Privacy Policy Statement relating to the Hong Kong Listed Structured Product Website

This website (the “Hong Kong Website”) is maintained by Citigroup Global Markets Asia Limited and/or its affiliates (each a "Citi Entity" and collectively, the “Website Owner”). From time to time, the Website Owner may collect your personal data in connection with the purposes and services set out below. Failure to supply such personal data may result in the Website Owner being unable to carry out those purposes or provide its services to you. It is the corporate policy of the Website Owner to respect and safeguard the privacy of an individual’s personal data. Compliance with the Personal Date (Privacy) Ordinance (Cap. 486, Laws of Hong Kong) (the “Ordinance”) is not only the responsibility of the management but also the direct responsibility of every employee of each Citi Entity.

This policy statement stipulates our personal data privacy policy in respect of this Hong Kong Website. Nothing in this policy statement shall limit the rights of any visitor to this Hong Kong Website (“Data Subject”) under the Ordinance.

For the purpose of this policy statement, words denoting one gender only shall include the other gender.

(a) Purposes of Data Use

Subject to paragraph (c) in respect of direct marketing, personal data collected from a Data Subject (including the name and contact details thereof) via this Hong Kong Website may be used by a Citi Entity (or any person who has obtained such data from the relevant Citi Entity in accordance with this policy statement) for the following purposes:-

(i) administering this Hong Kong Website;
(ii) statistical analysis;
(iii) marketing services, products and other subjects in respect of which a Citi Entity may or may not be remunerated (please see further details in paragraph (c) below);
(iv) complying with any legal or regulatory obligations, requirements or arrangements applicable to the relevant Citi Entity or its group companies, including but not limited to:
(1) any law binding or applying to it within or outside the Hong Kong Special Administrative Region of the People’s Republic of China (“Hong Kong”) existing currently and/or in the future (e.g. the Inland Revenue Ordinance (Cap. 112, Laws of Hong Kong) and its provisions including those concerning automatic exchange of financial account information or the Foreign Account Tax Compliance Act (FATCA) of the United States);
(2) any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers within or outside Hong Kong existing currently and/or in the future (e.g. guidelines or guidance given or issued by the Inland Revenue Department including those concerning automatic exchange of financial account information or any guideline or guidance concerning the Foreign Account Tax Compliance Act (FATCA) of the United States); and
(3) any present or future contractual or other commitment with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers that is assumed by or imposed on the relevant Citi Entity or its group company by reason of its financial, commercial, business or other interests or activities in or related to the jurisdiction of the relevant local or foreign legal, regulatory, governmental, tax, law enforcement or other authority, or self-regulatory or industry bodies or associations;
(v) complying with any obligations, requirements, policies, procedures, measures or arrangements for sharing data and information within the group of the relevant Citi Entity and/or any other use of data and information in accordance with any group-wide programmes for compliance with sanctions or prevention or detection of money laundering, terrorist financing or other unlawful activities; and
(vi) other purpose(s) relating to any of the above.

(b) Permitted Disclosure of Data

Personal data held by a Citi Entity relating to a Data Subject will be kept confidential but it may provide such information to the following parties for the purposes permitted under this policy statement:-

(i) any agent, contractor or third-party service provider who provides administrative, telecommunications, computer or other services to it in connection with the operation of its business;
(ii) any other person or entity under a duty of confidentiality to it, including its group company which has undertaken to keep such information confidential;
(iii) any person or entity to whom the relevant Citi Entity or its group company is under an obligation or otherwise required to make disclosure under the requirements of any law binding on or applying to the relevant Citi Entity or its group company, or any disclosure under and for the purposes of any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers with which the relevant Citi Entity or its group company is expected to comply, or any disclosure pursuant to any contractual or other commitment of the relevant Citi Entity or its group company with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers, all of which may be within or outside Hong Kong and may be existing currently and/or in the future; and
(iv) (1) any members and/or group companies of a Citi Entity; and
(2) co-branding partners of a Citi Entity and/or any other members and/or group companies of a Citi Entity (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be).

