Citi Events Privacy Notice

Effective: July 2, 2026

This Citi Events Privacy Notice (“Privacy Notice”) describes how Citigroup, Inc., its subsidiaries and affiliated companies (collectively, “Citi,” or “we,” or “us”) collect, use, or ’process,’ Personal Information (also referred to as ‘personal data’)  from and about users who register for, and attend live, in-person events, or pre-recorded and virtual events that are hosted or otherwise made available by Citi (the “Event Services”). We advise you to read this Privacy Notice including the information in the Appendix specific to your location.

Depending on how else you relate to us, other Citi Privacy Notices may also be relevant to you, for example: We have online privacy notices for visitors to our flagship website (Citigroup.com), we have privacy notices for customers of the retail, Citi Wealth or Citi Private Bank businesses, and for individuals related to a client of our global markets, investment banking or financial services for corporations. Citi also has non-client Privacy Notices, for example for Citi Careers (applicants to Jobs at Citi), for our Workforce (available internally), for Former Workforce and Persons associated with our Workforce (available externally), and for Contingent Workforce (Non-Employees) and Suppliers, etc.

This Privacy Notice does not replace or amend any other privacy notice that may be applicable to you through those interactions.

I. NOTICE AT COLLECTION

A. Collection of Personal Information

Citi collects and uses, or ‘processes’ your Personal Information in order to operate and provide its Event Services. This includes Personal Information that you provide when you register with us for the first time and for a specific event, and Personal Information that we collect automatically when you visit or interact with our Event Services. 

“Personal Information” as used in this Privacy Notice, also referred to as personal data, means information that directly or indirectly identifies you, or is about you or is reasonably capable of being associated with you, or your household. 

Personal Information can exist in various formats, including but not limited to all of the following: 

  • (A) Physical formats, including paper documents, printed images, vinyl records or video tapes.
  • (B) Digital formats, including text, image audio or video files.
  • (C) Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information 

The ‘data controller’ or ‘independent business’ responsible for the collection and processing of your personal data on this web page is Citibank, N.A. (a national association incorporated under the National Banking Act) with address at 388 Greenwich Street, New York, NY 10013, United States of America (CBNA). The Citi entity hosting and inviting you to any Citi Event (if different) is an independent and separate data controller, alongside CBNA.

1. Personal Information that you provide when you register for a Citi Event

Citi hosts many live and pre-recorded events throughout the year, which can be attended in-person or virtually or ‘online’, such as webinars. We collect Personal Information that you voluntarily provide when you sign up for an event for the first time with our Event Services, or when you register to, and attend any individual events. 

Categories of Personal Data
The categories of personal information we collect when you sign up or register, include:  

Identity: your full name, work email address, the business sector or industry of your expertise, your role, employer and job title, and as a Wealth of Private Bank customer, information about your source of wealth. 

Business contact details: such as Email address, telephone numbers, and other business contact details, including the names and contact details of persons reaching us on your behalf, your current employer.

Your contract preferences: Preferred methods of communications, and your marketing preferences.

Your financial and personal background, and your residential address(es), in order to connect you with the line of business most relevant to your needs.

Your relationships with us: Consumer, Wealth or Private Bank relationships with us or between Citi and the corporate or institutional organization you are related with that involve you.

Your Interests (Profile) in Events: The events that you attend, including, sessions that you plan, and do attend, and the topics that you present, or in which express an interest; and event or session evaluation such as ratings and feedback from you (or where you present, about you) through questions, polls and surveys.

Sensitive or Protected Personal Information: Where you attend in person, with your consent (including consent inferred by your requests, if legally permissible) we will collect certain personal information including medical and disability information about your allergies and dietary requirements, and any physical adjustments you may request, including mobility space, ramps, induction loops, and visual technologies. 

Information about disabilities, adjustments and your allergy and/or dietary restrictions, and, in certain cases other information appears on certain ID cards (for example in a Singapore NRIC (which you may be asked to show to enter certain events) can reveal legally protected characteristics about your health, disabilities or ethnicity, and contain or help infer information about religious or philosophical beliefs. We will only process these data element for the purposes of offering reasonable adjustments, for health and safety, and for event security. In an emergency, we may process and pass them to health, rescue and police services without your consent if we need to use them to protect your life or health.

If you register as a speaker or a presenter or intervene in in one of our events, we may also collect your picture(s) and make a sound or video recording (subject to you signing a release).

