators and persons supporting their preparation. The legal basis is Article 6 para. 1 lit. (b) GDPR where you personally register under a user agreement, or Article 6 para. 1 lit. (f) GDPR where you participate on behalf of a customer or business partner (our legitimate interest and that of your employer in enabling your participation). Where participant numbers are limited, the application selection process is based on Article 6 para. 1 lit. (f) GDPR. Your personal data processed in this respect will be stored by us as long as it is necessary to maintain our relationship (the webinar event) with you and as long as it is necessary in accordance with the applicable legal retention requirements.

3.1.4 Newsletter

ECC offers circulars, readiness newsflashes and product newsletters to keep you regularly informed about ongoing initiatives and upcoming projects and any future updates or news about products and events. You can register for the categories you would like to subscribe to on our website by entering your email address. The prerequisite for sending the newsletter is your e-mail address. The provision of additional, separately marked data is voluntary and will be used to address you personally and to improve our newsletter content. After entering your data, you will receive an e-mail in which you can confirm your registration in order to activate the newsletter (double opt-in). You can unsubscribe from this service in every newsletter and withdraw your consent with effect for the future. With regard to the processing of your personal data, the relevant legal basis is your consent in accordance with Article 6 Paragraph 1 lit. a in connection with Article 7 GDPR. The opening and click rates of the newsletters are measured exclusively anonymously. It is not possible to assign them to individual newsletter recipients. If you do not confirm your subscription within 24 hours, your personal data will be deleted after one month. If you unsubscribe from a newsletter or withdraw your consent, we process your e-mail address in a suppression list based on Article 6 para. 1 lit. (f) GDPR to ensure that you do not receive further newsletters.

3.1.5 Events

If you apply for an event and/or participate in our events, we collect your participant data (e.g. name, contact data, job title, company name, country, e-mail address, billing data) for the organisation and execution of the respective event. In order to carry out and organise the event, your data may also be passed on to other parties involved in the event if this is necessary (e.g. for admission control) or to speakers and moderators to help structure discussions and tailor presentations. Where you enter into a direct participation agreement with us, the legal basis is Article 6 para. 1 lit. (b) GDPR, permitting the processing of personal data for the purposes of the performance of a contract. Where you participate on behalf of a customer or business partner, processing is based on Article 6 para. 1 lit. (f) GDPR (our legitimate interest and that of your employer in enabling your participation). Where participant numbers are limited, application data may be processed on the basis of Article 6 para. 1 lit. (f) GDPR for our legitimate interest in selecting participants for the relevant professional audience. Further information may be provided in a privacy notice for the specific event, if this is necessary. Your personal data processed in this respect will be stored by us as long as it is necessary to maintain our relationship (participation in the event) with you and as long as it is necessary in accordance with the legal retention periods.

3.1.6 Applications

Data protection information on the application process can be found directly in the privacy notice on our careers page (https://www.eex.com/en/careers).

3.1.7 Performance of contracts and services

If you or your company want to be authorized as a customer of one of our services, we collect your personal data (first name, last name, contact data, company) to register you to our service and for the usage of our service. The sole responsible body is European Commodity Clearing AG with which a contract is concluded or occurs in the case of pre-contractual measures. The purposes of personal data processing are determined by the specific service or product. This may include especially assessments, consultation, clearing activities, and the execution of business accounting and fee administration. The legal basis for processing this personal data is Article 6 para. 1 lit. (b) GDPR, as processing is necessary to fulfill a contract or for pre-contractual measures between us and the customer. If the user is not the customer who concluded the contract with us, but an employee of the customer or otherwise authorized by the customer to use our services, the legal basis for processing is Article 6 para. 1 lit. (f) GDPR, as the processing is in the legitimate interest of the customer. The legitimate interest of the customer is to enable the user to use our services in accordance with the contract. Your personal data processed in this regard will be stored by us as long as it is necessary to carry out our relationship (registration and use of our service) with you and required by applicable statutory retention laws.

