Policy Statement relating to the Personal Data (Privacy) Ordinance (the "Ordinance")

It is the corporate policy of each of Citibank, N.A. Hong Kong Branch, Citibank (Hong Kong) Limited, Citicorp International Limited and Diners Club International (Hong Kong) Limited (each a "Citi Entity") to respect and safeguard the privacy of an individual’s personal data. Compliance with the Ordinance is not only the responsibility of the management but also direct responsibility of every employee of each Citi Entity. This policy statement stipulates clearly (1) our purposes of data collection, (2) the important controls employed by each Citi Entity for protection of personal data, (3) the classes of persons we can transfer personal data to, and (4) the data access and correction right of customers, guarantors and security providers (each a "Data Subject").

a. From time to time, it is necessary for a Data Subject to supply a Citi Entity with personal data ("data") in connection with the opening or continuation of accounts and / or the establishment or continuation of banking / credit facilities or provision of banking / financial services.
b. Failure to supply such data may result in the relevant Citi Entity being unable to open or continue accounts or establish or continue banking / credit facilities or provide banking / financial services to the Data Subject.
c. It is also the case that data are collected from a Data Subject in the ordinary course of the continuation of the banking / financial relationship, for example, when a Data Subject writes cheques, transfers funds, deposits money, effects transactions through cards or discusses / arranges banking / credit facilities for himself / herself or for any third party.
d. The purpose for which data relating to a Data Subject may be used by a Citi Entity or any person who has obtained such data from the relevant Citi Entity are as follows:-
i. the daily operation of the services and credit / financial facilities provided to the Data Subject or any third party when the Data Subject is a guarantor or security provider for such facilities;
ii. conducting credit checks and carrying out matching procedures (as defined in the Ordinance) at the time of application for credit and at the time of regular or special reviews which normally will take place one or more times each year;
iii. creating and maintaining the Citi Entity's credit scoring models;
iv. assisting other financial institutions to conduct credit checks and collect debts;
v. ensuring ongoing credit worthiness of a Data Subject;
vi. designing credit / financial services or related products for a Data Subject's use;
vii. marketing services, products and other subjects in respect of which a Citi Entity may or may not be remunerated (please see further details in paragraph (i) below);
viii. determining the amount of indebtedness owed to or by a Data Subject;
ix. enforcement of a Data Subject's obligations, including without limitation the collection of amounts outstanding from a Data Subject;
x. complying with the obligations, requirements or arrangements for disclosing and using data that apply to the relevant Citi Entity or its group company or that it is expected to comply according to:
(1) any law binding or applying to it within or outside the Hong kong Special Administrative Region existing currently and in the future;
(2) any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers within or outside the Hong Kong Special Administrative Region existing currently and in the future;
(3) any present or future contractual or other commitment with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers that is assumed by or imposed on the relevant Citi Entity or its group company by reason of its financial, commercial, business or other interests or activities in or related to the jurisdiction of the relevant local or foreign legal, regulatory, governmental, tax, law enforcement or other authority, or self-regulatory or industry bodies or associations;
xi. complying with any obligations, requirements, policies, procedures, measures or arrangements for sharing data and information within the group of the relevant Citi Entity and/or any other use of data and information in accordance with any group-wide programmes for compliance with sanctions or prevention or detection of money laundering, terrorist financing or other unlawful activities;
xii. enabling an actual or proposed assignee of the relevant Citi Entity or participant or sub-participant of the relevant Citi Entity's rights in respect of the Data Subject to evaluate the transaction intended to be the subject of the assignment, participation or sub-participation;
xiii. comparing data of the Data Subject or other persons for credit checking, data verification or otherwise producing or verifying data, whether or not for the purpose of taking adverse action against the Data Subject;
xiv. maintaining a credit history of the Data Subject (whether or not there exists any relationship between the Data Subject and the relevant Citi Entity or the recipient of the data) for present and future reference; and
xv. purpose relating thereto.
e. Data held by a Citi Entity relating to a Data Subject will be kept confidential but it may provide such information to the following parties for the purposes set out in paragraph (d):-
i. any agent, contractor or third party service provider who provides administrative, telecommunications, computer, payment, debt collection or securities clearing or other services to it in connection with the operation of its business;
ii. any other person or entity under a duty of confidentiality to it including its group company which has undertaken to keep such information confidential;
iii. the drawee bank providing a copy of a paid cheque (which may contain information about the payee) to the drawer;
iv. credit reference agencies, and, in the event of default, to debt collection agencies;
v. any person or entity to whom the relevant Citi Entity or its group company is under an obligation or otherwise required to make disclosure under the requirements of any law binding on or applying to the relevant Citi Entity or its group company, or any disclosure under and for the purposes of any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers with which the relevant Citi Entity or its group company is expected to comply, or any disclosure pursuant to any contractual or other commitment of the relevant Citi Entity or its group company with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers, all of which may be within or outside the Hong Kong Special Administrative Region and may be existing currently and in the future;
vi. any financial institution and charge or credit card issuing companies with which the Data Subject has or proposes to have dealings;
vii. any other person or entity (including its associated companies or affiliates) who has established or proposes to establish any business relationship with it or recipient of the data;
viii. any actual or proposed assignee of the relevant Citi Entity or participant or sub-participant or transferee of the rights of the relevant Citi Entity in respect of the Data Subject or all or any part of the assets or business of the relevant Citi Entity;
ix. any party giving or proposing to give a guarantee or third party security to guarantee or secure the Data Subject's obligations; and
x.
