Last Updated: June 2020

Citi International Financial Services LLC (“CIFS”), as introducing broker for your CIFS investment account (collectively “Firm,” “we,” “us,” “our”) and Pershing LLC (“Pershing”) engaged by CIFS to provide fully disclosed clearing broker (“clearing broker”) and other services for you as an introduced CIFS client with a CIFS Account appreciate your concerns about the privacy of information that you provide to us through this website or such other third party web sites, online locations, electronic services, devices or systems as the Firm may identify from time to time (“Site,” “Web Site”) including but not limited to online and/or wireless access to the Site and certain electronic functions, software, mobile applications, information and other services (collectively “Services,” “Online Services”) or retail services that link to or expressly reference this Privacy Statement (“Sites/Services”). Accordingly, this Privacy Statement is posted to explain how we handle such information.

Applicability

If you do not agree to the terms of this Privacy Statement, please do not provide us with any information and do not use the Sites/Services. By using the Site and voluntarily providing your information to us, you consent to the collection and use of such information as set forth in this Privacy Statement.

This Privacy Statement applies to the Sites/Services. Our online products and services may have different Privacy Statements. To view the Privacy Statement for specific products and services please click on the Privacy link on that site. This Privacy Statement describes the Sites/Services provided through us, your introducing broker, with or through your clearing broker. Pershing, your clearing broker for your introduced CIFS Account, also has posted its Pershing Privacy Statement on the Site, you should read it carefully before using the Site/Services.

If you have specific questions regarding this Privacy Statement or any information you have sent via the Site, please do not hesitate to contact us.

As you review this Notice, here are a few important things to keep in mind:

• If you have a financial product or service with us for personal, family or household use with one of our U.S. businesses, that business would also have delivered to you a U.S. Customer Privacy Notice (Customer Privacy Notice) that explains how that business collects, uses and shares information about you, and offers you certain choices with respect to the use and sharing of your personal information.
• This Site is not intended for children under 13 years of age. We do not knowingly solicit information online from, or market online to, children under 13 years of age.
• Wireless service providers, Internet service providers, device manufacturers and/or social media platforms may have their own privacy notices that are different from this one for the information they may access through your use of the Sites. We encourage you to read their privacy notices as the collection, uses and sharing of information by those third parties may be different than Citi.
• Our mobile, social media, or other services, sites, pages or materials may have additional terms about the privacy or use of your information. Please review the privacy notice for the specific Site/Service you are using.

Modifications

We may modify this Privacy Statement at any time so please check from time to time for such modifications.

U.S. Customer Privacy Notice

Individual consumers who are customers or former customers of CIFS with CIFS Accounts introduced to Pershing for clearing and other services, please refer to your Customer Privacy Notices which describe what information CIFS for your CIFS Account and Pershing as your clearing broker collect about customers, with whom information is shared, and how information is protected or safeguarded. As a customer where appropriate, we will limit sharing of your personal information in accordance with the choices you have provided us in response to our Customer Privacy Notice or other privacy choices that we may make available.

Contents

1. Information we Collect Through the Sites/Services
2. Use of Information
3. Sharing Personal Information
4. Aggregation Services
5. Your Choices Regarding Your Personal Information
6. Updating Your Personal Information
7. Security of Personal Information
8. Other Important Information
9. Contact Us
10. Appendix — Jurisdiction Specific Provisions

I. Information We Collect Through the Sites/Services

We collect Personal Information though our Site/Services. “Personal Information” is any information:

• that identifies or can be used to identify you or your household;
• that relates to, describes, is capable of being associated with, or could reasonably be linked (directly or indirectly) with you or your or household;
• that can be used to authenticate you or provide access to an account;
• that relates to you and that might be sensitive (such as personal medical or health information, account number, account value).

