How Personal Information Is Used

We use the Personal Information we collect to provide, maintain, and improve the Services. We also use the Personal Information we collect to:

• Send you technical notices, updates, security alerts, and support and administrative messages (such as changes to our terms, conditions, and policies) and to respond to your comments, questions, and customer service requests;
• Receive and respond to your submissions on the Services such as submissions on Citi News and Site Feedback;
• Permit you to participate in voluntary polls and surveys (we may use third parties to deliver incentives to you to participate in such polls and surveys, and you may be required to provide your contact details to the third party in order to fulfill the incentive offer);
• Communicate with you about products, services, and events offered by Citi and others, and provide news and information we think will be of interest to you (see "Your Choices" below for information about how to opt out of these communications at any time);
• Monitor and analyze trends, usage, and activities in connection with our Services;
• Develop new products and services and enhance current products and services;
• Detect, investigate, and prevent fraudulent transactions and other illegal activities, and protect the rights and property of Citi and others; and
• Carry out any other purpose described to you at the time the information was collected.

How Personal Information Is Shared

During at least the past 12 months, we have disclosed your Personal Information for the following business purposes or as otherwise described in this Notice:

• To support certain Citi entities' use of information in accordance with this Notice (a list of Citi entities who may access your Personal Information can be found at http://www.sec.gov/Archives/edgar/data/831001/000083100115000043/citi-exhibit2101x12312014.htm);
• With our service providers, who provide services such as website hosting, data analysis, information technology and related infrastructure provision, customer service, processing your transactions, e-mail delivery, auditing, and other services;
• To cooperate with public and government authorities and law enforcement, and to respond to their requests, or to provide them with information as required;
• For other legal reasons, such as to monitor compliance with and enforce our terms and conditions, to protect our rights, privacy, safety, or property, and/or that of our affiliates, you or others, to protect against fraud, crime, illegal activity, anti-money laundering, or anti-terrorism, and for risk management purposes; and
• In connection with a sale or business transaction, such as to an acquiring entity or its advisors in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

We may also share aggregated or de-identified information that cannot reasonably be used to identify you to help deliver products, services, and content that are tailored to the users of our Services and for other purposes.

We may transfer information to Citi affiliated companies or other parties throughout the world, for example to process transactions and provide you with products and services. Regardless of where we process your information, we still treat it in accordance with this Notice and applicable law.

Children

Our Services are not designed for children and we do not knowingly collect personal data from children under the age of 13. If you have reason to believe that a child has provided Personal Information to us, please contact us, and we will take appropriate action.

Links to Other Websites

The Services may contain links to other websites. Please note that Citi is not responsible for the privacy or information security practices of other websites. You should carefully review the applicable privacy and information security policies and notices for any other websites you click through to via the Services. This Notice applies solely to your Personal Information collected by the Services.

Security

We seek to use reasonable physical, electronic, and procedural measures to safeguard Personal Information within our organization against loss, theft, and unauthorized use, disclosure, or modification. Unfortunately, however, no data transmission over the internet can be guaranteed to be 100% secure. As a result, while we strive to protect your information, we cannot guarantee its security.

Your Choices

Marketing Emails and Citi News Alerts

If you no longer want to receive marketing-related emails from us or Citi News Alerts, you may opt out by following the instructions contained within each such email or through the communications center in your account profile. We will try to comply with your request as soon as reasonably practicable. Please note that if you opt out of receiving marketing-related emails or Citi News Alerts, we may still send you administrative messages, from which you cannot opt out.

Cookies

Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject browser cookies. Please note that if you choose to remove or reject cookies, this could affect the availability and functionality of our Services.

Do Not Track

Some browsers have a do not track feature that lets you tell websites that you do not want to have your online activities tracked. At this time, we do not respond to browser do not track signals.

Your California Privacy Rights

If you are a California resident, you have the right to request and receive certain information about disclosure of your Personal Information to third parties for their direct marketing purposes. Because it is our policy not to share your Personal Information with third parties for third-party direct marketing purposes without your consent, we are exempt from the requirement to respond to such requests. If you have any questions related to our policy, please contact us using the information provided in the "Contact Us" section below.

For information regarding how to exercise your rights as a consumer under the California Consumer Privacy Act, please see the below Appendix, Supplemental provision applicable to California residents.

Updating Your Personal Information

Keeping your account information accurate and up to date is very important. If your account information is incomplete, inaccurate or not current, please use the Contact Us option on our website, or call or write to us at the telephone numbers or appropriate address for changes listed on your account statements, records, online or other account materials. You can also speak to a branch representative, your financial advisor or your designated account representative.