(1) any members and/or group companies of a Citi Entity;
(2) third party financial institutions, insurers, credit card companies, securities and investment services providers;
(3) third party reward, loyalty, co-branding and privileges programme or other related services and/or products providers;
(4) co-branding partners of a Citi Entity and/or any other members and/or group companies of a Citi Entity (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be);
(5) charitable or non-profit making organisations; and
(6) third party service providers (including but not limited to mailing houses, telecommunication companies, telemarketing and direct sales agents, call centres, data processing companies and information technology companies) that a Citi Entity engages for the purposes set out in paragraph (d) above.
  Such information may be transferred to a place outside Hong Kong.
f. Of the data which may be collected or held by a Citi Entity from time to time in connection with mortgages and/or mortgage application(s) in relation to a Data Subject (whether as a borrower, mortgagor or guarantor and whether in the Data Subject's sole name or in joint names with others) on or after April 1, 2011, the following data relating to the Data Subject (including any updated data of any of the following data from time to time) may be provided by the Citi Entity, on its own behalf and/or as agent, to the credit reference agency:
i. full name;
ii. capacity in respect of each mortgage (as borrower, mortgagor or guarantor, and whether in the Data Subject's sole name or in joint names with others);
iii. Hong Kong Identity Card Number or travel document number;
iv. date of birth;
v. correspondence address;
vi. mortgage account number in respect of each mortgage;
vii. type of facility in respect of each mortgage;
viii. mortgage account status in respect of each mortgage (e.g. active, closed, write-off (other than due to a bankruptcy order), write-off due to a bankruptcy order);
ix. if any, mortgage account closed date in respect of each mortgage;
x. mortgage application date; and
xi. where there is any outstanding material default of a mortgage loan, account general data together with the default data relating to such material default.
  The credit reference agency will use the above data supplied by the relevant Citi Entity for the purposes of compiling a count of the number of mortgages from time to time held by the Data Subject with credit providers in Hong Kong, as borrower, mortgagor or guarantor respectively and whether in the Data Subject's sole name or in joint names with others, for sharing in the consumer credit database of the credit reference agency by credit providers (subject to the requirements of the Code of Practice on Consumer Credit Data approved and issued under the Ordinance).
g. Of the data which may be collected or held by a Citi Entity from time to time in connection with consumer credit, the following data relating to the Data Subject (including any updated data of any of the following data from time to time) may be provided by the Citi Entity to the credit reference agency:
i. full name;
ii. correspondence address;
iii. contact information;
iv. date of birth;
v. Hong Kong Identity Card Number or travel document number;
vi. credit application data that do not relate to a mortgage loan;
vii. account general data;
viii. account repayment data; and
ix. credit card loss data.
h. For the purpose of paragraph (e)(iv) above, the Citi Entity shall access and obtain from the credit reference agencies such personal and account information or records of the Data Subject (including information about the number of mortgage count) held by a credit reference agency in accordance with the Ordinance. Without prejudice to the foregoing, the Citi Entity may from time to time access the personal and account information or records of the Data Subject (including information about the number of mortgage count) held by a credit reference agency for reviewing any of the following matters in relation to the existing credit facilities granted to the Data Subject or to a third party which obligations are guaranteed by the Data Subject:
 
i. an increase in the credit amount;
ii. the curtailing of credit (including the cancellation of credit or a decrease in the credit amount); or
iii. the putting in place or the implementation of a scheme of arrangement with the Data Subject or the third party.