We may keep a record of your attendance or presentation in order to provide you with certifications (for example Continuing Legal Education). 

You may opt-in or decline, up to the time where the event begins, to have your name and the name of the business or organization you are related with, included in an attendee list, and to engage with our businesses and other sponsors or speakers.

2. Personal Information that we collect about your use of Event Services

When you attend an event in person, we may ask you to wear an entry ID badge and/or scan an entry code with your badge or personal device, to help you interact with the event’s agenda, measure attendance and for live space allocation, measure the length of your visit, receive updates, ask and answer questions, find and ‘follow’ other users. This information is held transitorily, and its tracking activities will cease and be deleted shortly after the end of each Event.  

You may also allow other attendees or speakers to scan your entry badge. By allowing such scanning you are verbally and/or physically consenting to provide the other person your business contact information and to contact you after the event. If you wish to revoke or withdraw your consent, or limit such communications please reach out to the person or business you allowed to scan your badge directly. 

When we co-sponsor events, and at such time as when you register for attendance, we may be sharing registration data with our co-sponsors, whether affiliates of Citi or external third parties. With your consent, we may send you leaflets and publications relating to Citi and external sponsors (including by way of example, the following publications, in digital of hard copy: Citi Insights, Citi GPS, or ad-hoc reports, and surveys).  

CONSEQUENCES OF NOT PROVIDING, OR WITHDRAWING CONSENT
If you need your consent and you do not provide it, or do not wear or scan your entry badge at the entrance of events you attend in person, you may not be able to join unless the organizers can reasonably accommodate your requirements. If you do not wish to sign a release for pictures or sound recordings and videos of an Event you attend, you must make this known to our event organizers at the first opportunity, so that we can respect your wishes. Please note however, that in cases where we have space restrictions, it may not be possible to sit you outside the field of a camera or audio, and you may be unable to join that event or session in person.

Most of our public-facing websites, including online publications, and events are free to access, and you will not be negatively impacted if you refuse your consent to be recorded (you must make this fact known if you speak or intervene, to ensure the recording is paused during your intervention, or edited out).

3. Personal Information processed through online Tracking and Analytics

Citi Events webpages and their service providers use cookies and online tracking technologies. We may deploy our own (first party cookies or online trackers) or contract specialized providers including Google Analytics and Adobe Omniture/Analytics (third party cookies or trackers). 

Where we use third parties tracking and analytics, these technologies relay your device’s information directly to Citi and may use such information for their own purposes after it has been de-personalized and aggregated with other data from other clients, such that it is no longer your personal data.

Please refer to our Citigroup Websites Cookie Policy, you can manage your Cookie Preferences by selecting the tab located in the footer at the bottom of the page. 

In the European Union, the European Economic Area, Switzerland, the United Kingdom and the Bailiwick of Jersey, and other countries with omnibus data protection laws (including, without limitation, Nigeria, Canada, Australia and the Republic of South Africa), we may only use optional (or non-essential) cookies and online trackers after we obtain your explicit consent. 

In the United States and certain jurisdictions with sector-specific privacy legislation, we can rely on implied consent, obtained through your actions such as registration and assistance of Citi Events. For compliance with California and other state-side privacy laws that may be applicable to us, we will provide an easily accessible facility or ‘button’ that allows you to opt out from ‘sharing or selling’ your personal information to third parties and opt-out of cross-contextual behavioral advertising (as those terms are defined by the California CCPA, as amended by the CPRA).

We may also collect your personal data from third party Apps and social media websites (e.g. LinkedIn, Instagram, X formerly Twitter, and Google Search) when you fill out a request form, ‘like’ or follow our pages. We are data controllers of any ‘likes’ or information we place on third party platforms (alongside the social media platform owner, who is a data controller of its platform. We encourage you to also read the privacy notices from these social media sites, apps and web browsers.

B. How Personal Information Is Used

We use the Personal Information that we collect to provide Event Services, to issue attendee ID badges, to manage your event subscriptions and to improve attendee engagement, tailoring our events to your interests. We use attendee analytics to determine space requirements or online resources, using numbers of attendees.  

