Citigroup.com Homepage

Privacy Notice for visitors to Citigroup website

This page was last updated on December 4, 2023.

This Privacy Notice (the "Notice") governs how Citigroup Inc. and our subsidiaries and affiliated companies (collectively, “Citi,” “we,” or “us”) collect, use, and disclose Personal Information (as defined below) from and about users (“you”) of this website. We advise you to read the Notice in its entirety, including the jurisdiction-specific provisions in the appendix to this Notice, which will apply to users in certain jurisdictions.

If you are a California resident, the California Privacy Rights Act may give you certain privacy rights related to your Personal Information, which are in addition to any rights set forth in this Notice. Please read the California Supplemental Provision below for additional information.
Please note that if you are a Citi customer, additional privacy notices may apply to you as a customer of a particular Citi business, and this Notice does not replace any other privacy notice that may be applicable to Personal Information collected or used by Citi through that customer relationship with Citi.

Personal Information Collected Through the Services

The type of personal information we collect is classified as Other Information.

"Other Information" is information that does not and cannot reveal an individual's specific identity, such as information that has been de-identified or aggregated.

Citi collects and uses certain Personal Information in order to operate and provide you with access to the Services. This includes Personal Information that we collect automatically when you visit or interact with the Services.

Information That We Collect About Your Use of the Services

We automatically collect certain information about your use of the Services and about the device you use to access the Services, which may include: 

  • The pages you request and visit;
  • Information obtained in the course of maintaining or supporting the Services;
  • Information about your internet use, such as your IP address, the URLs of sites from which you arrive or leave the Services, your type of browser, your operating system, your internet provider; and
  • If you access the Services via your mobile device, we may also collect information about your mobile provider and type of mobile device.

We (and others that control collection of Personal Information) use different technologies to collect this information, including cookies and web beacons. Cookies are small data files stored on your hard drive or in device memory that help us improve our Services and your experience, see which areas and features of our Services are popular, and count visits. Web beacons are electronic images that may be used in our Services or emails and help deliver cookies, count visits, and understand usage and campaign effectiveness. For more information about cookies and how to disable them, please see "Your Choices" below.

Advertising and Analytics

We may allow others to provide analytics services and serve advertisements on our behalf across the web and in mobile apps. These entities may use cookies, web beacons, device identifiers, and other technologies to collect information about your use of our Services and other websites and applications, including your IP address, web browser, mobile network information, pages viewed, time spent on pages or in mobile apps, links clicked, and conversion information. This information may be used by us and others to, among other things, analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on our Services and other websites, and better understand your online activity. For more information about interest-based ads, or to opt out of having your web browsing information used for behavioral advertising purposes, please visit www.aboutads.info/choices. Your device may also include a feature (“Limit Ad Tracking” on iOS or “Opt Out of Interest-Based Ads” or “Opt Out of Ads Personalization” on Android) that allows you to opt out of having certain information collected through mobile apps used for behavioral advertising purposes.

How Personal Information Is Used

We may disclose your Personal Information for the following purposes or as otherwise described in this Notice:

  • With our service providers, who provide services such as website hosting, data analysis, information technology and related infrastructure provision, customer service, processing your transactions, e-mail delivery, auditing, and other services;
  • To cooperate with public and government authorities and law enforcement, and to respond to their requests, or to provide them with information as required;
  • For other legal reasons, such as to monitor compliance with and enforce our terms and conditions, to protect our rights, privacy, safety, or property, and/or that of our affiliates, you
    or others, to protect against fraud, crime, illegal activity, anti-money laundering, or anti- terrorism, and for risk management purposes; and
  • In connection with a sale or business transaction, such as to an acquiring entity or its advisors in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

We may also disclose aggregated or de-identified information that cannot reasonably be used to identify you to help deliver products, services, and content that are tailored to the users of our Services and for other purposes.

Children

Our Services are not designed for children and we do not knowingly collect Personal Information from children under the age of 13. If you have reason to believe that a child has provided Personal Information to us, please contact us, and we will take appropriate action.

