This article provides answers to the following questions:
What data will be collected and/or used?
How can I correct, block or delete my data?
Will my data be passed on to third parties and how will it be protected against misuse?
1-CP GmbH, the party responsible for the collection, processing and use of data, is committed to protecting the privacy of all persons using our Website and services and to treat their data with confidentiality when collecting, processing and using such data. Our employees are regularly obligated to maintain data secrecy. The basis for this is the applicable provisions of law, such as the German Federal Data Protection Act (BDSG), the General Data Protection Regulation (GDPR) and the German Telemedia Act (TMG).
This privacy policy applies to our website and to all 1-CP products: the Corporate Checkout® (a checkout option embedded in the online shops of participating merchants that lets you complete purchases as a business), the Corporate Wallet® (the central hub in which you or your company manage profiles, payment methods and purchasing policies), the Corporate Wallet® Agent (a browser extension, see the dedicated section below) and Corporate PayLink™ (a payment link sent to you by a merchant to complete a business payment online). The following sections describe which data is processed for each of them.
You can visit our website without entering any directly identifiable personal information. When you visit our Website, we may automatically collect access information about you, such as the type of internet browser you use, the website from which you have come to our website and your IP address (the unique address which identifies your computer on the internet) which is automatically identified by our web server. This information is only used to assist us in providing an efficient service on our website and to collect demographic information. We will only store access data without any personal reference. Besides we will use the previously anonymized IP address on our own behalf to locate the country from which you are visiting our website, to offer you the correct language version. The anonymized IP address will not be stored for this purpose.
When you make a transaction, you are asked for your name, email address, home address, telephone number and payment information. Depending on existing information, you might also be asked for the travellers’ names and countries of origin as well as the company name and billing address.
We use this personal data to complete and administer your online transaction and forward your transaction details to the vendor.
The Corporate Checkout® is embedded in the online shop of a participating merchant. If you choose to complete a purchase as a business, we process the transaction data described above as well as your business details, such as company name, billing address, VAT ID and reporting details (for example cost centers or order numbers), together with the payment method you or your company selected. We use this data to complete the purchase as a business transaction, to apply the purchasing policies your company has configured, and to provide invoices and transaction records. If your purchase is paid with a virtual corporate card, the card data is generated and tokenized by our PCI DSS certified payment provider and is never stored on 1-CP systems in raw form.
With Corporate PayLink™, a merchant sends you a personalized payment link for a specific order. When you open the link, we process the order details provided by the merchant together with the data required to complete the payment process, as described in the transaction and Checkout section above. We use this data solely to complete and document the payment for that order.
We offer a user account facility on our website. We use the information you give us to administer this, allowing you to see prior transactions, manage your current transactions and your personal settings and take advantage of specially designated configurations.
When you register for an account on our website, you have to provide us with your email address, first name, last name as well as company name as a minimum. More details such as employee number, phone number, address of the company can be added optionally.
Your e-mail address serves as a username for access to the 1-CP system and is stored permanently for this purpose.
The Corporate Wallet® is the central hub in which you or your company configure how business purchases are made. Depending on the setup, it contains employee profile data (such as name, work email address, employee number), company data (such as billing addresses and VAT IDs), payment methods, purchasing policies and reporting requirements, as well as the transactions completed with 1-CP products. Where your employer has set up the Corporate Wallet, your employer decides which data is stored in it and acts as data controller; 1-CP GmbH processes this data as processor under Art. 28 GDPR. We use this data to authenticate you, to apply your company’s policies and to provide transaction records and reporting.
We will only send you our newsletter if you have agreed to receive this. Submission of your e-mail address is required to receive our newsletter,any other information that you provide is optional. The newsletter contains current information and offers from 1-CP GmbH and from third parties. You can unsubscribe directly via a link in the newsletter itself or at any time via e-mail to the sender.
If you are visiting our website on a mobile device, we might also collect data that identifies your mobile device, device-specific settings and characteristics and latitude/longitude details.
