GBT Global Privacy Rules

We collect and use only personal information insofar that is necessary for the provision of our services and, where legally required, permitted by them, or permitted by law, and we do it lawfully and fairly. This means that we only process personal information if and to the extent we have a legal basis to do so.

Transparency

We ensure that we are transparent towards individuals whose personal information we process. This means that we make it clear via our GBT Global Privacy Statement how personal information will be processed and which GBT companies are responsible for the processing of personal information. Where we collect personal information from data subjects, we provide them with the information contained in our privacy statement, available at: https://privacy.amexgbt.com/statement and our employee and contractor privacy statements. These notices provide the information required by Articles 13 and 14 of the GDPR and other applicable laws.

In particular, we provide the data subject with all of the following information:

• the identity and the contact details of the data controller, and where applicable, the controller's representative and contact details of the data protection officer.
• the purposes of the processing for which the personal information is intended as well as the legal basis for the processing (see more information on legal basis below). Where the processing is based on the legitimate interest legal basis, a description of the legitimate interest pursued. Where the processing is based on consent, information about the data subject's right to withdraw consent and how to exercise such right.
• the recipients or categories of recipients of the personal information (if any) and whether the data controller intends to transfer personal data to a third country or international organisation and if so, the legal basis for such data transfer and information on how to receive or find a copy of the appropriate or suitable safeguards in place.
• the period for which the personal information will be stored, or if that is not possible, the criteria used to determine that period
• the existence of data subject rights and how to exercise those rights, including information about the right to lodge a complaint with a supervisory authority
• whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal information and the possible consequences of failure to provide such information
• the existence of automated decision-making, including profiling, and in those cases, meaningful information about the logic involved, the significance and the envisaged consequences of such processing for the data subject.
where the data controller intends to further process the personal data for a purpose other than that for which the personal data were collected or obtained, we inform the data subject in advance about that other purpose and provide the data subject with any of the above relevant further information concerning that further processing.

If the personal information was not obtained directly from the data subject, we also provide information about the categories of personal information concerned and from which source the personal information originate, and, if applicable, whether it came from publicly accessible sources.

Where the personal data is obtained directly from the data subject, we provide the above information at the time the data are obtained. Where the personal information is not obtained from the data subject directly, we provide the notice within a reasonable period after obtaining the personal information, but at the latest within one month, having regard to the specific circumstances of the processing. If the personal information is to be used for communication with the data subject, we provide the notice at the latest at the time of the first communication to the data subject, or if a disclosure to another recipient is envisaged, at the latest when the personal information is first disclosed.

Legal basis for processing

We use the following legal bases for the processing of the personal information at hand, depending on the circumstances and as further described in the privacy statements we provide during interactions with data subjects:

• The data subject has given consent to the processing of his or her data for one or more specified purposes
• The data subject has given consent to the processing of his or her data for one or more specified purposes
• Processing is necessary for the performance of a contract to the which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• Processing is necessary for compliance with a legal obligation to which GBT is subject
• Processing is necessary in order to protect the vital interests of the data subject or another natural person
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in GBT
• Processing is necessary for the purposes of legitimate interests pursued by GBT or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal information, particularly where the data subject is a child

In addition, we only process special or sensitive categories of personal information in compliance with the legal requirements and restrictions applicable, as further detailed above.

A list of GBT companies is attached in Appendix 2 and a more detailed description of the material scope of the data processing under the Rules is provided for in Appendix 1.

We keep personal information confidential and limit access to those who need it for the purposes we've made clear. We use appropriate administrative, technical and physical security measures to protect personal information against unlawful processing taking into account the principles of privacy by design and by default.

Where we pass personal information to other internal or external processors to process the personal information that we control on our behalf, we require them to enter into a data processing agreement that complies with the requirements of applicable law before the processing begins. The data processing agreement shall be binding on the processor with regard to GBT and set out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal information and categories of data subjects and the obligations and rights of GBT.

