What is in this Online Recruitment Privacy Statement?

• What information does this Statement cover?
• Information We Collect
• Use of Information
• Cookies and Similar Technologies
• Automated Decision Making
• Disclosure of Information
• Aggregated and De-identified information
• Security and Retention
• Consent
• Your Rights
• Query or Complaint
• Glossary

What information does this Statement cover?

This online recruitment privacy statement describes how we (and our Service Providers) collect, use, share, and keep information that we get about you online. We gather Online Information if you:

Visit, use or apply on our recruitment sites or other platforms, such as social media platforms, that link to the American Express recruitment sites; or

• Receive or reply to electronic communications from us.

Information We Collect

Generally, you provide your Personal Information directly to us (or to our Service Providers). For example, you have to give us your name, email, mailing address, phone number, or date of birth when you:

• register for job notifications;
• create a profile by submitting your CV/resume; or
• apply for a job.

If you accept an employment offer from us, we will collect additional Personal Information from you during the onboarding process and throughout your employment with us.

Use of Information

We use the Personal Information you provide to us and, possibly, Online Information we collect about you, to follow up on your request. More specifically, we use your information to do the following:

• if you register for notifications, we may contact you with notifications and announcements about new jobs at American Express;
• if you submit your CV/resume
  • we may hold your resume and related Personal Information on file in accordance with our record retention schedule; and
  • review your online candidate profile from time to time to consider you for relevant job opportunities at American Express;
• to conduct research and analysis, including to better understand our job applicants and site visitors;
• to support our background screening process if you apply for employment and are subsequently offered a position, subject to applicable law and where appropriate (we will provide you with additional information before we do such a screening);
• in other ways as required by law such as to verify your employment eligibility; and
• to complete the legal and operational steps necessary to process your employment and onboarding if you accept an employment offer from American Express.

Please note that if you choose to provide us with your e-mail address or your mobile number, we will only use these to send you e-mails and/or SMS alerts about your recruitment inquiry, job application, to request additional details about your CV/resume, and send you job alerts, where you have enrolled in this service. If we send you emails, we will collect information about your interaction with our e-mail content, such as whether you can read graphic-rich html e-mails.

Cookies and Similar Technologies

We (and our Service Providers) collect information through Cookies and Similar Technologies. Most Cookies and Similar Technologies will only collect De-Identified Information such as how you arrive at our website or your general location. However, certain Cookies and Similar Technologies do collect Personal Information.

We (and our Service Providers) may collect information using Cookies and Similar Technologies about:

• the device you use to browse our sites (for example, we may collect information about the operating system or the browser version and the type of computer or mobile device);
• the IP Address and related information (such as domain information, your internet provider and general geographic location);
• browsing history on our site (such as what you search for, the pages you view, how long you stay, and how often you come back); and
• how you search for our site, from which sites you link to our site.

For more information about Cookies and Similar Technologies, please read About Cookies.

We (and our Service Providers) may also collect information made publicly available through third-party platforms (such as online social media platforms), through online databases or directories, or that is otherwise legitimately obtained.

The information we collect may be Personal Information, Aggregated Information or Anonymized Information. Aggregated Information or Anonymized Information does not identify you individually; it helps us to analyze patterns among groups of people.

Automated Decision Making

We may use fully automated processes to help us make certain decisions, including to evaluate certain aspects about you (for example, to identify relevant candidates for open positions based on job skills and resume details as part of our talent acquisition and recruitment process).

These decisions are based on Personal Information that we lawfully hold such as information that you provided in your job application. In addition, the methods we use to make such decisions are regularly tested to ensure that they remain fair, effective and unbiased.

Some of these decisions relying solely on automated means may have legal or similarly significant effects on you. However, we’ll only perform such processing if it’s:

• necessary for entering into or performing a contract between you and American Express;
• authorized by a law to which American Express is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• based on your explicit consent to such processing.

Please see the section “Your Rights” below for more information about your rights with respect to these types of automated decisions.

Disclosure of Information

We do not share Personal Information with anyone except as described below. We will share your Personal Information only with your express consent or as required or permitted by applicable law, such as:

• with regulatory authorities, courts, and governmental agencies to comply with legal orders, legal or regulatory requirements, and government requests;
• with our Service Providers, regulatory authorities, law enforcement and governmental agencies to detect and prevent fraud or criminal activity, and to protect the rights of American Express or others;
• within the American Express Family of Companies; and
• with our Service Providers who perform services for us and help us operate our business, including our recruitment processes.

Cross-Border Transfers of Personal Information

We may transfer your Personal Information outside Nigeria, such as to the United States (where our main operational data centers are located) to companies within the American Express Family of Companies or to our Service Providers throughout the world, for example, to search for suitable positions or to process your application. Regardless of where we process your information, we will take appropriate steps to ensure an adequate level of protection for your information in other countries outside Nigeria, including the United States, as stipulated under extant data protection laws in Nigeria.

