1

American Express® (American Express Services Europe Ltd.) is committed to protecting your privacy. For the contact details of our Data Protection Ocer

please see the “Query or Complaint” section.

In this Cardmember Privacy Statement we describe how American Express, in its capacity as controller, collects, uses, shares, and keeps Personal

Information about you in accordance with the Data Protection Act 2018 and the UK General Data Protection Regulation when you request our products or

services and we explain the choices that are available to you. This Cardmember Privacy Statement includes specic details about how we use information

tied to your card and related services.

If you interact with us online, there is a separate Online Privacy Statement available on the American Express Privacy Centre at americanexpress.co.uk

that describes how we collect, use, share and keep Personal Information about you in that context. It is not specic to our products or services. It applies

From time to time, we may change this privacy statement. If it’s a material change we will need to tell you about it. We’ll either do that by contacting you in

writing (to ask you to read the updated version) or by making it clear when you visit our website, americanexpress.co.uk, that it’s been updated.

INFORMATION COLLECTED

Personal Information is any information relating to you as an identied or identiable natural person, such as your name, addresses, telephone number,

and email address and other information specic to you such as demographic details, employment details, your income and/or transaction information.

We will only collect Personal Information that is reasonably necessary for our business. The types of information we collect will depend on which product

or service you request or use.

We collect your Personal Information from dierent sources depending on which product or service you request or use. For instance, we collect Personal

Information about you from:

• the application form for a card account and other information you directly provide to us;

• any research, surveys or competitions you enter or respond to or any marketing oers for which you register; and

CARDMEMBER PRIVACY STATEMENT

WHAT IS THIS DOCUMENT?

2

• third parties, such as marketing lists which we lawfully obtain from Business Partners (i.e., third parties with whom we conduct business or have

a contractual relationship, such as co-brand partners or merchants), or information we receive from open banking providers (such as account

information that you authorise such providers to collect from your bank, which is subsequently shared with American Express for the purpose of

completing our underwriting verications to issue you with a card).

In some limited instances and in accordance with applicable laws, we may also collect special categories of Personal Information, including information

regarding health (such as food allergies or details of a disability or condition which may aect your ability to travel or the way we manage your account), or

such as to prevent fraud, enhance our products or services and for certain marketing communications (including when we give an opt-out opportunity); (iii)

where we have obtained your consent, such as for marketing purposes when you opt-in; or (iv) for compliance with legal obligations, such as for the due

diligence that nancial institutions are required to perform before approving card accounts. Please note that we consider and balance any potential impact

on you and your rights before processing your Personal Information for our legitimate interest.

More specically, we use your Personal Information:

(i) To administer our contractual relationship with you and deliver products and services, including to:

• process applications for our products, including making decisions about whether to approve your application;

• administer and manage your account, such as whether to process, approve and complete individual transactions;

• provide location-based services you may request;

• communicate with you through email, SMS or any other electronic methods, by post and/or phone about your accounts, products, and services;

if you call us)), if you are an existing or potential customer. We would do this only where the law allows for this on the basis of opt-out;

• advertise and market products and services for the American Express Group (i.e., any aliate, subsidiary, joint venture, and any company owned or

controlled by American Express) and our Business Partners, including to present content that is personalised and tailored to your preferences and

interests, including targeted advertising across multiple devices or showing you oers in your Manage Your Card Account (MYCA) environment;

• improve your customer experience, for instance:

• when interacting with some of our partners available in your card benets programme, we may connect to your Membership Rewards account

• when you set up a recurring payment with merchants accepting our cards, we may disclose your Personal Information (such as your card

• help us better understand your nancial circumstances and behaviour so that we can make decisions about how we manage your existing

• analyse whether our ads, promotions and oers are eective;

• monitor and/or record your telephone calls with us or our Service Providers to ensure consistent servicing levels (including sta training) and

• conduct research and analysis, including to:

• allow you to give feedback by rating and reviewing our products and services and those of our Business Partners;

• produce data analytics, statistical research, and reports on an aggregated basis;

• manage our business risks such as fraud, credit, operational, regulatory, reputational and security risks (using automated processes and/or manual

reviews) including to:

• develop and rene our risk management policies, models and procedures for

• applications and customer accounts, relying upon information in your application or relating to your creditworthiness and account history (if

• inform our collection practices and share information with credit-reference agencies and fraud-management agencies (for more information,

(iii) With your consent (note you will always know when we are relying on your consent to use your personal data as we will ask you for opt-in permission

rst), to:

• market our products and services to you;

• send you ads, promotions, and oers by e-mail, SMS, or other electronic means about products and services from the American Express Group and

those of our Business Partners; or

• use special categories of information, such as your biometric data to identify you, your health data or life circumstances to provide a more

• to comply with legal and regulatory obligations (such as performing due diligence on you before approving your application).