Links to Other Websites

The Services may contain links to other websites. Please note that Citi is not responsible for the privacy or information security practices of other websites. You should carefully review the applicable privacy and information security policies and notices for any other websites you click through to via the Services. 

Security

We seek to use reasonable physical, electronic, and procedural measures to safeguard Personal Information within our organization against loss, theft, and unauthorized use, disclosure, or modification. Unfortunately, however, no data transmission over the internet can be guaranteed to be 100% secure. As a result, while we strive to protect your information, we cannot guarantee its security.

Your Choices

Cookies

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject browser cookies. Please note that if you choose to remove or reject cookies, this could affect the availability and functionality of our Services. For additional information on our cookies policy please refer to the Citigroup Websites Cookie Policy.  

Managing your Cookie preferences

We respect your right to privacy, and you can choose not to allow some types of cookies. You can disable cookies by clicking on the different category headings that is available in the pop-up cookies banner when you first access the site. 

Cookie List 

Strictly Necessary Cookies

Always Active
Allow our services to operate in a secure and reliable manner and provide basic functionalities. These cookies are essential and are used for website operations, navigation and allowing images to load. Strictly Necessary cookies cannot be disabled, and your internet browser will accept them by default. You can set your browser to delete them after each online session or at any time thereafter.

Functional Cookies

These cookies allow the website to remember choices you make, like what language you prefer and your location. Functional cookies can include first-party, third-party, persistent or session cookies. Like Strictly Necessary cookies, Functionality cookies are used to provide services that you request. These cookies can remember preferences to boost the user experience on a website.
Performance Cookies
 
These cookies collect information about how you use the website, like which pages you visit, and which links you clicked on. Their sole purpose is to improve website functions. This includes cookies from third-party analytic services as long as the cookies are for Citi’s exclusive use.

Targeting Cookies

These are also known as “marketing” cookies. These cookies track online activity to help advertisers deliver more relevant advertising or to limit how many times you see an advertisement. These cookies can share that information with other organizations or advertisers. These are persistent cookies and almost always of third-party provenance.

Updating Your Personal Information

Keeping your account information accurate and up to date is very important. If your account information is incomplete, inaccurate or not current, please use the Contact Us option on our website, or call or write to us at the telephone numbers or appropriate address for changes listed on your account statements, records, online or other account materials. You can also speak to a branch representative, your financial advisor or your designated account representative.

Changes to This Notice

From time to time, we may revise this Notice. Changes may be made for any number of reasons, including to reflect industry initiatives, changes in the law, and changes to the scope of the Services, among other reasons. You can tell when we last updated the Notice by checking the date at the beginning of the Notice. Any changes will become effective when we post the revised Notice on the Site.

Contact Us

If you have any questions about this Notice, please contact us using the contact information listed below.

If you are contacting us from outside the United States, please refer to the relevant Citi country page or use the contact details in the local privacy notice for your product. 

Appendix

Supplemental provisions regarding individuals in the EEA


If you are in the European Economic Area ("EEA"), you have certain rights and protections under the law regarding the processing of your personal data.

Legal Basis for Processing

If you are in the EEA, when we process your personal data we will only do so in the following situations:

We need to use your personal data to perform our responsibilities under our contract with you (e.g., to facilitate your participation in voluntary polls and surveys).

We have a legitimate interest in processing your personal data. For example, we may process your personal data to send you marketing communications, to communicate with you about changes to the Services, and to provide, secure, and improve our Services.

We find such processing is necessary to comply with our legal obligations.

We have your consent to do so. When consent is the legal basis for our processing, you may withdraw such consent at any time.

Data Subject Requests


You may have certain rights with respect to the personal data which Citi holds about you, including the right to access or correct (and sometimes, object to or delete) the information. If you would like to request to review, correct, update, suppress, restrict or delete personal data that you have provided to us, object to the processing of personal data, or if you would like to receive an electronic copy of your personal data for purposes of transmitting it to another company (to the extent this right to data portability is provided to you by applicable law) you may contact our GDPR Data Protection Officer using the bellowing information. We will respond to your request consistent with applicable law.

