American Express®
Online Privacy Statement

We collect your Personal Data through cookies and similar technologies (for example, GIFs, web beacons, pixel tags) when you use our online services or access our content online. A cookie is a small data file that a website or application transfers to your technological device used to access such a website or application (for example, computer, smartphone, tablet).

We basically place cookies in your devices when you visit our websites or another company’s website where our ads appear or when you make purchases, request or personalise information, or register for certain services. The Personal Data we may collect through cookies and similar technologies relate, inter alia, to: the device(s) you use, your IP address, how you use our websites and applications (for example, what you search for, the pages you view, how long you stay), which ads or online content from us and our business or commercial partners you view.

Please refer to our notice "About cookies and similar technologies " for more information about how we process your Personal Data through cookies.

We use your Personal Data either on its own or combined with other information as described in the above sections (for example, when you access you online account associated to your American Express card, where applicable). We need a “lawful reason” under data protection laws to process your Personal Data, which are as follows: (i) where it is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract with you; (ii) where necessary for our legitimate interests, such as to prevent fraud and/or enhance our products or services; (iii) where we have obtained your consent, such as for marketing purposes when you opt-in to receive marketing from us; or (iv) for compliance with legal obligations and where we are required by law to process your Personal Data.

The table below sets out what we use your Personal Data for and our legal basis for doing so. Please note that we consider and balance the potential impact on you and your rights before processing your Personal Data for our legitimate interests. The legitimate interest relied upon is also set out in the table below.

Please note that we may process your Personal Data for more than one legal basis depending on the specific purpose for which we are using your Personal Data. Please contact us if you need details about the specific legal basis we are relying upon to process your Personal Data where more than one basis has been set out in the table below.

Some of the Personal Data we collect is more sensitive in nature (also known as special categories of Personal Data). We will always collect this data in accordance with applicable laws. The below table explains what we use your sensitive Personal Data for and the legal basis for doing so.

When you use open banking services (when available), we process your Personal Data to enable activities such as:

• our online American Express application processes for business or credit services, for income check and verification and prevention of fraud purposes; or
  
  
• (where applicable) serving a request made on your behalf by (i) an account information service provider, when they provide you with consolidated information on the payment account(s) that you hold with one or more bank(s) or payment institution(s) or (ii) a payment initiation services provider, when they initiate a payment to pay a merchant on your behalf.

In this context, we will process your Personal Data for above purposes as described in the “Use of Personal Data” section of this Online Privacy Statement

We use fully automated processes to help us make certain decisions about you, including to evaluate certain attributes about you to provide our services. This may also involve profiling (for example, credit and risk fraud profiles). What this means is that we will use software and/or artificial intelligence to automatically evaluate your personal circumstances to identify or predict risks or certain outcomes. For example, we use automated processes to make decisions about you in relation to the following:
 

• to detect, monitor and manage fraud; 
  
• to process online American Express applications (such as determining whether to approve or decline your application for a product or service); and 
• to assess credit risks, including to check if you meet our eligibility criteria and decide whether we can issue you an American Express service or product, or to assess if we need to take any responsible lending action in relation to your account (for example, to decrease your credit line)

This is known as “automated decision-making”. Some of those decisions are made solely by automated means and have legal effects or similar effects, which we explain further below. However, we will only perform such processing if it is:

- necessary for entering into or performing a contract between you and American Express. For example, we may decide that some of our products and/or services may not be suitable for you, based on your credit history and if you do not meet our eligibility criteria;

- authorised by a law to which American Express is subject, and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests (for example, to prevent fraud); or

- based on your explicit consent to such processing.

How we make decisions with automated processes
 

Application processes
 

We take several factors into account in determining whether to approve or decline an online application for one of our products or services, including information provided on your online application form, your income, and your outgoings. We will use this information to determine the likelihood of you (if approved) defaulting on your account. In order to manage our credit risk exposure, we may decline your application if we consider that there is a high likelihood you may default during this period. If your application is approved, we will also use this information to determine your credit limit.
 

Fraud
 

We will assess payments to and from your online account to identify any payments that are unusual. For example, if there is a payment you would not usually make (such as a payment of a significant sum, which is not in accordance with your transaction history), we may take action to stop you from making a payment that is likely to be fraudulent.

We will also assess your spending behaviour and transaction history to identify if you are likely to be a fraud risk (for example, if a sudden change in your spending and repayment behaviour suggests you have no intention of paying any outstanding balances owed to American Express). This may mean that we take steps to mitigate the risk to us, including declining charges you make using your card.

