Supplemental Provision – California | Treasury and Trade Solutions

Last Updated and Effective Date: January 1, 2023

This California Supplemental Provision (the “Supplement”) supplements the information contained in the ICG Global Privacy Notice (the “Privacy Notice”) and applies solely to individuals who have rights under the California Privacy Rights Act (“CPRA”) (“consumers” or “you”). Unless otherwise defined in the Privacy Notice, any terms defined in this Supplement have the meaning used in the CPRA.

Sensitive Personal Information

Under California privacy and consumer protection laws, certain types of Personal Information are considered “sensitive” Personal Information or data and require additional data privacy rights and obligations. For example, we collect and process Social Security numbers, as described in the Types of Information We Collect and Process section in the Privacy Notice, which is considered Sensitive Personal Information under the CPRA. We only collect this Sensitive Personal Information to provide the products or services requested, detect security incidents, and resist malicious, deceptive, fraudulent or illegal activities (“Permitted Uses”) or as otherwise permitted or required by law. Because we use this Sensitive Personal Information of consumers for Permitted Uses, we do not need to provide a Limit Use and Disclosure of Sensitive Personal Information right under the CPRA.

If Citi ICG collects any information that would be considered Sensitive Personal Information under other applicable privacy-related laws, rules or regulations (laws, rules or regulations collectively “Laws”), we will first obtain your explicit consent, unless otherwise noted in our Privacy Notice.

Summary of Personal Information Handling Practices

Citi ICG provides in the chart below a summary of our prior 12-month Personal Information handling practices. We do not have actual knowledge of any collection, use, sale, or sharing of Personal Information of consumers under 16 years of age.

