AMERICAN EXPRESS AUSTRALIA LIMITED CARD MEMBER PRIVACY STATEMENT

Effective April 2026

About American Express

American Express Australia Limited holds an Australian Credit Licence number 291313.

You can contact American Express in the following ways:

Mail: American Express Australia Limited
GPO Box 1582
SYDNEY NSW 2001

Telephone: 1300 132 639 (in Australia) or +61 2 9271 8664 (if overseas)

This Card Member Privacy Statement describes how American Express collects, uses, shares, and keeps your credit information and personal information in accordance with the Privacy Act and the Australian Privacy Principles. If you do not agree to our use of your credit information and personal information in this way, we may be unable to provide our products and services to you.

In addition to this Card Member Privacy Statement, we also have more specific information available regarding how we handle your:

• Online information. Please see our Online Privacy Statement, which describes how we handle information we collect about you from your use or access of American Express websites, online applications and any of our online services or content. Our Online Privacy Statement is available at: americanexpress.com.au/privacy


• Credit reporting information. Please see our Credit reporting policy for further detail about when, how and why we access Credit Reports about you, which credit reporting bodies American Express is likely to disclose your credit information, and how you may complain about a failure by American Express to comply with the Privacy Act and how American Express will deal with a complaint. Our Credit Reporting policy is available at: americanexpress.com.au/creditinfo

Additional Privacy notices and statements
Generally, we will give you more specific details about how we will use your personal information in relation to a particular American Express product or service around the time when you apply for it.
At the bottom of this statement, we explain how we use artificial intelligence (AI), automated decision-making systems, analytical tools and predictive models (including statistical and machine learning models) in our business.

Collection, use and sharing of credit information by American Express
American Express may obtain both consumer and commercial credit reports about you from a credit reporting body. We will use this information along with other information we hold about you, including online information (see above), for purposes including:

• assessing your credit worthiness.
• assessing your application.
• collecting overdue payments.
• American Express’ internal management purposes relating to the provision or management of consumer credit or commercial credit as relevant.
• helping you to avoid defaulting on your obligations with American Express.
• to determine if you’re ineligible for certain marketing offers from us.
• for any other use in connection with your account as permitted under the Privacy Act 1988.

American Express may disclose information about you to credit reporting bodies before, during or after credit is provided to you. This includes:

• that you have applied for a Card, including the Account credit limit.
• that American Express is a credit provider to you, including the type of credit, Account opening and closing dates, and credit limit.
• 24 months of repayment history on your Card Account.
• default information related to payments that are at least 60 days overdue (and advice that overdue payments have been paid in full).
• if you have entered into a financial hardship arrangement with us, we are required to tell credit reporting bodies that you have entered into that arrangement.
• that you have committed a serious credit infringement.
• that you have made a request to correct your personal information.
• any other information as permitted under the Privacy Act 1988.

American Express may exchange information about you with credit providers named in your application or in a credit report issued by a credit reporting body. Among other things, this is to:

• assess your credit worthiness, this application, and any subsequent application for credit.
• notify other credit providers of a default by you.
• exchange information about your Account when you are in default with other credit providers.
• complete any approval process for any transactions you wish to make on your Account.
• administer your Card Account.
• notify that you have made a request to correct your Account.

American Express may also exchange credit information about you with any person considering whether to act as a guarantor in relation to this and future applications by you for credit.

For more information about how we use credit information, see our Credit Reporting Policy at americanexpress.com.au/creditinfo.

How we collect your personal information
Generally, if you are applying for a Card Account we collect your personal details such as name, date of birth and address, details about your employment, financial circumstances, and other information relevant to your Card Account.

American Express collects information about you in a number of ways, including:

• directly from you, such as in your credit application or when you enter one of our competitions or promotions.
• from your use of our products and services, such as when you make a purchase using your Card Account.
• from your use of or access to American Express websites, mobile applications any of our other online services or products (such as your IP Address and location, device type and browser version) (‘Online Information’) – For more information about how we collect and use Online Information see our Online Privacy Statement at americanexpress.com.au/privacy.
• from credit reporting bodies, as described above for credit information or for identity verification.
• from people or companies named in your credit application (for example your employer).
• from other information providers and sources that we may contact to verify your identity and financial information (such as, data aggregators, companies that process or administer your superannuation contributions, payroll providers, financial institutions and government bodies and agencies).

We and our service providers may collect or use your biometric information, such as your image, to verify your identity with your express consent. We and our service providers will collect and use such biometric information lawfully and will only store such data for so long as is strictly necessary to verify your identity. All biometric information will be deleted by no later than within 12 months of collection.