3.1.8    Business relationships with customers, suppliers and service providers

In the course of our business relationships, we process personal data of contacts at customers, clearing members, suppliers, service providers and other business partners. This may include identification and business contact data, role and responsibilities, communications, contract, order, invoice and payment data, system usage and access data, and compliance-related information where required. We process this data to initiate, perform and administer business relationships, communicate with business partners, ensure operational continuity, and meet internal administration, governance, risk, compliance and legal requirements. Depending on the circumstances, the legal bases are Article 6 para. 1 lit. (b), (c) and (f) GDPR. Our legitimate interests include the efficient administration of professional business relationships, operational security and sound governance and compliance. Data is deleted when no longer necessary for these purposes, subject to statutory retention and documentation requirements.

3.1.9    General use of our websites and online platforms

When you use our websites or online platforms, we automatically process technical connection and server log data, including your IP address, session time, pages accessed, referrer URL, browser and device information, operating system and, where applicable, account and registration data. For users of our SFTP Server, we similarly process connection parameters, server logs and access duration. We process this information to deliver and secure our websites and online services, ensure system functionality, perform technical support, analyse and improve performance, and detect or prevent misuse, fraud, security incidents and cyber-attacks.

The primary legal basis is Article 6 para. 1 lit. (f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of our websites, online platforms, SFTP servers and information technology systems, as well as network and information security. Where processing is required to comply with statutory legal obligations (such as official requests by law enforcement or regulatory authorities), the legal basis is Article 6 para. 1 lit. (c) GDPR. Unless a longer retention period is required for the investigation of a security incident or legal proceedings, server log data is routinely deleted after 30 days or anonymised.

Some of our websites or online platforms (such as member areas or customer portals) offer user registration. In the course of registration and platform use, we process your name, contact details, user credentials and role to provide and administer your user account and grant access to restricted services. Where you use the account in your own name, the legal basis is Article 6 para. 1 lit. (b) GDPR. Where the account is provided for your activities on behalf of a clearing member, customer or business partner, processing is based on Article 6 para. 1 lit. (f) GDPR (our legitimate interest and that of the customer in enabling authorized access). Account data is stored for the duration of the registration and deleted when the user account is closed, subject to applicable statutory retention requirements.

3.2 Do you have to provide personal data to us?

The provision of personal data is necessary where required to access protected areas, register for or use a service, enter into or perform a contract, contact us, or subscribe to a newsletter. Without the required data, we may be unable to provide the relevant function or service. Optional information is identified as such.

3.3 Do we make automated decisions on you? 

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

3.4 Retention periods 

The retention periods for personal data depend on the purpose of the processing. We will store the personal data mentioned under 3.1 above as long as (i) this is necessary for the respective purpose and / or (ii) this is required in accordance with the applicable statutory retention laws. We will keep personal data that you provide us for as long as our business relationship with you or with your company exists, plus all applicable retention periods that are in accordance with the statutory provisions (e.g. based on tax regulations) or to the extent they are necessary to pursue our legitimate interests after the end of the business relationship (e.g. to assert claims within the statutory limitation periods).

 

4. Transfer and disclosure of personal data to third parties and group companies

We disclose personal data only where permitted by law, necessary for the relevant purposes or based on your explicit consent.

We use selected service providers acting as processors pursuant to Article 28 GDPR. They receive access to personal data only to the extent necessary to provide their services and process the data on our documented instructions.

We may disclose personal data to public authorities, courts and law-enforcement authorities where required or permitted by applicable law, including where necessary to investigate suspected criminal offences, fraud, misuse of our services or security incidents.

Personal data may also be shared with other controllers for their own purposes, such as cooperation or advertising partners, only where a legal basis applies. Where such sharing requires consent, we obtain it separately from this privacy notice.

Where personal data is transferred to recipients outside the European Economic Area, we ensure an adequate level of protection, in particular on the basis of an adequacy decision by the European Commission, the EU Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914, or other appropriate safeguards under Articles 44 et seq. GDPR.

