Privacy Policy for American Airlines Team Members

Purpose

This Privacy Policy is applicable to all former and current team members (together, “employees” or “you”) of American Airlines, Inc. (“we”, “us”, “our”, or “American”) and certain of its affiliates. This Privacy Policy applies to our employees globally and therefore provides a global overview of how and why American will use employees’ personal information. It will be supplemented from time to time by more detailed information which will be provided to employees locally, for example at the point of collection of their data for a specific purpose.

We take your privacy seriously because we know you do. This Privacy Policy will help answer your questions about how we collect, use, share, and maintain the confidentiality, availability, integrity and security of our employees’ personal information.

This Privacy Policy applies to employees’ personal information and to the management of that personal information in any form, whether oral, electronic, or written. This Privacy Policy is not a contract and American reserves the right to change it at any time and will notify employees of any material changes.

We are providing this Privacy Policy to help you better understand the following:

• Collection of Your Personal Information
• Sources
• Sensitive Personal Information
• Information about Criminal Convictions
• Use of Your Personal Information
• Monitoring
• Change of Purpose
• How Your Information Will Be Secured
• With Whom Your Information Will Be Shared
• International Data Transfers
• Application of Local Laws
• Voluntary or Mandatory Provision?
• Your Rights with Respect to Your Personal Information
• Right to Object
• Additional Rights
• Contact Details
• Effective Date

Collection of Your Personal Information

The types of personal information that American may, where applicable and where permitted in accordance with applicable laws and regulations, collect and maintain as part of your employment with American, include:

• Contact and personal information - including name, gender, ethnicity (if volunteered or where necessary to comply with legal obligations, such as for diversity purposes), nationality/citizenship, home address and telephone number and other contact details, date of birth, disability status, marital status and dependents, emergency contacts;
• Recruitment/separation information - including any information shared in the application process - residency and work permit status, military status, national identification, drivers’ license and passport information, references and other curriculum vitae information, date of resignation or termination, reason for resignation or termination, information relating to administering termination of employment;
• Financial information - taxpayer identification number(s) such as a social security number, banking details including credit and debit card information;
• Benefits distribution information - sick pay, pensions, insurance and other incentives and benefits information (including the gender, age, marital status, nationality and passport information for any spouse, guest travelers, minor children or other eligible dependents and beneficiaries);
• Career and job performance information - employee ID number, job title, job grade and function, date of hire, date(s) of promotions(s), work history, hours worked, work location, direct manager/supervisor information, technical skills, educational background, professional certifications and registrations, language capabilities, training courses attended and training assessment, records of work absences, vacation entitlement and requests, salary information (history and expectations), performance appraisals/evaluations, letters of appreciation and commendation, disciplinary and grievance procedures (including monitoring compliance with and enforcing American policies), employee complaints;
• Health-related information - height, weight, clothing sizes, photographs, symptoms, physical limitations and special needs;
• Background check information where permitted by law and proportionate in view of the function to be carried out by an employee or prospective employee - the results of credit and criminal background checks, the results of drug and alcohol testing, screening, health certifications, medical records and reports, information on accidents at work, vehicle registration, driving history;
• Compliance information as required to comply with laws, including the requests and directions of law enforcement authorities or court orders (child support and debt payment information) and acknowledgements regarding American policies; and
• Automatically collected information – information captured on security systems, including CCTV and key card entry systems, video recordings of company events and activities, voicemails, e-mails, correspondence and other work product and communications created, stored or transmitted by an employee using American’s computer or communications equipment, use of American’s computer equipment and company issued mobile devices, including Internet browsing history, mobile app usage, and precise geo-location.

Sources

Most of the personal information we collect and process is information that you knowingly provide to us, for example during the onboarding process or during your employment. It may also include information about you that we may receive from a third party, such as references from former employers, recruiters, personal references, and benefit providers.

Sensitive Personal Information

“Sensitive personal information” includes any information about an employee that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation or information concerning a person’s sex life, genetic and biometric data, and health information.

To the extent that any of the personal information we collect constitutes special categories of personal information, American will collect and process this information within the limits provided for relevant, applicable law, and only after establishing appropriate security safeguards for it. Where required by law, American will seek the explicit written consent of employees before processing special categories of personal information. We may process special categories of personal information in the following additional circumstances:

• Where we need to in order to carry out our legal obligations;
• Where it is needed in the public interest, such as for equal opportunities monitoring or in relation to our occupational pension scheme; or
• Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.

We may use this type of data, where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s) and where you are not capable of giving consent, or where you have already made the information public.