How we use your personal information
We may use the information we collect about you (including online information) on its own or combine it with other information to:

• deliver products and services, including:
  - for the same purposes as for credit information listed above.
  - issuing your Card.
  - verify your identity when you contact us.
  - manage your Card Account and your transactions.
  - tell you about new features, benefits and updates to your Accounts, products, and services.
• advertise and market our products and services – and those of our business partners including to:
  - send or provide you with marketing, promotions and offers.
  - analyse whether our marketing, promotions and offers are effective.
  - help us determine whether you may be interested in new products or services.
• conduct research and analysis, including to:
  - better understand our customers - allow you to rate and review our products and services.
  - produce data analytics, statistical research, and reports.
  - review and improve our products and services and make them easier to use.
  - develop new products and services.
• manage fraud, security, and credit risks, including to:
  - detect and prevent fraud or criminal activity.
  - safeguard the security of your information.
  - assess your credit worthiness and make decisions about whether or not to approve your application for credit.
  - to manage your existing Accounts and credit limits.
• verify your identity and your financial details, including to:
  - verify your income.
  - verify your identity and your identification documents.
• use it in other ways as required or permitted by law or with your consent.

When we might share your personal information
We do not share personal information with anyone except as described below. We only share personal information as required or as permitted by law as follows:

• people you authorise to use or access your Account (for example, additional Card Members).
• with credit reporting bodies, for the same purposes as for credit information listed above.
• the provider of any payment service you use to make payments to American Express.
• with regulatory authorities, courts, and governmental agencies to check your identity, comply with legal orders, legal or regulatory requirements, and government requests and to detect and prevent fraud or criminal activity, and to protect the rights of American Express or others.
• within the American Express Family of Companies.
• with government agencies (such as official record holders or document issuers) to verify your identity.
• with other information providers and sources (such as, data aggregators, companies that process or administer your superannuation contributions, payroll providers, and financial institutions) that we may contact to verify your identity and financial information.
• with service providers who perform services for us and help us operate our business (for example, card manufacturers, collection agents, mail houses, and reward redemption partners). We require service providers to safeguard personal information and only use your personal information for the purposes we specify.
• share and exchange information with business partners and co-brand partners with whom we jointly offer or develop products and services for marketing, planning, product development and research purposes (but they may not use your personal information - in particular your email address - to independently market their own products or services to you unless you provide your consent).
• with third parties in the context of a sale of all or part of the American Express Family of Companies or their assets.
• any other purpose you have consented to.

Aggregated and de-identified information
Aggregated or de-identified Information is not personal information and does not identify you individually; however, it may be derived from personal information. It helps us to analyse patterns among groups of people. We may share aggregated or de-identified information in several ways, for example:

for the same reasons as we might share personal information

• with any business partners to help develop and market programs, products or services and present targeted content and marketing.
• with Business Partners to conduct analysis and research about customers.

Recording phone calls
American Express may also monitor and record your telephone conversations with us for staff training and service quality control purposes.

Direct marketing
From time to time, American Express, its agents and business partners (including insurance companies) will send you and any additional Card Members information about products, services, offers and other promotions on offer from American Express or jointly with its business partner. These communications may be sent electronically (for example by email, mobile message or push notification), by phone or by post. You can opt-out from receiving direct marketing at any time by calling 1300 132 639. You can also adjust your communication preferences using our online preferences or opt-out of email marketing by clicking ‘unsubscribe’ in the footer of our emails. This will continue until you opt-out or until twelve months after you cease being an American Express Card member.

Transfer of your personal information and credit information overseas
American Express is a global organisation and we may use international entities to help our business functions. As a result, American Express may need to share your information outside of Australia. It is impracticable for American Express to list out each and every country that we may share your information to, but such countries include the United States of America, Malaysia, India, and the United Kingdom. We will ensure that any transfer of your personal information is subject to appropriate conditions of confidentiality to ensure your information is handled consistently with the Australian Privacy Principles.

How we store your personal information
American Express stores personal information in a combination of secure computer storage facilities and paper-based files and other records. We have taken a number of steps to protect the personal information we hold from misuse, loss, and unauthorised access, modification, or disclosure. We use generally accepted technology and security so that we are satisfied that your information is transmitted safely to us through the internet or other electronic means. We will take reasonable steps to securely destroy or permanently de-identify personal information when we no longer need it.

Information about other persons
If you provide personal information about someone else to American Express, you must make sure that the individual has seen, understood, and agreed to:

• their personal information being collected, used, and disclosed by American Express in accordance with this notice.
• their ability to access that information in accordance with the Privacy Act 1988 and to advise American Express if they think the information is inaccurate, incomplete or out-of-date.
• the contact details of the American Express Privacy Officer.

Our Privacy Policy
For more information about how American Express Australia manages personal information, please see the American Express Privacy Policy.

Complaints, access, and corrections
We endeavour to provide you reasonable access to the personal information we hold about you where it is legal, reasonable, and feasible for us to do so. There is no fee to request access to your personal information, however we may charge a fee to collate and provide your personal information with your consent.

If you think any of the information, we hold about you is inaccurate, incomplete, or outof-date, you can ask us to update it or correct it.

