Supplemental Provisions for Switzerland Users
Effective Date: May 05, 2025
Citi Authenticator is provided in Switzerland to Citi Workforce members of staff and authorized contractors by and on behalf of Citibank, N.A. (Geneva and Zurich branches), Cititrust (Switzerland) Limited; