Privacy Policy

Purpose

This Privacy Policy is applicable to all former and current team members (together, “employees” or “you”) of American Airlines, Inc. (“we”, “us”, “our”, or “American”) and certain of its affiliates. This Privacy Policy applies to our employees globally and therefore provides a global overview of how and why American will use employees’ personal information. It will be supplemented from time to time by more detailed information which will be provided to employees locally, for example at the point of collection of their data for a specific purpose.

We take your privacy seriously because we know you do. This Privacy Policy will help answer your questions about how we collect, use, share, and maintain the confidentiality, availability, integrity and security of our employees’ personal information.

This Privacy Policy applies to employees' personal information and to the management of that personal information in any form, whether oral, electronic, or written. This Privacy Policy is not a contract and American reserves the right to change or update it at any time, so please refer to the effective date at the end to stay apprised of latest updates, and we will notify employees of any material changes.

We are providing this Privacy Policy to help you better understand the following:

• Collection of your personal information
• Sources
• Sensitive personal information
• Information about criminal convictions
• Use of your personal information
• Monitoring
• Change of purpose
• With whom your information will be shared
• International data transfers
• Application of local laws
• Voluntary or mandatory provision?
• How your information will be secured
• Retention
• Your rights with respect to your personal information
• Right to object
• Additional rights
• Contact us
• Data Protection Officer
• Effective date

Collection of your personal information

The types of personal information that American may, as applicable and where permitted in accordance with applicable laws and regulations, collect and maintain as part of your employment with American, include:

• Contact and personal information – including name, gender, ethnicity (if volunteered or where necessary to comply with legal obligations, such as for diversity purposes), nationality/citizenship, home address and telephone number and other contact details, date of birth, disability status, marital status and dependents, emergency contacts;
• Recruitment/separation information – including any information shared in the application process – residency and work permit status, military status, national identification, drivers’ license and passport information, references and other curriculum vitae information, date of resignation or termination, reason for resignation or termination, information relating to administering termination of employment;
• Financial information – taxpayer identification number(s) such as a social security number, banking details including credit and debit card information;
• Benefits distribution information – sick pay, pensions, insurance and other incentives and benefits information (including the gender, age, marital status, nationality and passport information for any spouse, guest travelers, minor children or other eligible dependents and beneficiaries);
• Career and job performance information – employee ID number, job title, job grade and function, date of hire, date(s) of promotions(s), work history, hours worked, work location, direct manager/supervisor information, technical skills, educational background, professional certifications and registrations, language capabilities, training courses attended and training assessment, records of work absences, vacation entitlement and requests, salary information (history and expectations), performance appraisals/evaluations, letters of appreciation and commendation, disciplinary and grievance procedures (including monitoring compliance with and enforcing American policies), employee complaints;
• Health–related information – height, weight, clothing sizes, photographs, symptoms, physical limitations and special needs;
• Background check information where permitted by law and proportionate in view of the function to be carried out by an employee or prospective employee – the results of credit and criminal background checks, the results of drug and alcohol testing, screening, health certifications, medical records and reports, information on accidents at work, vehicle registration, driving history;
• Compliance information as required to comply with laws, including the requests and directions of law enforcement authorities or court orders (child support and debt payment information) and acknowledgements regarding American policies; and
• Automatically collected information – information captured on network, information, operational and/or security systems, including but not limited to information and interactions required to provide and monitor access to American’s systems and networks, including CCTV and key card entry systems (including biometric data, such as fingerprints for entry access, as applicable), video recordings of company events and activities, voicemails, e-mails, and other correspondence, work product and communications created, stored or transmitted by an employee using American's computer network, communications equipment, and/or systems. American also collects information from American's computer equipment and company-issued mobile devices, including but not limited to user session information, Internet browsing history, mobile app usage, and precise geo-location. This information may be collected in a variety of ways, including through data logs or the use of cookies and similar tracking technologies, all in accordance with applicable law.