This section applies when you use the 1-CP Corporate Wallet Agent browser extension. For data described below that 1-CP collects to operate and secure the service itself, 1-CP acts as controller. The extension could be provided to you through your employer, who has set up a Corporate Wallet with 1-CP and acts as data controller for the employee data processed in it; 1-CP GmbH processes this data as processor under Art. 28 GDPR.
Account and authentication data: your work email address, name, company affiliation and session tokens used to sign you in to your company's Corporate Wallet. The extension does not collect or store your passwords for merchant websites.
Profile and business data provided by you or your employer: billing address, VAT ID, cost centers, travel profile data and the purchasing policies that apply to you.
Checkout and transaction data: when you actively use the extension on a checkout page, it processes the structure of that page and the data required to complete the purchase, such as merchant name, items, prices, taxes and delivery details. Documents you deliberately upload (for example an order confirmation PDF) are processed to extract transactional data.
Payment information: Card data can be stored and/or tokenized by our PCI DSS certified payment provider and is never stored in your browser or on 1-CP systems in raw form.
Technical and security data: sanitized page URL (without query strings), merchant domain, timestamps, processing metadata and error logs needed to operate and secure the service. Connection logs are retained for 30 days.
The extension only becomes active on shopping and checkout pages in connection with a purchase you initiate. It does not track your general browsing history.
The extension uses AI to understand the structure of checkout forms and to extract structured transaction data. For form filling, only the sanitized structure of the page and generic field names (for example "user.firstName") are sent to the AI model. The actual values of your personal data are not sent to the AI model; the extension retrieves them from the 1-CP platform and fills the form locally in your browser. AI processing runs in the EU (region Frankfurt) within 1-CP’s own cloud environment. Your data is not used to train AI models. Every purchase requires your explicit review and confirmation; AI cannot submit forms or execute payments on its own.
We only use your contact details to keep you informed about the current status or potential changes concerning your transactions.
If you use the Corporate Wallet Agent, we use the data described above exclusively to provide the service: to detect checkout pages, fill in your company data at your request, generate and apply virtual corporate cards within your company’s policies, capture invoices and transaction data for you or your employer’s finance processes, prevent fraud and misuse, and maintain the security and reliability of the service. We do not sell user data. We do not use user data for advertising. We do not transfer user data except as described in this policy (see also the Chrome Web Store Limited Use requirements, which we comply with).
We may also contact you via email, post, phone, depending on the contact information you shared with us previously . Here are some possible reasons for this:
We may need to respond to and handle requests you have made.
If you have not finalized your transaction online, we may remind you to finalize your transaction. We believe that this additional service is useful because it allows you to easily complete a transaction without having to search for the product again or fill in all the transaction details again.
When you use our services, we may send you a questionnaire or invite you to provide a review about your experience with our website.
We may also send you other material related to your transaction, such as how to contact 1-CP if you need assistance and information that we consider useful for handling transactions with 1-CP. We may also send you material related to ongoing transactions or a summary of previous transactions you made on our website.
We also use your information for marketing activities, as permitted by law. For example:
When you make a transaction with us or set up a user account, we may use your contact information to send you news of similar related products and services of the same vendor. With your consent – if consent is required under local law – we may also send you other newsletters by email. You can opt out, or unsubscribe, from marketing communications at any time using the “Unsubscribe” link in each newsletter.
Based on the information you share with us, individualized offers may be shown to you on our website, in mobile apps or on third-party websites, including social media sites. These might be offers that you can purchase directly on our website, or third-party offers or products we think you might find interesting.
If we believe that a particular offer is of interest to you, we may decide to contact you by phone.
We sometimes ask our customers to take part in market research surveys. Any additional personal details that you communicate to us as part of the market research will be used only with your consent.
We may use personal data for the detection and prevention of fraud and other illegal or unwanted activities.
Finally, we use personal data for analytical purposes, to improve our services, to enhance the user experience, and to improve the functionality and quality of our online travel services.