Recipients may include public bodies and institutions where a legal or regulatory obligation applies; Deutsche Börse Group and EEX Group companies where necessary for internal administration, customer and supplier management, information security, compliance, legal, audit, governance, finance or operational support; and service providers in the areas of IT hosting and infrastructure, identity and access management, telecommunications and collaboration, online platforms, printing, billing and payment, financial services, debt collection, newsletter and event management, consulting, legal advice, tax advice and auditing

 

5. Cookies and similar technologies

In order to improve the quality and ensure a user-friendly design of our offered services, we make use of cookies, i.e. small files stored on your terminal device. The cookies are not assignable to any certain or identifiable person. Profiles capable of being related to an individual person in respect to your user behaviour will not be created. Most of the cookies used are so-called “Session Cookies”, which are stored on a temporary basis, exclusively for the duration of your utilization of our website or online platforms. On the other hand, we also make use of “Permanent Cookies” to record information about visitors who repeatedly access one of our servers (e.g. to store cookie consent preferences). The content of a permanent cookie is limited to an identification number; your full IP address or other personal data will not be stored. As a general rule, we never collect personal data via cookies unless you have given us your express permission to do so. You are entitled to raise an objection against the collection and processing of your data through cookies and configure your browser settings accordingly.

For example, cookies enable us to tailor a website to better match your interests or to store your password so that you do not have to re-enter it every time. As a general rule, we never collect personal data via cookies, unless you have given us your express permission to do so.

If you do not want us to recognize your terminal device, please configure your Internet browser to erase all cookies from your device, to block all cookies or to receive a warning before a cookie is stored. You will find brief instructions on how to do this below.

Please note that certain functions of our website may no longer work, or not correctly, without cookies.

5.1 Types of cookies

Cookies can be assigned to four categories, depending on their function and intended purpose: absolutely necessary cookies, performance cookies, functional cookies, and cookies for marketing purposes.

5.1.1 Absolutely necessary cookies

This category of cookies is needed for you to navigate within websites and operate basic website functions, such as the issuance of anonymous session IDs for bundling several related queries to a server.

5.1.2 Performance cookies

This category of cookies collects information on the usage of our websites, including for example the internet browsers and operating systems used, the domain name of the websites previously visited, the number of visits, the average duration of each visit, and pages called up. These cookies do not store any information that would make it possible to personally identify the user. The information collected with the aid of these cookies is aggregated and is therefore anonymous. Performance cookies serve the purpose of improving the user friendliness of a website and therefore enhancing the user’s experience. You can block the use of such cookies by creating an exclusion cookie (see “managing cookies” below).

5.1.3 Functional cookies

This category of cookies enables our websites to store information the user has already entered (such as user ID, language selection, or the user’s location), in order to offer improved, personalized functions to the user. Functional cookies are also used to enable requested functions such as playing videos and to make a user’s decision to block or disable a certain function (e.g. web analysis) - “opt-out cookies”.

5.1.4 Cookies for marketing purposes

This category of cookies is used to offer more relevant content to users, based on their specific interests. They are also used to limit the display frequency of an ad and to measure and control the effectiveness of advertising campaigns. They register whether users have visited a website or not, and which contents were used. This information may possibly also be shared with third parties, such as advertisers, for example. These cookies are often linked to the functions of third-party websites. You can block the use of such cookies by creating an opt-out cookie (see “Managing cookies” below).

5.2 Cookies on our websites and online platforms

5.2.1 Absolutely necessary cookies

Cookies-Name	Description	Retention period
uo_id	The cookie sets an ID so that the user's consent to the use of cookies and their cookie settings can be stored in the uo_settings cookie. The cookie is technically necessary.	1 year
uo_settings	This cookie stores the user's consent to the use of cookies and the user's cookie settings. These are then linked to the ID from the cookie uo_id. The cookie is technically necessary.	1 year
SMSS_Extern-GUI	Session cookie to handle user login on ECC member area website.	Duration of the session
oam.Flash.RENDERMAP.TOKEN	Session cookie to handle user login on ECC member area website.	Duration of the session

5.2.2 Webanalytics

Our webanalytics (cookieless) does not set a cookie within your browser. They enables us to capture the following data: 

• Capture of origin with referrer URL and campaign parameters, if applicable. 
• Page views and assignment to areas based on the URL structure 
• Mailto and telephone link calls, downloads and individual click events 
• Scroll events per page 
• Form interactions including errors per form field 
• Devices and browsers used including language settings

5.3 Managing cookies

You can change your cookie preferences at any time by using the ‘Cookies Settings Manager’ at the top of this pages. You may need to refresh your page for your settings to take effect. Please note: Not all of the cookies mentioned above will necessarily be used when you browse our website using a mobile terminal device.

