Citi Ethics Office Privacy Statement
October 2021
1. SCOPE
1.1 This Citi Ethics Office Privacy Statement (“Statement”) explains how Citi’s Ethics Office (“we”) may use and otherwise process personal data.
1.2 Employees, customers, and third parties may raise or escalate concerns to the Ethics Office when they suspect or become aware of a possible violation of a law, regulation, Citi policy, or the Citi Code of Conduct. The Ethics Office, located in the United States and part of Citibank, N.A., located at 701 East 60th Street North, Sioux Falls, South Dakota, 57104, oversees the handling of such concerns, and is a data controller. All contacts to the Ethics Office and related investigations are treated as confidentially as possible, consistent with the need to investigate and address the matter and subject to applicable laws and regulations.
2. PERSONAL DATA WE COLLECT
2.1 The Ethics Office obtains your personal data when you raise a concern to the Ethics Office on a non-anonymous basis (i.e., you voluntarily provide your name or other identifying information about yourself to us when you raise your concern), or if a concern is raised about you by someone else. There are two channels available to raise concerns to the Ethics Office: a telephone hotline and web submission page. Additional information about these channels can be found here. The telephone hotline and web submission page is operated by a third-party hotline provider, NAVEX, located in the United States. NAVEX transfers the personal data it collects on behalf of Citi to the Ethics Office for further handling.
2.2 The Ethics Office may also receive your personal data from other Citi entities or functions, as well as third parties, such as Citi’s regulators or suppliers, when that data is related to potential violations of law, regulation, Citi policy, or the Code of Conduct or other concerns raised to the Ethics Office.
3. HOW WE USE PERSONAL DATA
3.1 The Ethics Office will collect, receive, use, store and otherwise process your personal data in order to carry out the legitimate interests set out in this section in accordance with our Code of Conduct and Mission and Values Proposition, and in order to meet our regulatory requirements.
3.2 The Ethics Office collects, receives, uses, stores and otherwise processes personal data for the legitimate interests outlined below where these interests are not overridden by data protection rights and to the extent necessary:
- (a) to investigate and respond to any complaints or concerns raised;
- (b) to administer the Ethics Office’s case management system;
- (c) to communicate with individuals and to verify an individual’s identity when they contact us or when we contact them;
- (d) where relevant, for the establishment, exercise or defense of legal claims;
- (e) in order to protect and enforce the rights, property or safety, our business, Citigroup Inc., Citibank, N.A, or any subsidiaries or affiliates, our stakeholders, our partners or others;
- (f) for information security (including to detect, investigate, monitor, remediate and/or prevent security or cyber incidents), to prevent fraud, and for statistical and trend analysis; and
- (g) for any other purpose that we specifically tell individuals about when we obtain personal data about them.
3.3 The Ethics Office may also use Special Categories of personal data that we receive for the purposes stated in this section. Special Categories of personal data may refer to data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life, sexual orientation or trade union membership, for the purpose of uniquely identifying you.
4. WHEN WE DISCLOSE PERSONAL DATA
4.1 We (or any third party on our behalf) may need to disclose or transfer personal data to others as follows:
- (a) to any Citi entity (including officers, directors, employees, agents, representatives, and professional advisers) for the purpose of managing our and their relationship with an individual and for the other purposes identified in this Statement related to raising, investigating, and remediating concerns raised to the Ethics Office;
- (b) to legal advisors, government and law enforcement authorities and with other parties involved in, or contemplating, legal proceedings or others as required in order to establish, exercise or defend or to protect legal claims, including in relation to our contracts with our clients and in order to protect the rights, property or safety of us, our business, Citigroup Inc., Citibank, N.A, or any subsidiaries or affiliates, our clients or others; and
- (c) to competent regulatory, prosecuting, tax or governmental authorities, courts or other tribunals in any jurisdiction or markets, domestic or foreign, upon their request or in accordance with or as desirable in respect of any applicable law.
5. WHERE WE TRANSFER PERSONAL DATA
5.1 The Ethics Office, our third-party partner which operates the telephone hotline on our behalf (NAVEX), and our translation service provider, Eriksen Translations, are located in the United States. Personal data may be transferred to NAVEX and Eriksen Translations (or to other relevant third-party suppliers where necessary) for the purposes outlined in Section 3 of this Statement. Personal data may also be transferred to other countries for the purposes outlined in Sections 3 and 4, and to the extent allowed by law or regulation.
5.2 In relation to transfers of EU employees’ personal data, Citi conforms to its Privacy Policy for Transferred European Workforce Data (also known as Citi Workforce “Binding Corporate Rules” (BCR)). This policy has been approved by the European personal information protection authorities. Please refer to the provisions of Citi’s BCR for information on how Citi may transfer personal data in compliance with EU law. In relation to transfers of personal data outside the EU of EU individuals who are not employees of Citi, Citi has in place appropriate safeguards, such as standard contractual clauses.
6. HOW LONG WE KEEP PERSONAL DATA
6.1 The Ethics Office stores personal data pursuant to Citi’s Records Management Policy. We keep personal data for as long as is necessary for the purposes outlined in Section 3 of this Statement or for as long as is required pursuant to applicable legal and/or regulatory requirements, whichever is longer.
7. SECURITY
7.1 We implement technical and organizational measures that are appropriate to protect the risk to personal data that we process.
8. INDIVIDUAL’S RIGHTS
8.1 You can ask us to: (i) provide you with a copy of your personal data; (ii) correct your personal data; (iii) erase your personal data; or (iv) restrict our processing of your personal data. These rights will be limited in some situations; for example, where the legitimate interests in Section 3.2 above require the processing of your data or we are required to process your personal data by EU or EU member state law.
8.2 To exercise these rights or if you have questions about how we process your personal data, please contact us using the contact details in this Statement. Individuals in the EEA can also complain to the relevant data protection authorities in the EEA member state where they live or work or where the alleged infringement of data protection law occurred.
9. CHANGES TO THIS PRIVACY STATEMENT
9.1 If we modify this Statement at any time we will place the modified versions on the Ethics Office’s website and here. We encourage you to regularly review this Statement to ensure that you are always aware of what personal information we collect and how we use, store and disclose it.
10. CONTACT
10.1 The contact details for other Citi entities who may have access to your personal data can be accessed here: https://www.citigroup.com/citi/about/countries-and-jurisdictions/.
10.2 Our data protection officer may be contacted at dataprotectionofficer@citi.com or Citi, Citigroup Centre, Canada Square, Canary Wharf, London E14 5LB, United Kingdom.