For more information, please read the Data Protection and Privacy Principles, which are available on the privacy section of our website. When we share your Personal Information with third parties outside Nigeria, we include appropriate contractual protections in those agreements. In addition, we assess whether other technical and organizational measures are required for those transfers.

Aggregated and De-identified information

Aggregated Information or De-Identified Information does not identify you individually; it helps us to analyze patterns among groups of people. We share Aggregate Information or De-Identified Information for the same reasons as we might share Personal Information.

Security and Retention

We use organizational, administrative, technical, and physical security measures to protect your Personal Information against accidental or unlawful destruction, loss, misuse, alteration, unauthorized disclosure, or access. These measures include technological safeguards and appropriate access controls to files and facilities. We require Service Providers to safeguard Personal Information and only use your Personal Information for the purposes we specify.

We will keep your Personal Information only as long as we need to follow up on your request to register for job notifications, process your application, or inform you about future opportunities, or process your employment and onboarding if you accept an employment offer from American Express, unless we are required by law or regulation or for litigation and regulatory investigations to keep it. When your Personal Information is no longer necessary for our business, legal or regulatory needs, we will take reasonable steps to securely destroy such information or permanently de-identify it. For more information about American Express’ retention periods for Personal Information, please contact us.

Consent

Where processing is based on consent, American Express shall obtain directly the requisite consent of data subjects at the time of collection of Personal Data or through a third party processor. In this regard, American Express will ensure that the consent is freely given by the data subject and obtained without fraud, coercion or undue influence.

You can withdraw your consent at any time, but such withdrawal shall not affect the lawfulness of processing based on consent given prior to the withdrawal.

Your Rights

You have the right to access, update, and/or erase your Personal Information. You may also be entitled to restrict and/or object to the use of your Personal Information in the following ways:

• withdraw your consent for our use of your Personal Information at any time where our processing is based on your consent, including withdrawal of your request to be considered for job notifications or job applications at any time;
• be informed of and entitled to provide express consent prior to the processing of your Personal Information for purposes other than that which your Personal Information was collected;
• ask us to rectify any incorrect Personal Information;
• request for deletion of your Personal Information;
• restrict and/or object to the use/processing of your Personal Information;
• request a copy of the Personal Information we have about you;
• receive your Personal Information in a structured, commonly used and machine-readable format and/or transmit such data to another data controller;
• object to automated decision making, see provisions on automated decision making above for exceptions; and
• transmit/port your Personal Information.

Please note that if you decide to restrict and/or object to the processing of your Personal Information for recruitment purposes or if you withdraw your job application, we will not be able to further process your application or consider you for future opportunities at American Express.

If you want to exercise any of your rights, click here. If you have any questions about how we process your Personal Information, you can contact us – please see the “Query or Complaint” section.

If we receive a request from you, we will respond as soon as possible and where we are yet to act on your request, we shall inform you within one month of receipt of the request, of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority. Please note that your request will be free of charge, except in certain circumstances where such requests are manifestly unfounded or excessive.

Query or Complaint

If you have questions about this privacy statement or how your information is handled or wish to make a complaint or exercise other rights, you may contact RecruitmentOperationsServicing@aexp.com You also have the right to contact the Nigeria Data Protection Commission at. https://ndpc.gov.ng If your request is not resolved to your satisfaction, you may also take your case to the court where you live, work or where there may have been an infringement.

Glossary

Aggregated Information — data or information relating to multiple people which has been combined or aggregated such that individuals cannot be re-identified. Aggregated Information includes information that we create or compile from various sources, including certain data from Cookies and Similar Technologies.

American Express (we, our, us) — the American Express Company as identified at the beginning of this Online Recruitment Privacy Statement.

American Express Family of Companies — any affiliate and subsidiary of, and any company owned or controlled by, the American Express Company.

Anonymized Information — data or information that has been modified, encrypted, or removed to protect the privacy of individuals by eliminating or obscuring personally identifiable information or other identifying characteristics.

Cookies and Similar Technologies —a cookie is a small data file that a website transfers to your computer's hard drive. We place cookies when you visit our recruitment website. We use the term Cookies and Similar Technologies in this statement to refer to all technologies that collect information in this way. For further details of our use of cookies and how you disable them, click on Privacy Statement and American Express Cookie Preferences.

De-identified Information — data or information used in a way (for example, pseudonymized) that does not identify you to a third party. We often derive De-Identified Information from Personal Information. It includes information that we may collect from Cookies and Similar Technologies.

IP Address — a number assigned to a device when connecting to the Internet.

Online Information — data or information collected on the American Express sites and applications as well as on sites and applications of third parties relating to topics about our business, which may include Personal Information, Aggregated Information and De-Identified Information.

Personal Information — information that relates to an identified or identifiable natural person, including but not limited to a name, address, telephone number, email address, previous employment history and other information associated with that individual such as demographic details.

Service Providers — any vendor, third party and/or company that performs business operations on our behalf, such as recruitment, printing, mailing, and other communications services (email, direct mail, etc.), data processing, and outsourced technology, auditors, consultants, and professional advisors.