CLIENT CONSENT AND DATA PRIVACY STATEMENT

Know more about our Client Consent and Data Privacy Statement

Data Privacy Statement | Citibank Philippines

CONSENT ON CITI PROCESSING, PROFILING AND SHARING OF DATA AND INFORMATION (Citi's Data Privacy Terms).

Please read these provisions (the "Consent") on Citi Processing, Profiling and Sharing of Data and Information thoroughly. Capitalized terms used herein shall have the meanings set forth in Citi's Data Privacy Statement (version 1, 3/31/2017), the terms of which are incorporated herein by reference. Citi's Data Privacy Statement ("Data Statement") can be viewed online at www.citibank.com.ph.

The words "We", "Us" and "Our" refer to you as a banking, brokerage, credit, debit or prepaid card or loan prospect/applicant or client or Relevant Individual of a Data Subject of Citibank, N.A. Philippine Branch (Citibank) or Citicorp Financial Services and Insurance Brokerage Philippines, Inc. (CFSI) or any other entity owned or controlled by Citigroup Inc. in the Philippines (collectively, "Citi"). The words "You" and "Your" refer to Citi.

1. We agree that our application, enrollment, purchase, maintenance, access or continued use of any of Citi's products and services shall be deemed as our acceptance and agreement to be bound by the provisions of these terms.

We hereby agree that all Personal Data (as defined under the Data Privacy Law of 2012 and its implementing rules and regulations), customer data and account or transaction information or records (collectively, the "Information") relating to us with you from time to time may be processed, profiled or shared to, by and between Citigroup Inc., and any of its affiliates and subsidiaries (collectively, "Citigroup") or each of the Authority (foreign or domestic) or Data Recipients (whether in or outside the Philippines) and for the purposes as set out in Citi's Data Statement in force provided by you to us from time to time or for compliance with any law, regulation, government requirement, treaty, agreement or policy or as required by or for the purpose of any court, legal process, examination, inquiry, audit or investigation of any Authority. The aforesaid terms shall apply notwithstanding any applicable non-disclosure agreement. We acknowledge that such Information may be processed or profiled by or shared with jurisdictions which do not have strict data protection or data privacy laws.

2. We agree that the Data Statement from time to time in force shall in all respects apply in relation to our application, account and any matter arising therefrom or incidental thereto. We agree that the Data Statement is deemed to be incorporated by reference into this Consent.

3. We understand and agree that we must provide you with such information as you may require from time to time to enable you or Citigroup or relevant Data Recipient to comply with any law or regulation, government requirement, treaty, agreement or policy or as required by or for the purpose of any court, legal process, examination, inquiry, audit or investigation of any Authority.

4. We acknowledge that you may use voice recognition technology to collect and analyze our voiceprint biometric data for the purpose of identity verification when we give instructions through the phone.

5. We consent, in connection with any proposed novation, assignment, transfer or sale of any of your rights and/or obligations with respect to or in connection with our account and any products, facilities and services available in connection with the account, to any novatee, assignee, transferee, purchaser or any other person participating or otherwise involved in such transaction, to the disclosure, to any such person, by you, of any and all Information which may be required in relation thereto.

6. We understand and consent that the processing, profiling and sharing apply during the prospecting and application stages, as well as for the duration of and even after the rejection, termination, closure or cancellation of the account or relationship or Services (collectively "Termination") for a period of at least ten (10) years from the Termination of our last existing account or relationship or that of the Relevant Individual as determined by you. Where you deem it necessary or are required to fulfill foreign and domestic legal, regulatory, governmental, tax, law enforcement and compliance requirements and disclosure to each of the Authority or Industry Organization, we understand and consent that the storage will be made even after a period of ten (10) years from such Termination until the final conclusion of any requirement or disclosure obligation, dispute or action.

7. We agree that Citibank may use our Personal Data and other Information for automated processing and automated decision-making in connection with the prospecting, application, establishment, maintenance, renewal, reissuance, collection, cancellation and closure of our account/s, relationship/s and/or card/s, including the provision of Services.

8. For any update, change, supplement, reconfirmation or remediation of the Data Statement and/or these consents, we hereby specifically authorize the following to accept the Data Statement and to provide the consents anew to you on our behalf in any acceptable form or evidence as determined by you:

  1. Any one of the accountholders in a joint account or relationship;
  2. Principal cardholder in a card account or relationship;
  3. Any one of the security party or guarantor in a borrowing account or relationship;
  4. Company representative in an institutional or corporate client, a merchant party, a commercial card or prepaid card account or relationship; or
  5. Where any one of the above is not present as determined by you, any person as has been authorized by us to act on our behalf.

