Last Updated: 17/11/2025
1. Introduction
This Privacy Notice explains how International Chamber of Commerce (ICC) One Click ("we", "us", "our") processes your personal data in accordance with the ICC Personal Data Protection Policy and applicable data protection laws, including the General Data Protection Regulation (GDPR).
2. What Data We Collect
a) Cookie Data and Similar Tracking Technologies
When you visit our website, we use cookies and similar tracking technologies, including web beacons (also known as "pixel tags" or "clear GIFs"), by automated means. We categorise these as follows:
Strictly Necessary Cookies
These cookies are essential for the website to function and cannot be disabled. They are processed based on our legitimate interest in operating the platform. They include:
• Session management cookies
• Security and authentication cookies
• Load balancing cookies
Analytics Cookies (require your consent via 'opt-in' mechanism)
We use analytics services to collect:
• Device and browser identifiers
• Pages viewed, time spent, navigation paths
• Events triggered (e.g., button clicks)
• Links clicked and time spent on pages
• The page you visited before navigating to our Services
• Aggregated usage statistics
We also work with third-party analytics providers who use cookies, web beacons, device identifiers and other technologies to collect information about your use of our Services.
Marketing Cookies (require your consent via 'opt-in' mechanism)
These cookies enable us to:
• Track marketing campaign effectiveness
• Provide personalised content
• Deliver targeted advertisements
Cookie data does not directly identify you personally. For full details, including cookie lifespan and management options, please see our Privacy Policy.
b) Personal Data (Account Creation and Management)
When you create an account, we collect:
• Full name
• Email address
• Organisation/company information (optional)
• Any other information you voluntarily provide during registration or account updates
We do not collect special categories of personal data (such as health information, racial or ethnic origin, political opinions, religious beliefs or biometric data) through this website.
c) AI Chatbot Data
Our platform includes an AI chatbot powered by GPT-4 to assist with trade-related inquiries. When you interact with the chatbot by asking trade-related questions, we collect the input data you provide (e.g., query text). This data is linked to your user profile to provide contextually relevant responses and improve your experience.
Any personally identifiable information (PII) that is unrelated to trade topics will not be stored or retained. We only process and store trade-relevant data to ensure compliance with data minimisation principles.
3. Purposes of Data Processing
We process your data for the following purposes:
Account Management and Service Delivery
• To create and manage your One Click account
• To provide access to One Click features and services
• To authenticate your identity and maintain account security
• To respond to your inquiries and provide customer support
Website Improvement and Analytics
• To analyse website usage and improve functionality
• To optimise user experience and navigation
• To conduct research and development for new features
Security and Fraud Prevention
• To protect against unauthorised access and cyber threats
• To detect and prevent fraudulent activities
• To ensure compliance with our terms of service
Marketing and Communications
• To send you service-related notifications (e.g., account updates, security alerts)
• With your separate consent: To send you newsletters, promotional materials and information about One Click updates
• With your separate consent: To inform you about other ICC products, services, events and initiatives that may interest you
You can opt out of marketing communications at any time while maintaining your account (see Section 7).
Legal Compliance
• To comply with legal obligations, court orders or regulatory requirements
• To enforce our terms and conditions and ICC policies
4. Legal Basis for Processing
We process your personal data based on the following legal grounds:
| Processing Activity | Legal Basis |
|---|
| Account creation and management | Performance of contract (to provide you with the service) |
| Service-related communications | Performance of contract and legitimate interest |
| Strictly necessary cookies | Legitimate interest (website functionality and security) |
| Analytics and marketing cookies | Your consent (obtained via cookie banner) |
| Marketing communications | Your consent (obtained separately during registration or subsequently) |
| Security and fraud prevention | Legitimate interest (protecting our systems and users) |
| Legal compliance | Legal obligation |
Withdrawing Consent
You may withdraw your consent at any time via our cookie management tool (accessible via the cookie banner or footer link) or by contacting us (see Section 9). Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
5. Data Sharing and International Transfers
Who We Share Your Data With
We do not sell your personal data. We share data only in the following circumstances:
Within ICC
• Your data may be shared with other ICC entities for administrative purposes and to provide you with information about ICC services, subject to appropriate data protection agreements.
Service Providers
We engage trusted third-party service providers who process data on our behalf, including:
• Cloud hosting providers (for data storage and website hosting, e.g. Microsoft Azure)
• Email service providers (e.g. Microsoft Dynamics)
• Analytics providers (e.g. Google Analytics and Matomo)
• IT security and maintenance providers
• AI Chatbot (e.g. Microsoft Foundry)
All service providers are bound by strict confidentiality and data protection agreements and may only process your data according to our instructions.
Legal Requirements
We may disclose your data when required by law, court order or regulatory authority or to protect our legal rights and those of our users.
International Transfers
Some of our service providers are located outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, including:
• EU Standard Contractual Clauses
• Adequacy decisions by the European Commission
• Other legally recognised transfer mechanisms
6. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These measures include:
• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and updates
• Staff training on data protection practices
• Secure data backup procedures
However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
7. Data Minimization and Retention
We implement strong data minimization and retention practices to ensure GDPR compliance:
• No personal data (e.g., names, email addresses) is passed to third parties
• We explicitly avoid configuring URLs or tracking parameters that contain personal data.
• Where Analytics is used alongside Ads, we anonymize IP addresses and avoid user-level identifiers unless consent is given.
• Only the minimum amount of personal data necessary is collected to achieve the purposes stated in section 3 above.
We retain your personal data only for as long as necessary to fulfil the purposes outlined in this notice:
| Data Type | Retention Period |
|---|
| Active account data | Duration of account plus 2 years after account closure |
| Inactive accounts | Deleted after 24 months of inactivity (following advance notice) |
| Marketing consent records | Retained until consent withdrawn plus 3 years for compliance purposes |
| Analytics cookie data | 14 months from collection |
| Security logs | 12 months |
| Legal/compliance records | As required by applicable laws (typically 5-7 years) |
After the retention period expires, data is securely deleted, anonymised (rendering it no longer personal data) or archived in accordance with legal requirements.
8. Your Rights
Under data protection law, you have the following rights:
• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data in certain circumstances
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Request a copy of your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority
Marketing emails: When you create an account you can opt-in to receiving information via email from the ICC. You can unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any marketing email, updating your communication preferences in your account settings or contacting us directly.
To exercise any of these rights, please contact our Global Data Protection Officer (see Section 9).
9. Contact Information
For questions about this Privacy Notice or to exercise your data protection rights:
ICC Global Data Protection Officer
International Chamber of Commerce
33-43 avenue du Président Wilson
75116 Paris, France
Email: dataprotection@iccwbo.org
10. Third-Party Links
Our website may contain links to external websites operated by third parties. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review the privacy policies of any external sites you visit.
11. Updates to This Notice
We may update this Privacy Notice from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we make significant changes, we will notify you by email or through a prominent notice on our website. The "Last Updated" date at the top of this notice indicates when it was last revised.
We encourage you to review this Privacy Notice periodically to stay informed about how we protect your data.
For business. For you..svg)
-1.svg)
.svg)
.svg)