In order to make visiting our website appealing and to enable the use of certain functions, we use so-called cookies on various pages. Cookies are small text files that are saved on your computer. Most of the cookies we use are deleted from your hard drive at the end of your browser session (so-called session cookies). Other cookies remain on your computer and enable us to recognize your computer again the next time you visit our site (so-called permanent cookies).
The cookies we use have varying lifespans. The maximum lifespan we set is one month from your last visit on our website. You can erase all cookies from your browser any time you want to. Please see the support pages of your browser for more information on how to delete cookies.
You can find our cookies in your browser settings.
Our website uses the following cookies:
We try to give our visitors an advanced and user-friendly website that adapts automatically to their needs and wishes. To achieve this, we use technical cookies to show you our website, to make it function correctly, to create your user account, to sign you in and to manage your transactions. These technical cookies are absolutely necessary for our website to function properly.
We also use functional cookies to remember your preferences and to help you to use our website efficiently, for example by remembering your preferred currency and language, your search entries and the transactions you viewed earlier. These functional cookies are not strictly necessary for the functioning of our website, but they add functionality for you and enhance your experience.
We use these cookies to gain insight into how our visitors use the website, to find out what works and what doesn’t, to optimize and improve our website and to ensure that we are meeting our customer’s requirements. The data we gather includes web pages you have viewed, the referring/exit pages you have entered and left from, the platform type you use, date and time stamp information as well as details such as the number of clicks you make on a given page, your mouse movements and scrolling activity, the search words you use and the text you type while using our website. We also make use of analytics cookies as part of our online advertising campaigns to learn how users interact with our website after they have been shown an online advertisement – which may include advertisements on third-party websites. However, we will not know who you are, and will only obtain anonymous data. Our business partners may also use analytics cookies to learn if their customers make use of offers integrated into their websites.
Yes, we use the services of trusted and recognized online advertising and marketing companies. We may also use third-party providers for analytical purposes. To enable their services, these companies need to place cookies.
The providers we use are committed to building consumer awareness and establishing responsible business and data management practices and standards.
This website uses Google Analytics, a web analysis service of Google Inc. Google Analytics uses “cookies”, which are text files that are saved on your computer and enable your use of the website to be analyzed. The information collected by the cookies on your use of the website, is transmitted to a Google server in the US and stored there. If IP anonymization is activated on this website, Google will truncate your IP address within Member States of the European Union or in other countries that are party to the Agreement on the European Economic Area. Only in exceptional cases will the entire address be transmitted to a Google server in the US and truncated there. IP anonymization is activated on this website.
Google will use this information on behalf of the operator of this website for the purpose of evaluating your use of the website, compiling reports on website activity and providing the website operator with other services relating to website activity and internet usage. The IP address transmitted by your browser within the context of Google Analytics will not be associated with any other data held by Google. You can prevent the saving of cookies by setting your browser software accordingly; however, we would like to point out that you may not be able to use all functions of this website to their full extent.
You can also prevent the collection of data generated by the cookies and related to your use of the website (including your IP address) for Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available through the following link: https://tools.google.com/dlpage/gaoptout?hl=en
As an alternative to the browser plug-in, you can click on this link to prevent collection by Google Analytics within this website in future. An opt-out cookie is then stored on your device. If you delete your cookies, you need to click on the link again.
Only 1-CP has access to 1-CP cookies. Cookies placed by third parties can be accessed by these third parties.
Using your browser settings in, for example, Internet Explorer, Safari, Firefox or Chrome, you can set which cookies to accept and which to reject. Where you find these settings depends on which browser you use. Use the “Help” function in your browser to locate the settings you need.
If you choose not to accept certain cookies, you may not be able to use some functions on our website. However, we do not otherwise support “Do Not Track” browser settings. Opting out of an online advertising network does not mean that you will no longer receive or be subject to online advertising or marketing analysis. It means that the network from which you opted out will no longer deliver ads tailored to your web preferences and browsing patterns.
