Privacy Policy

We collect personal information that identifies you, with respect to your relationship to the Business, as an individual or otherwise relates to identifying information about you, such as your name, phone number, and e-mail. We, or companies we work with, collect other information such as browser and device information, app usage data, information collected through cookies, web beacons and other technologies, demographic and other information, behavioral information and aggregated information about your visits to, or use of our sites, and other services. While that information alone may not reveal your specific individual identity, we may associate this usage and other information we collect with personal information about you. This other information is described in more detail below in Section 4. We may share anonymized, pseudonymized or de-identified aggregated information with third parties to help deliver products, services, and content that are tailored to the users of our Sites/Services and for other purposes.

We may use the personal and other information we collect from and about you and the Business to:

• Authenticate you so that you can access the Sites/Services and conduct account transactions on the Sites/Services;
• Recognize you, your device or your browser when you use the Sites/Services so that we can facilitate navigation, display information more effectively, store your preferences and otherwise personalize your experience and enhance the use of the Sites/Services;
• Process applications and transactions for the Business;
• Respond to your inquiries, fulfill requests and request your feedback;
• To track responses to our e-mails and advertisements and to measure the success of our marketing campaigns;
• Manage our business, such as for data analysis, audits, fraud monitoring and prevention, information security, improving the Sites/Services, developing new products and services, identifying usage trends, and expanding our business activities;
• Review statistical information about use of the Sites/Services in order to improve their design and functionality, to understand how they are used, and to assist us with resolving questions about the Sites/Services; and
• Ensure that the Sites/Services function properly and otherwise administer the Sites/Services.

Your personal information may be shared:

• with our affiliates to the extent permissible under applicable law;
• with our third party service providers, who provide services such as website hosting, data analysis, information technology and related infrastructure provision, customer service, processing your transactions, e-mail delivery, auditing, and other services;
• with Participating Lenders for the purpose of facilitating your engagement with potential lenders through Bridge built by Citi^SM; and

We also may use and disclose your personal information and information about you and the Business as we believe to be necessary or appropriate: (a) under applicable law, which may include laws outside your country of residence; (b) to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include such authorities outside your country of residence; (c) to enforce our terms and conditions; and (d) to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or others.

We may transfer information to Citi affiliated companies or third parties throughout the world, for example to process transactions and provide you with products and services. Regardless of where we process your information, we still treat it in accordance with this Notice and applicable law.

In addition to personal information you provide directly to us, we and our service providers may collect other information about you, which is collected in a variety of ways, including:

• Through your use of your browser or device:
  Certain information is collected by internet browsers or automatically through your device, such as your Media Access Control (MAC) address, computer type (Windows or Macintosh), screen resolution, operating system name and version, device manufacturer and model, device identifier, language, and Internet browser type and version. We may also collect your IP address, along with the time of your visit and the page(s) visited. We may also collect behavioral data about the way you use your devices or our mobile apps and website.
• Using cookies, pixel tags, device profiling, and similar technologies:
  We may use cookies, pixel tags, and similar technologies to collect browser, device and other information, such as time spent on the Site, pages visited, language preferences, and other traffic data. These cookies may contain or reflect segment or other interest-based data in a de- identified form including interests across other sites. We may also collect various attributes associated with your device (such as IP address, installed fonts, language and browser settings, and time zone) in order to create a device “fingerprint” or identifier so that we can recognize your device. Other similar tracking technologies may be introduced and used by us in the future in connection with the Site.
• You can choose whether to accept cookies through your browser settings. For example, most browsers allow you to automatically decline cookies or decline or accept a particular cookie (or cookies) from a particular site when browsing. If you decide not to accept cookies, some features of the Site may not work properly because we may not be able to recognize your device and associate you with your Citi account(s). In addition, the offers or content we provide when you visit our site or on third party sites may not be as relevant to you or tailored to your interests.

In some instances, we may combine other information with personal information where permissible by law and applicable industry guidelines.

Some browsers have a “do not track” feature that lets you tell websites that you do not want to have your online activities tracked. At this time, we do not respond to browser “do not track” signals.

The security of personal information about you is a priority. We seek to protect this information by maintaining physical, electronic, and procedural safeguards designed to protect personal information within our organization. We provide employee training in the proper handling of personal information. When we use other companies to provide services for us, we require them to protect the confidentiality of personal information they receive from us. Although we take extensive measures to protect your personal information, and to anticipate and mitigate new threats to personal information, unfortunately, no data transmission over the Internet or wireless network or data storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately contact us.

With respect to Participating Lenders, they maintain their own privacy, security, and other practices and so we refer you to their policies for further information on their approach to the security of personal information about you.

