• Citigroup Global Markets Asia Limited and/or its affiliates (each a "Citi Entity" and collectively, the “Group”) may collect your personal data in connection with the purposes and services set out below from time to time.
• Failure to supply such personal data may result in the Group being unable to carry out those purposes or provide its services to you.
• It is the corporate policy of the Group to respect and safeguard the privacy of an individual’s personal data. Compliance with the Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong) (the “Ordinance”) is not only the responsibility of the management but also the direct responsibility of every employee of each Citi Entity.
• This policy statement stipulates our personal data privacy policy in respect of the operation of www.citifirst.com.hk (the “Hong Kong Website”) and various marketing activities by the Group via, including without limitation, the Hong Kong Website, online social media platforms, newsletter, SMS, email, telephone, offline seminars and media advertisements (the “Marketing Campaigns”).
• Nothing in this policy statement shall limit the rights of any visitor to the Hong Kong Website and any individual of whom personal data is collected in the Marketing Campaigns (“Data Subject”) under the Ordinance.
• For the purpose of this policy statement, words denoting one gender only shall include the other gender.

Purposes of Data Use

• Subject to paragraph 10 in respect of direct marketing, personal data collected from a Data Subject (including the name, contact details and digital footprints (such as cookies) thereof) may be used by a Citi Entity (or any person who has obtained such data from the relevant Citi Entity in accordance with this policy statement) for the following purposes:
  • 7.1. administering the Hong Kong Website;
  • 7.2. statistical analysis;
  • 7.3. marketing services, products and other subjects in respect of which a Citi Entity may or may not be remunerated (please see further details in paragraph 10 below);
  • 7.4. carrying out prize draws, games and competitions, and delivering rewards;
  • 7.5. organizing and delivering seminars and other events hosted by the Group;
  • 7.6. complying with any legal or regulatory obligations, requirements or arrangements applicable to the relevant Citi Entity or its group companies, including but not limited to:
    • 7.6.1. any law binding or applying to it within or outside the Hong Kong Special Administrative Region of the People’s Republic of China (“Hong Kong”) existing currently and/or in the future (e.g. the Inland Revenue Ordinance (Cap. 112, Laws of Hong Kong) and its provisions including those concerning automatic exchange of financial account information or the Foreign Account Tax Compliance Act (FATCA) of the United States);
    • 7.6.2. any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers within or outside Hong Kong existing currently and/or in the future (e.g. guidelines or guidance given or issued by the Inland Revenue Department including those concerning automatic exchange of financial account information or any guideline or guidance concerning the Foreign Account Tax Compliance Act (FATCA) of the United States); and
    • 7.6.3. any present or future contractual or other commitment with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers that is assumed by or imposed on the relevant Citi Entity or its group company by reason of its financial, commercial, business or other interests or activities in or related to the jurisdiction of the relevant local or foreign legal, regulatory, governmental, tax, law enforcement or other authority, or self-regulatory or industry bodies or associations;
  • 7.7. complying with any obligations, requirements, policies, procedures, measures or arrangements for sharing data and information within the group of the relevant Citi Entity and/or any other use of data and information in accordance with any group-wide programmes for compliance with sanctions or prevention or detection of money laundering, terrorist financing or other unlawful activities; and
  • 7.8. other purpose(s) relating to any of the above.

Permitted Disclosure of Data

• Personal data held by a Citi Entity relating to a Data Subject will be kept confidential but it may provide such information to the following parties for the purposes permitted under this policy statement:
  • 8.1. any agent, contractor or third-party service provider who provides administrative, telecommunications, computer or other services to it in connection with the operation of its business;
  • 8.2. any other person or entity under a duty of confidentiality to it, including its group company which has undertaken to keep such information confidential;
  • 8.3. any person or entity to whom the relevant Citi Entity or its group company is under an obligation or otherwise required to make disclosure under the requirements of any law binding on or applying to the relevant Citi Entity or its group company, or any disclosure under and for the purposes of any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers with which the relevant Citi Entity or its group company is expected to comply, or any disclosure pursuant to any contractual or other commitment of the relevant Citi Entity or its group company with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers, all of which may be within or outside Hong Kong and may be existing currently and/or in the future;
  • 8.4. any members and/or group companies of a Citi Entity;
  • 8.5. co-branding partners of a Citi Entity and/or any other members and/or group companies of a Citi Entity (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be);
  • 8.6. third-party financial institutions, insurers, credit card companies, securities and investment services providers;
  • 8.7. third-party reward, loyalty, co-branding and privileges programmes or other related services and/or products providers; and
  • 8.8. charitable or non-profit making organisations.
• Personal data of a Data Subject may be processed, kept and transferred or disclosed in and to a jurisdiction outside Hong Kong, in accordance with the local practices and laws, rules and regulations (including any governmental acts and orders) in that jurisdiction.