i. USE OF DATA IN DIRECT MARKETING
  A Citi Entity intends to use a Data Subject's data in direct marketing and the relevant Citi Entity requires the Data Subject's consent (which includes an indication of no objection) for that purpose. In this connection, please note that:
i. the name, contact details, products and services portfolio information, transaction pattern and behaviour, financial background and demographic data of a Data Subject held by a Citi Entity from time to time may be used by any Citi Entity or group company in direct marketing;
ii. the following classes of services, products and subjects may be marketed:
(1) financial, insurance, credit card, banking and related services and products;
(2) reward, loyalty, co-branding or privileges programmes and related services and products;
(3) services and products offered by a Citi Entity's co-branding partners (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
(4) donations and contributions for charitable and/or non-profit making purposes;
iii. the above services, products and subjects may be provided or (in case of donations and contributions) solicited by a Citi Entity and/or:
(1) a Citi Entity and any other members and/or group companies of a Citi Entity;
(2) third party financial institutions, insurers, credit card companies, securities and investment services providers;
(3) third party reward, loyalty, co-branding or privileges programmes or other related services and/or products providers;
(4) co-branding partners of a Citi Entity and/or any other members and/or group companies of a Citi Entity (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
(5) charitable or non-profit making organisations;
iv.  in addition to marketing the above services, products and subjects itself, a Citi Entity also intends to provide the data described in paragraph (i)(i) above for use by them in marketing those services, products and subjects, and the relevant Citi Entity requires the Data Subject's written consent (which includes an indication of no objection) for that purpose;
v.  a Citi Entity may receive money or other property in return for providing the data to the other persons in paragraph (i)(iv) above and, when requesting the Data Subject's consent or no objection as described in paragraph (i)(iv) above, the relevant Citi Entity will inform the Data Subject if it will receive any money or other property in return for providing the data to the other persons. 
If a Data Subject does not wish a Citi Entity to use or provide to other persons his data for use in direct marketing as described above, the Data Subject may exercise his opt-out right by notifying the relevant Citi Entity.
j. Under and in accordance with the terms of the Ordinance and the Code of Practice on Consumer Credit Data approved and issued under the Ordinance, any individual has the right:-
i. to check whether a Citi Entity holds data about him / her and access to such data;
ii. to require a Citi Entity to correct any data relating to him / her which is inaccurate;
iii. to ascertain a Citi Entity's policies and practices in relation to data and to be informed of the kind of personal data held by that Citi Entity;
iv. in relation to consumer credit and mortgage loans, to request to be informed which items of data are routinely disclosed to credit reference agencies or debt collection agencies, and be provided with further information to enable the making of an access and correction request to the relevant credit reference agency or debt collection agency, as the case may be; and
v. in relation to any account data (including, for the avoidance of doubt, any account repayment data) which has been provided by a Citi Entity to a credit reference agency, to instruct the relevant Citi Entity, upon termination of an account by full repayment, to make a request to the credit reference agency to delete such data from its database, as long as the instruction is given within five years of termination and at no time was there any default of payment, lasting in excess of 60 days within 5 years immediately before account termination. Account repayment data include amount last due, amount of payment made during the last reporting period (being a period not exceeding 31 days immediately preceding the last contribution of account data by the relevant Citi Entity to a credit reference agency), remaining available credit or outstanding balance and default data (being amount past due and number of days past due, date of settlement of amount past due, and date of final settlement of amount in default lasting in excess of 60 days (if any)).
k. In the event of any default of payment relating to an account, unless the amount in default is fully repaid or written off (other than due to a bankruptcy order) before the expiry of 60 days from the date such default occurred, the account repayment data (as defined in paragraph (j)(v) above) may be retained by the credit reference agency until the expiry of five years from the date of final settlement of the amount in default.
l. In the event of any amount being written off due to a bankruptcy order being made against the Data Subject, the account repayment data (as defined in paragraph (j)(v) above) may be retained by the credit reference agency, regardless of whether the account repayment data reveal any default of payment lasting in excess of 60 days, until the expiry of five years from the date of final settlement of the amount in default or the expiry of five years from the date of the Data Subject's discharge from bankruptcy as notified by the Data Subject with evidence to the credit reference agency, whichever is earlier.
m. A Citi Entity may have obtained a credit report on the customer from a credit reference agency in considering any application for credit. In the event the Data Subject wishes to access the credit report, the Citi Entity will advise the contact details of the relevant credit reference agency.
n. Data of a Data Subject may be processed, kept, transferred or disclosed in and to any country as the Citi Entity or any person who has obtained such data from Citi Entity referred to in paragraph (e) above considers appropriate. Such data may also be processed, kept, transferred or disclosed in accordance with the local practices and laws, rules and regulations (including any governmental acts and orders) in such country.
o. In accordance with the terms of the Ordinance, a Citi Entity has the right to charge a reasonable fee for the processing of any data access request.
p. In respect of each Citi Entity, requests for access to data or correction of data or for information regarding policies and practices and kinds of data held are to be addressed as follows:
Attention to The Data Protection Officer The Data Protection Officer
Citi Entity Citibank, N.A., Hong Kong Branch or
Citicorp International Limited
Citibank (Hong Kong) Limited or
Diners Club International (Hong Kong) Limited
Address 50/F Citibank Tower, Citibank Plaza,
3 Garden Road, Central,
Hong Kong
8/F Dorset House, Taikoo Place,
979 King's Road, Quarry Bay,
Hong Kong
Telephone (852) 2868-8888 (852) 2868-8888
q. Nothing in this Policy Statement shall limit the rights of Data Subjects under the Ordinance.
r. You may, at any time, choose not to receive our promotional materials. Please let us know in writing in case of such a request.
April 2013