Online Privacy Statement and Disclosures

Data Access & Collection · Company practice

Not intended for children under 13; no knowing online solicitation or marketing to them

American Express says its products and services are not intended for children under 13 years of age, and that it does not knowingly solicit data online from, or market online to, children under 13.

Supporting quotations

Our products and services are not intended for children under 13 years of age. We do not knowingly solicit data online from, or market online to, children under 13 years of age.

Not stated here

• This passage does not say what American Express does if it learns it has received data from a child under 13.

Data Access & Collection · Company practice

Covers information from site and app use, electronic communications, ads and social media

The statement describes online information that American Express (and its Service Providers) may collect, use, share and keep. As examples, it says it gathers Online Information if you visit or use its website or apps; receive or reply to electronic communications from it; view or click on its ads or other online content; or interact with it through social media websites and other websites and applications.

Supporting quotations

may collect, use, share and keep information that we get about you online

Visit or use our website or apps;

Receive or reply to electronic communications from us;

View or click on our ads or other online content; and

Interact with us through social media websites and other websites and applications.

Qualifications & exceptions

• The list is introduced with "For example", so it is not stated to be a complete list of situations.

Not stated here

• Terms such as Service Providers and Online Information link to Glossary entries on the same page, which are carded separately; this card does not rely on any other linked document.

Data Access & Collection · Company practice

Information you give directly: name, account number, contact details, biometric data, date of birth

American Express says the types of information it collects depend on which product or service you use. Sometimes you give information directly to American Express or its Service Providers. For example, you might give your name, account number, email, mailing address, biometric data, phone number, or date of birth when you fill out an online form or survey (including when you book travel with American Express); register, log into or update the settings on your account using its online services; enter a competition or register for a marketing offer; or sign up for its products and services.

Supporting quotations

The types of information we collect depends on which product or service you use.

you might give us your name, account number, email, mailing address, biometric data, phone number, or date of birth when you:

fill out an online form or survey, including when you book travel with us;

register, log into or update the settings on your account using our online services;

enter a competition or register for a marketing offer; or

sign up for our products and services.

Qualifications & exceptions

• The items are introduced with "For example" and "might", so neither the data types nor the situations are stated to be a complete list.

Not stated here

• The statement does not say here what biometric data is collected, or in which of these situations.

Data Access & Collection · Company practice

Cookies and similar technologies collect information, including Personal Information, for listed purposes

American Express, its Service Providers and its Advertising Partners also collect information, including Personal Information, through Cookies and Similar Technologies. The purposes named are keeping the site secure, remembering website preferences, enhancing site functionality, analyzing site traffic, and advertising customization and measurement. As an example, if you click Remember Me when you log in to the website, a cookie will store your username. A later pointer sends readers to the "What are your choices?" section for choices about collection and use, including through these technologies.

Supporting quotations

also collect information including Personal Information through Cookies and Similar Technologies for purposes such as keeping our site secure, remembering website preferences, enhancing site functionality, analyzing site traffic, and advertising customization and measurement. For example, if you click Remember Me when you log in to our website, a cookie will store your username.

section below to learn more about your choices regarding the collection and use of your information, including through

Qualifications & exceptions

• The purposes are introduced with "for purposes such as", so the list is not stated to be complete.

Not stated here

• The definition of Cookies and Similar Technologies is in the Glossary and the linked terms are on the same page; this card does not rely on any other linked document.

Data Access & Collection · Company practice

Cookies and similar technologies may log device, IP address, browsing history, referrers and ad activity

American Express, its Service Providers and its Advertising Partners may use Cookies and Similar Technologies to collect information about: the device, operating system and browser you use (including when you browse the websites, use the apps or open electronic communications); your IP address and related information (such as domain information, your internet provider and general geographic location); your browsing history on the website or in the apps (such as what you search for, the pages you view, how long you stay and how often you come back); how you search for the website, which websites you arrive from, and which of its Business Partners' websites you visit; and which ads or online content from American Express and its Business Partners you view, access or click on.

Supporting quotations

may collect information using

the device, operating system, and browser you use, such as when browse our websites, access our apps, or open electronic communications from us;

the IP Address and related information (such as domain information, your internet provider and general geographic location);

browsing history on our website or in our apps (such as what you search for, the pages you view, how long you stay, and how often you come back);

how you search for our website, from which websites you arrive, and which of our Business Partners’ websites you visit;

which ads or online content from us and our Business Partners you view, access, or click on;

Not stated here

• The terms Business Partners, Service Providers and Advertising Partners link to Glossary entries on the same page, which are carded separately; the statement does not name which Business Partners' websites are meant.

