American Express®
Online Privacy Statement

We collect your Personal Data through cookies and similar technologies (for example, GIFs, web beacons, pixel tags) when you use our online services or access our online content. A cookie is a small data file that a website or application transfers to your technological device used to access that website or application (for example, computer, cell phone, tablet).

Basically, we install cookies on your devices when you visit our websites or another company's website where our advertisements appear, or when you make purchases, request or customize information, or register for certain services. The Personal Data we may collect through cookies and similar technologies relates to, among other things: the device or devices you use, your IP address, how you use our websites and applications (for example, what you search for, the pages you view, how long you stay on the sites you visit), what advertisements or commercial online content (ours and our partners') you view.

Please refer to our "Information about cookies and similar technologies" policy for more information about how we process your Personal Data through cookies.

We use your Personal Data on its own or combined with other information as described in the previous sections (for example, when you access your online account associated with your American Express card, if applicable). Under data protection legislation, we need a "lawful basis" to process your Personal Data, which may be any of the following: (i) where it is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract with you; (ii) where it is necessary to pursue our legitimate interests, such as preventing fraud and/or improving our products or services; (iii) where we have obtained your consent, such as, for example, or (iv) for compliance with legal obligations where we are required by law to process your Personal Data.

The following table sets out what we use your Personal Data for and our legal basis for doing so. Please note that we consider and balance the potential impact on you and your rights before processing your Personal Data to pursue our legitimate interests. The legitimate interest relied upon in each case is also set out in the table below.

Please note that we may process your Personal Data under more than one legal basis, depending on the specific purpose for which we are using your Personal Data. Please contact us if you need detailed information about the specific legal basis on which we are relying to process your Personal Data where more than one basis has been set out in the table below.

Some of the Personal Data we collect is of a more sensitive nature (also known as special categories of Personal Data). We will always collect these data in accordance with applicable law. In particular, we may process sensitive Personal Data relating to your health (in order to provide you with a more appropriate service), or biometric data. The following table explains what we use your sensitive Personal Data for and the legal basis for doing so.

When you use open banking services (where available), we will process your Personal Data to enable activities such as:

• our American Express online application processes for corporate or credit services, for the purposes of income verification and fraud prevention; or
• (if any) to comply with a request made on your behalf by (i) an account information service provider, when they provide you with consolidated information on the account(s) that you hold with one or more bank(s) or payment institution(s) or (ii) a payment initiation services provider, when they initiate a payment to pay a merchant on your behalf.

In this context, we will process your Personal Data for the above purposes as described in the section "Use of Personal Data".

We use fully automated processes to help us make certain decisions about you, including to asses certain attributes about you in order to provide our services to you. This may also involve profiling (for example, credit and risk fraud profiles). This means that we will use software and/or artificial intelligence to automatically assess your personal circumstances in order to identify or predict risks or certain outcomes. For example, we use automated processes to make decisions about you in relation to the following:

• detect, monitor and manage fraud;
  
  
• process online requests from American Express (for example, determining whether to approve or deny your request for a product or service); and
  
  
• assess credit risks, for example, to check whether you meet our eligibility criteria and decide whether we can offer you an American Express service or product, or to assess whether we need to take any responsible credit action in connection with your account (for example, reduce your credit line).
  

This is known as "automated decision making". Some of these decisions are made solely by automated means and have legal or similar effects , as we explain below. However, we will only carry out such processing if it is:

- necessary to enter into or perform a contract between you and American Express. For example, we may decide that some of our products and/or services may not be suitable for you based on your credit history and if you do not meet our eligibility criteria;

- authorized by a law to which American Express is subject and which also provides for appropriate measures to safeguard your rights and freedoms and legitimate interests (for example, to prevent fraud); or

- carried out on the basis of your explicit consent to such processing.

How automated processes make decisions

Application process

We consider several factors when approving or declining an online application for one of our products or services, including the information provided on your online application form, your income and your expenses. We will use this information to determine the likelihood that you (if your application is approved) will default on your account within a certain period of time. In order to manage our exposure to credit risk, we may decline your application if we believe there is a high probability that you will default during this period. If your application is approved, we will also use this information to determine your credit limit.

Fraud

We will evaluate payments made to and from your online account to identify any payments that are unusual. For example, if there is a payment that you would not normally make (such as a payment of a significant sum, which does not match your transaction history), we may take steps to prevent us from making a payment that is likely to be fraudulent.