Changes to This Notice

From time to time, we may revise this Notice. Changes may be made for any number of reasons, including to reflect industry initiatives, changes in the law, and changes to the scope of the Services, among other reasons. You can tell when we last updated the Notice by checking the date at the beginning of the Notice. Any changes will become effective when we post the revised Notice on the Site.

Contact Us

If you have any questions about this Notice, please us using the contact form below.

If you are contacting us from outside the United States, please refer to the Citi website in your country or use the contact details in the local privacy notice for your product. If you would like to submit a request pursuant to the California Consumer Privacy Act ("CCPA"), please visit Citi's Privacy Hub at online.citi.com/dataprivacyhub or call us at (833) 971-1191. If you wish to submit a request to have your Personal Information deleted (see section 3 in the "Supplemental provision applicable to California residents" Appendix below) or wish to opt-out of the selling of your Personal Information, call us at (833) 981-0270.

Appendix

Supplemental provisions regarding individuals in the EEA

If you are in the European Economic Area ("EEA"), you have certain rights and protections under the law regarding the processing of your personal data.

Legal Basis for Processing

If you are in the EEA, when we process your personal data we will only do so in the following situations:

• We need to use your personal data to perform our responsibilities under our contract with you (e.g., to facilitate your participation in voluntary polls and surveys).
• We have a legitimate interest in processing your personal data. For example, we may process your personal data to send you marketing communications, to communicate with you about changes to the Services, and to provide, secure, and improve our Services.
• We find such processing is necessary to comply with our legal obligations.
• We have your consent to do so. When consent is the legal basis for our processing, you may withdraw such consent at any time.

Data Subject Requests

You may have certain rights with respect to the personal data which Citi holds about you, including the right to access or correct (and sometimes, object to or delete) the information. If you would like to request to review, correct, update, suppress, restrict or delete personal data that you have provided to us, object to the processing of personal data, or if you would like to receive an electronic copy of your personal data for purposes of transmitting it to another company (to the extent this right to data portability is provided to you by applicable law) you may contact our GDPR Data Protection Officer by mail at Citigroup Centre, Canada Square, Canary Wharf, London, E14 5LB. We will respond to your request consistent with applicable law.

For your protection, we may only implement requests with respect to the personal data associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable. Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion.

Data Retention

We retain personal data for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the Services to you (for example, for as long as you keep using the Services);
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

Data Controller Except as otherwise specified on any subsections within sites or apps that comprise the Services, such as the Careers, Alumni, or Citi Consumer Banking subsections, your personal data will be controlled by Citigroup Technology Inc. of 388 Greenwich Street, New York, NY 10013, USA and/or the Citi entity which operates the Services you are accessing (and/or if you are Citigroup personnel, the Citi entity which employs you or contracts with you). A list of certain Citi entities can be found at: http://www.sec.gov/Archives/edgar/data/831001/000083100115000043/citi-exhibit2101x12312014.htm. If you would like additional information regarding the applicable Citi entity or entities, please contact us.

Data Transfer

Your personal data may be stored and processed in any country where we have facilities or in which we engage service providers.

Some of the non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here).

Complaints

You may lodge a complaint with a data protection authority for your country or region where an alleged infringement of applicable data protection law has occurred. A list of data protection authorities is available here.

Supplemental provision applicable to users registering from the UAE

Your use of the Services signifies that you agree to waive your material privacy rights under the laws of the UAE. You also agree not to hold Citi liable for any publicity, any publication of news, or comments pertaining to the secrets of your or any other person's private or family lives on the Services. Your use of the Services signifies your consent to allowing Citi to disclose any information that you may consider a secret to anybody at any time. You agree not to hold Citi liable for any disclosure of such information that you may think to be a secret to anyone. Please do not use the Services if you disagree with any part of this Notice.

Supplemental provision applicable to users registering from Korea

Your consent of the Notice and User Agreement upon joining the Citi Alumni Site is deemed that you agreed that your personal information will be controlled, not by Citibank Korea Inc. nor other subsidiaries and affiliates in Korea ("Citi Korea"), but by Citigroup Inc. NY, USA and/or Citi entity which operates the Services you are accessing. Citi Korea is solely responsible for the use of your personal information within Korea, when it is used by Citi Korea, under the applicable Korean laws including; Personal Information Protection Act, Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., and other relevant Korean laws. Your personal information and the Submitted material can be shared with Citi Korea but Citi Korea will not collect and use such personal information and material for any marketing purpose without your prior consent. When Citi Korea obtains personal information our personal information via the Services, the use will be controlled by and be bound to the necessary process and procedure following the applicable Korean laws.

Supplemental provision applicable to California residents

Requests

California residents have certain rights with respect to Personal Information under the California Consumer Privacy Act ("CCPA"). For purposes of this subsection, the terms "consumer," "categories of personal information," "business purpose," "third party," and "sell" have the meanings ascribed to them respectively in the CCPA. Terms defined under the CCPA may differ in meaning from the common usage of the same terms used elsewhere in this Notice.

