Cardmember Privacy Statement

Personal Data is any information relating to you as an identified or identifiable natural person, such as your name, addresses, telephone number, and email address and other information specific to you such as demographic details, employment details, your income and/or transaction information. If you do not provide us with Personal Data that we tell you is mandatory (for example, if we need to collect Personal Data by law or if it is necessary to enter into a contract with you), we may not be able to provide you with our products and services. We will notify you if this is the case at the time.
 

We collect and process various categories of Personal Data about you, throughout your relationship with us as a cardmember (and beyond, subject to appropriate retention periods as further explained below). The types of information we collect will depend on which product or service you request or use. We will only collect Personal Data that is necessary for our business or to comply with our legal obligations. Personal Data may include:
 

• your personal details, including name and address, date of birth, personal identity number, nationality, contact details
  
  
• financial information, such as your bank account number, card numbers, expiry date and card cryptogram, and details of your transactions (e.g. payments you make and receive)
  
  
• information about your financial and credit history, including proof of income, employment details, outgoings and credit and borrowing history
  
  
• information about your preferences (for example, your marketing preferences and the offers you redeem through your Membership Rewards)
  
  
• biometric data used for fraud prevention and identification purposes
  
  
• criminal data for collating evidence and investigate about a suspected crime
  
  
• in limited cases, information about criminal convictions and offences
  
  
• information about your position as, or relationship with, a Politically Exposed Person

We collect Personal Data directly from you, through the following means:
 

• from your application form;
  
  
• through the way you communicate with us and use your account (such as information provided during servicing calls);
  
  
• any research, surveys or competitions you enter or respond to or any marketing offers for which you register; and
  
  
• from other information you directly provide to us.

We also collect your Personal Data from different sources depending on which product or service you request or use, such as:
 

• when you request or utilize products, goods or services (such as when you use your card to make transactions with merchants, ATM operators, use concierge services or book travel);
  
  
• from checks at the Gjeldsregisteret and their records and databases and other publicly available records or databases;
  
  
• if you are a Supplementary Cardmember, from the primary cardmember linked to the card account;
  
  
• third parties, such as:
  
  
  • Business Partners. These are third parties with whom we conduct business or have a contractual relationship, such as co-brand partners or merchants; or
    
    
  • Open banking providers.Information we receive from open banking providers you (or a third party properly authorised on your behalf) have authorised. Open banking providers provide payment-initiation or account-information services (for example, you may authorise such providers to collect account information from your bank, which is subsequently shared with American Express for the purpose of completing our underwriting verifications to issue you with a card).

In addition, we also collect digital data, such as your IP address or other information about your online interactions, as described in the Online Privacy Statement.
 

We sometimes process Personal Data so that it no longer identifies any individual. Once processed in this manner, it will no longer constitute Personal Data and will be aggregated and anonymized information. We process Personal Data to aggregate and anonymize it to:
 

• analyze patterns among groups of people, such as cardmembers;
  
  
• create business insights or statistical research reports; and/or
  
  
• improve our advertising and our business.
  
  

We sometimes share aggregated and anonymized information with Business Partners or other trusted third parties, for many of the same reasons mentioned above.

We use your Personal Data either on its own or combined with other information. We need a “lawful reason” under data protection laws to process your Personal Data, which are as follows: (i) where it is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract with you; (ii) where necessary for our legitimate interests, such as to prevent fraud and/or enhance our products or services; (iii) where we have obtained your consent, such as for marketing purposes when you opt-in to receive marketing from us; or (iv) for compliance with legal obligations and we are required by law to process your Personal Data, such as for the due diligence that financial institutions are required to perform before approving card accounts.

The table below sets out what we use your Personal Data for and our legal basis for doing so. Please note that we consider and balance any potential impact on you and your rights before processing your Personal Data for our legitimate interests. The legitimate interest relied upon is also set out in the table below.

