The categories of Personal Data about you that we Process, subject to applicable law, are as follows:

• Personal Identifiers: your name, gender; date of birth, marital status; Passport or National ID number; (tax identification number(s), nationality; images of passports; a sample of your signature; online authentication information (passwords, mother’s maiden name, challenge/response questions and answers, PINs, facial and voice recognition data); photographs; visual images; and personal appearance and behaviour.
• Family details: names and contact details of family members and dependents or beneficiaries of trusts.
• Business and personal contact details: address; telephone number; email address; and social media profile details.
• Former employment: industry; role; business activities; names of current and former employers; work address; telephone number; work email address; and work-related social media profile details.
• Financial details: billing address; bank account numbers; credit card numbers; cardholder or accountholder name and details; instruction records; transaction details; and counterparty details.

Sensitive Personal Data: We do not archive nor collect protected categories of data. Please note that if you are a US Person we will store your Social Security Number, Drivers License and Passport. In some US jurisdictions these documents are considered sensitive.

Our UK Citi entities, branches, subsidiaries or affiliates, may process your personal information for the reasons set out below.

We safeguard and store information that you provided us directly, and information we learnt about you from our communications and dealings with you. We may have also obtained information about you from others, as set out below.

We do not collect historical information under the legal basis of consent. Please refer to the table in Section 3 for the consequences of not providing consent where it is needed for processing.

We disclose your personal information, as applicable:

1. to the bank or financial institution that acquired the divested consumer finance business portfolio and, subject to legal restrictions, to in-country Citi affiliates, for the purpose of winding down a business line and other purposes identified in this Privacy Statement;
2. in case of threatened or filed litigation, to our counsel and external advisors;
3. in case of substantial business risks and as permitted by applicable law, to our parent and group companies, who may process and exchange personal data with the responsible Citigroup chief trust officer, senior risk officer, compliance officer, tax officer, anti-money laundering officer, fraud officer, audit officer, data protection officer, control officer, Citi leadership team, and Citi managers;
4. at the request of any financial institution, payment infrastructure provider, custodian, sub-custodian, fund houses, fund administrators or issuers of securities, in relation to any maturing payment or repayment of a closed (but still active) trust, loan or investment;
5. as required in order to establish, exercise or defend or to protect legal proceedings, including in relation to contracts with our clients and in order to protect the rights, property, or safety of us, our business, any Citi entities, our clients or others including to legal, tax or other professional advisors, government and law enforcement authorities, and with other parties involved in, or contemplating, legal proceedings;
6. with authorities in any jurisdiction including any government, judicial, or regulatory body of which your Data Controller entity is subject to, in the following cases: (i) if false or inaccurate information was gathered, in case of a criminal or money laundering investigation, (ii) for or in connection with an examination of us by our parent bank or other examiners; (iii) pursuant to subpoena or other legal process; (iv) at the express direction of any other authorised government agency; (v) to our internal or external attorneys or auditors; (vi) to others to whom the Data Controllers are required to make such disclosure by applicable law, including attorneys nominated to represent you under a Lasting Power of Attorney or by the Court of Protection under the Mental Capacity Act 2005.
7. we will also disclose your information:
   1. Without divulging or giving access to your banking or transaction details, to our sub-contractors who we have engaged for storage of your information under strict confidentiality undertakings;
   2. to any bank, financial institution, law firm or company that processes claims (including class actions) on your behalf, whether contractual or not, arising out of a closed relationship, and to the Credit Management Companies you have given authority to; and
   3. to third parties providing data services to us, in respect of any claims or queries arising out of, or in relation with, any agreement that existed between you and us, including specifically our processors (a) Equiniti (in the UK) and (b) Tata Consulting Services (TCS) in Singapore and other countries.
   Where we transfer data for storage, or grant access for processing to entities outside the UK or the EU/EEA, in countries that have not attained a formal Adequacy decision by the European Commission, or the UK government we put in place standard contractual clauses (SCCs) as set out in the European Commission Implementing Decision (EU)2021/914 with UK Addendum, or rely on other valid data transfer mechanisms. We also conduct data transfer impact assessments and set up specific measures to cover any gaps the impact assessment may highlight.

We archive your personal and financial data within our European IT network, or when authorised by local regulators, within secured IT virtual servers or private cloud networks and deep archive solutions subcontracted by Citi for electronic and paper records. Please note that only us, and the bank or financial institution that acquired our consumer finance business, and our and their financial and prudential regulators, have legal right to access and audit your personal or financial data.

Due to the nature of electronic communications, data processors store transient copies that are subsequently deleted after the customer data is processed, and there is no mandate to retain it under applicable law.

Personal data processed in connection with a divested consumer finance business is stored during the term in which that account or product (and any transaction under it) remained open or ‘active’. This is followed by a retention period, the length of which is reasonably determined by Citi, taking into account the statute of limitations (the Limitations Act 1980) which establishes timescales for civil liability after contract termination. In most cases, your information is deleted after 7 years from the closure of your account or product at Citi. In document that were witnessed or executed as Deeds, that term is between 10 and 12 years. We will retain voice recordings or electronic communications for shorter periods (instructions for 5 years and transient records are deleted at the end of each calendar year). We dispose of our records, and any personal data that is contained in them, at the end of their corresponding retention period. We may hold on to contractual and personal data if under applicable law, financial or data regulators or a court of law instruct us to save certain data during ongoing investigations or during litigation.

11.1 You can ask us to: (a) provide a copy of your personal information; (b) correct errors or mistakes in your personal information; (c) erase your personal information after the statutory limitation period has expired (if we have not already disposed of your data); (d) transfer your personal information to other organisations; and (e) restrict processing of your personal information. These rights are limited by law, in particular as this privacy notice relates to the processing of historical data stored in ‘vaults’, certain rights relating deletion or transfer to a designated person may be impossible or involve a disproportionate effort. Citi does not use or share any data relating to divested consumer finance businesses for marketing purposes.

11.2 If you wish to exercise your data rights, or if you have any queries about your personal information, please contact Canada Square Operations Limited using the contact details provided in Section 2.1 of this Privacy Statement. If you have any unresolved concerns, you can reach out to our UK Data Protection Office. You also have the right to complain to the Information Commissioner’s Office and/or the Jersey Office of the Information Commissioner, as detailed in Section 2.