Moreover, data processing agreement stipulates, at minimum, that the processor:

• processes the personal information only on documented instructions from GBT, including with regard to transfers of personal information to a third country, unless required to do so by the laws of the European Union or a Member State to which the processor is subject;
• ensures that persons authorised to process the personal information have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk;
• taking into account the nature of the processing, assists GBT by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of GBT's obligation to respond to requests for exercising the data subject's rights laid down in the GDPR;
• assists GBT in ensuring compliance with the obligations under the GDPR;
• at the choice of GBT, deletes or returns all the personal information to GBT after the end of the provision of services relating to processing, and deletes existing copies unless required by law to which the processor is subject; and
• respects the conditions referred to above for engaging another processor.
• makes available to GBT all information necessary to demonstrate compliance with its obligations and allow for and contribute to audits, including inspections, conducted by GBT or another auditor mandated by the GBT.

The data processing agreement also requires the processor to notify us of any breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information transmitted, stored or otherwise processed (a personal information breach) by notifying our Security Operations Centre. All personal information breaches are handled in accordance with our incident response plan and assessed by the GBT privacy team.

Where we become aware of a personal information breach, we notify, without undue delay and in any case not later than 72 hours after having become aware of it, the personal information breach to the competent supervisory authority, unless the personal information breach is unlikely to result in a risk to the rights and freedoms of natural persons.

In addition to our internal notification obligation (on basis of our incident response plan) and our notification obligation to the competent supervisory authority, where the personal information breach is likely to result in a high risk to the rights and freedoms of data subjects, we communicate the personal information breach to the data subject without undue delay.

We keep a record of personal information breaches, comprising the facts relating to the personal information breach, its effects and remedial action taken. The record is made available to the supervisory authority on request, to enable it to verify compliance.

We respond promptly and accurately to individuals' requests in respect of their personal information, to understand how it is processed or to exercise other data protection rights regardless of where that personal information is processed and stored. Individuals have the right to:

• require us to receive confirmation whether or not their personal information is being processed, a copy of their personal information and receive the following information about the processing of that personal information:
  • the purposes of the processing;
  • the categories of personal information concerned;
  • the recipients or categories of recipients to whom the information is disclosed, in particular recipients located in a third country. If the third country is not recognized by the European Commission as ensuring an adequate level of protection, individuals shall have the right to be informed of the appropriate safeguards authorizing such transfers;
  • the envisaged period for which the personal information will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request rectification or erasure of personal information, or restriction of processing of personal information, or to object to such processing;
  • the right to lodge a complaint with a Supervisory Authority;
  • any available information as to the source of personal information which has not been collected from the individual; and
  • the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved in any automatic processing as well as the significance and the envisaged consequences of such processing for the individual.
• Without undue delay, require from us the rectification of personal information about them where it is inaccurate, taking into account the purposes of the processing, individuals have the right to have incomplete personal information completed, including by means of a supplementary statement;
• Without undue delay, require from us the erasure of the personal information where:
  • it is no longer necessary for the purpose for which was processed;
  • the legal basis for processing is consent, consent is withdrawn and there is no other legal basis for the processing;
  • the individual objects to processing, including profiling undertaken on the basis of legitimate interests of the controller or a third party and there are no overriding legitimate grounds for the processing;
  • the individual objects to processing, including profiling, for direct marketing purposes;
  • the personal information has been unlawfully processed;
  • the personal information has to be erased to comply with EU Member State law to which GBT is subject; or
  • personal information has been collected in relation to the offer of information society services to children.
• Require us to restrict the processing of their personal information where:
  • the accuracy of the personal information is disputed for a period enabling GBT to verify the accuracy of the personal information;
  • the processing is unlawful and the individual opposes the erasure of the personal information and requests restriction instead;
  • GBT no longer needs the personal information, but it is required by the individual for the establishment, exercise or defence of legal claims; or
  • the individual has objected to processing including profiling undertaken on the basis of legitimate interests of the controller or a third party, pending verification that there are no overriding legitimate grounds for the processing.
• Receive his or her personal information in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from GBT, where:
  • personal information is processed based on consent or on a contract with the individual; or
  • the processing is carried out by automated means.
• Grant their objection to processing, including profiling:
  • based on GBT’s legitimate interests, unless GBT can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the individual or for the establishment, exercise or defence of legal claims, to the processing, including profiling of personal information for direct marketing purposes;
  • based on public interests or official authority that may be vested in GBT; or
  • for direct marketing purposes, which includes profiling related to such direct marketing.
• Not be subject to a decision based solely on automated processing including profiling, which produces legal effects concerning him or her or significantly affects him or her, unless the decision:
  • is necessary for entering into, or performing a contract between GBT and the individual;
  • is authorised by applicable EU Member State law; or
  • is based on the individual’s explicit consent.
  Where such decision is necessary for entering into, or performing, a contract between GBT and the individual or based on the individual's consent, we implement suitable measures to safeguard the individual's rights and freedoms and legitimate interests, at least the right to obtain human intervention on GBT's part, to express the individual's point of view and to contest the decision. Furthermore, automated individual decision-making, including profiling, is not based on special categories of personal information referred to in Article 9(1) of the GDPR, unless (a) the individual has given explicit consent to the processing of those personal information for one or more specified purposes (except where EU or Member State law provide that the prohibition for processing special categories of personal information may not be lifted by the data subject), or (b) the processing is necessary for reasons of substantial public interest, on the basis of EU or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the individual, and - in each case - GBT ensures that suitable measures to safeguard the individual's rights and freedoms and legitimate interests are in place.