We also use the Personal Information we collect to: 

  • Send you technical notices, updates, security alerts, and support and administrative messages (such as changes to our terms, conditions, and policies) and to respond to your comments, questions, and customer service requests;
  • Receive and respond to your submissions or questions on Event Services, such as the topics in which you express an interest;
  • Allow you to interact with us on polls and surveys;
  • Communicate with you about retail and corporate products, services, and events offered by Citi, relevant to the Events you participate in that may be of interest to your or the organization you are related with. With your consent (where applicable) products and services from co-hosts and others, and to provide news and information will be of interest to you (see “Your Choices” below for information about how to opt-out of these communications at any time);
  • Create a profile of you and your event interests that may help us further engage with you and enhance our products and services;
  • Detect, investigate, and prevent fraudulent uses, and other illegal activities, and protect the rights and property of Citi and others; 
  • Debug to identify and repair errors in our web pages for Event Services; 
  • Comply with our legal and financial obligations, and other applicable Law including health and safety capacity requirements; and
  • Carry out any other purpose described to you at the time the information has been collected.

C. How Personal Information Is Disclosed

During at least the past 12 months and currently, we have disclosed and may disclose your Personal Information for the following business purposes or as otherwise described in this Notice:

  • With our service providers or contractors, who provide website hosting, data analytics, information technology and related infrastructure, customer services, email delivery, website monitoring, and similar services;
  • To cooperate with public and government authorities and law enforcement, and to respond to their requests, or to provide them with information as required;
  • For compliance with certain legal requirements, such as to ensure compliance with applicable Law, to monitor and enforce our website terms of use, and our premises terms, to protect our rights, privacy, safety, or property, and/or that of our affiliates, you or others, to protect against fraud, crime, illegal activity, anti-money laundering, or anti-terrorism, and for risk management purposes; and
  • In connection with a sale or business transaction, such as to an acquiring entity or its advisors in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

Further, we may disclose your Personal Information with your explicit consent or at your direction.

D. Storage and Retention of Personal Information

We store Personal Information for a length of time that is reasonably necessary and proportionate to provide our Event Services and related purposes, expressed in this Privacy Notice, for which we collected your data in the first place, and will retain it in either electronic or hard copy form, during such time in which you are registered at Citi Events (or a specific event), and for a reasonable length of time after you leave, in accordance with our internal data retention policies. When retention of your data is no longer necessary, we will securely dispose of it either by deleting your data or anonymizing it so that it is aggregated and cannot be reconstituted to identify you.

We may retain your personal data for additional lawful purposes, including where we need to meet legal, regulatory, or judicial orders or obligations, or where retention of your personal data is necessary for the establishment, exercise of defense of legal claims.

II. PRINCIPLES AND LAWFUL BASES OF DATA PROCESSING

The following principles are the foundation of our commitment to data protection: 

  • Transparency 
  • Purpose limitation 
  • Proportionality 
  • Accuracy 
  • Confidentiality 
  • Storage Limitation
  • Accountability 
  • Compliance with applicable Data Protection laws and regulations. 

Citi relies on various lawful bases for the collection and processing of personal data:  

Consent
We use consent as a lawful basis for the processing of personal data, and for international data transfers, where appropriate or where required by law, subject to conditions applicable in the country where consent is collected, where: 

  • We are required by law or regulatory guidance to obtain consent, or consent is the expected lawful basis for processing (for example, in the United States and other consent-first countries in the APAC region) or where consent is needed to transfer personal data across national borders;

    or

  • Where your consent can be assumed or inferred from your conduct (for example by registering with us and using Citi Event services)

If Citi relies at any time on your consent, this will be made clear to you at the time it is needed, or example when you register to any of our events. 

Where your consent is the legal basis for processing, you are at liberty to withdraw it at any time by sending a request to the Data Protection Officer through the contact details provided in this Privacy Notice. Please note that withdrawal of your consent shall not affect, retrospectively, the lawfulness of processing of your Personal Information prior to the moment your consent is withdrawn. 

We may process personal data without your consent, were permissible, where we cannot reasonably obtain it provided that the processing in question is clearly needed for your benefit, and your consent for its collection, use or disclosure cannot be obtained in a timely manner, or where you would not be reasonably expected to withhold your consent. 

Legitimate interests
We will use this lawful basis for processing if available under applicable law (for example in Europe):

  • Where we have a legitimate business purpose for processing your personal information; and
  • Processing your personal information is necessary to achieve this purpose; and
  • Our legitimate business interest is not overridden by your individual interests, rights and freedoms.