EU/EEA

EU/EEA Data Protection Officer
Citi
1 North Wall Quay
Dublin
D01 T8Y1
Ireland

UK

UK Data Protection Officer
Citi
Citigroup Centre
25 Canada Square
London
E14 5LB
United Kingdom

For your protection, we may only implement requests with respect to the personal data associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable. Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion.

Data Retention

We retain personal data for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

  • The length of time we have an ongoing relationship with you and provide the Services to you (for example, for as long as you keep using the Services);
  • Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or
  • Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

Data Controller

Except as otherwise specified on any subsections within sites or apps that comprise the Services, your personal data will be controlled by Citigroup Technology Inc. of 388 Greenwich Street, New York, NY 10013, USA and/or the Citi entity which operates the Services you are accessing (and/or if you are Citigroup personnel, the Citi entity which employs you or contracts with you). A list of Citi entities can be found here for the applicable Citi entity or entities, please contact us.

Data Transfer

Your personal data may be stored and processed in any country where we have facilities or in which we engage service providers.

Some of the non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here).

You may lodge a complaint with a data protection authority for your country or region where an alleged infringement of applicable data protection law has occurred. A list of data protection authorities is available here.

Supplemental provision applicable to California residents

Supplemental Provision – California

Last Updated and Effective Date: December 4, 2023
This California Supplemental Provision (the “Supplement”) supplements the information contained in the Citigroup.com Privacy Notice (the “Privacy Notice”) and applies solely to residents of California who have rights under the California Privacy Rights Act (“CPRA”) (“consumers” or “you”). Unless otherwise defined in the Privacy Notice, any terms defined in this Supplement have the meaning used in the CPRA. 
We do not collect other forms of Personal Information called “sensitive” Personal Information, which are subject to additional protections under applicable data privacy laws. Because we do not collect “sensitive” Personal Information, we do not need to provide a Limit Use and Disclosure of Sensitive Personal Information right under the CPRA.
Summary of Personal Information Handling Practices
We provide in the chart below a summary of our prior 12-month Personal Information handling practices. We do not sell your Personal Information to third parties for monetary consideration. However, we may share your Personal Information with third parties for advertising purposes. We do not have actual knowledge of any collection, use, sale, or sharing of Personal Information of consumers under 16 years of age.
Categories of Personal Information Sources Purposes of Processing such Personal Information Recipients of Personal Information
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement. From You
  • To recognize you, your device or your browser when you use the websites/services so that we can facilitate navigation, display information more effectively, store your preferences and otherwise personalize your experience and enhance the use of the websites/services;
  • To manage our business, such as for data analysis, audits, fraud monitoring and prevention, information security, ensuring that the websites/services function properly and otherwise administering and improving them, developing new products and services, identifying usage trends, and expanding our business activities; 
  • To review statistical information about use of the websites/services in order to improve their design and functionality, to understand how they are used, and to assist us with resolving questions about the Websites/services; and
  • To fulfill our compliance or legal obligations or as otherwise permitted by applicable laws.

Sold

We have not sold this information to third parties for monetary consideration.

Shared

We may have shared this information with third party cookie and tracker providers for targeted advertising purposes. See the Advertising and Analytics section in the Privacy Notice for more details.

Service Providers

We have disclosed this information to our affiliates and to other parties that provide services to us or act on our behalf in connection with the operation of our business. See the  How Personal Information is Disclosed section  in the Privacy Notice for more details.
Geolocation data. From your usage of the site
  • To recognize you, your device or your browser when you use the websites/services and enhance the use of the websites/services;
  • To manage our business, such as for data analysis, audits, fraud monitoring and prevention, information security, ensuring that the websites/services function properly and otherwise administering and improving them, developing new products and services, identifying usage trends, and expanding our business activities;
  • To review statistical information about use of the websites/services in order to improve their design and functionality, to understand how they are used, and to assist us with resolving questions about the Websites/services; and
  • To fulfill our compliance or legal obligations or as otherwise permitted by applicable laws.