For at least the past 12 months, we have collected the following categories of Personal Information from the following sources:

What we collect through the Site:

• What we collect: We collect from you through the Sites/Services Personal Information that identifies you as an individual or relates to identifying information about you, including your name, username and password, and any other information that you submit, including all electronic instructions (including all transaction information).
• We also collect information that you voluntarily submit to us, including by responding to our online polls and surveys, requesting information from us or asking to be contacted by one of our representatives. If you work for one of our institutional (business) clients, we may obtain your business contact information from your firm. If you register to enter an area of this Site, the Site will recognize who you are and collect all information that you submit (including subscription to emails, etc.).
• We will collect personal information that you voluntarily provide, such as your name, address, telephone number or e-mail address. This Site may collect information on what country you are accessing this Site from; information on which pages within this Site you visit; and certain technical information regarding your computer and operating systems, such as your Internet protocol address, domain name and system configurations and settings
• Additionally, this Site is a password-protected site (a) once you submit your password and enter, this Site will recognize who you are and will collect all information that you submit, including all electronic instructions (including all transaction information), and (b) any information collected about you from this Site may be associated with other identifying information that we have about you.

Please note that any information collected about you from this Site may be associated with other identifying information that we have about you.

Our business purpose for collecting this information: account maintenance and servicing; providing customer service; improving our Sites/Services; performing research and business analytics and identifying usage trends; engaging in fraud monitoring and prevention; compliance with applicable laws and regulations; protecting our business and our customers against illegal activity; performing audits; verifying requests made pursuant to this Notice; tailoring marketing communications from our affiliates as well as from selected third parties; managing our business effectively; developing new products and services and expanding our business.

Using unique identifiers such as cookies, pixel tags, device profiling, and similar technologies:

• What we collect: We use cookies, web beacons and similar technologies (called “Cookies” in this Privacy Statement) to collect information from your browser and by our software application when you use the Site. A cookie is a small piece of information that a website stores on the web browser on your device and can later retrieve. “Session” Cookies are temporary and will expire at the end of a browser session; that is, when you leave a website. Session Cookies allow a website to recognize you and carry information as you navigate between pages during a single browser session and allow you to use the website most efficiently. “Persistent” Cookies, in contrast, remain in the Cookie file of your browser even after you leave a website and after the browser is closed. They enable a website to recognize you on your return, remember your preferences and provide tailored services to you. A cookie will not contain information that will enable us to contact you via telephone, e-mail, or other means.
• We may use third party advertising companies to serve ads on our behalf on other websites across the Internet. In order to measure and track the effectiveness of such ads, these companies typically use cookies. In order to measure and track the effectiveness of such ads, these third party advertising companies typically use cookies; so a cookie may be set in the cookie file of your browser when you click on one of our ads or visit a webpage associated with our ad campaigns. These companies may also use and measure information about your visits to our Site as part of this same process. The information provided to us by these companies about you will be de-identified.

Our business purpose for collecting this information: operating, maintaining, and protecting our Sites/Services; reviewing and processing applications for our Services; intake of new customers; account maintenance and servicing; improving our products and services; improving your experience on our Sites; performing research and business analytics; understanding your interests and preferences; to tailor tailoring and send sending you marketing communications for ourselves and for selected third parties; engaging in fraud monitoring and prevention; protecting our business and our customers against illegal activity; compliance with applicable laws and regulations.

Please note that any information collected about you from this Site may be associated with other identifying information that we have about you.

II. Use of Information

We use the Personal Information we collect from and about you to:

• Authenticate you so that you can access the Site and conduct account transactions on the Site;
• Process your transactions;
• Remember preferences that you submit as well as those generated from your usage data, your confirmation of being an institutional investor or consultant in the United States, and your responses to polls and surveys on our Site;
• Measure your use of our Site in an effort to improve its quality and enhance your overall experience, including tracking page views, time and date of Site access, and other usage data, and identifying your operating system and browser type (but not other information about your computer or the programs on it) and your general geographic location;
• Allow you to share certain information on our Site via social media bookmarking buttons, email or on social networking sites;
• For our business purpose and other lawful purposes, such as for data analysis, audits, fraud monitoring and prevention, information security, improving the Sites, developing new products and services, managing our business effectively, identifying usage trends, and expanding our business activities; and
• Ensure that the Sites functions properly and otherwise administer the Sites.