We also review digital information (such as information about your device, your browser, or your online interaction patterns with American Express) to help us detect potential fraud.
 

Assessing credit risks
 

As part of managing our relationship with you, we will assess if we need to take any responsible lending actions (for example, to decrease your credit line). We take several factors into account to assess if there is a credit risk, or if you are getting into financial difficulties. This may include assessing the activity on your online account, your payment history (for example, if you’ve missed payments due and payable), information you provided on your online application form (for example, your income) and information we obtain from credit reference agencies (i.e., UC AB). We will use this information to decide whether to take any actions in relation to your American Express product or service to manage any credit risk. This may involve us decreasing your credit line if we reasonably consider that you are likely to default on future payments.

Our automated decision-making methods are regularly tested to ensure that they remain fair, effective and unbiased.

Where we use automated decision making for entering into or performing a contract with you, as authorised by law or based on your explicit consent, you have the right to express your point of view, contest the decision made and request human intervention. Please see the section “Your Rights” for more information about your rights related to automated decision making.

We advertise through our websites and applications, and also on third-party platforms, such as websites and applications of our Business Partners and third-party platforms.

We may use your Personal Data to show you online marketing content tailored to your interests or general geographic location, across various devices that you use depending on your Marketing Choices as follows:

• We analyse your needs, preferences and behaviours shown within our websites, mobile applications and the content we offer on third-party platforms (such as our electronic communications, social media pages, voice assistant applications, and digital ads) to create individual customer and group customer profiles. Please see the "Use of Personal Data" section for more details.
  
  
• We serve you personalised ads based on your individual customer and group customer profiles and other information collected through cookies and similar technologies about your browsing behaviour, over time, and across different websites, via email or other electronic means, based on your Marketing Choices. Personalised advertising may extend to our products and services, those of the American Express Group and those of Business Partners. Please see the " Marketing Choices" and the "Cookies and similar technologies" sections for more details.
  
  
• We also use your Personal Data to present advertising content or engage in personalised advertising campaigns on social media platforms. If you follow our social media pages or "like" our content on those platforms, we may use your Personal Data to improve the content we serve to you on social media and how we deliver it to you.

You can choose how and if we market ourselves to you as specified in the "Marketing Choices" section below.

We will only share your Personal Data with others where it is lawful for us to do so, and for a specific purpose (as set out in the above tables or below), including with:

• UC AB to report or ask about your financial circumstances, and to report debts you owe to us;
   
• police, regulatory authorities, courts, governmental agencies, tax authorities and any other third party (for example, third parties specified in a court order) to comply with legal orders, legal or regulatory requirements, law enforcement requests and/or otherwise in connection with actual or suspected fraud or criminal activities, or investigation of the same, as well as regulatory investigations, and protect the rights of American Express or others;
  
  
• collection agencies and external legal counsel to collect debts on your online account;
   
• our Service Providers (including their subcontractors) who perform services for us and help us manage our online services and/or operate our business (i.e., any vendor, third party and/or company that provides services such as printing, mailing, advertising and marketing, among others);
   
• companies or other lines of products and services within the American Express Group. For example, where those companies share your Personal Data processed within the scope of the provision of their products and services with us to so that we can combine it with your Personal Data processed within the scope of this Online Privacy Statement;
   
• Business Partners, such as parties that accept American Express branded cards for payments of goods/services purchased by you (i.e., merchants), distribution, travel, rewards and other loyalty partners and certain advertising partners with whom we offer or develop products and services, as well as other financial institutions to provide, deliver, offer, customise or develop products and services to you, and address or resolve claims. We will not share your contact information with Business Partners for them to independently market their own products or services to you without your consent. However, we may show you offers related to Business Partners products or services. Please note that if you take advantage of an offer provided by a Business Partner and become their customer, they may independently send communications to you. In this case, you will need to review their privacy statement and inform them separately if you wish to decline receiving future communications from them;
   
• providers of insurance products or services that are included in your American Express card or account programme and that may be available to you as a benefit;
   
• any party approved by you, such as third parties for the provision of open banking and related services upon your request, for example where you seek to connect your account information to another platform or to initiate payments from other accounts;
   
• our loyalty partners to connect your membership rewards account (if applicable) and dependent on your product, with any partners available in your benefits programme;
   
• your advisers (such as accountants, lawyers and other professional advisers) who you have authorised to represent you, or any other person you have told us is authorised to give instructions or use the account; or
   
• anyone to whom we transfer or assign our contractual rights.