We may change this Notice from time to time. When we do, we will let you know by appropriate means, such as posting the revised Notice on this page with a new effective date. Any changes will become effective when we post the revised Notice on the Site. Your use of the Sites/Services following these changes means that you accept the revised Notice.

This Notice does not address, and we are not responsible for, the privacy, security, or other practices of any third parties, including any third party operating any site or service to which the Site links or any Participating Lender. The inclusion of a link on the Site does not imply endorsement of the linked site or service by us or by our affiliates. In addition, we are not responsible for the information collection, usage, disclosure, or security policies or practices of other organizations, such as Facebook, Apple, Google, Microsoft, or any other third-party app provider, social media platform provider, operating system provider, device manufacturer, or wireless service provider, including with respect to any personal information you disclose to other organizations through or in connection with the Site.

The Sites/Services are controlled and operated by us from the United States and are not intended to subject us to the laws or jurisdiction of any state, country, or territory other than those of the United States. Information about you may be stored and processed in any country where we have facilities or in which we engage service providers, and, by using the Sites/Services, you consent to the transfer of information to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access your personal information or information about the Business.

If you have any questions about this Notice, please contact us. European Union residents may contact us at: dataprotectionofficer@citi.com. California residents have certain rights with respect to “personal information” under the California Consumer Privacy Act (“CCPA”). If you would like to submit a request pursuant to the California Privacy Rights Act (“CPRA”) to exercise any rights you may have, please visit Citi's Global Privacy Hub at https://online.citi.com/US/ag/dataprivacyhub/home or call us at (833) 971-1191.

Effective Date: January 1, 2023

This California Supplemental Provision (the “Supplement”) supplements the information contained in the Notice and applies solely to individuals who have rights under CPRA. Unless otherwise defined in the Notice, any terms defined in this Supplement have the meaning used in the CPRA.

Under California privacy and consumer protection laws, certain types of Personal Information are considered “sensitive” Personal Information or data and require additional data privacy rights and obligations.

If Bridge built by Citi^SM collects any information that would be considered Sensitive Personal Information under other applicable privacy-related laws, rules or regulations (laws, rules or regulations collectively “Laws”), we will first obtain your explicit consent, unless otherwise noted in our Notice. To the extent we may collect and process Sensitive Personal Information, such as Social Security numbers, we only collect this Sensitive Personal Information to provide the products or services requested, detect security incidents, and resist malicious, deceptive, fraudulent or illegal activities (“Permitted Uses”) or as otherwise permitted or required by law. If we use this Sensitive Personal Information of consumers for Permitted Uses, we do not need to provide a Limit Use and Disclosure of Sensitive Personal Information right under the CPRA.

Bridge built by Citi^SM provides in the chart below a summary of our prior 12-month Personal Information handling practices. We do not have actual knowledge of any collection, use, sale, or sharing of Personal Information of consumers under 16 years of age.

We store personal information for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations.

An opt-out preference signal is a signal that is sent by a platform, technology or mechanism on your behalf that communicates your choice to opt-out of the sale and sharing of your personal information. You can learn more about implementing opt-out preference signals here by exploring other developing technologies and services that offer this tool.

We treat opt-out preference signals (Do Not Track signals may also be considered opt-out preference signals under applicable privacy-related Laws in the United States) as valid requests to opt-out of the sale or sharing of your personal information under those Laws. Ordinarily, your opt-out preference signal is sufficient for us to honor your request, but in some instances we may request additional information to help facilitate your request for offline sales or sharing. We will not use, disclose or retain this additional information for any purpose other than to facilitate the request.

Further, we will treat your opt-out preference signals in a frictionless manner, which includes not:

Please note that you can also opt-out of the sale or sharing of your personal information through our other methods described in the “Your Rights and Choices“ section below.

Applicable privacy-related Laws may afford consumers residing in the California certain rights with respect to their Personal Information, subject to certain exceptions. Subject to certain limitations, you have the following rights in California:

To exercise your rights described above, please submit a verifiable consumer request to us by either:

Except for the right to opt-out related to selling or sharing your Personal Information for and right to limit use of Sensitive Personal Information, we will need to verify your identity before honoring your privacy right request. Subject to certain limitations, we will honor your privacy rights request within 45 calendar days of receipt of your request, unless we request an extension as permitted by data privacy laws. However, we will honor opt-out of sale and sharing requests within 15 business days.

You may exercise your privacy rights through an authorized agent. If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. If you are an authorized agent seeking to make a request, please contact us by either:

If you have any questions about this Supplement, the ways in which Citi ICG collects and processes your Personal Information described in this Supplement, your choices and rights regarding such use, or wish to exercise your rights under the CPRA, please visit Citi Privacy Hub or call us at 833-981-0270 (TTY: 711).