Sources

Most of the personal information we collect and process is information that you knowingly provide to us, for example, during the onboarding process or during your employment. It may also include information about you that we collect from your use of American’s systems, technology, and company-issued devices, as well as information we may receive from third parties as necessary for specific purposes, such as references or other information from former employers, recruiters, personal references, and benefits providers.

Sensitive personal information

"Sensitive personal information" includes any information about an employee that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation or information concerning a person's sex life, genetic or biometric data, health information, or any other information defined as “sensitive” by applicable law.

To the extent that any of the personal information we collect constitutes sensitive personal information, American will collect and process this information within the limits prescribed by relevant, applicable law, and only after establishing appropriate security safeguards for it. Where required by law, American will seek the explicit written consent of employees before processing sensitive personal information. We may process sensitive personal information in the following additional circumstances:

• Where we need to in order to carry out our legal obligations;
• Where it is needed in the public interest, such as for equal opportunities monitoring or in relation to our occupational pension scheme; or
• Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.

We may also use this type of data where it is necessary in relation to legal claims, where it is necessary to protect a person’s vital interests and that person is not capable of giving consent, or where a person has already made the information public.

We will also use sensitive personal information to carry out our obligations in connection with your employment as set out below:

• Information relating to leaves of absence, which may include sickness absence or family-related leaves, to comply with employment and other laws;
• Information about your physical or mental health or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits;
• Information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sex life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting in accordance with applicable law;
• Trade union membership information to pay trade union premiums, register the status of a protected employee and to comply with employment law obligations.

Information about criminal convictions

We may use information relating to criminal convictions only where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and in accordance with our policies. We may also use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect a person’s vital interests and that person is not capable of giving consent, or where you a person has already made the information public.

Use of your personal information

We need the categories of information in the list above (Collection of Your Personal Information) primarily to allow us to perform our contract with you (designated by"*") or to enable us to comply with our legal obligations (designated by"**"). In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties (designated by"***"), provided your interests and fundamental rights do not override those interests.

• The business purposes for which American may process your personal information include, without limitation, those set out in the list below. For employees based in the European Union, Switzerland, United Kingdom, or any other jurisdiction which legally requires us to specify the purposes for which we process personal information, we have used asterisks to indicate the purpose or purposes (referred to in the preceding paragraph) for which we may process your personal information.Facilitate applications: evaluate applications for employment opportunities within American***, including examining visa status/right to work in the jurisdiction** and background checks, where appropriate***;
• Internal employee management: manage all aspects of an employee's employment relationship including, without limitation, payroll, benefits, incentives, compensation, corporate travel and other reimbursable expenses, development and training, absence monitoring, timekeeping, performance appraisal, disciplinary and grievance processes, administration of termination of employment, resource planning and allocation, talent management, succession planning and other general administrative and human resource related processes*;
• Career planning: resource planning and allocation, talent management, succession planning***;
• Business travel, relocation, transfers and cross-border programs: coordinate global employee programs, international moves and cross-border team work and project management*;
• Compensation and benefits management: coordinate compensation and maintain medical and sickness records and occupational health programs, as well as emergency contact and beneficiary details (as designated by employees)*;
• Security management: protect the safety and security of American customers, team members, and property (including controlling and facilitating access to and monitoring activity in secured premises and activity using American computers, communications and other resources), investigate and respond to claims against American and its customers and employees, including any internal complaints**;
• Corporate communications: to communicate with internal and external audiences (e.g., conduct employee surveys, administer employee recognition programs and promotions and diversity programs)*; and
• Compliance requirements: comply with applicable laws (e.g., health and safety), including judicial or administrative orders regarding individual employees (e.g., garnishments, child support payments, and so forth)**.

