Supplemental Provisions for Kenya Users
Effective Date: July 22, 2025
Preliminary
1. It is important that you read this Supplement together with Citi Authenticator Global Privacy Notice (“Authenticator Privacy Notice”). These provisions are supplemental to and in addition to the information contained in the Authenticator Privacy Notice.
2. Citi Authenticator is provided in Kenya to Citi workforce/members of staff and any other person authorized by Citibank, N.A. Kenya Branch (“Citi”, “we”, “us”, “our”) which may include non-employees with access to Citi IT networks.
3. For purposes hereof and the Notice, “personal information” bears same meaning as “personal data” the phrase used in the Data Protection Act (Chapter 411C, Laws of Kenya) (the “DPA”).
4. Unless where certain exceptions apply, the DPA requires that we inform you appropriately about collection of your personal data.
The rights you have over your personal information
You have certain rights with respect to your personal data that is processed by us. These are:
(a) to request access to your personal data and receive a copy of the personal data we hold about you.
(b) to request correction and erasure of the personal data that we hold about you.
(c) to request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data.
(d) to request us to transfer personal data either to you or to another person in a commonly used electronic format. This is known as the right to data portability.
(e) to object to the processing of your personal data.
(f) to request not to be subject to automated decision making.
If you wish to review, verify, correct, erase or object to the processing of your Personal Information, please Request with Citi at Citibank, N.A. Kenya, Citibank House, Upperhill Road, P.O. Box 30711 - 00100 Nairobi.
Implications of withdrawing your consent to the processing of your personal data
Where you have provided your consent to the processing of personal data for a specific purpose, you also have the right to withdraw it at any time. Please note that withdrawing your consent, will not render unlawful any prior processing of your personal data, nor affect processing of personal data that is based on other legal bases.
If you fail to provide personal data, where required to do so
If you fail to provide any personal data that we request from you that is required for the functioning of Citi Authenticator , we may not be able to grant you access to Citi networks using this platform, and you will need to discuss with Citi alternative forms of authentication, or work from our premises.
Change of Purposes
We will only use your personal data for the purposes for which we collected it (which are stated in the main text of the Authenticator Privacy Notice), unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use your personal data for a different purpose that would be incompatible with the initial purpose for which the personal data was collected, we will seek your prior consent.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above, where this is required or permitted by law (for example for the prevention of fraud and other forms of criminal activity).
Contact Us
If you have any concerns about the use of your personal data, questions about this Supplement including any requests to exercise your legal rights under the law, please contact the Data Protection Officer using the details set out below: -
Email address: yvonne.n.muturi@citi.com
Postal address: P.O. Box 30711 - 00100 Nairobi
Physical address: Citibank House, Upper Hill, Nairobi, Kenya