In addition to the above uses, we may use your information for the purpose of conducting business with you, managing our relationship with you, and advising you of products and services that we believe might be of interest. The information collected also is used to provide a record of communications between introducing or clearing brokers and Site visitors and to comply with any applicable legal and/or regulatory requirements.

We may also use aggregated usage data to track trends and analyze patterns on the Site.

III. Sharing Personal Information

During at least the past 12 months, we have disclosed your Personal Information for the following business purposes:

• with our affiliates to the extent permissible under applicable law;
• with third parties, to permit them to send you marketing communications on our behalf;
• with our service providers that have agreed to confidentiality restrictions and use any personal information they collect on our behalf solely for the purpose of providing the contracted service to us;
• with a third party in the event of any proposed reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings). Your personally identifiable information, technical information about your device or browser and/or other information we obtain from you via the Site may be disclosed to any potential or actual third party purchasers of some or all of your introducing or clearing broker’s assets and/or may be among those assets transferred.

We also may use and disclose your Personal Information as we believe to be necessary or appropriate: (a) under applicable law, which may include laws outside your country of residence; (b) to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include such authorities outside your country of residence; (c) to enforce our terms and conditions; and (d) to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or others.

Also, we may share in aggregate, statistical form, non-personal information regarding the visitors to the Site, traffic patterns, and Site usage with our partners, affiliates or advertisers.

We may also export your information to the United States and other jurisdictions where we, or our service providers, do business.

IV. Aggregation Services

Citi, as well as others, offers account aggregation services that allow you to consolidate your electronically enabled financial account information from different sources (such as your accounts with us or with other financial institutions) so that you can view all your account information in one online location.

When acting as an account aggregator, Citi or its aggregation service provider may request your account user credentials for third-party (non-Citi) financial accounts, including usernames and passwords, in order to access your account information as your agent.

If you provide us access, as your agent, to your third-party account information we may use such information as well as your Citi account information where applicable, to provide you offers, suggestions and insights on your spending, savings and other financial behaviors. These insights are not investment, tax or legal advice and neither Citi not any of its affiliates are acting as a tax, legal or investment advisor in providing same. With your consent, subject to written agreement, CIFS or other Citigroup businesses may currently or in the future provide investment advisory or other investment services based on online access to your investment account and other financial information.

You may cancel enrollment in Citi's aggregation service or delete accounts at any time. Upon cancellation or deletion of an account, we will delete and direct our service provider to delete this data from our and their respective records as permitted under applicable law, rules and regulations.

With regard to aggregation services provided by a third-party, if you provide your user credentials or other Personal Information about your Citi accounts to a third-party aggregation services provider, we will consider that you have authorized all transactions or actions initiated by such access information you provide, whether or not you were aware of a specific transaction or action. If you decide to revoke the authority you have given to an aggregation website, we strongly recommend that you change your password for the Site to ensure that the aggregation website cannot continue to access your account information.

V. Your Choices Regarding Your Personal Information

You have certain rights with regard to your Personal Information.

1. Your California Privacy Rights

   If you are a California resident, you have the right to request and receive certain information about disclosure of your Personal Information to third parties for their direct marketing purposes. Because it is our policy not to share your Personal Information with third parties for third-party direct marketing purposes without your consent, we are exempt from the requirement to respond to such requests. If you have any questions related to our policy, please contact us using the information provided in the “Contact Us” section below.

   For information regarding how to exercise your rights as a consumer under the California Consumer Privacy Act. Please see “Supplemental provisions for California residents” in the Appendix to this Notice.

2. Cookies

   Most browsers are initially set to accept Cookies. However, you have the ability to change your browser settings. It may also be possible to configure your browser settings to enable acceptance of specific Cookies or to notify you each time a new Cookie is about to be stored on your device enabling you to decide whether to accept or reject the Cookie. You can also disable Cookies by configuring your browser setting to reject Cookies. Please refer to the help section of your browser for instructions on disabling Cookies. For more information about Cookies, how they work, why they are so useful and how to disable them, you can visit www.allaboutcookies.org

   If you do not wish to accept Cookies from this Site, please either disable them or refrain from using this Site. If Cookies are disabled, it may mean that you experience reduced functionality or will be prevented from using all or part of this Site.