Category of Personal Information	Sources	Business or commercial purpose of processing and recipients of Personal Information
Identifiers, such as real name, email address, postal address, or other similar identifiers	Directly from You, from Your Organization or from other third parties.	Sold We have not sold your identifiers to third parties. Shared We have not shared your identifiers with third parties for targeted advertising purposes. Service Providers We have disclosed your identifiers to our affiliates and to other parties that provide services to us or act on our behalf in connection with the operation of our business. See the Disclosure of Personal Information section in the Privacy Notice for more details Purposes of Processing such Personal Information To authenticate you so that you can access the websites/services and conduct account transactions on the websites / services on behalf of Your Organization; To recognize you, your device or your browser when you use the websites/services so that we can facilitate navigation, display information more effectively, store your preferences and otherwise personalize your experience and enhance the use of the websites/services; To process applications and transactions for Your Organization; To respond to your inquiries, fulfill requests and request your feedback on behalf of Your Organization; To track responses to our e-mails in connection the services to Your Organization and to measure the success of our communications; To manage our business, such as for data analysis, audits, fraud monitoring and prevention, information security, ensuring that the websites/services function properly and otherwise administering and improving them, developing new products and services, identifying usage trends, and expanding our business activities; To review statistical information about use of the websites/services in order to improve their design and functionality, to understand how they are used, and to assist us with resolving questions about the Websites/services; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable Laws.
Any Personal Information described in Cal. Civ. Code § 1798.80(e), such as name, address, telephone number, or financial information	Directly from You, from Your Organization or from other third parties.	Sold We have not sold such Personal Information to third parties. Shared We have not shared such Personal Information with third parties for targeted advertising purposes. Service Providers We have disclosed such Personal Information to our affiliates and to other parties that provide services to us or act on our behalf in connection with the operation of our business. See the Disclosure of Personal Information section in the Privacy Notice for more details. Purposes of Processing such Personal Information To authenticate you so that you can access the websites/services and conduct account transactions on the websites/services on behalf of Your Organization; To recognize you, your device or your browser when you use the websites/services so that we can facilitate navigation, display information more effectively, store your preferences and otherwise personalize your experience and enhance the use of the websites/services; To process applications and transactions for Your Organization; To respond to your inquiries, fulfill requests and request your feedback on behalf of Your Organization; To track responses to our e-mails in connection the services to Your Organization and to measure the success of our communications; To manage our business, such as for data analysis, audits, fraud monitoring and prevention, information security, ensuring that the websites/services function properly and otherwise administering and improving them, developing new products and services, identifying usage trends, and expanding our business activities; To review statistical information about use of the websites/services in order to improve their design and functionality, to understand how they are used, and to assist us with resolving questions about the websites/services; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable Laws.
Characteristics of protected classifications under California or federal law, such as age, gender, or marital status	Directly from You, from Your Organization or from other third parties.	Sold We have not sold such Personal Information to third parties. Shared We have not shared such Personal Information with third parties for targeted advertising purposes. Service Providers We have disclosed such Personal Information to our affiliates and to other parties that provide services to us or act on our behalf in connection with the operation of our business. See the Disclosure of Personal Information section in the Privacy Notice for more details. Purposes of Processing such Personal Information To process applications and transactions for Your Organization; To manage our business, such as for data analysis, audits, fraud monitoring and prevention, information security, ensuring that the websites/services function properly and otherwise administering and improving them, developing new products and services, identifying usage trends, and expanding our business activities; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable Laws.
Commercial information, such as records of products or services purchased, obtained, or considered	Directly from you, from Your Organization or from other third parties.	Sold We have not sold such Personal Information to third parties. Shared We have not shared such Personal Information with third parties for targeted advertising purposes. Service Providers We have disclosed such Personal Information to our affiliates and to other parties that provide services to us or act on our behalf in connection with the operation of our business. See the Disclosure of Personal Information section in the Privacy Notice for more details. Purposes of Processing such Personal Information To authenticate you so that you can access the websites/services and conduct account transactions on the websites/services on behalf of Your Organization; To recognize you, your device or your browser when you use the websites/services so that we can facilitate navigation, display information more effectively, store your preferences and otherwise personalize your experience and enhance the use of the websites/services; To process applications and transactions for Your Organization; To respond to your inquiries, fulfill requests and request your feedback on behalf of Your Organization; To track responses to our e-mails; To manage our business, such as for data analysis, audits, fraud monitoring and prevention, information security, ensuring that the websites/services function properly and otherwise administering and improving them, developing new products and services, identifying usage trends, and expanding our business activities; To review statistical information about use of the websites/services in order to improve their design and functionality, to understand how they are used, and to assist us with resolving questions about the websites/services; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable Laws.
Internet or other electronic network activity information, such as browsing history	Directly from You, from Your Organization or from other third parties.	Sold We have not sold such Personal Information to third parties. Shared We have not shared such Personal Information with third parties for targeted advertising purposes. Service Providers We have disclosed such Personal Information to our affiliates and to other parties that provide services to us or act on our behalf in connection with the operation of our business. See the Disclosure of Personal Information section in the Privacy Notice for more details. Purposes of Processing such Personal Information To authenticate you so that you can access the websites/services and conduct account transactions on the websites/services on behalf of Your Organization; To recognize you, your device or your browser when you use the websites/services so that we can facilitate navigation, display information more effectively, store your preferences and otherwise personalize your experience and enhance the use of the websites/services; To process applications and transactions for Your Organization; To respond to your inquiries, fulfill requests and request your feedback on behalf of Your Organization; To track responses to our e-mails in connection with the services to Your Organization and to measure the success of our communications; To manage our business, such as for data analysis, audits, fraud monitoring and prevention, information security, ensuring that the websites/services function properly and otherwise administering and improving them, developing new products and services, identifying usage trends, and expanding our business activities; To review statistical information about use of the websites/services in order to improve their design and functionality, to understand how they are used, and to assist us with resolving questions about the websites/services; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable Laws.
Sensitive Personal Information, such as consumers’ biometric information	Directly from You, from Your Organization or from other third parties.	Sold We have not sold such Personal Information to third parties. Shared We have not shared such Personal Information with third parties for targeted advertising purposes. Service Providers We have disclosed such Personal Information to our affiliates and to other parties that provide services to us or act on our behalf in connection with the operation of our business. See the Disclosure of Personal Information section in the Privacy Notice for more details. Purposes of Processing such Personal Information To provide the products or services requested, detect security incidents, and resist malicious, deceptive, fraudulent or illegal activities (“Permitted Uses”) or as otherwise permitted or required by law.
Professional or employment-related information	Directly from You, from Your Organization or from other third parties.	Sold We have not sold such Personal Information to third parties. Shared We have not shared such Personal Information with third parties for targeted advertising purposes. Service Providers We have disclosed such Personal Information to our affiliates and to other parties that provide services to us or act on our behalf in connection with the operation of our business. See the Disclosure of Personal Information section in the Privacy Notice for more details. Purposes of Processing such Personal Information To authenticate you so that you can access the websites/services and conduct account transactions on the Websites/services on behalf of Your Organization; To recognize you, your device or your browser when you use the Websites/services so that we can facilitate navigation, display information more effectively, store your preferences and otherwise personalize your experience and enhance the use of the Websites/services; To process applications and transactions for Your Organization; To respond to your inquiries, fulfill requests and request your feedback on behalf of Your Organization;