Compliance with a legal obligation
We will process your personal data under this lawful basis if we need to use your personal information to comply with a legal obligation. This includes, without limitation, replying to a competent governmental agency, regulatory bodies, securities and commodities markets, securities brokers, and our intermediaries or counterparties. An example may be your attendance to a shareholders vote.

 

III. YOUR PRIVACY AND DATA PROTECTION RIGHTS

In non-US jurisdictions and in California, you have the right to: 

  • Request access to your Personal Information (make a “data subject access request”). This enables you to receive a copy of the Personal Information CNL holds about you; 
  • Request rectification of the Personal Information that Citi Events holds about you. This enables you to correct any incomplete or inaccurate information CNL holds about you; 
  • Request the erasure of your Personal Information in certain circumstances. you also have the right to request the deletion or removal of your Personal Information. where you have exercised your right to object to processing and your request is upheld; 
  • Object to the processing of your Personal Information. We shall discontinue the processing of your Personal Information on your request, unless we can demonstrate there is also a public interest or other legitimate ground, that overrides your fundamental rights and freedoms and interests.
  • You may request the restriction of the processing of your Personal Information. We will agree to such requests except where there is a lawful basis to continue processing, such as public interest or other legitimate grounds; 
  • Request that your Personal Information be transmitted directly from one Data Controller to another [*only in certain countries], where technically feasible, provided that such data portability shall not adversely affect the rights and freedoms of other persons; and 
  • Not be subject to a decision based solely on automated processing, unless where it has human involvement that influences the outcome of the decision.  

To exercise these data rights or if you have questions about how Citi Events processes your Personal Information, please follow the information in Section X Contact Us.  

We may need to request specific information from you for confirmation of your identity and to ensure your right to access Personal Information held by us (or to exercise any of your other rights). This is another appropriate security measure to ensure that your Personal Information is not disclosed to any person who has no right to receive it, and to assist Citi to process your request in a timely manner. 

Citi may not always be able to provide all requested information in a ‘data subject access request’ nor fulfil other rights, where exceptions apply, including the protection of privacy rights of others:  If we need to withhold certain information or cannot fulfil your request we will explain the rationale for our decision, and the subsequent steps you can take. We will always respond to your request within the timeframes provided under applicable law. 

Before disclosing any personal data. If you are making a request on behalf of someone else (as an attorney, relative or representative) we may require further information to ensure that you are duly authorized to make that request.

NOTES:

This section is intended to include a summary of what relevant rights are available to data subjects and how the individual can take steps to exercise such rights. 

It is crucial that there is a reference to the portal, tool, mechanism or inbox available to individuals to make their requests.

Relevant rights may vary from jurisdiction to jurisdiction. For global Privacy Notices, the key is to account for the more general rights and to caveat that they may be exercised ‘where applicable’, ‘if so, provided by applicable law’ or equivalent expressions. 

The laws of certain jurisdictions may require Citi to offer more stringent privacy or data protection rights. Due to operational and other reasons, it may not be feasible to provide those stringent rights in other jurisdictions. For those cases, the most practical solution would be to include those rights in special provisions in country Supplements to the main Privacy Notice. 

IV. INTERNATIONAL DATA TRANSFERS TO THE UNITED STATES AND THIRD COUNTRIES

Personal Information is directly collected from this web page and used, or ‘processed’ by Citibank N.A. with headquarters at 388 Greenwich Street, New York, NY 10013, the United States of America. 

If you are invited to a Citi Event in another country, your personal information will also be processed by a Citi subsidiary or affiliate that tendered the invitation, as a separate and independent data controller, and any services by Citi Events service will be deemed to be provided by Citibank, N.A. on behalf of that entity.  

Where we transfer personal data between Citi entities across national borders, we ensure your personal information is transferred to locations that have an equivalent or ‘adequate’ level of data protection to those present the country or territory where we collected your personal data.  

We also use or ‘process’ and transfer de-personalized and aggregated (or otherwise anonymized) data, such that it ceases to be personal information, to subsidiaries and third parties for our internal processing, security and business purposes.  

Because Citigroup is a global financial organization, your personal data may be accessed and used, or ‘processed’ in different locations globally. For example, Citi IT services may use or back-up information in different locations, in a manner that causes your data to be transferred across national borders, or to be accessed from another country, whether on infrastructure owned by Citi or operated on its behalf by a supplier. Such activities (known as international data transfers) are subject to certain requirements which are fulfilled on our Citi Events registration, and this Privacy Notice.  