Use of Data for Direct Marketing

• Subject to a Data Subject’s consent (which includes an indication of no objection), the Group may use such Data Subject’s data for direct marketing. In this connection, please note that:
  • 10.1. the name, contact details and digital footprints (including cookies) of the Data Subject held by a Citi Entity from time to time may be used by any Citi Entity or group company in direct marketing;
  • 10.2. the following classes of services, products and subjects may be marketed:
    • 10.2.1. financial and related services and products (including structured products);
    • 10.2.2. services and products offered by a Citi Entity's co-branding partners (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be);
    • 10.2.3. events hosted by the Group including but not limited to seminars, workshops, prize draws, games and competitions;
    • 10.2.4. reward, loyalty, co-branding or privileges programmes and related services and products; and
    • 10.2.5. donations and contributions for charitable and/or non-profit making purposes;
  • 10.3. the above services, products and subjects may be provided or (in case of donations and contributions) solicited by a Citi Entity and/or:
    • 10.3.1. any other members and/or group companies of a Citi Entity;
    • 10.3.2. co-branding partners of a Citi Entity and/or any other members and/or group companies of a Citi Entity (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be);
    • 10.3.3. third-party financial institutions, insurers, credit card companies, securities and investment services providers;
    • 10.3.4. third party reward, loyalty, co-branding or privileges programme providers or merchants; and
    • 10.3.5. charitable or non-profit making organisations;
  • 10.4. a Citi Entity may provide the data described in paragraph 10.1 to any of the persons described in paragraph 10.3 for their use in marketing the services, products and subjects, and the relevant Citi Entity requires the Data Subject’s written consent (which includes an indication of no objection) for that purpose; and
  • 10.5. a Citi Entity may receive money or other property in return for providing the data to other persons in paragraph 10.4 and, when requesting the Data Subject’s consent or no objection, the Group will inform the Data Subject if it will receive any money or other property in return for providing the data to other persons.
• Should a Data Subject wish to withdraw his consent, such Data Subject may exercise his opt-out right by notifying the Group in accordance with paragraph 14 below.

Data Access

• Under the Ordinance, a Data Subject has the right to, by notifying the Group in accordance with paragraph 14 below:
  • 12.1. check whether the Group holds data about him and access to such data;
  • 12.2. require the Group to correct any data relating to him which is inaccurate; and
  • 12.3. ascertain the Group’s policies and practices in relation to data and to be informed of the kind of personal data held by the Group.
• In accordance with the provisions of the Ordinance, a Citi Entity has the right to charge a reasonable fee for the processing of any data access request.

Contact Information

• Requests by a Data Subject to the Group under this policy statement (for example, for (i) access to data, (ii) correction of data, (iii) information regarding policies and practices and kinds of data held, (iv) withdrawing his consent to use of data in direct marketing or (v) ceasing to receive any promotional materials from the Group) are to be addressed as follows:

  	Citigroup Global Markets Asia Limited
  Attention﹕	The Data Protection Officer
  Address:	50/F, Champion Tower, Three Garden Road, Central, Hong Kong

Security of Personal Data

• The Group undertakes to make its best efforts to protect the quality and integrity of personal data held by it. The Group intends to take all practicable steps to ensure that personal data held by it are protected against unauthorized or accidental access, processing, erasure or other unauthorized usage. However, the Group cannot ensure the security and confidentiality of internet communications. All information transmitted via the internet is at a Data Subject’s own risk.

Retention of Personal Data

• All practical steps will be taken to ensure that personal data will not be kept longer than necessary and that the Group will comply with all statutory and regulatory requirements in the Hong Kong and any other applicable jurisdictions concerning the retention of personally identifiable information.

Use of Cookies

• When visits are made to the Hong Kong Website, cookies may be installed automatically and retained temporarily in a Data Subject’s memory or on his hard disk. Cookies will record information about a Data Subject’ use of the Hong Kong Website. Each Data Subject is hereby deemed to acknowledge that he has been informed of this practice and authorize the Group to use any information collected through such use of cookies in connection with the purposes set out herein.
• A Data Subject may deactivate the cookies by changing the settings on his web browser. But if a Data Subject blocks all cookies, including strictly necessary cookies, he may find that certain features on the Hong Kong Website will not work properly.

Links to Other Websites

• The Hong Kong Website may contain hypertext links to other websites that are not controlled by the Group. The Group shall not have any liability for the privacy practices or the contents of such websites.

Last updated in January 2022