Sold

We have not sold this information to third parties.

Shared

We have not shared this information with third parties for targeted advertising purposes.

Service Providers

We have disclosed this information to our affiliates and to other parties that provide services to us or act on our behalf in connection with the operation of our business. See the How Personal Information is Disclosed section in the Privacy Notice for more details.

Retention of Personal Information

We store Personal Information for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations. 

Your Rights and Choices

The CPRA affords consumers residing in California certain rights with respect to their Personal Information, subject to certain exceptions. Subject to certain limitations, you have the following rights in California:
  • (1) Right to Delete. You have the right to request us to delete the Personal Information we have collected about you.
  • (2) Right to Correct. You have the right to request us to correct inaccurate Personal Information we maintain about you.
  • (3) Right to Know and Access. You have the right to know and access the Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, and the specific pieces of Personal Information we have collected about you.
  • (4) Data Portability. You have the right to receive the information under right (3) in a format, to the extent technically feasible, that is portable, usable, and allows you to transmit the Personal Information to a person without impediment, where the processing is carried out by automated means.
  • (5) Right to Opt-Out. You have the right to opt out of certain processing, such as opting out of profiling or our sale or sharing of your Personal Information.
  • (6) Right to No Discrimination. You have the right not to be discriminated against for exercising any of your privacy rights. This includes us not: (a) denying you goods or services; (b) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level or quality of goods or services; and (d) suggesting to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Exercising Your Rights

To exercise your rights described above, please submit a verifiable consumer request to us by either:
Except for the right to opt-out related to selling or sharing your Personal Information, we will need to verify your identity before honoring your privacy right request.  Subject to certain limitations, we will honor your privacy rights request within 45 calendar days of receipt of your request, unless we request an extension as permitted by data privacy laws.  However, we will honor opt-out of sale and sharing requests within 15 business days.

Authorized Agents

You may exercise your privacy rights through an authorized agent. If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. If you are an authorized agent seeking to make a request, please contact us by either:

Additional Disclosure for California Residents

California law permits residents of California to request certain details about how their information is shared with third parties for direct marketing purposes. If you are a California resident and would like to make such a request, please contact us by either:

Contact Information

If you have any questions about this Supplement, the ways in which we collect and process your Personal Information described in this Supplement, your choices and rights regarding such use, or wish to exercise your rights under the CPRA, please visit Citi Privacy Hub or call us at (833) 971-1191 (TTY: 711).  

Supplemental provision applicable to users registering from the UAE

Your use of the Services signifies that you agree to waive your material privacy rights under the laws of the UAE. You also agree not to hold Citi liable for any publicity, any publication of news, or comments pertaining to the secrets of your or any other person's private or family lives on the Services. Your use of the Services signifies your consent to allowing Citi to disclose any information that you may consider a secret to anybody at any time. You agree not to hold Citi liable for any disclosure of such information that you may think to be a secret to anyone. Please do not use the Services if you disagree with any part of this Notice.

Supplemental provision applicable to users registering from Korea

Your consent of the Notice and User Agreement upon joining the Citi Alumni Site is deemed that you agreed that your personal information will be controlled, not by Citibank Korea Inc. nor other subsidiaries and affiliates in Korea ("Citi Korea"), but by Citigroup Inc. NY, USA and/or Citi entity which operates the Services you are accessing. Citi Korea is solely responsible for the use of your
personal information within Korea, when it is used by Citi Korea, under the applicable Korean laws including; Personal Information Protection Act, Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., and other relevant Korean laws. Your personal information and the Submitted material can be shared with Citi Korea but Citi Korea will not collect and use such personal information and material for any marketing purpose without your prior consent. When Citi Korea obtains personal information our personal information via the Services, the use will be controlled by and be bound to the necessary process and procedure following the applicable Korean laws.

Sign up to receive the latest from Citi.