No matter where we process and store personal information, it continues to be protected by these principles. We make it clear when personal information is transferred out of the country, and we make sure such transfers are compliant with law and apply appropriate safeguards to any onward transfers to third parties outside the EEA. This means that we only transfer personal information outside the EEA:

• where the recipient is located in a country whose laws have been deemed by the EU Commission to offer adequate protection to the privacy of data subjects (Article 45 of the GDPR); or
• where we are transferring the personal information to one of the GBT companies that is bound by these Rules (Article 47 of the GDPR), or in the case of vendors and travel suppliers, subject to standard data protection clauses adopted by the EU Commission (Article 46 (d) of the GDPR); or
• in the case of travel suppliers such as hotels or airlines, where ad hoc, non-systematic transfers are made, subject to either the explicit consent of the data subject, or the derogation in Article 49 (1) b of the GDPR: that the transfer is necessary for the performance of a contract between the data subject and GBT or the derogation in Article 49 (1) c of the GDPR: the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between GBT and the client; or
• in any other circumstances, a valid ground is available under Article 48 of the GDPR or an applicable derogation applies subject to Article 49 of the GDPR.

In addition to the foregoing, we take into account the level of protection of personal information data in the country or territory to which personal information subject to the GDPR is transferred or onward transferred - regardless of the legal basis of the transfer under the GDPR - and take supplementary measures appropriate to safeguard that personal information transferred benefits from a level of protection equivalent to the standards applicable to it under EU law. We do not transfer personal information subject to countries or territories outside the EU which we believe do not, even with supplementary measures, offer an adequate level of protection.

In more detail, we abide by the following:

The parties involved in the data transfer, i.e. the data exporter (i.e. the party providing (access to) the personal information) and the data importer (i.e. the party receiving (access to) the personal information), shall warrant that they have no reason to believe that the laws and practices in the country or territory of destination applicable to the processing of the personal information by the data importer, including any requirements to disclose personal information or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Rules. This based on the data importer's and data exporter's understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of the GDPR, are not in contradiction with these Rules.

Assessment of level of protection of personal information transferred To establish this, the data exporter and the data importer make an assessment of the level of protection of personal information in the country or territory to which personal information is transferred, and take supplementary measures appropriate to safeguard that personal information transferred benefits from a level of protection equivalent to the standards applicable to it under EU law. In this assessment, all relevant circumstances are taken into account, including in particular:

• The specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal information; the economic sector in which the transfer occurs and the storage location of the data transferred.
• The laws and practices of the third country of destination (including those requiring the disclosure of data to public authorities or authorising access by such authorities) relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards. This includes for example the existence of data protection and privacy laws, regulations and supervision of such laws in the country concerned, and the powers of local authorities to gain access to the personal information processed in the country.
• Any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Rules, including measures applied during transmission and to the processing of the personal Information in the country of destination.

The data importer further warrants that, in carrying out this assessment, it has made its best efforts to provide the data exporter with all relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Rules.

The assessment is documented and made available to the competent supervisory authority upon request.

Notification of public authority access
The data importer notifies the data exporter promptly, for as long as the transfer takes place, if it has reason to believe that it is or has become subject to laws or practices not in line with the applicable requirements (as above), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with these requirements. In case the data importer and the data exporter are data processors within the meaning of the GDPR, the data exporter forwards the notification from the data importer to the controller.