To request access to your personal information, request a correction or make a complaint, please contact us via chat or call us on 1300 132 639 or write to:

The Privacy Officer,
American Express Australia Limited,
GPO Box 1582,
Sydney,
Nsw 2001

In the event we refuse to give you access to your personal information, or do not consider that your information needs correcting we will provide you a written explanation of our decision and your options of review. You may ask us to include a statement alongside your personal information which says that you think your personal information is inaccurate, incomplete, misleading, or out of date.

Where you make a complaint, we will confirm in writing that it has been received by us within seven days. We endeavour to resolve your complaint within 30 days and where we are unable to, we will contact you to explain why and request more time.

Where you are unsatisfied with the way we have handled your complaint, you may escalate your complaint to the Australian Financial Complaints Authority (AFCA) who facilitates a free dispute resolution service. AFCA will generally ask if you have tried to resolve the issue with us first. You may contact AFCA on 1800 931 678, through www.afca.org.au or at GPO Box 3, Melbourne, VIC, 3001.

Artificial intelligence and automated decision making
We use artificial intelligence (AI), automated decision-making systems, analytical tools, and predictive models (including statistical and machine learning models) (“ADM Systems”) to assist with certain decisions and to support the delivery, security and management of our products and services.

Our ADM systems analyse patterns and relationships in data to generate risk scores, classifications, predictions, or recommendations. These systems help us assess the likelihood of certain outcomes (such as credit risk or potential fraud) based on patterns identified in personal information.

Some of our decisions are made solely by ADM Systems, while others are supported or informed by ADM Systems and are reviewed or confirmed by our staff.

Our ADM Systems may operate at different stages of your relationship with us, including when you apply for a product, during the ongoing management of your account, and in connection with fraud prevention, risk management, and marketing activities.

We use ADM Systems where it is reasonably necessary to provide our products and services, to support our legitimate business activities (such as risk management and fraud prevention), or where otherwise permitted by law.

Decisions we make using ADM Systems
We use ADM Systems in connection with:

• assessing eligibility and applications for Cards and other financial products (for example, assessing the likelihood that you may be able to meet your repayment obligations).
• setting and adjusting credit limits (for example, based on your financial circumstances, account activity and repayment history).
• assessing creditworthiness and financial risk.
• ongoing account monitoring and management, including spending capacity and risk management.
• detecting, preventing, monitoring, and managing fraud, scams, and suspicious transactions, including in real-time (for example, identifying unusual transactions or behaviours that may indicate fraud).
• identity verification and authentication.
• providing customer service and support; and,
• personalising or determining eligibility for certain benefits, offers and promotions.

Some decisions made using ADM Systems may have a significant impact on you. For example, the decision may affect your ability to access or use our products or services, meaning you may not have access to credit. This may include refusing or approving an application, setting, or adjusting your credit limit, restricting, or declining transactions, suspending, or limiting account functionality, or determining whether you are eligible for certain products or offers.

Types of personal information used by ADM Systems
The personal information used in our ADM Systems may include:

• application information (such as income, employment, and financial details).
• credit reporting information, including credit history, repayment information, and credit scores.
• account and transaction information.
• identification and contact information.
• device, network, and behavioural information (such as IP address or indicators of unusual activity); and,
• information obtained from third parties, such as credit reporting bodies or service providers, where permitted by law.

We may also combine information from different sources to improve the accuracy and reliability of our assessments.

How ADM Systems are used in decision-making
Depending on the type of decision, decisions may be made solely by an ADM System or substantially using an ADM System (with human involvement). Some decisions are made using ADM Systems without mandatory human review. This may include:

• automated approvals or declines of applications for products or services.
• identifying transactions or activity that may be fraudulent or suspicious; and,
• determining eligibility for certain offers, benefits, or promotions.

In these cases, model outputs are applied using predefined rules, thresholds, or criteria.

In other cases, ADM Systems are used to generate scores, alerts or recommendations that are considered by our staff when making a decision. This may include decisions relating to credit limits, account management, or risk monitoring. In these cases, our staff may review available information and may override or adjust outcomes generated by ADM Systems where appropriate.

Real-time decisions
For certain decisions, particularly those made in real time (such as fraud, security, or risk controls), it may not be possible for a decision to be reviewed by a human before it takes effect.

Further information
If you have questions about how we use ADM Systems, or about a decision that has been made using these systems, you may contact us to request further information. We will take reasonable steps to provide additional information where appropriate.

Governance and safeguards
We do not disclose proprietary algorithms or technical details about our ADM Systems. However, we take reasonable steps to ensure our ADM Systems are appropriately designed, tested, monitored, and governed.

We maintain governance and risk management processes for ADM Systems, which may include:

• model risk management and oversight.
• ongoing monitoring, testing, and validation.
• processes designed to identify and mitigate potential bias or unintended impacts.
• controls designed to assess accuracy, reliability, and appropriate use.
• data minimisation, access controls, and security measures; and,
• oversight of third party or vendor provided models, including contractual and governance safeguards.

American Express Australia Limited (ABN 92 108 952 085).
® Registered Trademark of American Express Company