We will also evaluate your spending behavior and transaction history to identify whether it is likely to constitute a fraud risk (for example, if a sudden change in your spending and repayment behavior suggests that you do not intend to pay outstanding balances owed to American Express). This may result in us taking steps to mitigate the risk to us, including declining charges you make on your card.

We also review digital information (such as information about your device, your browser, or your online interaction patterns with American Express) to help us detect potential fraud.

Assessing credit risks

As part of managing our relationship with you, we will assess whether we need to take any responsible lending action (for example, reduce your credit line). We take into account several factors to assess whether a credit risk exists, or whether you are experiencing financial difficulties. This may include assessing the activity on your online account, your payment history (for example, whether you have missed payments that are due and payable), the information you provided to us on your online application form (for example, your income) and information we obtain from the Bank of Spain and credit information systems. We will use this information to decide whether to take any action in relation to your American Express product or service to manage any credit risk. This may involve us reducing your credit line if we reasonably believe that you are likely to default on your payments in the future.

Our automated decision-making methods are regularly tested to ensure that they remain fair, effective and unbiased.

When we use automated decision making to enter into or perform a contract with you, as authorized by law or based on your explicit consent, you have the right to express your point of view, challenge the decision made, and request human intervention. See the "Your Rights" section for more information about your rights related to automated decision making.

We display advertising through our websites and applications, and also on third-party platforms, such as the websites and applications of our Business Partners and third-party platforms.

We may use your Personal Data to show you online advertising content tailored to your interests or general geographic location, across the different devices you use based on your Marketing Choices, as set forth below:

• We analyze your needs, preferences and behaviors displayed within our websites, mobile applications and the content we provide on third party platforms (such as our electronic communications, social media pages, voice assistant applications and digital advertisements) to create individual customer and customer group profiles. Please see the "Use of Personal Data" section for more details.
  
  
• We show you personalized advertisements based on your individual customer and customer group profiles and other information collected through cookies and similar technologies about your browsing behavior, over time and across different websites, based on your Marketing Choices. Personalized advertising may extend to our products and services, those of the American Express Group and those of our Business Partners. For more information, please see the "Marketing and Communications Choices" and "Cookies and Similar Technologies" sections.
  
  
• We also use your Personal Data to display advertising content or participate in personalized advertising campaigns on social media platforms. If you follow our social media pages or "like" our content on social media platforms, we may use your Personal Data to improve the content we provide to you on social media and the way we provide it to you. Please remember that we do not own such websites and social media applications, and we are obligated to use information about you only in accordance with the privacy policies and terms and conditions of such websites and applications.
  

You can choose how we target advertising to you as specified in the "Marketing and Communications Choices" section below.

We will only share your Personal Data with third parties when it is lawful for us to do so and for a specific purpose (as set out in the tables above or as described below), including with:

• the Bank of Spain and credit information systems to inquire about your financial circumstances, and to report financial risks and, where applicable, debts that you have with us; if you are a sole trader acting within your professional activity, we will inform that risks are reported in respect of that professional status;
  
  
• police, regulators, courts, government agencies, tax authorities and any other third parties (for example, third parties specified in a court order) to comply with legal or regulatory requirements, law enforcement and/or other requests in connection with actual or suspected fraud or criminal activity, or the investigation thereof, as well as regulatory investigations, and to protect the rights of American Express or others;
  
  
• collection agencies and external legal counsel to collect debts on your online account;
  
  
• our Service Providers (including their subcontractors) who perform services on our behalf and help us manage our online services and/or operate our business (that is, any vendor, third party and/or company that provides services such as printing, mailing, advertising, among others);
  
  
• companies or other product and service lines within the American Express Group. For example, when such companies provide services to us and/or when it is necessary for us to lawfully conduct our business and comply with regulatory obligations;
  
  
• Business Partners, such as entities that accept American Express branded cards for payment for goods/services purchased by you (that is, merchants), distribution, travel, benefits and other loyalty partners and certain advertising partners with whom we offer or develop products and services, as well as other financial institutions to provide, deliver, offer, customize or develop products and services to you, and address or resolve complaints. We will not share your contact information with Business Partners to independently promote their own products or services to you without your consent. However, we may send you offers about their products or services. Please note that if you take advantage of an offer from a Business Partner and become their customer, they may send you communications independently. In this case, you should review their privacy statement and inform them separately if you wish to opt out of receiving future communications from them;
  
  
• providers of insurance products or services included in your American Express card or account program that may be available to you as a benefit;
  
  
• any third party authorized by you, such as third parties providing open banking and related services at your request, for example when you intend to connect your account information to another platform or initiate payments from other accounts;
  
  
• our loyalty partners to connect you to your Membership Rewards account (where enrolled and applicable) and, depending on your product, to the partners available in your benefits program;
  
  
• your advisors (such as accountants, lawyers and other professional advisors) whom you have authorized to represent you, or any other person you have told us that you have authorized to give instructions or to use the account;
  
  
• third parties that participate in the same digital advertising network as us, so that they may also use Personal Data collected by us on our websites, applications and digital spaces for their own legitimate advertising purposes; or
  
  
• any person to whom we transfer or assign our contractual rights.