3. Do Not Track

   Some browsers have a do not track feature that lets you tell websites that you do not want to have your online activities tracked. At this time, we do not respond to browser do not track signals.

VI. Updating Your Personal Information

Keeping your account information accurate and up to date is very important. If your account information is incomplete, inaccurate or not current, please contact us by calling or write to us at the telephone numbers or appropriate address for changes listed on your account statements, records, online or other account materials. You can also speak to a branch representative, your financial advisor or your designated account representative.

VII. Security of Personal Information

We utilize reasonable security technologies to protect sensitive information. However, the security of this information depends in part on the security of the computer you use to communicate with us, the security you use to protect User IDs and passwords, and the security provided by your internet access services provider. We are not responsible for the security of your internet access services provider; you should review the security and privacy policies of your internet access services provider carefully. Information that you access via this Site may be stored on your computer during your session for your convenience. If others have access to your computer or your User ID and password, they may be able to access this information. We are not responsible for the security or privacy of information communicated to or from such a computer. Finally, you should keep any correspondence you receive relating to this Site or the Services (including, but not limited to registration information, emails, or any other information) confidential and in a safe place.

VIII. Other Important Information

1. Notice of changes

   We may modify this Privacy Statement at any time so please check from time to time for such modifications.

2. Third-Party Services

   This Site may contain links to third party sites (including social media bookmarking buttons that enable you to share certain content on our Site). Please review the cookie and privacy statements of these third party sites to understand how they may use Cookies and your information. Our Privacy Statement does not apply to your use of a third party site.

3. Jurisdictional Issues

   The Site is controlled and operated by us from the United States and are not intended to subject us to the laws or jurisdiction of any state, country, or territory other than those of the United States. Information about you may be stored and processed in any country where we have facilities or in which we engage service providers, and, by using the Site, you consent to the transfer of information to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access your Personal Information.

IX. Contact Us

If you have any questions about this Notice, please contact your account representative, call the number on your statement, the back of your Citi card, visit https://online.citi.com/US/ag/contactus, or contact us at (787) 756-4998 from 8:30 am — 5:30 pm ET | TTY: We accept 711 or other Relay Service.

If you are contacting us from outside the United States, please refer to the Citi website in your country or use the contact details in the local privacy notice for your product. If you would like to submit a request pursuant to the California Consumer Privacy Act (“CCPA”), please visit Citi’s Privacy Hub at https://online.citi.com/US/ag/dataprivacyhub or call us at (833) 971-1191 | TTY: We accept 711 or other Relay Service. If you wish to submit a request to have your Personal Information deleted (see section I.A.3 in the Appendix below) or wish to opt-out of the selling of your Personal Information, call us at (833) 981-0270 | TTY: We accept 711 or other Relay Service.

Appendix — Jurisdiction Specific Provisions

1. Supplemental provisions for California residents.
   1. Requests. California residents have certain rights with respect to Personal Information under the California Consumer Privacy Act (“CCPA”). For purposes of this subsection, the terms “consumer,” “categories of personal information,” “business purpose,” “third party,” and “sell” have the meanings ascribed to them respectively in the CCPA. Terms defined under the CCPA may differ in meaning from the common usage of the same terms used elsewhere in this Notice.
      
      
      1. You have the right to request, up to two times every 12 months, that Citi disclose to you the following: (i) the categories of Personal Information that Citi has collected about you; (ii) the categories of sources from which Citi has collected Personal Information about you; (iii) the business or commercial purpose for collecting or selling your Personal Information; (iv) the categories of Personal Information that Citi has sold about you in the last 12 months and the categories of Third Parties to whom the Personal Information was sold, by category or categories of Personal Information for each Third Party to whom the Personal Information was sold; (v) the categories of Personal Information that Citi has disclosed about you for our business purposes in the last 12 months and the categories of Third Parties to whom the Personal Information was disclosed, by category or categories of Personal Information for each Third Party to whom the Personal Information was disclosed; and (vi) the specific pieces of Personal Information that Citi has collected about you. Please note that Personal Information we have collected in connection with your personal account with us is not subject to the requirements of CCPA because it is already protected under existing federal and California state privacy laws, including the Graham Leach Bliley Act.
      2. You have the right to request a portable copy of your Personal Information.

