Statement covers Amex websites and apps that link to it, not sites with their own statement
This online privacy statement applies to American Express websites and online apps (on smart phones, tablets and other devices) that link to it. It does not apply to American Express websites that have their own online privacy statements, and Resy.com is named as one of those. The statement describes how American Express and its Service Providers may collect, use, share and keep information obtained about you online.
Details
Who
American Express and its Service Providers
What it covers
American Express websites and apps that link to this statement
Exception
Websites with their own online privacy statements, including Resy.com
Supporting quotations
This online privacy statement applies to American Express websites and online applications ("apps") that run on smart phones, tablets, and other devices that link to this statement.
This online privacy statement does not apply to those American Express websites that have their own online privacy statements, including Resy.com.
may collect, use, share and keep information that we get about you online
Qualifications & exceptions
Defined terms such as Online Information, Service Providers, Personal Information and Other Information are explained in the Glossary at the end of the statement.
Not stated here
Which other American Express websites have their own online privacy statements is not listed in this text beyond the Resy.com example.
Products from other providers, and some products, have their own privacy notices
American Express says that for certain of its products or services it may give you specific additional details about how it will use your Personal Information in that context. If an American Express product or service is not provided by American Express (for example, a card issued by one of its partner banks), the statement tells you to review the relevant privacy notice for that product or service, or contact the provider about its privacy practices. For a Business Card, a later passage points to a separate Business Card Privacy Notice for additional information.
Details
What it covers
Products or services not provided by American Express, such as a card issued by a partner bank
What it does
Review the relevant privacy notice or contact the product provider
Supporting quotations
When we provide certain American Express products or services to you, we may give you specific additional details about how we will use your Personal Information in that context.
If you have an American Express product or service that is not provided by American Express (such as a card issued by one of our partner banks), please review the relevant privacy notice that covers such product or service or contact your product or service provider for information about their privacy practices.
If you have a Business Card, please review the
Qualifications & exceptions
The product-specific notices are linked from the statement but are not part of this text.
Not stated here
What the product-specific details or the Business Card Privacy Notice say is not supplied here, so this statement alone does not show how those products handle information.
Recruitment and employment information is governed by separate notices
Information that American Express collects during recruitment or employment processes is governed by separate notices, which it says will be provided to you before or when your Personal Information is collected in those contexts. This online privacy statement is not the notice for that information.
Details
What it covers
Information collected during recruitment or employment processes
Condition
Separate notices provided before or when the information is collected
Supporting quotations
Information that we collect during recruitment or employment processes at American Express is governed by separate notices, which will be provided to you before or when your Personal Information is collected in those contexts.
Not stated here
The separate recruitment and employment notices are not supplied in this text.
Version dated March 26, 2026; updates are shown by changing the Effective Date
This version of the statement shows an Effective Date of March 26, 2026. American Express may update it, recommends that you check the current version from time to time, and says that if it updates the statement it will change the "Effective Date" at the top of the page.
Details
When
Effective Date: March 26, 2026
What it does
American Express may update the statement and will change the Effective Date if it does
Supporting quotations
Effective Date: March 26, 2026
Since we may update this online privacy statement, we recommend that you check the current version available from time to time. If we make updates to this statement, we will change the “Effective Date” at the top of this page.
Not stated here
This passage does not say American Express will notify you directly of an update other than by changing the Effective Date.
Legal Rights & Agreement Rules · Permission or license
Other uses are allowed where required or permitted by law or with your consent
The list of uses ends with a general permission: American Express may use the information in other ways as required or permitted by law or with your consent.
Details
Condition
As required or permitted by law, or with your consent
Supporting quotations
use it in other ways as required or permitted by law or with your consent.
Not stated here
The statement does not say what other uses this covers.
Legal Rights & Agreement Rules · Context
The statement lists separate privacy notices for particular products; their text is not part of this document
Under a line saying that its Privacy Notices inform you what personal information is collected, reasons for sharing and how you can limit sharing, the statement lists notices to click for the product that applies: Consumer Products; American Express Business Card Privacy Notice; American Express Affiliate Sharing Notice; American Express Prepaid Cards; American Express Travelers Cheques; American Express Savings; MyCredit Guide; Travel & Lifestyle Services; CreditSecure; American Express Travel Insurance; and California Privacy Notice.
Details
What it covers
Product-specific privacy notices
Supporting quotations
Our Privacy Notices inform you of what personal information we collect, reasons we share information and how you can limit the sharing of your information. Click on the applicable product below to view associated privacy notice.
These notices are linked documents whose text is not supplied here, so this card cannot say what they cover or how they differ from this statement. The statement does not say which notice applies to which situation beyond "the applicable product".
Legal Rights & Agreement Rules · Context
Separate Data Protection and Privacy Principles, effective December 19, 2024, set a global standard for personal data
After the list of product notices, the page includes Data Protection and Privacy Principles marked "Effective: December 19, 2024". They set out how American Express Company and its wholly owned direct and indirect subsidiaries will collect, use, store, share, transmit, delete or otherwise process personal data, and say the same standard will be used by American Express globally. In the Principles, personal data means any information that relates to an identified or identifiable individual, and "you" means any individual customer or employee of American Express and any other individual whose personal data is processed.