We use social media to promote our partners’ products and services and to promote, improve and facilitate our own services. For example, we have integrated social media plugins into our website. When you click on one of the buttons and register with your social media account, information is shared with your social media provider, and possibly presented on your social media profile to be shared with others in your network.
In certain circumstances, 1-CP may share your personal data with third parties.
In order to complete your transaction, we need to transfer the buyer and product/service related names as well as the payment details to the vendor from which you bought.
If your Corporate Wallet is provided and managed by your employer, your employer acts as data controller and receives transaction data, invoices and policy compliance information relating to your business purchases.
To complete your payment, the payment service providers, card issuers and card networks involved receive the transaction and payment details required to process your purchase. They act as independent controllers.
We may use service providers (such as “data processors”) to process your personal data strictly on our behalf. This processing would be for purposes such as hosting and operating our services, facilitating payments and payment tokenization, sending out marketing material or for analytical support services. These processors are bound by confidentiality clauses and are not allowed to use your personal data for their own purposes or any other purpose.
We disclose personal data to law enforcement and other governmental authorities insofar as it is required by law or is strictly necessary for the prevention, detection or prosecution of criminal acts and fraud.
In general, your data is not passed on to third parties without your permission, excepting the disclosures referred to in this privacy policy. We do not sell or rent personal data to third parties, we do not use it for purposes unrelated to the purposes described in this policy, and we do not use it to determine creditworthiness or for lending purposes.
We prioritize / emphasize the security of all personally identifiable information associated with our users. We have security measures in place to protect against the loss, misuse and alteration of personal information under our control. Whilst we cannot ensure or guarantee that loss, misuse or alteration of information will never occur, we use all reasonable efforts to prevent it.
Using the latest technical and organizational measures, we secure our website and other systems from loss, destruction, access to, change or publication of your data by third parties. We use encryption technology to ensure the highest level of protection when transferring personal data. Your personal data is password protected, meaning that only you have access to it. Our servers use various security mechanisms and authorization procedures in order to impede unauthorized access. You should never disclose your access information to others and always close the browser window when you have used our website. You can thereby ensure that nobody can access your personal data if you use a shared computer.
All 1-CP services are hosted in the European Union (EU data residency). Data is encrypted in transit (TLS 1.2+) and stored with provider-managed encryption at rest. Access to production systems is restricted to named, authorized personnel with multi-factor authentication.
You should bear in mind that submission of information over the internet is never entirely secure. We cannot guarantee the security of information you submit via our website whilst it is in transit over the internet and any such submission is at your own risk.
Transaction records are retained as required by statutory commercial and tax retention periods, thereafter deleted or anonymized. Connection logs are deleted after 30 days. If your Corporate Wallet is provided by your employer, personal data is deleted upon termination of your employer’s contract in line with our data processing agreement (backups within 6 months).
You always have the right to review the personal information we record about you. You can request an overview of your personal data by emailing us at [email protected]. Please write ‘Personal Information Request’ in the subject line of your email and include a copy of your identity card to help us prevent unauthorized individuals from accessing your personal data.
You can view and edit your user information at any time in the secure area of our website by logging in with your e-mail address and password. If you forgot your password or have problems logging in, do not hesitate to contact us. Please use the contact form to request that your user information be deleted.
You have the right to request information about your saved data, as well as the right to have that data amended, blocked or deleted, to receive it in a portable format, and to object to or restrict processing.
However, we may need to retain certain information, for example for legal or administrative purposes, such as record keeping or to detect fraudulent activities.
The 1-CP GmbH controls the processing of personal data. 1-CP GmbH is incorporated under the law of Germany and has its office at An der Oberpforte 7, 60388 Frankfurt, Germany. Our external Data Protection Officer is Christiane Vedder, attorney-at-law. You can reach our data protection team at [email protected] or [email protected].
If you have any other questions, please do not hesitate to contact our support team on [email protected].