Please note that we may process your Personal Data for more than one legal basis depending on the specific purpose for which we are using your Personal Data. Please contact us if you need details about the specific legal basis we are relying upon to process your Personal Data where more than one basis has been set out in the table below.

When you use open banking services (when available), we process your Personal Data to provide our open banking services, such as:
 

• during the card application process, for income check and verification purposes; or
  
  
• providing you with consolidated information on the payment account(s) that you hold with one or more bank(s) or payment institution(s), or (where applicable) complying with a request made on your behalf by a payment initiation services provider, when they initiate a payment to pay a merchant on your behalf.

In this context, we will process your Personal Data to provide you with the regulated open banking services or as otherwise described in the “Use of Personal Data” section.

We use fully automated processes to help us make certain decisions about you, including to evaluate certain attributes about you to provide our services. This may also involve profiling. What this means is that we will use software and/or artificial intelligence to automatically evaluate your personal circumstances to identify or predict risks or certain outcomes. For example, we use automated processes to make decisions about you in relation to the following:
 

• detect, monitor and manage fraud;
  
  
• process card applications (such as determining whether to approve or decline your application for a card); and
  
  
• assess credit risks, including to check if you meet our eligibility criteria and decide whether we can issue you a card, or to assess if we need to take any responsible lending action in relation to your account (for example, to decrease your credit line)
  
  

This is known as “automated decision-making”. Some of those decisions that are made solely by automated means have legal effects or similar effects, which we explain further below. However, we will only perform such processing if it is:
 

- necessary for entering into or performing a contract between you and American Express. For example, we may decide that some of our products and/or services may not be suitable for you, based on your credit history and if you do not meet our eligibility criteria;

- authorized by a law to which American Express is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests (for example, to prevent fraud); or

- based on your explicit consent to such processing.

 

How we make decisions with automated processes

 

Application process
 

We take several factors into account in determining whether to approve or decline an application for one of our cards, including information provided on your application form, your income, and your outgoings. We will use this information to determine the likelihood of you (if approved) defaulting on your account. In order to manage our credit risk exposure, we may decline your application if we consider that there is a high likelihood you may default during this period. If your application is approved, we will also use this information to determine your credit limit.
 

Fraud
 

We will assess payments to and from your account to identify any payments that are unusual. For example, if there is a payment you would not usually make (such as a payment of a significant sum, which is not in accordance with your transaction history), we may take action to stop us from making a payment that is likely to be fraudulent.
 

We will also assess your spending behaviour and transaction history to identify if you are likely to be a fraud risk (for example, if a sudden change in your spending and repayment behaviour suggests you have no intention of paying any outstanding balances owed to American Express). This may mean that we take steps to mitigate the risk to us, including declining charges you make using your card.
 

Assessing credit risks

As part of managing our relationship with you, we will assess if we need to take any responsible lending actions (for example, to decrease your credit line). We take several factors into account to assess if there is a credit risk, or if you are getting into financial difficulties. This may include assessing the activity on your account, your payment history (for example, if you’ve missed payments due and payable), information you provided on your application form (for example, your income) and information we obtain from the Gjeldsregisteret. We will use this information to decide whether to take any actions in relation to your card to manage any credit risk. This may involve us decreasing your credit line if we reasonably consider that you are likely to default on future payments.

Our automated decision-making methods are regularly tested to ensure that they remain fair, effective and unbiased.
 

Where we use automated decision making for entering into or performing a contract with you, as authorized by law or based on your explicit consent, you have the right to express your point of view, contest the decision made and request human intervention. Please see the section “Your Rights” for more information about your rights related to automated decision making.