OPEN BANKING

We may use your Personal Information to provide our open banking services, such as:

• providing you with consolidated information on the payment account(s) that you hold with one or more bank(s) or payment institution(s); or

• contacting your bank to perform a credit transfer to a merchant, for example, when you use our Pay With Bank Transfer service (which may allow

you to pay for any purchase made on a participating website directly from your bank account, with your money being sent directly to the merchant’s

bank account).

In this context, we will process your Personal Information to provide you with the regulated open banking services or as otherwise described in the “Use of

Information” section.

AUTOMATED DECISION MAKING

your application form (including your reported income), your payment history with American Express, and information we obtain from third parties, such as

credit bureaus. We also look at digital data (such as information about your device, browser, or patterns in your online interactions with American Express)

to help us detect fraud. These methods are regularly tested to ensure that they remain fair, eective and unbiased.

Some of those decisions that are made solely by automated means have legal eects or similar eects, such as the denial of credit or card applications or

receiving credit line approval. However, we will only perform such processing if it’s:

• necessary for entering into or performing a contract between you and American Express;

• authorized by a law to which American Express is subject and which also lays down suitable measures to safeguard your rights and freedoms and

legitimate interests; or

• based on your explicit consent to such processing.

Where we use automated decision making for entering into or performing a contract with you, or based on your consent, you have the right to contest the

information, please see the “Credit Reference Agencies and Fraud Prevention” section below);

• police, regulatory authorities, courts, and governmental agencies to comply with legal orders, legal or regulatory requirements, and law enforcement

requests;

• collecting agencies and external legal counsel to collect debts on your account;

• our Service Providers (i.e. who perform services for us and help us manage your account and/or operate our business (i.e., any vendor, third

party and/or company that provides services or performs business operations on our behalf such as communications services, marketing, data

4

processing and outsourced technology, servicing, ad management, auditors, consultants and professional advisors such as external legal counsel

and accountants);

• companies or other lines of products and services within the American Express Group;

• Business Partners, such as parties that accept American Express branded cards for payments of goods/services purchased by you (i.e.,

merchants), your bank, building society or other payment card issuers to provide, deliver, oer, customise or develop products and services to you,

and address or resolve claims. We will not share your contact information with Business Partners for them to independently market their own

products or services to you without your consent. However, we may send you oers on their behalf with your consent. Please note that if you take

advantage of an oer provided by a Business Partner and become their customer, they may independently send communications to you. In this

case, you will need to review their privacy statement and inform them separately if you wish to decline receiving future communications from them;

• we will use the information of a Supplementary Cardmember to process their application, issue their card, manage the account, and comply with

5

You are entitled to access your personal records held by credit and fraud prevention agencies. You can contact the CRAs currently operating in the UK; the

information they hold may not be the same so it is worth contacting them all.

• TransUnion, One Park Lane, Leeds, West Yorkshire, LS3 1EPor call 0330 024 7574 or email consumer@transunion.co.uk

• Equifax Limited, Customer Service Centre PO Box 10036, Leicester, LE3 4FSor call 0800 014 2955 or 0333 321 4043 or email 0333 321 4043

us/index.html

If we receive a request from you, we will respond as soon as possible but no later than one calendar month except as follows. If, due to the nature or

circumstances of your request, we can’t meet that deadline, we may extend it by up to a further two months (complex requests). In such case, we will send

you an email or letter explaining the cause of the delay. Please note that your request will be free of charge, except in certain circumstances if it incurs

additional cost to our company such as when it’s unfounded or excessive, i.e. when the law allows us to charge a fee (we’ll explain this at the time before

If you have any questions about how we process your Personal Information, you can contact us – please see the “Query or Complaint” section.

email, SMS and/or telephone. See above section for our lawful reasons which justify using your information to send you marketing communications. The

lawful reasons for sending direct marketing communications to you will dier depending on a number of factors, including the marketing channel used (e.g.

SMS, email, telephone), whether we have an existing relationship with you if you are an individual customer, or if you are a business customer.

If after making your preferences you wish to opt out of receiving marketing from the American Express Group, we recommend you go to americanexpress.

co.uk, log in, and update your privacy preferences. If you prefer, you can also contact us – please see the “Query or Complaint” section below. If you choose

to not receive marketing communications from us, we will honour your choice.

Please be aware that if you choose not to receive such communications, certain oers attached to the products or services you have chosen could be

aected.

We will still communicate with you in connection with servicing your account, fullling your requests, or administering any promotion or program in which

you have elected to participate. These communications are necessary to provide the service you expect to receive from us and you may not opt out of

contact the ICO directly at www.ico.org.uk. If your request is not resolved to your satisfaction, you may also take your case to the court where you live, work

or where there may have been an infringement.

American Express Services Europe Limited has its registered office at Belgrave House, 76 Buckingham Palace Road, London

SW1W 9AX, United Kingdom. It is registered in England and Wales with Company Number 1833139 and is authorised and

regulated by the Financial Conduct Authority. Where American Express Services Europe Limited Cards are issued in the UK

but obtained within the European Economic Area, local rules may apply to the way that it conducts its business which can be

enforced by that country's applicable regulatory authority.