You understand (and if legally required agree) that such transfers of personal information to countries outside of your country of residence, which have different data protection rules including the United States, may mean that in certain circumstances, their courts, law enforcement, regulatory or security agencies may be entitled to request access your Personal Information providing notice or without your knowledge.

V. WEBLINKS AND CONTENT IN OTHER WEBSITES

Citi Events may contain links to other websites. Please note that in certain circumstances Citi is deemed a controller of the cookies or online trackers and other facilities, such as ‘like’ buttons, in social media platforms, web browsers or webmail from third parties. We are not responsible however for the privacy or information security practices of those third-party platforms, websites or apps. You should carefully review their privacy notices and information security policies, and their terms of use/service 

VI. DATA SECURITY

We will take reasonable and appropriate steps to preserve the security of your personal data and protect it against misuse, accidental loss or from unauthorized access or disclosure. 

All information shared with external third parties is encrypted during transmission and in storage, and all information held internally is protected using security passwords and logons or other security procedures. However, due to the inherent risk of electronic communications, we cannot guarantee the security of personal data traversing outside our networks. 

VII. YOUR CHOICES

A. Cookies and Online Trackers

Our webpages use essential or strictly necessary cookies, which are deployed by default and do not need your consent. In addition, it may contain optional cookies (whether functional, analytics or marketing cookies). To update your preferences please select Cookie Preferences located in the footer at the bottom of the page. 

Please refer to our Citigroup Websites Cookie Policy, for further information about cookies and online trackers, and ways to opt-in or out of them.

B. Do Not Track

Some browsers have a do not track feature that lets you tell websites that you do not want to have your online activities tracked. At this time, we do not respond to browser do not track signals.

VIII. MINORS (CHILDREN)

Citi Events are designed for person over 18 years of age and are not offered to persons under legal age that are generally unable to represent corporate entities or enter into business transactions in their own name.

We do not knowingly collect personal information from anyone under the age of 18 except where the age of the individual cannot be determined. If you are a parent or guardian, please read this Privacy Notice to thoroughly understand how personal information is handled and contact us if you have any concerns. If we become aware of personal information of minors collected without parental consent, we will take steps to obtain such consent or remove it from our records.

IX. CHANGES TO THIS PRIVACY NOTICE

From time to time, we may revise this Privacy Notice. Changes may be made for reasons including to reflect industry initiatives, changes in applicable Law, and changes to the scope of the Services, among other reasons. You can tell when we last updated the Notice by checking the date at the beginning of the Notice. Any changes will become effective when we post the revised Notice on the Registration Website.

X. CONTACT US

If you have any questions about this Notice, please contact us at gem.support@citi.com.

XI. APPENDIX

A. Additional information for individuals in European countries (European Union and European Economic Area member States, Switzerland, the United Kingdom and the Bailiwick of Jersey) 

If you are in any European jurisdiction in this subtitle, you have certain specific rights and protections under applicable data protection laws. Please read the following paragraphs, which complement the main provisions. 

1. Lawful Basis for Processing Personal Data
We process your personal data under the lawful basis of legitimate interest where: 

  • We need to use your personal data for the purposes indicated in Section 1 (B) How Personal Information is Used AND
  • We are not under an obligation to process your personal data.  
  • We find such processing is proportionate and within your expectations when providing your personal data. If we intend to use personal data collected under the lawful basis of legitimate interest, such repurposing shall meet two conditions (a) the new purpose will have to be closely aligned with the original purpose for processing and (b) we will inform you of the new purpose and provide you the ability to opt-out, or decline such further processing, within a certain period.  

2. Data Subject Requests and Enforcement of Rights
You have rights with respect to the personal data which Citi holds about you. Please refer to Section II Your Privacy or Data Protection Rights for information 

To request or enforce any of these rights please contact our teams via the email address indicated in Section X Contact Us 

3. Contact the Data Protection Officers or the Data Protection Authority
You also have a legal right to lodge a complaint with Data Protection Authorities. In Europe you may contact: 

Click here for additional contacts.

B. Additional Information for persons in Nigeria 

Data Controller
The Data Controller for Citi Events in Nigeria is Citibank Nigeria Limited (CNL) a commercial bank licensed by the Central Bank of Nigeria, with registered offices at 27 Kofo Abayomi Street, Victoria Island, Lagos, Nigeria. CNL is responsible for the lawful collection, use, processing and disposal of personal data in Nigeria and its lawful transfer across national borders. CNL has ensured that it has appropriate contractual, technical and operational measures in place with its affiliates and parent companies, and any sub-processors of personal data gathered in Nigeria. 