Retention of Personal Information

We store personal information for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations.

Opt-Out Preference Signals

An opt-out preference signal is a signal that is sent by a platform, technology or mechanism on your behalf that communicates your choice to opt-out of the sale and sharing of your personal information. You can learn more about implementing opt-out preference signals here by exploring other developing technologies and services that offer this tool.

We treat opt-out preference signals (Do Not Track signals may also be considered opt-out preference signals under applicable privacy-related Laws in the United States) as valid requests to opt-out of the sale or sharing of your personal information under those Laws. Ordinarily, your opt-out preference signal is sufficient for us to honor your request, but in some instances we may request additional information to help facilitate your request for offline sales or sharing. We will not use, disclose or retain this additional information for any purpose other than to facilitate the request.

Further, we will treat your opt-out preference signals in a frictionless manner, which includes not:

Charging you a fee or requiring any valuable consideration if you use an opt-out preference signal;
Changing your experience with the product or services we offer; and
Displaying a notification, pop-up, text, graphic, animation, sound, video, or any interstitial content in response to your opt-out preference signal.

Please note that you can also opt-out of the sale or sharing of your personal information through our other methods described in the “Your Rights and Choices” section below.

Your Rights and Choices

Applicable privacy-related Laws may afford consumers residing in the California certain rights with respect to their Personal Information, subject to certain exceptions. Subject to certain limitations, you have the following rights in California:

(1) Right to Delete. You have the right to request us to delete the Personal Information we have collected about you.
(2) Right to Correct. You have the right to request us to correct inaccurate Personal Information we maintain about you.
(3) Confirm Processing. You have the right to confirm whether we are processing your Personal Information.
(4) Right to Know and Access. You have the right to know and access the Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, and the specific pieces of Personal Information we have collected about you.
(5) Data Portability. You have the right to receive the information under right (4) in a format, to the extent technically feasible, that is portable, usable, and allows you to transmit the Personal Information to a person without impediment, where the processing is carried out by automated means.
(6) Right to Opt-Out. You have the right to opt out of certain processing, such as our sale or sharing of your Personal Information.
(7) Right to No Discrimination. You have the right not to be discriminated against for exercising any of your privacy rights. This includes us not: (a) denying you goods or services; (b) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level or quality of goods or services; and (d) suggesting to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Exercising Your Rights

To exercise your rights described above, please submit a verifiable consumer request to us by either:

Visiting Citi Privacy Hub; or
Calling us at 833-981-0270 (TTY: 711)

Except for the right to opt-out related to selling or sharing your Personal Information for and right to limit use of Sensitive Personal Information, we will need to verify your identity before honoring your privacy right request. Subject to certain limitations, we will honor your privacy rights request within 45 calendar days of receipt of your request, unless we request an extension as permitted by data privacy laws. However, we will honor opt-out of sale and sharing requests within 15 business days.

Authorized Agents

You may exercise your privacy rights through an authorized agent. If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. If you are an authorized agent seeking to make a request, please contact us by either:

Visiting Citi Privacy Hub; or
Calling us at 833-981-0270 (TTY: 711)

Contact Information

If you have any questions about this Supplement, the ways in which Citi ICG collects and processes your Personal Information described in this Supplement, your choices and rights regarding such use, or wish to exercise your rights under the CPRA, please visit Citi Privacy Hub or call us at 833-981-0270 (TTY: 711).