In the following you will find a summary of links that provide detailed information on the deactivation of cookies in commonly used browsers.

• Mozilla Firefox (https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored)
• Internet Explorer (https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies)
• Google Chrome (https://support.google.com/accounts/answer/61416?hl=en)
• Safari (https://support.apple.com/en-en/guide/safari/sfri11471/mac)

5.4 Social media

We maintain publicly accessible company profiles on various social media platforms to communicate with customers, market participants, and business partners, and to inform about our clearing services, ongoing initiatives, and events.

When you visit or interact with our social media profiles, personal data may be processed both by us and by the respective platform operator.

5.4.1    Purposes and legal basis

We process your personal data (in particular username, interactions such as likes, shares, comments, direct messages, as well as profile details you have set to be publicly available) to communicate with you, process inquiries, and evaluate the reach of our content. The legal basis is Article 6 para. 1 lit. (f) GDPR. Our legitimate interest lies in professional external representation, transparent public relations, and efficient communication with market participants.

5.4.2    Joint responsibility (Article 26 GDPR)

For certain services, specifically aggregated visitor analytics ("Page Insights") on LinkedIn and Instagram/Facebook, we are jointly responsible with the platform operators pursuant to Article 26 GDPR. The platform operators have agreed to assume primary responsibility for fulfilling data subject rights and providing mandatory information under the GDPR:

• LinkedIn Page Joint Controller Addendum: https://legal.linkedin.com/pages-joint-controller-addendum
• Meta Page Controller Addendum: https://www.facebook.com/legal/terms/page_controller_addendum

5.4.3    International data transfers

Where platform operators transfer personal data to recipients outside the European Economic Area (particularly the USA), an adequate level of data protection is safeguarded on the basis of the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Article 45 GDPR) or EU Standard Contractual Clauses (Article 46 para. 2 lit. (c) GDPR).

5.4.4    Platform providers, privacy policies and opt-out options

For detailed information regarding processing purposes, data categories, and objection/opt-out settings, please refer to the respective privacy notices of the platform providers:

• LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
  Privacy Policy: www.linkedin.com/legal/privacy-policy;
• X (formerly Twitter): Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland
  Privacy Policy: x.com/en/privacy;
• YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  Privacy Policy: policies.google.com/privacy;
• Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
  Privacy Policy: privacycenter.instagram.com/policy;
• XING: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany
  Privacy Policy: privacy.xing.com/de/datenschutzerklaerung

 

6. Your rights as a data subject

Under applicable data protection laws, you have rights

• of access to, rectification of, and/or erasure of your Personal Data;
• to restrict or object to its processing;
• to tell Us that you do not wish to receive marketing information; and
• (in some circumstances) to require certain of your Personal Data to be transferred to you or a third party, which you can exercise by contacting Us at the details set out at the beginning of this Notice.

To the extent Our processing of your Personal Data is based on your consent, you also have the right to withdraw your consent, without affecting the lawfulness of Our processing based on your consent before its withdrawal.

To exercise your rights, you can contact Us as set out in Section 2 above. You also have the right to lodge a complaint about our processing of your personal data with a competent data protection supervisory authority. The competent supervisory authority for European Commodity Clearing AG is

Saxon Data Protection Commissioner (Sächsischer Datenschutzbeauftragter, Devrientstraße 5, 01067 Dresden, Germany; www.saechsdsb.de). A complete list and contact details of all European data protection authorities is available on the European Data Protection Board (EDPB) website: edpb.europa.eu/about-edpb/about-edpb/members_en.

 

Last updated: September 2026