We transfer your Personal Data to organisations in other countries and to regulatory authorities in other countries. Some of these jurisdictions may not provide the same level of protection for Personal Data as provided in the European Economic Area (EEA). Some countries will have different data protection laws. This includes transfers to countries outside of the EEA, such as into the United States where our main operational data centres are located. We undertake these transfers to operate our business, administer your account and to provide our products and services to you.

Keep in mind, no matter where we process your Personal Data, we will always protect it in the manner described in our privacy statements and in accordance with applicable laws. When we transfer your Personal Data to certain countries outside of the EEA:

• If that country has received an adequacy decision from the European Commission (please see the list of countries here), we will rely on that decision to undertake our transfer; or
  
  
• In the case of transfers of Personal Data to a third party in the United States, we may rely on that third party’s certification to the EU-US Data Privacy Framework (see here) to transfer your Personal Data.

In other cases, we are required to put in place an “appropriate safeguard”. In particular:

• When we share Personal Data with other companies within the American Express Group that are outside of the EEA, we ensure an adequate level of protection through our Binding Corporate Rules, available here. Our Binding Corporate Rules ensure your Personal Data is protected by requiring all of our group participating companies to follow the same rules when processing your Personal Data.
  
  
• When we share your Personal Data with third parties (or American Express Group non-participating Binding Corporate Rules companies) outside the EEA to countries which have not received an adequacy decision from the European Commission, we include appropriate contractual protections (including the European Commission standard contractual clauses) in those agreements. In addition, we assess whether other technical and organisational measures are required for those transfers. If we are dealing with public authorities or regulators we won’t need to have contractual protections in place but that doesn’t mean your data is not protected by appropriate security measures when it’s transferred.

You can receive a copy of such contractual protections by contacting us, see the “Query or Complaint” section below.

We use organisational, administrative, technical and physical security measures to safeguard your Personal Data and to help ensure that your information is processed promptly, accurately and completely. In particular:
 

• these measures include technological safeguards and adequate access controls to data and infrastructure; 
• we require Service Providers to safeguard your Personal Data and only use your Personal Data for the purposes we specify; and 
• we take all necessary steps to securely destroy or de-identify personal information, when we no longer need it.

If you simply browse through our websites and applications, we will keep your Personal Data only for as long as we keep cookies installed in your devices. If you have set up an account online within the scope of this Online Privacy Statement, we will keep your Personal Data for as long as your online account is active. Once our relationship with you has ended (for example, your account has closed), we will only keep your Personal Data for a period of time that is appropriate, taking into account the nature and the sensitivity of the data and what we continue to hold it for.

We will only keep Personal Data for specific purposes, including where it allows us to:

• comply or evidence compliance with our legal and regulatory requirements (for example, laws relating to money laundering)
• defend or take legal action
• maintain business records for analysis or audit purposes
• keep records of anyone who does not want to receive marketing from us

For example, your Personal Data will be stored by American Express for 10 years after your online account is closed. This is linked to the amount of time available to bring a legal claim. Personal Data necessary to fight money laundering will be stored for 10 years after your account is closed in accordance with applicable laws on anti-money laundering. We will keep your Personal Data after this time if your American Express card account is in default and the balance remains unpaid or unsettled, or for legal or regulatory reasons or requirements.

Separately, we will keep Personal Data of prospect customers for 3 years where we need to keep a record of rejected applications.

When your Personal Data is no longer necessary for the above purposes, we will securely destroy such information or de-identify it. For more information about our data retention practices, you can contact us – please see the “Query or Complaint” section.

If you are an American Express customer interacting online with us, we encourage you to check regularly that all Personal Data held by us is accurate and up to date. If you believe that any information we hold about you is incorrect or incomplete, you may ask us to correct or remove this information from our records. We recommend that you go to www.americanexpress.com/sv-se/, log in and update your Personal Data. If you prefer, you can contact us – please see the “Query or Complaint” section. Any information which is found to be incorrect or incomplete will be corrected promptly.

You have the right to access, update, restrict, port, erase or object to the processing of your Personal Data. More specifically, you have the right to:

• Withdraw your consent for our use of your Personal Data at any time, where our processing is based on your consent.
  
  This will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

• Request restriction of the use of your Personal Data in certain cases.
  