9. These provisions shall be in addition to, and not in substitution for, any other provision agreed to between Citi and us (whether before or after the date hereof) which gives broader rights of disclosure to Citi than contained herein.

Additional provisions for corporations, partnerships or other juridical entities:

We represent that we have been authorized by any Related Party, Customer Affiliate, Data Subject or other person regarding whom we have provided information to Citi to signify the latter's consent to the provisions herein, and that we have provided to and secured from any Related Party, Customer Affiliate, Data Subject or other person regarding whom we have provided information to Citi any notices, consents and waivers necessary to permit Citi, its affiliates, representatives, and its and their third party service providers and Payment Infrastructure Providers (which refers to a third party that forms part of the global payment system infrastructure, including without limitation communications, clearing or payment systems, intermediary banks and correspondent banks) to carry out the actions described in this provision, and that we will provide such notices and secure such necessary consents and waivers in advance of providing similar information to Citi in the future.

For purposes of these Terms and Conditions, "Control" means an entity that possesses directly or indirectly the power to direct or cause the direction of the management and policies of the other entity, whether through the ownership of shares or the possession of voting power, by contract or through other means or any legal or natural person ultimately has a controlling ownership interest in a legal person or exercises control through any arrangement. "Customer Affiliate" means any entity, present or future, that directly or indirectly Controls or is Controlled by or is under common Control with us, and any branch thereof. "Data Subject" means an individual whose Information is processed, and may also include a juridical entity, where applicable. Data Subjects may be us, our personnel, customers, suppliers, payment remitters or payment beneficiaries, or other persons. "Related Party" means any natural person or entity, or any branch thereof, that (i) owns, directly or indirectly, our stock (if the customer is a corporation), (ii) owns, directly or indirectly, profits, interests or capital interests in us (if the customer is a partnership), (iii) is treated as our owner (if the customer is a "grantor trust" under sections 671 through 679 of the United States Internal Revenue Code or an equivalent under a similar law of any jurisdiction, domestic or foreign), (iv) holds, directly or indirectly, beneficial interests in us (if the customer is a trust), (v) is a natural person who exercises control over us, such as a settlor, protector or beneficiary of a trust, or a person or entity which otherwise has a controlling ownership in or otherwise exercises control over us through any arrangement or other means (if the customer is an entity), (vi) is designated as our signatory or representative (if the customer is an entity).

DATA PRIVACY STATEMENT

This Data Privacy Statement ("Data Statement") is applicable to all persons who have established or propose to establish an account and/or relationship with, and/or who have provided or propose to provide a guarantee or third party security (the "Data Subject") to: (i) Citibank, N.A., Philippine Branch, (ii) Citicorp Financial Services and Insurance Brokerage Philippines, Inc., or (iii) any other entity owned or controlled by Citigroup Inc. in the Philippines (collectively, "Citi"). This Data Statement has been prepared by Citi in connection with the Data Privacy Law of 2012 and its implementing rules and regulations (the "DPA"). Capitalized terms used herein and not otherwise defined shall have the meanings set forth in the DPA. To the extent that any similar agreement and consent involving the data and information of the Data Subject are required under Philippine bank secrecy laws and regulations, this Data Statement is applicable for such purpose.

1. General

  1. The Data Subject agrees that the use or continued use of any of Citi's products and services or maintenance of an account or relationship shall be deemed as the Data Subject's acceptance and agreement to be bound by the provisions of this Data Statement.
  2. From time to time, it is necessary for a Data Subject to allow Citi to undertake processing, profiling and sharing of Personal Data, customer, transaction or account data and information (collectively, the "Information") in connection with the prospecting, application, establishment or maintenance of accounts or relationships, including provision of banking, credit facilities or financial, or customer services (collectively, the "Services").
  3. Failure to supply the Information to Citi, and allow Citi to undertake processing, profiling and sharing of such Information may result in Citi being unable to provide or maintain the Services to the Data Subject.
  4. The Data Subject warrants to Citi that where he/she or his/her representative/s is/are responsible for the provision of any Information relating to any Relevant Individual (as defined below) to Citi, or actually provide/s any such Information to Citi, that he/she has informed each Relevant Individual and such Relevant Individual has given consent to, Citi's processing, profiling and sharing of the Information as described in this Data Statement, and that the Data Subject will obtain such consent in advance of providing any similar Information in the future.
  5. The Data Subject agrees that Information of the Data Subject and a Relevant Individual may be processed, profiled and shared in and to any country/jurisdiction as Citi considers appropriate or necessary, as described below. Such Information may also be processed, profiled and shared in accordance with the local practices and laws, rules and regulations (including any regulatory requests, governmental acts and orders) in such country/jurisdiction.
  6. The Data Subject understands and consents that the processing, profiling and sharing apply during the prospecting and application stages, as well as for the duration of and even after the rejection, termination, closure or cancellation of the Services (collectively "Termination") for a period of at least ten (10) years from the Termination of the last existing account or relationship of the Data Subject or Relevant Individual as determined by Citi. Where Citi has deemed it necessary or required to fulfill foreign and domestic legal, regulatory, governmental, tax, law enforcement and compliance requirements and disclosure to any foreign or domestic market exchange, court, tribunal and/or legal, regulatory, governmental, tax and law enforcement authority or self-regulatory organization, the Data Subject understands and consents that the storage will be made even after a period of ten (10) years from such Termination until the final conclusion of any requirement or disclosure obligation, dispute or action.