Some of the grounds for processing will overlap and there may be several grounds which justify our use of your personal information. Also note that there are Closed Circuit Television (CCTV) cameras in operation within and around our stations and other premises, which are used for the following purposes:

There are Closed Circuit Television (CCTV) cameras in operation within and around our stations and other premises, which are used for the following purposes:

• to prevent and detect crime**;
• to protect the health and safety of American customers and employees**;
• to manage and protect American’s property and the property of American’s guests and other visitors***; and
• for quality assurance purposes***.

Monitoring

To the extent permitted by law, we also monitor employees' use of American information technology (IT) systems, the use of American's resources, and communications, including without limitation internet use, in accordance with the Security Policy (available on Jetnet), and any other applicable policies that may replace, amend or supplement those policies from time to time***. We may share such information with third parties and service providers, as necessary, to fulfill the business purposes described above, including for security management and to adhere to our compliance requirements.

As a result, within the limits prescribed by relevant, applicable law, employees should not have an expectation of complete privacy while at work or while using or accessing company equipment, information, computer, or communication systems, as those systems may be accessed at any time in accordance with our monitoring policies.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

With whom your information will be shared

In order to carry out the business purposes set forth above, your information will be disclosed to relevant and appropriate personnel within American, including, without limitation, human resources and payroll/accounting personnel, and managers, as well as American's affiliates, consultants and other advisers or persons when necessary. This includes disclosure of personal information to or for:

• Our Agents, Services Providers and Suppliers: From time to time, we outsource the processing of certain functions and/or information to third parties. For example, we use an employee management platform called Success Factors which is hosted by SAP in the US as a platform to store employee data and manage your employee profile so that, for example, when you apply online for an internal employment position with American, you will be directed to Success Factors. Further information will be provided about service providers who have access to your personal information locally from time to time.
• When we outsource the processing of your personal information to third parties or provide your personal information to third-party service providers, we take reasonable measures, such as implementing contractual controls, in an effort to ensure that those third parties safeguard your personal information with appropriate security measures, and prohibit them from using your personal information for their own purposes or from disclosing your personal information to other third parties.
• Business Transitions: In the event we undergo a business transition involving another company, such as a merger, corporate reorganization, acquisition, the sale of all or a portion of our assets, or in the event of bankruptcy, information that we have collected from or about you may be disclosed to such other entities as part of the due diligence or business integration process and will be transferred to such entity as one of the transferred assets.*** For internationally based employees, the personal information disclosed will vary based on local labor laws. Please contact your local human resources representative for country specifics.
• Legal and Regulatory Requirements: To the extent required by relevant, applicable law or regulation, we may be obligated to disclose personal information to government authorities, or to third parties pursuant to a court order or other legal process.** Such information may be disclosed to:
• Protect your or American’s legal claims and interests
• Defend against potential or actual litigation
• Abide by applicable law, regulation or contracts
• Respond to a court order, governmental administrative or judicial process, including but not limited to, a subpoena or search warrant
• Comply with American’s obligations where it is registered with any governmental agency

American does not sell your personal information, nor do we share it for purposes of cross-context behavioral advertising.

International data transfers

Please note that personal information submitted to us may be transferred to, stored and processed on servers located in various countries around the world, including when it is used as set out in this Privacy Policy by American in the United States of America, in accordance with applicable laws and regulations.

This may include transfers to American's affiliates and to third parties with whom we share personal information, as described in this Privacy Policy. The privacy laws of those countries might not be equivalent to those in your country of residence, but please be assured that we take reasonable steps to protect your privacy, such as by ensuring the country to which your information is sent is deemed to provide an adequate level of data protection, implementing contractual controls such as the EU Standard Contractual Clauses which American has entered into with all of its branches located in the EU (a copy of which can be requested), or seeking employee consent, where required by law. In certain circumstances, we may rely on applicable exemptions to transfer restrictions, such as where the transfer is necessary to perform a contract with an individual or in their interests (or to take pre-contractual measures at their request), or based on another relevant exemption recognized by applicable law. If you wish to obtain further details about the transfer safeguards in place to protect your privacy, please contact us at Privacy@aa.com.