You can request or enforce your personal data rights by emailing or writing to the Data Protection Officer at our registered address or by Email to CNL Data Protection Officer at dponigeria@citi.com 

Legal Basis for Processing personal information
CNL relies on various lawful basis as permissible by law for the collection and processing of Personal Data in Nigeria and will rely on your consent for the transfer for the transfer of personal information, where appropriate. These will be gathered, for example in the Release of Permission to Record images, sounds or videos. 

We may rely on other lawful basis for processing, including for compliance with applicable law or in the public interest recognized in a statute, or if it is necessary for the establishment, exercise or defense of legal claims.

Silence
Your silence will never be assumed to be consent to the processing of your Personal Information.

Your Rights when our processing is for Legitimate Interests
Citi shall discontinue the processing of your Personal Information upon your request, unless Citi demonstrates a public interest or other legitimate grounds, which overrides your fundamental rights and freedoms and interests. 

Further Protections for Processing of Sensitive Personal Data
Without prejudice to the principles set out in the Nigeria Data Protection Act 2023, Citi shall not process your sensitive personal data, unless: 

(a) you have given and not withdrawn consent to the processing for the specific purpose or purposes for which it will be processed;

(b) processing is necessary for the purposes of performing the obligations of Citi or exercising your rights under employment or any other similar laws;

(c) processing is necessary to protect your vital interests or of another person, where the data subject is physically or legally incapable of giving consent;

(d) processing is carried out in the course of its legitimate activities, with appropriate safeguards, by a foundation, association, or such other non-profit organisation with charitable, educational, literary, artistic, philosophical, religious, or trade union purposes, and the —

(i) processing relates solely to the members or former members of the entity, or to persons, who have regular contact with it in connection with its purposes, and

(ii) sensitive personal data is not disclosed outside of the entity without the explicit consent of the data subject;

(e) processing is necessary for the establishment, exercise, or defense of a legal claim, obtaining legal advice, or conduct of a legal proceeding;

(f) processing is necessary for reasons of substantial public interest, since a law, which shall be proportionate to the aim pursued, and provides for suitable and specific measures to safeguard the fundamental rights, freedoms and interests of the data subject;

(g) processing is carried out for purposes of medical care or community welfare, and undertaken by or under the responsibility of a professional or similar service provider owing a duty of confidentiality;

(h) processing is necessary for reasons of public health and provides for suitable and specific measures to safeguard the fundamental rights, freedoms and interests of the data subject; or

(i) processing is necessary for archiving purposes in the public interest, or historical, statistical, or scientific research, in each case since a law, which shall be proportionate to the aim pursued, and provides for suitable and specific measures to safeguard the fundamental rights and freedoms and the interests of the data subject.

Notification of Security Incidents and Breaches of Personal Information
The safety, security and integrity of your personal information are paramount to banking operations. We will promptly notify the Nigeria Data Protection Commissioner and in any case within 72 upon becoming aware of any accidental or intentional damage, alteration, destruction, unauthorized disclosure, loss, misuse, inability to access, extraction or theft of personal information that is stored or processed by Citi, where there is a risk to your rights or freedoms. If the risks are significant, we will also communicate directly with you, providing details of the data exposed to risk, with advice and measures we take to mitigate any adverse effects.

Right to File Claims before the Nigeria Data Protection Commission
In the event that the protection of your Personal Information is compromised or interfered with, you may lodge a complaint with the Nigeria Data Protection Commission No.12 Clement Isong Street, Asokoro, Abuja or info@ndpc.gov.ng.