2. Description of the Information to be entered into the System

From time to time, Citi may collect directly from the Data Subject, from any person authorized by the Data Subject in a manner approved by Citi, from third parties including Relevant Individuals (as defined below) and from available sources, the following data, and enter the data into any system for processing, profiling and sharing:

  1. Personal Data and account information about the Data Subject, family members, friends, beneficiaries, attorneys, attorneys-in-fact, shareholders, beneficial owners (if relevant), persons under any trust, trustees, partners, committee members, directors, officers or authorized signatories, guarantors, other security and other individuals (collectively for all of the foregoing who are natural persons, "Relevant Individuals"), which may include names, identification particulars, contact details, products and services portfolio information, transaction activity, patterns, history and behavior, employment information, financial background, educational background and demographic data;
  2. data and information generated in the ordinary course of prospecting, accepting applications, establishment, continuation and Termination of Services with Citi, or when a Relevant Individual gives instructions, writes checks, withdraws funds, transfers funds, deposits money, enters into a transaction or arranges banking/credit facilities for himself/herself or for any third party or participates in promos, programs, contests, surveys and other information and records, such as providing preferences, answers to questions intended for security verification, and other data the Data Subject chooses to provide; and,
  3. Information from cookies, or other technologies deployed for analysis of visits to, usage and transactions in websites, mobile applications, SMS or the use of any information technology application of and by Citi, social media networks, data aggregators and data integrators and other available data sources and the use of the internet.

3. Scope and Method of Personal Data Processing, Profiling and Sharing

The scope and method of Personal Data processing by Citi cover the following:

"Processing" refers to any operation or any set of operations performed upon Personal Data including, but not limited to, the collection, recording, organization, storing, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data, and outsourcing of these activities. Processing may be performed through automated means, or manual processing, if the Personal Data are contained or are intended to be contained in a system.

"Profiling" refers to any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects containing that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

"Data sharing" or "sharing" is the disclosure or transfer to a third party of Personal Data or Information by Citi or its data processors or recipients of the data, and excludes outsourcing.

4. Purpose of Information Processing, Profiling and Sharing

The Data Subject agrees that the Information may be processed, profiled or shared by Citi or any person who has legitimately obtained such data from Citi for any of the following purposes (collectively "Permitted Purposes"):