Following the receipt of such notification, or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Rules, the data exporter promptly identifies appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. In case the data importer and the data exporter are data processors within the meaning of the GDPR, the data exporter does so in consultation with the controller.

Information duties
In addition, the data importer promptly notifies the data exporter if it receives a legally binding request to disclose transferred personal information from, or becomes aware of direct access thereto by, a public or judicial authority in the country of destination, unless the data importer is legally prohibited from notifying the data exporter in which case it uses its best efforts to obtain a waiver of the prohibition. The data importer agrees to review the legality of such disclosure requests or direct access, and make use of any opportunity to suspend, challenge, object or appeal it if it concludes that there are reasonable grounds to consider that the request or access is unlawful. The data importer provides the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request. The data importer adequately documents and preserve all relevant information pertaining to authority disclosure and access of transferred personal information with a view to communicating to the data exporter as much information as possible, as soon as possible.

Suspension and termination of the transfer
The data exporter suspends the data transfer if it considers that no appropriate safeguards for the transfer can be ensured, or if instructed by the data controller (where applicable) or by the competent supervisory authority to do so. In case the data transferred is subject to a contract (e.g. standard data protection clauses between the data exporter and the data importer), the data exporter is entitled to terminate the contract, insofar as it concerns the processing of personal information under such contract. If such contract involves more than two parties, the data exporter may exercise this right to termination only with respect to the relevant party, unless the parties have agreed otherwise.

Effect of termination
In case of such termination, personal information that has been transferred prior to the termination of the contract is, at the choice of the data exporter, immediately returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data.

In case the data exporter is a data processor and the data importer is a data controller within the meaning of the GDPR, personal information collected by the data exporter in the EU that has been transferred prior to the termination of the contract is immediately deleted in its entirety, including any copy thereof. The data importer certifies the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer continues to ensure compliance with these Rules. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal information, the data importer warrants that it will continue to ensure compliance with these Rules and only process the data to the extent and for as long as required under that local law.

We have appointed a Chief Privacy Officer to head the Global Privacy Team. The global privacy team plays a formal oversight role in business activities impacting personal information, including product development, vendor onboarding, marketing reviews and data governance decisions. Contact details of the Global Privacy Team are provided below.

Where required by EU or Member State law, we also have a formally appointed Data Protection Officer ("DPO") who monitors compliance with these Rules and is responsible for administering training and complaints. Contact details of the DPO are provided in the GBT Global Privacy Statement (at http://privacy.amexgbt.com/statement )

We apply effective measures to monitor and enforce compliance all aspects of these Rules and our data protection obligations, including methods of ensuring that corrective actions take place. This includes:

• Regular formal assessments to identify strategic and operational privacy risks. Annual documented planning based on the output of these assessments, adjusted through the year;
• Proactive testing, monitoring and reporting of risk and control metrics designed to identify potential gaps, trends or increasing risk areas that may require new or improved processes;
• Periodic review by GBT's Internal Audit Function, on average on a biennial basis (but no less than every three years); and
• An Annual Privacy Risk Management Report.

Results are reported to the Chief Risk & Compliance Officer, Chief Privacy Officer, and/or DPO and shared with the Board and are shared with supervisory authorities on request.

We keep a record of processing activities carried out under our responsibility. The record is made available to the supervisory authority on request, to enable it to verify compliance. That record contains all of the following information:

• the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;
• the purposes of the processing;
• a description of the categories of data subjects and of the categories of personal information;
• the categories of recipients to whom the personal information have been or will be disclosed including recipients in third countries or international organisations;
• where applicable, transfers of personal information to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1) of the GDPR, the documentation of suitable safeguards; and
• where possible, the envisaged time limits for erasure of the different categories of data; and
• where possible, a general description of the technical and organisational security measures taken.