You may communicate with CNL
Through Citi’s Data Protection Officer at Citibank Nigeria Limited, 27, Kofo Abayomi Street, Victoria Island, Lagos, Nigeria or dponigeria@citi.com or,

Through your relationship manager or customer services at https://www.citigroup.com/global/privacy/contact-us 

C. Additional information for users registering from the Republic of Korea

Your consent of the Notice and User Agreement upon joining the Citi Events webpage is deemed that you agreed that your personal information will be controlled, not by Citibank Korea Inc. nor other subsidiaries and affiliates in Korea (“Citi Korea”), but by Citigroup Inc. NY, USA and/or Citi entity which operates the Services you are accessing. Citi Korea is solely responsible for the use of your personal information within Korea, when it is used by Citi Korea, under the applicable Korean laws including; Personal Information Protection Act, Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., and other relevant Korean laws. Your personal information and the Submitted material can be shared with Citi Korea but Citi Korea will not collect and use such personal information and material for any marketing purpose without your prior consent. When Citi Korea obtains personal information our personal information via the Services, the use will be controlled by and be bound to the necessary process and procedure following the applicable Korean laws

D. Additional information for California residents

This California Supplemental Provision (the “Supplement”) supplements the information contained in the Citi Events Privacy Notice above (the “Privacy Notice”) and applies solely to residents of California who have rights under the California Privacy Rights Act (“CPRA”) (“consumer” or “you”). Unless otherwise defined in the Privacy Notice, any terms defined in this Supplement have the meaning used in the CPRA.

1. Sensitive Personal Information

Under the CCPA, as amended by the CPRA, certain types of Personal Information are considered “sensitive” Personal Information and require additional data privacy rights and obligations. We may collect information regarding allergy and dietary restrictions that may reveal consumers’ racial or ethnic origin, religious or philosophical beliefs and health information, which may be considered sensitive Personal Information. To the extent we collect any information that would be considered sensitive Personal Information under the CPRA, we will only use this sensitive Personal Information of consumers to provide the goods or services you requested, to ensure your physical safety, to verify or maintain the quality or safety of our products and services, and for providing accommodations for you without necessarily inferring characteristics about you (“Permitted Uses”). Because we use this sensitive Personal Information for Permitted Uses under the CPRA, we do not need to provide a Limit Use and Disclosure of Sensitive Personal Information right under the CPRA.

2. Summary of Personal Information Handling Practices

We provide in the chart below a summary of our prior 12-month Personal Information handling practices, which is consistent with our practices in Notice at Collection in Section I of the Privacy Notice.

Click here to view the chart. 

3. Selling or Sharing of Personal Information

We do not sell your Personal Information or share your Personal Information for cross-context behavioral advertising and have not done so in the prior 12 months. We also do not knowingly sell or share the Personal Information of children under the age of 16 and have not done so in the prior 12 months.

4. Your Rights and Choices

The CPRA affords consumers residing in California certain rights with respect to their Personal Information, subject to certain exceptions. Subject to certain limitations, you have the following rights in California: 

(1) Right to Delete. You have the right to request us to delete the Personal Information we have collected about you.

(2) Right to Correct. You have the right to request us to correct inaccurate Personal Information we maintain about you.

(3) Right to Know and Access. You have the right to know and access the Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, and the specific pieces of Personal Information we have collected about you.

(4) Data Portability. You have the right to receive the information under right (3) in a format, to the extent technically feasible, that is portable, usable, and allows you to transmit the Personal Information to a person without impediment, where the processing is carried out by automated means.

(5) Rights Related to Sharing for Cross-Context Behavioral Advertising or Sale. We do not share your personal information for cross-context behavioral advertising or sell your personal information. Please contact us by using the information in Contact Us in Section X of the Privacy Notice above if you have any questions.

(6) Right to No Discrimination. You have the right not to be discriminated against for exercising any of your privacy rights. This includes us not: (a) denying you goods or services; (b) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level or quality of goods or services; and (d) suggesting to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

5. Exercising Your Rights

To exercise your rights described above, please submit a verifiable consumer request to us by either: 

We will need to verify your identity before honoring your privacy right request. We will verify your identity by asking you to provide Personal Information we may have previously collected about you. Subject to certain limitations, we will honor your privacy rights request within 45 calendar days of receipt of your request, unless we request an extension as permitted by applicable Law.

6. Authorized Agents

You may exercise your privacy rights through an authorized agent. If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. If you are an authorized agent seeking to make a request, please contact us by either:

Visiting Citi’s California Privacy Hub at https://online.citi.com/dataprivacyhub; or

Calling us at (833) 981-0270 (TTY: 711).
 

7. Additional Disclosure for California Residents 

If you are a California resident, you have the right to request and receive certain information about disclosure of your Personal Information to third parties for their direct marketing purposes. Because it is our policy not to share your Personal Information with third parties for third-party direct marketing purposes without your consent, we are exempt from the requirement to respond to such requests. If you have any questions related to our policy, please Contact Us using the information provided in Section X.