Application of local laws

This Privacy Policy provides global principles, which set out the minimum data protection requirements that American will apply to employees' personal information. American recognizes that local, state, national or regional laws and regulations in certain jurisdictions may require stricter legal standards than those described in this Privacy Policy. American will always process employee personal information in accordance with relevant, applicable law. Please contact your local human resources representative for country specifics.

Voluntary or mandatory provision?

When collecting personal information from you, American will, where required by applicable law, inform you whether your provision of the requested information is voluntary or whether provision of it is mandatory, and if so, the consequences of not providing it. The provision of certain personal information is necessary for us to enter into an employment contract with you and/or for us to perform our obligations under that contract, and without it, we will be unable to do so, such as the provision of your bank details in order for us to pay you for your services via direct deposit.

If you choose not to provide certain information that we need for these reasons, this may impact your use of certain resources (e.g., if you refuse to provide information about your spouse, you may not be eligible for spousal coverage under employer­ sponsored health insurance).

How your information will be secured

American is committed to protecting the security of your personal information. Whenever and wherever we collect, process or use personal information, we apply appropriate technical, physical and administrative safeguards and access restrictions to secure that information in accordance with this Privacy Policy in order to prevent unauthorized access and use, unlawful processing, unauthorized or accidental loss, destruction, or damage to that information.

Retention

American will generally retain personal information for as long as necessary to fulfill the purpose(s) for which it was collected, and thereafter in accordance with our data retention schedules (available on Jetnet).

Your rights with respect to your personal information

Right to object

Where provided by applicable law, you have the right to object to or opt out the use of your personal information for certain purposes on grounds relating to your particular situation, including to the extent the processing is based on our legitimate interests. If we receive such an objection, we will stop processing the personal information at issue unless we can demonstrate compelling legitimate grounds for the continued processing which override your interests, rights and freedoms, or if the processing is necessary for the establishment, exercise or defense of legal claims.

Additional rights

You may also have the following rights under applicable data privacy laws (unless an exemption applies), which can be exercised by contacting your local employer or American using the details provided below.

• Request access to your personal information. This may also enable you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us to continue to process it. You may also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see above).
• Request the restriction of processing of your personal information, including sensitive personal information (as applicable). This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;
• Request the transfer of your personal information to another party; and
• The right to withdraw consent at any time where we have relied on it to process your personal information.

If you wish to exercise your rights directly (or have designated an authorized agent to do so on your behalf), please contact us using the details provided in the “Contact Us” section below. When we receive a request to exercise one of these rights, we will indicate what personal information we require from you to validate your identity (or the identity of your authorized agent and their authority to act on your behalf, as applicable).

Upon receipt of your request, we may ask for additional information to verify your identity (or to confirm that an authorized agent is acting on your behalf), to ensure the validity of the request. Please also note that American enables employees to easily access their personal information and exercise their applicable rights directly on Jetnet. Please refer to this page for more information on how you can access your personal information via Jetnet to correct it, update it, or take further actions.

American will respond to your request in accordance with applicable laws, and will not discriminate against you when doing so. Where provided by applicable law, you have the right to lodge a complaint with the corresponding data protection supervisory authority in your country of residence.

Contact us

If you have questions, comments or concerns about our privacy practices, please contact the Privacy Office at Privacy@aa.com. Please provide your name and contact information along with the request. Alternatively, inquiries may be mailed to the following address:

American Airlines
c/o Privacy Office
1 Skyview Drive, MD 8B503
Fort Worth, Texas 76155

Data Protection Officer

American has assigned a data protection officer, Russell Hubbard, who is responsible for overseeing American's compliance with data protection law, whom you may contact at Privacy@aa.com or via the postal address above in case of any questions or concerns regarding the processing of your personal information.

Effective date

This Privacy Policy is effective on and was last reviewed in 01/01/2023