      In response to verified requests pursuant to #1 or #2 above, we will confirm receipt of the request within 10 business days of receipt of the request, and disclose and deliver the required information to you free of charge within 45 days of receiving a verifiable consumer request. We may extend this time period to provide once by an additional 45 days when reasonably necessary. We will provide notice of the extension within the first 45-day period

      3. You have the right to request that Citi delete Personal Information collected from you, subject to certain exceptions allowed under applicable law.

      In response to verified requests pursuant to #3 above, we will confirm receipt of the request within 10 business days of receipt of the request. Following verification of your request, we may require you to separately confirm that you want your Personal Information to be deleted.

      4. You have the right to opt out of the sale of your Personal Information to Third Parties by visiting our Privacy Hub at https://online.citi.com/US/ag/dataprivacyhub. CCPA defines sale very broadly, covering both monetary and other consideration. Citi does not sell personal information for money. However, we share some types of personal information. See our Privacy Hub at https://online.citi.com/US/ag/dataprivacyhub
      5. Citi will not discriminate against you because you elect to exercise these rights, including by:
         • Denying goods or services to you.
         • Charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
         • Providing a different level or quality of goods or services to you.
         • Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.
         • None of the foregoing, however, prohibits Citi from charging you a different price or rate, or from providing a different level or quality of goods or services to you, if that difference is reasonably related to the value provided to Citi by your data.
   2. Submission of Requests. You may exercise these rights by managing this information through Citi’s Privacy Hub at https://online.citi.com/US/ag/dataprivacyhub or by calling us at (833) 971-1191. If you wish to submit a request to have your Personal Information deleted (see section I.A.3 in this Appendix) or wish to opt-out of the selling of your Personal Information, call us at (833) 981-0270. If you wish to submit any type of CCPA request through an authorized agent, please follow the process in Section I.D. below.
   3. Requests from Households. Citi cannot take action in response to a request to know or request to delete as it pertains to household specific pieces of personal information unless all of the following conditions are satisfied:
      1. All consumers of the household must jointly request access or deletion through the processes outlined in this Privacy Statement;
      2. We are able to individually verify (i) all members of the household (see Section I.E below); and (ii) that all individuals making the request are still members of the household.
   4. CCPA Authorized Agent. CCPA permits consumers to designate authorized agents to submit requests on their behalf. Under CCPA, an “authorized agent” is a natural person or a business entity registered with the Secretary of State to conduct business in California that a consumer has authorized to act on their behalf subject to the requirements. If you would like to designate an authorized agent to submit a request to know or a request to delete Personal Information on your behalf, please call us at (833) 981-0270. Please be advised of the following additional information that will be required:
      1. We require a written power of attorney, executed by you, confirming the authority of the authorized agent with respect to your CCPA request(s). After you initiate a request with us by phone at the number above, we will provide you with a form of power of attorney.
      2. Prior to responding to any request made on your behalf by an authorized agent, we may require you to provide written confirmation directly to us that you have provided the authorized agent permission to submit such request(s) on your behalf.
      3. Once verified (see Section I.E below), your authorized agent may create a unique account for you through Citi’s Privacy Hub at online.citi.com/dataprivacyhub and manage your requests through that account.
   5. Verification. Whether you submit a request directly on your own behalf, or through an authorized agent, we will take reasonable steps to verify your identity prior to responding to your requests under CCPA. Upon receiving a request pursuant to #I.A.1 or #I.A.2 above, we will confirm receipt within 10 days and provide you with information about how we will verify and process the request. In order to verify your request, we will require you to provide your social security number, tax ID number or passport number and issuing country, in addition to your first and last name, email address and mailing address.