  You can ask us to restrict the processing of your Personal Data in the following scenarios:
  
  
  • if you want us to establish the accuracy of the Personal Data;
  • where our use of the Personal Data is unlawful, but you do not want us to erase it;
  • where you need us to hold the Personal Data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • you have objected to our use of your Personal Data but we need to verify whether we have overriding legitimate grounds to use it.

• In certain cases, request the erasure of your Personal Data.

This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have revoked your consent and successfully exercised your right to object to processing and where there is no other legal ground for processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with applicable law. However, please note that we may not always be able to comply with your request for specific reasons set out in the law which will be notified to you, if applicable, at the time of your request.

• Request a human review of automated decisions that impact your legal or contractual rights or that may have a similarly significant effect.

In certain circumstances, you have the right to request for an automated decision to be reviewed, to express your point of view and to contest the decision. This right only applies to fully automated decisions, so it won’t apply if there has already been input from us as part of the decision-making process.

• Request the transfer of your Personal Data to you or to a third party.

We will provide to you, or (where technically feasible) a third party you have chosen, your Personal Data in a structured, commonly used and machine-readable format. Note that this right only applies to automated information for which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Request a copy of your Personal Data we have about you (often referred to as a “data subject access request” or a “DSAR”).

This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.
 

• Subject to applicable law you may establish guidelines regarding your Personal Data for when you become deceased in accordance with applicable law. In this regard, persons expressly designated by deceased data subjects or the public prosecutor in the case of minors or people with disabilities may request to access the Personal Data of the deceased data subject or the rectification of the Personal Data of the deceased data subject.

If we receive a request from you, we will respond as soon as possible but no later than one calendar month except as follows. If, due to the nature or circumstances of your request, we can’t meet that deadline, we may extend it by up to a further two months (complex requests). In this case, we will send you an email or letter explaining the cause of the delay.
 

If you wish to exercise any of your rights, please click here.

If you have any questions about how we process your information, you can contact us – please see the “Query or Complaint” section.

You have the discretion to decide how American Express collects and uses Personal Data about you for marketing and advertising purposes.

You have the following choices regarding the Personal Data we collect about you:
 

• Regarding Cookies and similar technologies:
   
  • If you do not want us to collect Personal Data about you through cookies or similar technologies for advertising and marketing purposes, you can choose to reject the installation of cookies through the banner that appears the first time you visit our websites, by clicking on "Configure Cookie Preferences" or through your browser settings, as explained in the " About cookies and similar technologies” policy.
    
    
  • If you reject cookies, purchase a new device, access websites from another device, or change browsers, you will need to choose the option to accept or reject cookies again. 
    
    
  • If you choose to reject cookies, we will continue to show you advertising related to our products or services, but this will not be based on Personal Data about you. 
     
• Regarding marketing communications, if you have opted in to receive marketing communications from us but you no longer wish to receive these communications, you can: 
  
  
  • Click the unsubscribe option at the bottom of an email and follow the instructions, or head here.
    
    
  • Log in to your online account and click on Account Management/Alerts, Communications, Privacy/Contact Preferences. 
     
• You can also change the settings for how we collect your Personal Data in your device settings. For example, you can turn off location-based services and ad tracking for devices. 

Please remember that even if you have chosen not to accept direct marketing, we will still contact you to service your online account, respond to your requests, or administer any promotions or programs you have chosen to be a part of. These communications, which are necessary to inform you about the services you expect to receive from us, are not considered direct marketing, but are classified as service messages. For example, they may be used to inform you of a benefit from your online account.
 

If you are a customer, you can choose how we should communicate with you. To update your communication preferences, you can:
 

• log in to your online account, click Manage Your Account, and make your choice on Make Your Marketing Communications Choice. 

If you wish to manage your marketing and communication choices regarding an American Express Establishment (i.e., merchant), you can:
 

• Log in to your online account by going to americanexpress.com/merchant and going into the settings to update your preferences in marketing communications.
  
  
• Call +46 8 429 56 80.

If you have questions about this Online Privacy Statement or how your information is handled or wish to make a complaint or exercise your rights, please contact our Data Protection Officer at DPO-Europe@aexp.com or by referring to the “Contact Us” page of our website. You may also write to the following address and specify the American Express entity you would like to submit your query to: Avenida Partenón 12-14. 28042 Madrid.

You also have the right to lodge a complaint with Integritetsskyddsmyndigheten directly at www.imy.se, or the authority of the European Member State where you live, work or where there may have been an infringement. If your request is not resolved to your satisfaction, you may also take your case to court.