We will also use sensitive personal data to carry out our obligations in connection with your employment as set out below:

• Information relating to leaves of absence, which may include sickness absence or family related leaves, to comply with employment and other laws;
• Information about your physical or mental health or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits;
• Information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sex life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting;
• Trade union membership information to pay trade union premiums, register the status of a protected employee and to comply with employment law obligations.

Information about Criminal Convictions

We may only use information relating to criminal convictions where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and in accordance with our policies.

We may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s) and you are not capable of giving your consent, or where you have already made the information public.

Use of Your Personal Information

We need all of the categories of information in the list above (Collection of Your Personal Information) primarily to allow us to perform our contract with you (designated by “*”) or to enable us to comply with our legal obligations (designated by “**”). In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties (designated by “***”), provided your interests and fundamental rights do not override those interests.

The purposes for which American may process your personal information include, without limitation, those set out in the list below. For those employees based in the European Union, Switzerland and any other jurisdiction which legally requires us to specify the purposes for which we process personal information, we have used asterisks to indicate the purpose or purposes (referred to in the preceding paragraph) for which we may process your personal information.

• Facilitate internal applications: evaluate applications for employment opportunities within American*** - visa status/right to work in the jurisdiction** and background checks, where appropriate***;
• Internal employee management: manage all aspects of an employee’s employment relationship - including without limitation payroll, benefits, incentives, compensation, corporate travel and other reimbursable expenses, development and training, absence monitoring, timekeeping, performance appraisal, disciplinary and grievance processes, administration of termination of employment, resource planning and allocation, talent management, succession planning and other general administrative and human resource related processes*;
• Career planning: resource planning and allocation, talent management, succession planning***;
• Business travel, relocation, transfers and cross-border programs: coordinate global employee programs, international moves and cross-border team work and project management*;
• Compensation and benefits management: coordinate compensation and maintain medical and sickness records and occupational health programs - emergency contact and beneficiary details (which involves American holding information of those you nominate in this respect)*;
• Security management: protect the safety and security of American customers, staff and property (including controlling and facilitating access to and monitoring activity in secured premises and activity using American computers, communications and other resources), investigate and respond to claims against American and its customers and employees, including any internal complaints**;
• Corporate communications: to communicate with internal and external audiences (e.g., conduct employee surveys, administer employee recognition programs and promotions and diversity programs)*; and
• Compliance requirements: comply with applicable laws (e.g., health and safety), including judicial or administrative orders regarding individual employees (e.g., garnishments, child support payments)**.

Some of the grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

There are Closed Circuit Television (CCTV) cameras in operation within and around our stations and other premises, which are used for the following purposes:

• to prevent and detect crime**;
• to protect the health and safety of American customers and employees**;
• to manage and protect American’s property and the property of American’s guests and other visitors***; and
• for quality assurance purposes***.

Monitoring

To the extent permitted by law, we also monitor employees’ use of American information technology (IT) systems, the use of American’s resources, and communications, including without limitation internet use, in accordance with the Security Policy (available on Jetnet), and any other applicable policies that may replace, amend or supplement those policies from time to time ***.

As a result, within the limits provided for by relevant, applicable law employees should not have an expectation of complete privacy while at work or while using or accessing company equipment, information, computer, or communication systems, as those systems may be accessed at any time in accordance with our monitoring policies.

Change of Purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How Your Information Will Be Secured

American is committed to protecting the security of your personal information. Whenever and wherever we collect, process or use personal information, we apply appropriate technical, physical and administrative safeguards and access restrictions to secure that information in accordance with this Privacy Policy in order to prevent unauthorized access and use, unlawful processing, unauthorized or accidental loss, destruction, or damage to that information. For further information, contact the Information Security Officer aa.it.security@aa.com.

American will generally retain personal data in accordance with our data retention and schedules (available on Jetnet).

With Whom Your Information Will Be Shared

In order to carry out the purposes set forth above, your information will be disclosed to the appropriate personnel within American, including without limitation human resources and payroll/accounting staff, and managers as well as American’s affiliates, consultants and other advisers or persons when necessary. This includes disclosure of personal information to or for:

• Our Agents, Services Providers and Suppliers: From time to time, we outsource the processing of certain functions and/or information to third parties. For example, we use an employee management platform called Success Factors which is hosted by SAP in the US as a platform to store employee data and manage your employee profile so when you apply online for an internal employment position with American for example, you will be directed to Success Factors. Further information will be provided about service providers who have access to your personal data locally from time to time.
• When we outsource the processing of your personal information to third parties or provide your personal information to third party service providers, we take reasonable measures, such as implementing contractual controls, to endeavor to provide that those third parties safeguard your personal information with appropriate security measures and prohibit them from using your personal information for their own purposes or from disclosing your personal information to other third parties.
• Business Transitions: In the event we undergo a business transition involving another company, such as a merger, corporate reorganization, acquisition, the sale of all or a portion of our assets, or in the event of bankruptcy, information that we have collected from or about you may be disclosed to such other entities as part of the due diligence or business integration process and will be transferred to such entity as one of the transferred assets.*** For internationally based employees, the personal information disclosed will vary based on local labor laws. Please contact your local human resources representative for country specifics.
• Legal and Regulatory Requirements: To the extent required by relevant, applicable law or regulation, we may be obligated to disclose personal information to government authorities, or to third parties pursuant to a subpoena or other legal process and we may also use or disclose your personal information as permitted by law to protect the rights or property of American, our customers, our employees, our services, or its users. ** Such information may be disclosed to:
• Protect your or American’s legal claims and interests
• Defend against potential or actual litigation
• Abide by applicable law, regulation or contracts
• Respond to a court order, governmental administrative or judicial process, including but not limited to, a subpoena or search warrant
• Comply with American’s obligations where it is registered with any governmental agency

International Data Transfers

Please note that personal information submitted to us may be transferred to, stored and processed on servers located in various countries around the world, including when it is used as set out in this Privacy Policy by American in the United States of America, in accordance with applicable laws and regulations.

This may include transfers to American’s affiliates and to third parties with whom we share personal information, as described in this Privacy Policy. The laws of those countries might not be equivalent to those in your country of residence, but please be assured that we take reasonable steps to protect your privacy, such as by implementing contractual controls such as American’s EU Standard Contractual Clauses which American has entered into with all of its branches located in the EU (a copy of which can be requested by contacting American at Privacy@aa.com) or seeking employee consent, where required by law.

Application of Local Laws

This Privacy Policy provides global principles, which set out the minimum data protection requirements that American will apply to employees’ personal information. American recognizes that local, national or regional laws and regulations in certain jurisdictions may require stricter legal standards than those described in this Privacy Policy. American will process employee personal information in accordance with applicable local law in those cases. Please contact your local human resources representative for country specifics.

Voluntary or Mandatory Provision?

When collecting personal information from you, American will, where required by applicable law, inform you whether your provision of the requested information is voluntary or whether provision of it is mandatory and if so the consequences of not providing it. The provision of certain personal information is necessary for us to enter into an employment contract with you and/or for us to perform our obligations under that contract and without it we will be unable to do so, such as the provision of your bank details in order for us to pay you for your services via direct deposit.

If you choose not to provide certain information, this may impact your use of certain resources (e.g., if you refuse to provide information about your spouse, you may not be eligible for spousal coverage under employer-sponsored health insurance).

Your Rights with Respect to Your Personal Information

Right to Object

If you are located in the European Union or Switzerland you have the right to object to our use of your personal data, on grounds relating to your particular situation, to the extent the processing is based on our legitimate interests. If we receive an objection, then we will stop processing the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing is necessary for the establishment, exercise or defense of legal claims.

Additional Rights

If you are located in the European Union or Switzerland, you have the following rights under applicable data privacy laws (unless exemptions apply), which can be exercised by contacting your local employer or American using the details provided below.

• Request access to your personal information. This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see above).
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;
• Request the transfer of your personal information to another party; and
• The right to withdraw consent at any time where we have relied on it to process your personal data.

Similar rights may exist under local data protection laws of other countries outside of the EU and the US. For further details please use the contact details below.

Contact Details

If you wish to exercise your rights, issue a request, or if you have other questions, comments or concerns about our privacy practices, please contact the Privacy Office at Privacy@aa.com. Please provide your name and contact information along with the request. Alternatively, inquiries may be mailed to the following address:

American Airlines
c/o Privacy Office
1 Skyview Drive, MD 8B503
Fort Worth, Texas 76155

Data Protection Officer

American has assigned a data protection officer, Russell Hubbard, who is responsible for overseeing American’s compliance with EU data protection law, whom you may contact at Privacy@aa.com or via the postal address above in case of any questions or concerns regarding the processing of your personal data.

EU Representative

American in the US has appointed the following representative in the EU:

American Airlines, Inc.
People Team
Terminal 2A
BP 35 060
95 716 Roissy, CDG Cedex
Contact: Cecile.Willmore@aa.com

Complaints

If American’s processing of your personal data is covered by EU law or Swiss Law you may also contact or lodge a complaint with the corresponding data protection supervisory authority in your country of residence. You can find the relevant EU supervisory authority name and contact details underhttp://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

Effective Date

This Privacy Policy is effective on and was last reviewed in June 18, 2020.