(c) Use of Data for Direct Marketing

Subject to a Data Subject’s consent (which includes an indication of no objection), the Website Owner intends to use such Data Subject’s data for direct marketing and/or transfer such data to the Website Owner’s subsidiaries, its affiliates and/or third parties for direct marketing. In this connection, please note that, after a Data Subject giving such consent:
(i) the name, contact details, products and services portfolio information, transaction pattern and behaviour, financial background and demographic data of the Data Subject held by a Citi Entity from time to time may be used by any Citi Entity or group company in direct marketing;
(ii) the following classes of services, products and subjects may be marketed:
(1) financial and related services and products (including structured products); and
(2) services and products offered by a Citi Entity's co-branding partners (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be);
(iii) the above services, products and subjects may be provided or (in case of donations and contributions) solicited by a Citi Entity and/or:
(1) any other members and/or group companies of a Citi Entity; and
(2) co-branding partners of a Citi Entity and/or any other members and/or group companies of a Citi Entity (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
(iv) a Citi Entity may receive money or other property in return for providing the data to other persons and, when requesting the Data Subject’s consent or no objection, the Website Owner will inform the Data Subject if it will receive any money or other property in return for providing the data to other persons.
Should a Data Subject wish to withdraw his consent, such Data Subject may exercise his opt-out right by notifying the Website Owner in accordance with paragraph (e) below.

(d) Data Access

(i) Under the Ordinance, a Data Subject has the right to, by notifying the Website Owner in accordance with paragraph (e) below:-
(1) check whether the Website Owner holds data about him and access to such data;
(2) require the Website Owner to correct any data relating to him which is inaccurate; and
(3) ascertain the Website Owner’s policies and practices in relation to data and to be informed of the kind of personal data held by the Website Owner.
(ii) In accordance with the provisions of the Ordinance, a Citi Entity has the right to charge a reasonable fee for the processing of any data access request.

(e) Contact Information

Requests by a Data Subject to the Website Owner under this policy statement (for example, for
(i) access to data,
(ii) correction of data,
(iii) information regarding policies and practices and kinds of data held,
(iv) withdrawing his consent to use of data in direct marketing or
(v) ceasing to receive any promotional materials from the Website Owner) are to be addressed as follows:
Citigroup Global Markets Asia Limited
Attention: The Data Protection Officer
Address: 50/F, Champion Tower, Three Garden Road, Central, Hong Kong

(f) Security of Personal Data

The Website Owner undertakes to make its best efforts to protect the quality and integrity of personal data held by it. The Website Owner intends to take all practicable steps to ensure that personal data held by it are protected against unauthorized or accidental access, processing, erasure or other unauthorized usage. However, the Website Owner cannot ensure the security and confidentiality of internet communications. All information transmitted via the internet is at a Data Subject’s own risk.

(g) Retention of Personal Data

All practical steps will be taken to ensure that personal data will not be kept longer than necessary and that the Website Owner will comply with all statutory and regulatory requirements in the Hong Kong and any other applicable jurisdictions concerning the retention of personally identifiable information.

(h) Use of Cookies

(i) When visits are made to this Hong Kong Website, cookies may be installed automatically and retained temporarily in a Data Subject’s memory or on his hard disk. Cookies will record information about a Data Subject’ use of this Hong Kong Website. Each Data Subject is hereby deemed to acknowledge that he has been informed of this practice and authorize the Website Owner to use any information collected through such use of cookies in connection with the purposes set out herein. (ii) A Data Subject may deactivate the cookies by changing the settings on his web browser. But if a Data Subject blocks all cookies, including strictly necessary cookies, he may find that certain features on this Hong Kong Website will not work properly.

(i) Links to Other Websites

This Hong Kong Website may contain hypertext links to other websites that are not controlled by the Website Owner. The Website Owner shall not have any liability for the privacy practices or the contents of such websites.

Last updated in September 2019