We transfer your Personal Data to organizations located in other countries and to regulatory authorities in other countries in certain circumstances in connection with the provision of our products and services. Some of these jurisdictions may not offer the same level of protection for Personal Data as that offered in the European Economic Area (EEA). Some countries will have different data protection laws. This includes transfers to countries outside the EEA, such as the United States, where our main operational data centers are located. We carry out these transfers to operate our business, administer your account and provide our products and services to you.

Please note that no matter where we process your Personal Data, we will always protect it in the manner described in our privacy policies or statements and in accordance with applicable law. When we transfer your Personal Data to certain countries outside the EEA:

• If that country has been the subject of an adequacy decision by the European Commission (see the list of countries here), we will rely on that decision to conduct our transfer; or

• In the case of transfers of Personal Data to a third party in the United States, we may rely on that third party's certification under the EU-US Data Privacy Framework to transfer your Personal Data.

In other cases, we are obliged to establish an "adequate guarantee". In particular:

• When we share Personal Data with other entities in the American Express Group covered by our Binding Corporate Rules and outside the EEA, we ensure an adequate level of protection through our Binding Corporate Rules, available here. Our Binding Corporate Rules ensure the protection of your Personal Data by requiring all entities in our group to follow the same standards when processing your Personal Data.

• When we share your Personal Data with other entities outside the EEA located in countries that have not been the subject of an European Commission adequacy decision, we include appropriate contractual protections (including European Commission standard contractual clauses) in those agreements. In addition, we assess whether additional technical and organizational measures are required for such transfers. If we deal with public or regulatory authorities, we will not need to have contractual protections, but that does not mean that your data is not protected by adequate security measures when it is transferred.

You can receive a copy of these contractual protections by contacting us. For more information, please see the "Query or Complaint" section below.

We use organizational, administrative, technical and physical security measures to safeguard your Personal Data and help ensure that your information is processed properly, accurately and completely. In particular:

• these measures include technological safeguards and appropriate access controls to data and infrastructure;

• we require Service Providers to safeguard your Personal Data and only use it for the purposes we specify; and

• we take all necessary steps to securely destroy or de-identify personal information when it is no longer needed.

If you simply browse our websites and applications, we will retain your Personal Data only for as long as we keep cookies installed on your devices. If you have created an online account within the scope of this Online Privacy Statement, we will retain your Personal Data for as long as your online account is active. After our relationship with you ends (for example, when your account is closed), we will only retain your Personal Data for an appropriate period of time, taking into account the nature and sensitivity of the data and the purposes for which we continue to retain it.

We will only retain Personal Data for specific purposes, including those that allow us to:

• comply or demonstrate compliance with our legal and regulatory requirements (for example, laws relating to money laundering);
  
• defend ourselves or initiate legal action;
• maintaining business records for analysis or audit purposes; and
• keep a record of people who do not wish to receive advertising from us

For example, your Personal Data will be stored by American Express for 5 years after the closure of your online account. This is related to the time available to take legal action. Personal Data necessary to fight money laundering will be stored for 10 years after the closure of your account, in accordance with applicable anti-money laundering legislation. We will retain your Personal Data after this period if your American Express Card account is in default and the balance remains unpaid or unsettled, or for legal or regulatory reasons or requirements.

We will block your Personal Data whenever it must be rectified or deleted in accordance with Article 32 of Organic Law 3/2018, dated December 5, on Personal Data Protection and guarantee of digital rights for the enforcement of possible liabilities arising from the processing during the applicable statute of limitations period.

On the other hand, we will retain the Personal Data of potential customers for 6 months when we need to keep a record of rejected applications.

When your Personal Data is no longer needed for the above purposes, we will securely destroy it or convert it into information that can no longer be associated with you. If you would like more information about our data retention practices, you may contact us; please see the "Query or Complaint" section for more information.

