Privacy Statement

THE AMERICAN EXPRESS DATA PROTECTION & PRIVACY PRINCIPLES

1. COLLECTION

We will only collect personal data that is needed and by lawful and fair means. 

We collect information through Cookies and Similar Technologies when you use our online services or access online content.

A cookie is a small data file that a website transfers to your computer. Similar Technologies include clear GIFs, web beacons, and pixel tags, which are typically transparent images on websites. Cookies and Similar Technologies collect information about your device, operating system and web browser, as well as your use of the device, as described in more detail below.

The information we collect using Cookies and Similar Technologies may include information about:

• the device(s) you use (for example, the operating system or type of device you use to open electronic communications
  from us);
• information about your IP Address (for example, domain information, internet provider information and general geographic location);
• your use of our websites and apps (for example, what you search for on our websites and apps, the pages you view, how long you stay and how often you return);
• how you search for our websites or apps, which website or app you came from, and sometimes, whether you have visited a website of one of our business or commercial partners;
• which ads or online content from us and our business or commercial partners you view, access or click on; and
• whether you open our electronic communications and which sections you click on (for example, how many times you open an email from us).

In addition, if you use your mobile device to access our products or services, we may collect information about your mobile
device (for example, we collect location information to provide location-based content you request).

2. NOTICE AND PROCESSING

The information we collect from you via Cookies and Similar Technologies are for the purpose of helping the site remember information about your visit, which can make your experience better and more useful. Where it is not apparent from the products or services you require or the nature of your relationship with us, we will tell you how your personal data will be processed and which companies in the American Express Group are responsible for that processing. We will process your personal data fairly and only for those purposes we have told you, for purposes permitted by you or as permitted by applicable law. In addition, you may object to certain types of processing as expressly permitted by applicable law.

3. CHOICE

We give customers the option of having their personal data included or removed from lists used for marketing as required by applicable law. This includes product and service offers from American Express and those made in conjunction with our business partners. Of course each of our businesses will continue to send customers information about the products or services they receive from that business.

4. QUALITY

We use appropriate technology and well-defined employee practices to process your personal data promptly and accurately. We will not keep your personal data longer than is necessary, except as otherwise required by applicable law.

5. SECURITY AND CONFIDENTIALITY

We will keep your personal data confidential and limit access to your personal data to those who specifically need it to conduct their business activities, except as otherwise permitted by applicable law. We refer to industry standards and use reasonable administrative, technical and physical security measures to protect your personal data from unauthorised access, destruction, use, modification or disclosure. We require industry standard data security measures from those third parties who are authorized by us to process your personal data on our behalf.

6. DATA SHARING

We will only share your personal data with third parties, such as our bank partners in Macau where: (a) it is necessary for us to provide you with products or services or as part of the nature of our relationship with you, (b) we have previously informed or been authorized by you, in connection with our efforts to reduce fraud or criminal activity, or (c) as permitted by law.

7. OPENNESS AND DATA ACCESS

If you ask, we will inform you about how your personal data is processed and the rights and remedies you have under these Principles. You may inquire as to the nature of the personal data stored or processed about you by American Express. You will be provided access as is required by law in your country, regardless of the location of the data processing and storage. If any data is inaccurate or incomplete, you may request that the data be amended or erased. To exercise any of your rights, you may contact us by writing to the Data Protection Officer at the following address:

The Data Protection Officer

American Express International Inc. Hong Kong Branch

18/F, 12 Taikoo Wan Road, Hong Kong

8. INTERNATIONAL TRANSFER

Where it is not apparent from the international products or services you require or the nature of your relationship with us, we will inform you if your personal data may be transferred outside of your country and ensure that such transfer is only performed in accordance with applicable law. Regardless of where your personal data is transferred, your personal data is protected by these Principles.

9. RESPONSIBILITY

Each company in the American Express Group and their employees may only process your personal data in accordance with these Principles. We conduct training and reviews of our compliance with these Principles. Employees who violate these Principles may be subject to disciplinary action, up to and including dismissal. Employees are expected to report violation of these Principles, and may do so to their managers or HR managers, to their business unit's compliance officer, to the legal department, to the Privacy Office or to the company's Office of the Ombudsperson.

10. ACCOUNTABILITY

You may enforce these Principles in your country against any company in the American Express Group that is responsible for your personal data, as a third party contractual beneficiary to these Principles. If you have a complaint that we have breached these Principles and have attempted in good faith to resolve the complaint through our customer service process or employee complaints process, but the complaint was not resolved by us within a reasonable amount of time, then you may enforce these Principles against us. If you complain to your local data protection authority and the data protection authority finds that we have breached these Principles, we will abide by the findings of the data protection authority, but we reserve the right to challenge or appeal such findings. These Principles do not affect any rights you have under applicable law, the requirements of any applicable regulatory data protection authority, or any other type of agreement that you may have with us.

11. LANGUAGE

This privacy statement and principles are in English and Chinese. If there is a conflict between the English and Chinese versions, the English version shall prevail.