Online Privacy Statement and Disclosures

Retention & Deletion · Company commitment

Personal Information is securely destroyed or permanently de-identified when no longer needed, with reasonable steps

American Express says it takes reasonable steps to securely destroy or permanently de-identify Personal Information when it no longer needs it.

Supporting quotations

We take reasonable steps to securely destroy or permanently de-identify Personal Information when we no longer need it.

Qualifications & exceptions

• The commitment is to "reasonable steps", not to a guaranteed outcome or a fixed deadline.

Not stated here

• The statement does not say how American Express decides when it "no longer need[s]" the information, or give a time period.

Retention & Deletion · Company commitment

Online Information is kept only as long as must be to deliver products and services, unless law requires longer

American Express says it will keep your Online Information only as long as it must to deliver its products and services, unless it is required by law or regulation, or for litigation and regulatory investigations, to keep it.

Supporting quotations

We will keep your Online Information only as long as we must to deliver our products and services, unless we are required by law or regulation or for litigation and regulatory investigations to keep it.

Qualifications & exceptions

• This sentence is about Online Information; the passage does not state a separate retention rule for Other Information.
• The exceptions are legal or regulatory requirements and litigation and regulatory investigations.

Not stated here

• No specific retention period is stated. The passage does not say how this limit relates to the other uses of Online Information listed in the use section, such as advertising, research and fraud management.

Cross-references

• contrast (model-proposed): Principles: process data promptly and accurately and keep it no longer than necessary, unless law requires — The online statement keeps Online Information only as long as it must to deliver products and services, with legal and litigation exceptions. The Principles say personal data is not kept longer than necessary, except as required by applicable law. The wording differs and neither gives a period; the page does not say which governs online data.

Retention & Deletion · Company commitment

Principles: process data promptly and accurately and keep it no longer than necessary, unless law requires

The Principles say American Express uses appropriate technology and well-defined employee practices to process personal data promptly and accurately, and will not keep personal data longer than is necessary, except as otherwise required by applicable law.

Supporting quotations

We use appropriate technology and well-defined employee practices to process your personal data promptly and accurately. We will not keep your personal data longer than is necessary, except as otherwise required by applicable law.

Not stated here

• No retention period is given, and the Principles do not say who decides what is "necessary".

Cross-references

• contrast (model-proposed): Online Information is kept only as long as must be to deliver products and services, unless law requires longer — The online statement keeps Online Information only as long as it must to deliver products and services, with legal and litigation exceptions. The Principles say personal data is not kept longer than necessary, except as required by applicable law. The wording differs and neither gives a period; the page does not say which governs online data.