If you are an American Express customer who interacts online with us, we encourage you to periodically check that all Personal Data we hold about you is accurate and up to date. If you believe that any information we have about you is incorrect or incomplete, you may ask us to correct or delete it from our records. We encourage you to visit www.americanexpress.com/en-iec/, log in and update your Personal Data. If you prefer, you may contact us; see the "Query or Complaint" section for more information. Any information found to be incorrect or incomplete will be corrected promptly.

You have the right to access, update, limit, apply for portability, delete or object to the processing of your Personal Data. More specifically, you have the right to:

• Withdraw your consent for us to use your Personal Data at any time, when our processing is based on your consent.
  
  This will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to offer you certain products or services. We will inform you of this at the time you withdraw your consent.
  
  
• Request the limitation of the use of your Personal Data in certain cases.
  
  You can ask us to limit the processing of your Personal Data in the following cases:
  
  
  • if you want us to check the accuracy of the Personal Data;
    
    
  • when our use of the Personal Data is unlawful, but you do not want us to delete it (for example, for the enforcement of any liabilities arising from the processing during the applicable statute of limitations period for legal action);
    
    
  • when you need us to keep the Personal Data even though we no longer need it, because you need it to establish, exercise or defend legal claims; or
    
    
  • you have objected to our use of your Personal Data, but we need to verify whether we have overriding legitimate grounds to use it.
    

• In certain cases, request the deletion of your Personal Data.
  
  This allows you to ask us to erase or delete your Personal Data where there is no good reason for us to continue to process it. You also have the right to ask us to erase or delete your Personal Data where you have successfully exercised your right to object to the processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with applicable law. Please note, however, that in some circumstances we may not be able to comply with your request for specific reasons set out in applicable law, which will be notified to you, if applicable, at the time of your request.
  
  
• Request a human review of automated decisions that affect your legal or contractual rights or that could have a similar significant effect.
  
  In certain circumstances, you have the right to request a review of an automated decision, to express your views and to challenge the decision. This right only applies to fully automated decisions and will not apply if there has already been human intervention by us as part of the decision-making process.
  
  
• Request the portability or transfer of your Personal Data to yourself or to a third party.
  
  We will provide to you, or (where technically possible) to a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information for which you initially provided consent for us to use or where we used the information to perform a contract with you.
  
  
• Request a copy of the Personal Data we hold about you (often referred to as a "data subject access request" or "DSAR").
  
  This allows you to receive a copy of the Personal Data we hold about you and to check that we are processing it lawfully.
  
  
• Establish guidelines regarding your Personal Data upon your death in accordance with the applicable legislation. In this regard, the persons expressly designated by the deceased data subjects, or the Public Prosecutor's Office in the case of minors or persons with disabilities, may request access to the Personal Data of the deceased data subject or the rectification of the Personal Data of the deceased data subject.

You can choose how American Express collects and uses your Personal Data for advertising purposes. We work with a number of advertising partners, including ad networks, ad-servers, and social media platforms, to display our online advertisements. Your choices will vary depending on whether we show you ads through websites, apps, or social media.

You have the following choices regarding the Personal Data we collect about you:

• In connection with cookies and similar technologies:
  
  
  • If you do not want us to collect Personal Data about you through cookies or similar technologies for advertising purposes, you can choose to reject the installation of cookies through the banner that appears when you first visit our websites, by clicking on "Set Cookie Preferences" or through your browser settings, as explained in the "Information about cookies and similar technologies" policy. To reject the installation of cookies on third-party websites or applications, you should consult the applicable privacy policies and terms and conditions.
    
    
  • If you reject cookies, purchase a new device, access websites from another device, or change your browser, you will need to choose the option to reject cookies again.
    
    
  • If you choose to reject cookies, we will continue to show you advertising related to our products or services, but it will not be based on your Personal Data.
     
• You can also change the settings of how we collect your Personal Data in your device settings. For example, you can disable location services and ad-tracking on devices.
  
  

If you have any questions about this Corporate Cardmember Privacy Statement or how your information is handled or wish to file a complaint or exercise your rights, please call us at the toll-free number on the back of your corporate card or at the number posted on our website in the "Contact Us" section. You may also contact our Data Protection Officer at DPO-Europe@aexp.com. You can also write to American Express Europe, S.A; with address at Avenida Partenón 12-14. 28042 Madrid.

You also have the right to contact the Spanish Data Protection Authority directly at https://www.aepd.es/ or other competent supervisory authorities. If you are not satisfied with the resolution given to your request, you may also bring your case before the court in the place where you live, work or where an infringement may have occurred.