Details
When
Effective: December 19, 2024
Who
American Express Company and its wholly owned direct and indirect subsidiaries
What it covers
Personal data of customers, employees and other individuals
Where
Used globally
Supporting quotations
Effective: December 19, 2024
The following Data Protection and Privacy Principles (“Principles”) set out the way that American Express Company and its wholly owned direct and indirect subsidiaries (“American Express”) will collect, use, store, share, transmit, delete or otherwise process (collectively “process”) your personal data. Personal data means any information that relates to an identified or identifiable individual. The standard of personal data protection set out in these Principles will be used by American Express globally,
Personal data means any information that relates to an identified or identifiable individual.
In these Principles, “you” and “your” means any individual customer or employee of American Express and any other individual whose personal data we process
Not stated here
The page does not say how the Principles relate to the online privacy statement above them (for example, which controls if they differ). The Principles carry their own date, separate from the statement's Effective Date of March 26, 2026.
Cross-references
contrast (model-proposed): Recruitment and employment information is governed by separate notices — The online statement says information collected during recruitment or employment is governed by separate notices. The Principles on the same page define "you" to include any customer or employee. The page does not say how the two statements fit together, so no exception or contradiction is claimed.
Legal Rights & Agreement Rules · Company commitment
Principles: group companies and employees may only process data under them, with training, reviews and discipline
The Principles say each company in the American Express Group and their employees may only process your personal data in accordance with the Principles. American Express says it conducts training and reviews of its compliance, that employees who violate the Principles may be subject to disciplinary action up to and including dismissal, and that employees are expected to report violations to their managers, compliance officer, the legal department, the Privacy Office or the Amex Ethics Hotline.
Details
Who
Each company in the American Express Group and their employees
What it does
Process personal data only in accordance with the Principles; train, review compliance, discipline violators
Supporting quotations
Each company in the American Express Group and their employees may only process your personal data in accordance with these Principles.
We conduct training and reviews of our compliance with these Principles.
Employees who violate these Principles may be subject to disciplinary action, up to and including dismissal.
Employees are expected to report violation of these Principles, and may do so to their managers, to their business unit's compliance officer, to the legal department, to the Privacy Office or to the
Not stated here
The results of training and compliance reviews are not described.
Legal Rights & Agreement Rules · User right or choice
Principles: you may enforce them against a responsible group company after an unresolved complaint
The Principles say you may enforce them in your country against any company in the American Express Group that is responsible for your personal data, as a third party contractual beneficiary. This applies if you have a complaint that American Express breached the Principles, you have attempted in good faith to resolve it through its customer service process, and it was not resolved within a reasonable amount of time. If you complain to your local data protection authority and the authority finds a breach, American Express says it will abide by the findings, but reserves the right to challenge or appeal them. The Principles say they do not affect any rights you have under applicable law, the requirements of any applicable regulatory data protection authority, or any other type of agreement you may have with American Express.
Details
Who
You, as a third party contractual beneficiary
Condition
Complaint unresolved by the customer service process within a reasonable amount of time
Exception
American Express reserves the right to challenge or appeal a data protection authority's findings
Supporting quotations
You may enforce these Principles in your country against any company in the American Express Group that is responsible for your personal data, as a third party contractual beneficiary to these Principles.
If you have a complaint that we have breached these Principles and have attempted in good faith to resolve the complaint through our customer service process, but the complaint was not resolved by us within a reasonable amount of time, then you may enforce these Principles against us.
If you complain to your local data protection authority and the data protection authority finds that we have breached these Principles, we will abide by the findings of the data protection authority, but we reserve the right to challenge or appeal such findings.
These Principles do not affect any rights you have under applicable law, the requirements of any applicable regulatory data protection authority, or any other type of agreement that you may have with us.
Qualifications & exceptions
Enforcement is conditioned on an unresolved complaint after a good-faith attempt through the customer service process and a reasonable amount of time.
Not stated here
"A reasonable amount of time" is not defined, and the passage does not say how enforcement works in practice or whether it is available in every country.
Legal Rights & Agreement Rules · Company commitment
Principles: binding on all Group companies, which may keep additional rules consistent with them
The Principles say they emphasize American Express's commitment to protect your personal data and are binding on all companies in the American Express Group. Each Group company that holds personal data may maintain its own additional rules and practices for particular products or services, consistent with the Principles. Questions or comments can be sent to American Express.
Details
What it covers
All companies in the American Express Group
Condition
Additional rules and practices must be consistent with the Principles
Supporting quotations
They are binding on all companies in the American Express Group
each company in the American Express Group that holds personal data may maintain its own additional rules and practices for particular products or services, consistent with these Principles.
If you have questions or comments about these Principles, please contact us at American Express.
Not stated here
The passage does not give a contact address or method for questions or comments, and does not say what the additional rules and practices are.
Legal Rights & Agreement Rules · Context
Glossary: "American Express" is the American Express Company; its Family includes affiliates and controlled companies
The Glossary defines "American Express" (we, our, us) as the American Express Company as identified at the beginning of the online privacy statement. It defines the American Express Family of Companies as any affiliate and subsidiary of, and any company owned or controlled by, the American Express Company.
Details
Who
American Express Company
What it covers
Family of Companies: affiliates, subsidiaries and companies owned or controlled by the American Express Company
Supporting quotations
American Express (we, our, us)
the American Express Company as identified at the beginning of this online privacy statement.
any affiliate and subsidiary of, and any company owned or controlled by, the American Express Company.
Not stated here
The beginning of the statement as saved here refers to "American Express" without naming the American Express Company as a legal entity, so the entity the Glossary points to is not separately identified in this text.