We will only share your Personal Data with others where it is lawful for us to do so, and for a specific purpose (as set out in the above table or below), including with:

• the Gjeldsregisteret to report or ask about your financial circumstances, and to report debts you owe to us;
  
  
• police, regulatory authorities, courts, governmental agencies, tax authorities and any other third party (for example, third parties specified in a court order) to comply with legal orders, legal or regulatory requirements, law enforcement requests and/or otherwise in connection with actual or suspected fraud or criminal activities, or investigation of the same;
  
  
• collection agencies and external legal counsel to collect debts on your account;
  
  
• our Service Providers (including their subcontractors) who perform services for us and help us manage your account and/or operate our business (i.e., any vendor, third party and/or company that provides services or performs business operations on our behalf such as communications services, fraud checks, marketing, data processing and outsourced technology, servicing, ad management, auditors, consultants and professional advisors such as external legal counsel and accountants);
  
  
• companies or other lines of products and services within the American Express Group. For example, where those companies provide services to us and/or where it is necessary for us to lawfully carry out our business activities;
  
  
• Business Partners, such as parties that accept American Express branded cards for payments of goods/services purchased by you (i.e., merchants), your bank or other payment card issuers to provide, deliver, offer, customise or develop products and services to you, and address or resolve claims. We will not share your contact information with Business Partners for them to independently market their own products or services to you without your consent. However, we may send you offers on their behalf with your consent. Please note that if you take advantage of an offer provided by a Business Partner and become their customer, they may independently send communications to you. In this case, you will need to review their privacy statement and inform them separately if you wish to decline receiving future communications from them;
  
  
• any party approved by you, such as third parties for the provision of open banking and related services upon your request, for example where you seek to connect your account information to another platform or to initiate payments from other accounts;
  
  
• our loyalty partners to connect your Membership Rewards account (if applicable) and dependent on your card product, with any partners available in your card benefits programme;
  
  
• your advisers (such as accountants, lawyers and other professional advisers) who you have authorized to represent you, or any other person you have told us is authorized to give instructions or use the account (for example, a Supplementary Cardmember or under a power of attorney); or
  
  
• anyone to whom we transfer or assign our contractual rights.

The provisions of this privacy statement apply to any Supplementary Cardmember(s) who you have approved to use your account. Where you have approved the issue of a Supplementary Card:

• we will use the information of a Supplementary Cardmember to process their application, issue their card, manage the account, and comply with our legal or regulatory obligations; and
  
  
• the Supplementary Cardmember may need to provide us with your Personal Data for identity verification when they contact us about activating or using their card, register for on-line services and access new or updated services and benefits.

Supplementary Cardmembers will not be permitted to make any alteration to any of your Personal Data unless you have provided us with a mandate for them to do so (which may be in a form reasonably requested by us).

Where applicable, we will exchange your Personal Data as part of customer due diligence and to prevent fraudulent conduct or behaviour that contravenes international sanctions and to comply with regulations against money laundering, terrorism financing and tax fraud with the centralized information files kept by the Gjeldsregisteret and Fraud Prevention Agencies. We may obtain Personal Data about you from the Gjeldsregisteret, including, where relevant, your household (such as your spouse), and any business in which you are involved (including details of your co-directors or partners in business). For these purposes you may be treated as financially linked to such persons ("financial associates") and you will be assessed with reference to their "associated records". You must be sure that you have your financial associates’ agreement to disclose information about them.
 

When you apply
 

Where applicable, we seek confirmation from the centralized information files kept by the Gjeldsregisteret that no incident of payment has been reported towards you.
 

During the lifetime of your account
 

We will continue to make searches at the registers held by the Gjeldsregisteret to assist in managing your account and this will include looking at the associated records of your financial associates. These searches will not be seen or used by other organisations to assess your ability to obtain credit. We will also carry out further credit checks whilst any money is owed by you on your account.
 

We will tell the Gjeldsregisteret if you do not make payments when due. They will record this information on the centralized information files (such as FICP) and it may be shared with other organisations for the purpose of assessing applications from you, and applications from any other party with a financial association with you, for credit or other facilities, for other risk management purposes and for preventing fraud and tracing debtors. Records shared with the Gjeldsregisteret remain on file for 5 years maximum unless they are closed and settled by you earlier.
 