Data Access & Collection · Company practice

Whether you open electronic communications and what you click on may be collected

Using Cookies and Similar Technologies, American Express, its Service Providers and its Advertising Partners may collect information about whether you open its electronic communications and which parts you click on.

Supporting quotations

whether you open our electronic communications and which parts you click on;

Data Access & Collection · Company practice

Information about your wireless account and device, including mobile device location, may be collected

Using Cookies and Similar Technologies, American Express, its Service Providers and its Advertising Partners may collect information about your wireless account and device, including the location of your mobile device. The example given is when you use mobile websites or apps to register to receive location-based content.

Supporting quotations

and information about your wireless account and device, including the location of your mobile device (for example, when you use mobile websites or apps to register to receive location-based content).

Qualifications & exceptions

• The location example is introduced with "for example", so it is not stated to be the only situation in which mobile device location is collected.

Not stated here

• The statement does not say how precise the location is, or whether it is collected only when you register for location-based content.

Data Access & Collection · Company practice

Information may also come from social platforms, online databases or directories, or be otherwise legitimately obtained

American Express, its Service Providers and its Advertising Partners may also collect information made available through third-party platforms and apps (such as online social media platforms), through online databases or directories, or that is otherwise legitimately obtained. The statement says this information may be governed by the privacy notice(s) provided by the third party at the time of collection.

Supporting quotations

may also collect information made available through third-party platforms and apps

Not stated here

• The third parties' privacy notices are not supplied here, and the statement does not say what other sources count as "otherwise legitimately obtained".

Data Access & Collection · Context

Glossary: Cookies and Similar Technologies include cookies, pixels, web beacons, SDKs, tags and Device ID technology

The Glossary says American Express and its Service Providers and Advertising Partners may use cookies, pixels, web beacons, Software Development Kits (SDKs), gifs, tags, Device ID technology and other similar technologies (together, "Cookies and Similar Technologies") on its websites and apps. It describes cookies as small data files a website transfers to your computer's hard drive, and SDKs as snippets of code embedded in websites or apps, both of which collect information about your activity.

Supporting quotations

we and our Service Providers and Advertising Partners may use cookies, pixels, web beacons, Software Development Kits (“SDKs”), gifs, tags, Device ID technology and other similar technologies (collectively, “Cookies and Similar Technologies”) on our websites and apps. Cookies, for example, are small data files that a website transfers to your computer's hard drive, while SDKs are snippets of code embedded in websites or apps, both of which collect information about your activity.

Qualifications & exceptions

• "Other similar technologies" is open-ended, so the list is not stated to be complete.

Data Access & Collection · Context

Glossary: an IP Address is a number assigned to a device when connecting to the Internet

The Glossary defines an IP Address as a number assigned to a device when connecting to the Internet.

Supporting quotations

a number assigned to a device when connecting to the Internet.

Data Access & Collection · Context

Glossary: Online Information covers data from American Express and third-party websites and apps about its business

The Glossary defines Online Information as data or information collected on the American Express websites and apps, as well as on websites and apps of third parties, relating to topics about its business.

Supporting quotations

data or information collected on the American Express websites and apps as well as on websites and apps of third parties relating to topics about our business.

Not stated here

• The definition does not say which third-party websites and apps are meant, or what "topics about our business" covers.

Data Access & Collection · Context

Glossary: Other Information includes internal records such as card transactions, external data and offline information

The Glossary defines Other Information as American Express internal information (for example, card transaction data and customer call records), external data that financial companies use to process applications and complete transactions, and other online and offline information it collects from or about you.

Supporting quotations

American Express internal information (for example, Card transaction data and customer call records), external data that financial companies use to process applications and complete transactions, and other online and offline information we collect from or about you.

Qualifications & exceptions

• This is the information that Online Information may be combined with, as described in the use section.

Not stated here

• The definition does not say what the "other online and offline information" consists of.

Data Access & Collection · Context

Glossary: Personal Information is information that can identify a person, such as name, address, phone and email

The Glossary defines Personal Information as information that can identify a person, such as name, address, telephone number, and email address.

Supporting quotations

information that can identify a person, such as name, address, telephone number, and email address.

Qualifications & exceptions

• "Such as" introduces examples.

Not stated here

• The definition does not say whether the other items the statement says it collects online (for example IP address, device and browsing information, biometric data or mobile device location) count as Personal Information.

Data Access & Collection · Company commitment

Principles: collect only personal data that is needed, by lawful and fair means

The Principles say American Express will only collect personal data that is needed and by lawful and fair means.

Supporting quotations

We will only collect personal data that is needed and by lawful and fair means.