• Customer data: To perform travel-related services, GBT must process personal information relating to the traveller, including his/her name, address, phone, email, nationality, age, passport details, dietary preferences and details of any disability which may affect his/her ability to travel etc. and potentially emergency contact details. Traveller data is also used to provide event management services as part of performance of the GBT Meetings & Events service or, on an aggregated basis, to advise how to structure a customer's travel management policy and reduce company travel costs, as part of the GBT consultancy service. That information must be transferred around the world to wherever travellers wish to go.
• Employee data: GBT employs and retains many employees, directors, individual consultants, contingent workers and staff. The nature of the data covered by the BCRs are all the human resource records and information that relate to former, current and prospective employees, directors, individual consultants, contingent workers, retirees, job applicants as well as any data given to GBT by such persons relating to third parties, for example dependants, and beneficiaries under employees' life insurance policies or for their emergency contacts. 
• Service provider data: GBT contracts various service providers in the course of business. During service provider review, GBT receives basic information for contact purposes, including name, business email and business phone. If determined that the provider has anti-corruption or sanctions risk, information about the service provider's beneficial owner(s) is required to perform proper screening activities. 

• Customer data: Customer data that originates within the EEA and UK will in most cases flow to GBT entities located in the EEA and UK to be stored in GBT or third-party data centres located in the EEA, the UK, and the US. Where GBT receives data in a data feed directly from its customers. EEA and UK customers sign a contract with a local GBT entity in one of GBT's proprietary markets, and so this initial data feed occurs within the EEA and / or UK. Travellers then use the shell profile created by this initial data feed to create their traveller profile, which is stored in databases operated by the providers of online booking tools and by the independent global distribution system ("GDS") in use in that region. The traveller profile is also synced back to GBT servers to provide consistent servicing to travellers across tools and GDSs, and can then be accessed by GBT entities in other countries where travellers choose to travel. The GDSs are subject to the EU Code of Conduct on the use of computerised reservation systems and are regulated as data controllers. 

• Employee data: GBT receives employee data from employees located in every proprietary country where it operates. This data is transferred to central HR operations based on a Workday-operated database maintained in the US and accessed by HR employees in the country of employment, in the UK and in the US. Information in corporate directories and other business applications is available across the GBT global footprint. Employee information is also shared with parties who carry out IT system support, payroll, training, compliance, ethics helpline administration, organisational programs and other activities on GBT's behalf. 
• Service provider data: Service provider data relate to employees or owners of service providers located anywhere in the world where our services are provided. They are processed and stored centrally in the US in databases internally housed within GBT or in databases associated with our e-GRC tool provided by a service provider in the US. 

• To provide GBT's products and services, including:
• 1. to book travel, organise meetings and events, prepare itineraries and invoices, communicate with travellers about products and services, provide customer service, manage customers' accounts, and provide travellers and their employers with emergency services; and
  2. to provide travel, meetings and events, consulting, business insights, and other related services to travellers' employers or travel sponsors, to comply with GBT's agreements with them, to communicate about GBT products and services, and to help travellers' employers or travel sponsors ensure compliance with their policies.
  3. To market goods and services to prospective customers;
  4. To process payments and transactions and provide related customer service;
  5. To operate websites and mobile applications, including using device data to monitor and improve the performance and content of services, provide updates, analyse trends and usage in connection with services, and measure whether ads and offers are effective; and
  6. To operate and improve GBT's business, using travellers' information for compliance with GBT company policies and procedures; for accounting and financial purposes; to detect or prevent fraud or criminal activity; to perform, analyse and improve GBT's business and services; and otherwise as required by law. 

• Administration of employment contracts, payroll and employee benefits, including insurance and pensions;
• Compliance with employment-related legal requirements such as income tax, national insurance deduction and employment and immigration laws and responding to requests and legal demands from regulators or other authorities;
• Administration of the workforce, including training and development, evaluation, rewards, assigning tasks, managing activities, planning, travel and expenses;
• Implementing and maintaining IT systems, including providing IT support, ensuring business continuity, and managing security services and IT access rights and administration of GBT's ethics helpline;
• Verification of the personal information related to former employment, educational history, and professional standing, and completion of background checks;
• Administering health and safety programmes and policies and corporate resource planning; and
• Monitoring GBT's premises and property. 
• Post-transfer processing: The personal information transferred will be processed for the administration of human resources functions and the maintenance of GBT's workforce and may be further processed by third party service providers who provide payroll services, health and other insurance, and other benefits to employees.

• “Data Protection and Privacy Principles” under the heading “Data Subject Rights” 
• “Rights Granted to Individuals.  
• Information about the means to exercise those rights is set out in the section “Questions, Complaints or Concerns”.

• www.justice.gov.uk (England and Wales)
• www.scotcourts.gov.uk (Scotland)
• www.courtsni.gov.uk (Northern Ireland)