We will analyse your Personal Data to assist in managing your account and to prevent fraud or any other unlawful activity. If fraud is detected, you could be refused certain services, finance, or employment. We and other organisations, including fraud prevention agencies, may access and use your Personal Data to prevent fraud and money laundering and to verify your identity, for example, when:

• verifying the information you provide on applications for insurance, credit and credit related or other facilities;
  
  
• managing credit, credit related accounts or facilities, and insurance policies;
  
  
• recovering debt; or
  
  
• checking details on applications, proposals and claims for all types of insurance.
  
  

We and other organisations may access and use from other countries the information recorded by fraud prevention agencies.
 

For additional information about how the Gjeldsregisteret gather and use your Personal Data, please review the Incident File Information at https://www.gjeldsregisteret.com/pages/personvernsdeklarasjon

We transfer your Personal Data to organisations in other countries and (where permitted by applicable law) to regulatory authorities in other countries. Some of these jurisdictions may not provide the same level of protection for Personal Data as provided in the European Economic Area (EEA). Some countries will have different data protection laws. This includes transfers to countries outside of the EEA, such as into the United States where our main operational data centres are located. We undertake these transfers to operate our business, process transactions on foreign purchases, administer your account and to provide our products and services to you.
 

Keep in mind, no matter where we process your Personal Data, we will always protect it in the manner described in our privacy statements and in accordance with applicable laws. When we transfer your Personal Data to certain countries outside of the EEA:
 

• If that country has received an adequacy decision from the European Commission (please see the list of countries here), we will rely on that decision to undertake our transfer; or
  
  
• In the case of transfers of Personal Data to a third party in the United States, we may rely on that third party’s certification to the EU-US Data Privacy Framework to transfer your Personal Data.

In other cases, we are required to put in place an “appropriate safeguard”. In particular:
 

• When we share Personal Data with other companies within the American Express Group that are outside of the EEA, we ensure an adequate level of protection through our Binding Corporate Rules, available here. Our Binding Corporate Rules ensure your Personal Data is protected by requiring all of our group companies to follow the same rules when processing your Personal Data.
  
  
• When we share your Personal Data with third parties (or American Express Group non-participating Binding Corporate Rules companies) outside the EEA to countries which have not received an adequacy decision from the European Commission, we include appropriate contractual protections (including the European Commission standard contractual clauses) in those agreements. In addition, we assess whether other technical and organizational measures are required for those transfers. If we are dealing with public authorities or regulators we won’t need to have contractual protections in place but that doesn’t mean your data is not protected by appropriate security measures when it’s transferred.

You can receive a copy of such contractual protections by contacting us, see the “Query or Complaint” section below.

We use organisational, administrative, technical and physical security measures to safeguard your Personal Data and to help ensure that your information is processed promptly, accurately and completely. We require Service Providers to safeguard your Personal Data and only use your Personal Data for the purposes we specify.

We will keep your Personal Data only for as long as you are a customer of ours and we need to perform the contractual relationship with you and deliver the products and services that you requested. Once our relationship with you has ended (for example, your account has closed), we will only keep your Personal Data for a period of time that is appropriate, taking into account the nature and the sensitivity of the data and what we continue to hold it for.
 

We will only keep Personal Data for specific purposes, including where it allows us to:
 

• comply or evidence compliance with our legal and regulatory requirements (for example, laws relating to money laundering)
  
  
• defend or take legal action
  
  
• maintain business records for analysis or audit purposes
  
  
• keep records of anyone who does not want to receive marketing from us
  
  

When your Personal Data is no longer necessary for the above purposes, we will securely destroy such information. For more information about our data retention practices, you can contact us – please see the “Query or Complaint” section.

We encourage you to check regularly that all Personal Data held by us is accurate and up to date. If you believe that any information we hold about you is incorrect or incomplete, you may ask us to correct or remove this information from our records. We recommend that you go to www.americanexpress.com/nb-no/ , log in and update your Personal Data. If you prefer, you can contact us – please see the “Query or Complaint” section. Any information which is found to be incorrect or incomplete will be corrected promptly.