  1. To establish, maintain or terminate accounts and establish, provide or continue banking/credit facilities or financial services including investment, trust, insurance, credit, debit, charge, prepaid or any type of card, loan, mortgage, auto loan, financial and wealth management products and services and otherwise maintaining accurate “know your customer” information and conducting anti-money laundering and sanctions, credit and background checks (whether such facilities or services are offered or issued by Citi, Citi’s affiliates, third parties or through other intermediaries, providers or distributors);
  2. To provide, operate, process and administer Citi accounts and services or to process applications for Citi accounts and services, including banking/financial transactions such as remittance transactions and credit/financial facilities, subscription or proposed subscription of products or services (whether offered or issued by Citi or otherwise), and to maintain service quality and train staff;
  3. To undertake activities related to the provision of the Citi accounts and services including but not limited to transaction authorization, statement printing and distribution, customer service and conduct of surveys, the provision of research reports, offering documents, product profiles, term sheets or other product related materials, administration of rewards and loyalty programs;
  4. To provide product related services and support, including, without limitation, provision of processing or administrative support or acting as an intermediary / nominee shareholder / agent / broker / market participant /counterparty in connection with participation in various products including investment, trust, insurance, credit, debit, charge, prepaid or any type of card, loan, mortgage, auto loan, financial and wealth management products and services (whether such products are offered or issued by Citi, Citi’s affiliates, third parties or through other intermediaries, providers or distributors);
  5. To fulfil foreign and domestic legal, regulatory, governmental, tax, law enforcement and compliance requirements (including US anti-money laundering, sanctions and tax obligations applicable to Citigroup Inc., and any of its affiliates and subsidiaries (collectively, "Citigroup") and disclosure to any foreign or domestic market exchange, court, tribunal, and/or legal, regulatory, governmental, tax and law enforcement authority (each, an "Authority") pursuant to relevant guidelines, regulations, orders, guidance or requests from the Authority) and comply with any treaty or agreement with or between foreign and domestic Authorities applicable to Citi or Citigroup, their agents or providers;
  6. To verify the identity or authority of Relevant Individuals, representatives who contact Citi or may be contacted by Citi and to carry out or respond to requests, questions or instructions from verified representatives or other parties pursuant to Citi's then-current security procedures;
  7. For risk assessment, statistical and trend analysis and planning purposes, including to carry out data processing, statistical, credit, risk and anti-money laundering and sanctions analyses, creating and maintaining credit scoring models, and otherwise ensuring potential or ongoing credit worthiness of Relevant Individuals and Data Subjects, including conducting banking, credit, financial and other background checks and reviews, and maintaining banking, credit and financial history of individuals (whether or not there exists any direct relationship between that Data Subject or Relevant Individual, and Citi) and creating and maintaining business development plans and activities for present and future reference;
  8. To monitor and record calls and electronic communications with Relevant Individuals and Data Subjects for record keeping, quality assurance, customer service, training, investigation, litigation and fraud prevention purposes;
  9. For crime and fraud detection, prevention, investigation and prosecution;
  10. To enforce (including without limitation collecting amounts outstanding) or defend the rights of Citi, Citigroup, its employees, officers and directors, contractual or otherwise;
  11. To perform internal management and management reporting to Citigroup, to operate control and management information systems, and to carry out business risk, control or compliance review or testing, internal audits or enable the conduct of external audits;
  12. To enable an actual or proposed assignee of Citi, or participant or sub-participant or transferee of Citi's rights in respect of the Data Subject to evaluate or consummate a transaction intended to be the subject of the assignment, transfer, participation or sub-participation;
  13. To comply with contractual arrangements or to support initiatives, projects and programs by or between financial industry self-regulatory organizations, financial industry bodies, associations of financial services providers or other financial institutions (each, an "Industry Organization"), including assisting other financial institutions to conduct background or credit checks or collect debts;
  14. To manage Citi's relationship with the Data Subject, which may include providing information about the Data Subject or a Relevant Individual, to Citi or Citigroup;
  15. For marketing to us and to individuals with similar profiles, attributes or behavior, banking, financial, credit, investment, trust, insurance, credit, debit, charge, prepaid or other types of card, loan, mortgage, and wealth management related products or services, conducting market, product and service research, and designing or refining any products or services including by conducting data analysis, and surveys, by various modes of communication including mail, telephone call, SMS, fax, electronic mail, internet, mobile, social media, chat, biometric, and other technological tools and development;
  16. To comply with any obligations, requirements, policies, procedures, measures or arrangements for sharing data and information within Citigroup and any other use of data and information in accordance with any Citigroup-wide programs for compliance with tax, sanctions or prevention or detection of money laundering, terrorist financing or other unlawful activities; and,
  17. purposes relating directly thereto.

5. Classes and Recipients of the Information

In addition, the Data Subject agrees that the Information may be processed, profiled and shared, to the following entities inside or outside the Philippines (each, a "Data Recipient"), in accordance with any purpose described in the Permitted Purposes:

  1. Any person, agent, broker, adviser, contractor or third party service provider who provides administrative, mailing, telemarketing, direct sales, telecommunications, call centre, business process, travel, visa, knowledge management, human resource, data processing, information technology, computer, information security, payment, debt collection, credit or business information, reference or other background checks, leads and referrals, nominee or securities clearing, consulting service, or other services to Citi in connection with the operation of the business of Citi and the Data Subject;
  2. Any person or entity which is part of Citigroup to the extent necessary to fulfil the relevant Permitted Purpose;
  3. Any drawee bank check clearinghouse, or the service provider of the foregoing, in connection with any cheque or equivalent;
  4. Credit reference or information company or bureau, and fellow users, members or subscribers of the foregoing company, bureau or agency (including, where such entities are users, members or subscribers of the foregoing, universal, commercial and thrift banks, including their trust departments, rural banks and entities with quasi-banking license issued by the BSP, including their subsidiaries and/or affiliates that are engaged in the business of providing credit; life insurance companies, mutual benefit associations and other similar entities supervised by the Insurance Commission; credit card companies; financing companies; trust entities; investment houses with quasi-banking license; non-governmental organizations engaged in the micro financing business; government lending institutions, both government financial institutions and government-owned and controlled corporations engaged primarily in lending; cooperatives engaged in lending activities such as credit cooperatives or financial services cooperatives; other entities providing credit facilities; telecommunications companies); and, in the event of default, skip or asset tracing and debt collection agency;
  5. Any person or entity to whom Citigroup is under an obligation or otherwise required to make disclosure pursuant to legal process or under the requirements of any foreign or domestic law, regulation, court order or agreement entered into, binding on or applying to Citigroup, or agreement entered into by Citigroup and any foreign or domestic Authority or between or among any two or more domestic or foreign Authorities, or any disclosure under and for the purposes of any guidelines or guidance given or issued by any Authority, or Industry Organization with which Citigroup is required or expected to comply or participate, or any disclosure pursuant to any contractual or other commitment of Citigroup with an Authority, or Industry Organization, all of which may be within or outside Philippines including disclosure to any Authority, whether such legal process, obligation, request, requirement, agreement or guidance may be existing currently or created in the future;
  6. Any financial institution, processing agent, intermediary, payment infrastructure provider, clearinghouse, issuer, borrower, underwriter, dealer, seller, registrar, registry, paying and collecting agent, custodian, depository, underwriter, fund manager, fund provider, insurer, credit card company, acquiring company, card network or association, securities and investment services provider, trustee or any other person who will be involved in the transactions, Services or any banking/credit or financial activities or with whom the Data Subject has or proposed to or is required to have dealings;
  7. Any actual or proposed assignee of Citi or participant or sub-participant or transferee of Citi's rights in respect of the Data Subject or any other Relevant Individual, of all or any part of the assets or business of Citi; and,
  8. Any party giving or proposing to give a guarantee or third party security to guarantee or secure the Data Subject's obligations or those of any Relevant Individual.
  9. Third party reward, loyalty, privileges, programs or other related services and/or service or product provider;
  10. Co-branding partners of Citi (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
  11. Charitable or non-profit making organizations or other recipients of donations or contributions from the Data Subject;
  12. The respective subcontractor, assignee, vendor or delegate of each of the above-described person or entity.

6. Rights of a Data Subject / Amendment of Data Statement

  1. Under and in accordance with the terms of the DPA, any individual has the right:
    1. To be informed whether Personal Data is being or has been processed. This includes processing through automated decision-making and profiling;
    2. To require Citi to correct any Personal Data relating to the Data Subject which is inaccurate;
    3. To object to the processing of the Personal Data in case of changes or amendments to the Personal Data supplied or declared to the Data Subject;
    4. To access the Personal Data;
    5. To suspend, withdraw or order the blocking, removal or destruction of the Data Subject's Personal Data from Citi's system. It is understood and acknowledged by the Data Subject that where the Data Subject exercises his right set out in this provision, Citi reserves its right to Terminate the Services;
    6. In respect of each Citi entity, requests in relation to the above or for information regarding this Data Statement are to be addressed as follows:
      Attention to The Data Protection Committee
      c/o the Citi Country Compliance Officer
      Address Citibank, N.A., Philippine Branch
      16th Floor, Citibank Plaza, 34th Street, Bonifacio Global City, Taguig City 1634 Philippines

      Citicorp Financial Services and Insurance Brokerage Philippines, Inc.
      11th Floor, Citibank Square, #1 Eastwood Avenue,  Eastwood City, Barangay Bagumbayan, Quezon City, 1110 Philippines
      Email address CitiPHDPO@citi.com
  2. The Data Subject hereby agrees that Citi may amend and vary this Data Statement and the account terms from time to time and that upon notification of such amended Data Statement, the contents thereof shall similarly amend, vary and supplement such account terms and conditions, agreements and/or arrangements aforesaid with effect from the date specified in such amended Data Statement, and without prejudice to the foregoing, the Data Subject's use or continued use of any of Citi's services after such change shall also be deemed as his/her acceptance and agreement to the same.
  3. Nothing in this Data Statement shall limit the rights of Data Subjects under the DPA.