Supplemental Provision – Panama

Last Updated and Effective Date: May 15th 2025

This Supplemental Provision for Panama (the “Panama Supplement”) complements the ICG Global Privacy Notice (the “Global Privacy Notice”) and applies solely to data subjects who have rights under applicable law in Panama.

Unless otherwise defined in the Global Privacy Notice, any terms defined in this Panama Supplement have the same meaning used in the Data Protection Act No. 81 of 2019 (Ley de Protection de Datos Personales) and Rule 001-2022 of the Superintendency of Banks of Panama. In the event of any conflict or inconsistency, this Panama Supplement will govern and prevail over any and all other terms of the Global Privacy Notice.

The Data Controller(s) for any personal data gathered in Panama, are Citibank N.A. (Panama Branch) for banking activities and Citivalores, S.A. for broker-dealer and investment advisory activities.

Cross-border Transfers

Your personal information may be stored at, processed in, or transferred to, countries other than Panama (such as the US and India), including countries which may not provide the same level of protection offered in Panama. We take steps to ensure that your data receives an adequate level of protection through contractual, technical, and operational measures, including any standard contractual clauses.

Security

Citi stakes reasonable steps to preserve the security of personal information.

All personal information is held in a protected environment with sufficient organizational and technology measures appropriate to a professional financial organization that is an expert in the field. We have implemented security controls, procedures and protocols across our different business lines, physical premises and IT networks to minimize loss, misuse, unauthorized access, modification or disclosure of personal information. All information shared with external third parties is encrypted during transmission and in storage, and all information held internally is protected using security passwords and logons or other security procedures. However, due to the inherent nature or electronic communications, we cannot guarantee the security of personal information outside our networks.

ARCO Rights

Your individual rights of access, rectification, cancellation, opposition and portability (“ARCO”) rights are non-waivable. You may at any time exercise any of your ARCO rights, by using this link: Institutional Clients Group (citi.com) or contacting the Data Protection Officer, to the address set forth herein.

Withdrawal of Consent

Where consent is the lawful basis to process your Personal Information, You may withdraw such consent, without retroactive effects.

Right to File Claims before the Superintendency of Banks of Panama

If you deem that Citi has not properly addressed Your request to exercise any of your ARCO rights, or You are dissatisfied with Citi’s position, you have the right to submit a claim with the Superintendency of Banks, under the terms and conditions set forth in Rule 1-2022.

Data Protection Officer

marta.segovia@citi.com or +507 3016401

Citibank. N.A. Torre de las Américas, Torre B, Piso 12, Avenida B Sur, Punta Pacífica, Ciudad de Panamá.

Effective Date and Notice of changes

This Supplemental Provision takes effect on June 12, 2023 and will be in effect until a new updated version is published. Any change to this Supplemental Provision will be published in our website immediately.