You have the right to access, update, restrict, port, erase or object to the processing of your Personal Data. More specifically, you have the right to:
 

• Withdraw your consent for our use of your Personal Data at any time, where our processing is based on your consent.
  
  This will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

• Request restriction of the use of your Personal Data in certain cases.
  
  

  You can ask us to restrict the processing of your Personal Data in the following scenarios:

  
  
  • if you want us to establish the accuracy of the Personal Data;
    
    
  • where our use of the Personal Data is unlawful, but you do not want us to erase it;
    
    
  • where you need us to hold the Personal Data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
    
    
  • you have objected to our use of your Personal Data but we need to verify whether we have overriding legitimate grounds to use it.
    
    
• In certain cases, request the erasure of your Personal Data.
  
  This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with applicable law. However, please note that we may not always be able to comply with your request for specific reasons set out in the law which will be notified to you, if applicable, at the time of your request.
  
  
• Request a human review of automated decisions that impact your legal or contractual rights or that may have a similarly significant effect.
  
  In certain circumstances, you have the right to request for an automated decision to be reviewed, to express your point of view and to contest the decision. This right only applies to fully automated decisions, so it won’t apply if there has already been input from someone as part of the decision-making process.
  
  
• Request the transfer of your Personal Data to you or to a third party.
  
  We will provide to you, or (where technically feasible) a third party you have chosen, your Personal Data in a structured, commonly used and machine-readable format. Note that this right only applies to automated information for which you initially provided consent for us to use or where we used the information to perform a contract with you.
  
  
• Request a copy of your Personal Data we have about you (often referred to as a “data subject access request” or a “DSAR”).
  
  This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.

Subject to applicable law you may establish guidelines regarding your Personal Data for when you become deceased in accordance with applicable law. In this regard, persons expressly designated by deceased data subjects or the public prosecutor in the case of minors or people with disabilities may request to access the Personal Data of the deceased data subject or the rectification of the Personal Data of the deceased data subject.

If we receive a request from you, we will respond as soon as possible but no later than one calendar month except as follows. If, due to the nature or circumstances of your request, we can’t meet that deadline, we may extend it by up to a further two months (complex requests). In this case, we will send you an email or letter explaining the cause of the delay.

If you have any questions about how we process your Personal Data, you can contact us – please see the “Query or Complaint” section.

You can choose how you would like to receive marketing communications, including direct marketing - whether we send them to you through postal mail, email, SMS and/or telephone. Please see the above section for our lawful reasons which justify using your information to send you marketing communications. The lawful reasons for sending direct marketing communications to you will differ depending on a number of factors, including the marketing channel used (e.g., SMS, email, telephone), whether we have an existing relationship with you, or if you are an individual customer or a business customer.
 

If after making your preferences you wish to opt out of receiving marketing, we recommend you go to https://www.americanexpress.com/nb-no/, log in, and update your privacy preferences. If you prefer, you can also contact us – please see the “Query or Complaint” section below. If you choose not to receive marketing communications from us, we will honour your choice.
 

Please be aware that if you choose not to receive such communications, certain offers attached to the products or services you have chosen could be affected.
 

We will still communicate with you in connection with servicing your account, fulfilling your requests, or administering any promotion or program in which you have elected to participate. These communications are necessary to provide the service you expect to receive from us and you may not opt out of receiving them.

If you have questions about this Cardmember Privacy Statement or how your information is handled or wish to make a complaint or exercise your rights, please contact our Data Protection Officer at DPO-Europe@aexp.com or by referring to the "Contact Us" page of our website. You may also write to the following address and specify the American Express entity you would like to submit your query to: Avenida Partenón 12-14, 28042, Madrid, Spain.
 

You also have the right to contact the Norwegian Data Protection Authority “Datatilsynet” directly at www.datatilsynet.no or the authority of the European Member State where you live, work or where there may have been an infringement. If your request is not resolved to your satisfaction, you may also take your case to court.