1. You have the right to request, up to two times every 12 months, that Citi disclose to you the following: (i) the categories of Personal Information that Citi has collected about you; (ii) the categories of sources from which Citi has collected Personal Information about you; (iii) the business or commercial purpose for collecting or selling your Personal Information; (iv) the categories of Personal Information that Citi has sold about you in the last 12 months and the categories of Third Parties to whom the Personal Information was sold, by category or categories of Personal Information for each Third Party to whom the Personal Information was sold; (v) the categories of Personal Information that Citi has disclosed about you for our business purposes in the last 12 months and the categories of Third Parties to whom the Personal Information was disclosed, by category or categories of Personal Information for each Third Party to whom the Personal Information was disclosed; and (vi) the specific pieces of Personal Information that Citi has collected about you. Please note that Personal Information we have collected in connection with your personal account with us is not subject to the requirements of CCPA because it is already protected under existing federal and California state privacy laws, including the Graham Leach Bliley Act.
2. You have the right to request a portable copy of your Personal Information.
   
   In response to verified requests pursuant to #1 or #2 above, we will confirm receipt of the request within 10 business days of receipt of the request, and disclose and deliver the required information to you free of charge within 45 days of receiving a verifiable consumer request. We may extend this time period to provide once by an additional 45 days when reasonably necessary. We will provide notice of the extension within the first 45-day period.
3. You have the right to request that Citi delete Personal Information collected from you, subject to certain exceptions allowed under applicable law.
   
   In response to verified requests pursuant to #3 above, we will confirm receipt of the request within 10 business days of receipt of the request. Following verification of your request, we may require you to separately confirm that you want your Personal Information to be deleted.
4. You have the right to opt out of the sale of your Personal Information to Third Parties by clicking here to visit our Privacy Hub. CCPA defines sale very broadly, covering both monetary and other consideration. Citi does not sell personal information for money. However, we share some types of personal information. See our Privacy Hub.
5. Citi will not discriminate against you because you elect to exercise these rights, including by:
   • Denying goods or services to you.
   • Charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
   • Providing a different level or quality of goods or services to you.
   • Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

None of the foregoing, however, prohibits Citi from charging you a different price or rate, or from providing a different level or quality of goods or services to you, if that difference is reasonably related to the value provided to Citi by your data.

Submission of Requests

You may exercise these rights by managing this information through your online account on Citi's Privacy Hub at online.citi.com/dataprivacyhub or by calling us at (833) 971-1191. If you wish to submit a request to have your Personal Information deleted (see section 3 in this "Supplemental provision applicable to users registering from California" Appendix) or wish to opt-out of the selling of your Personal Information, call us at (833) 981-0270. If you wish to submit any type of CCPA request through an authorized agent, please follow the process in the “CCPA Authorized Agent” section below.

Requests From Households

Citi cannot take action in response to a request to know or request to delete as it pertains to household specific pieces of personal information unless all of the following conditions are satisfied:

1. All consumers of the household must jointly request access or deletion through the processes outlined in this Notice;
2. We are able to individually verify (i) all members of the household (see the “Verification” section below); and (ii) that all individuals making the request are still members of the household.

CCPA Authorized Agent

CCPA permits consumers to designate authorized agents to submit requests on their behalf. Under CCPA, an “authorized agent” is a natural person or a business entity registered with the Secretary of State to conduct business in California that a consumer has authorized to act on their behalf subject to the requirements. If you would like to designate an authorized agent to submit a request to know or a request to delete Personal Information on your behalf, please call us at (833) 981-0270. Please be advised of the following additional information that will be required:

1. We require a written power of attorney, executed by you, confirming the authority of the authorized agent with respect to your CCPA request(s). After you initiate a request with us by phone at the number above, we will provide you with a form of power of attorney.
2. Prior to responding to any request made on your behalf by an authorized agent, we may require you to provide written confirmation directly to us that you have provided the authorized agent permission to submit such request(s) on your behalf.
3. Once verified (see the “Verification” section below), your authorized agent may create a unique account for you through Citi’s Privacy Hub at online.citi.com/dataprivacyhub and manage your requests through that account.

Verification

Whether you submit a request directly on your own behalf, or through an authorized agent, we will take reasonable steps to verify your identity prior to responding to your requests under CCPA. Upon receiving a request pursuant to #1 or #2 in the “Requests” section above, we will confirm receipt within 10 days and provide you with information about how we will verify and process the request. In order to verify your request, we will require you to provide your social security number, tax ID number or passport number and issuing country, in addition to your first and last name, email address and mailing address.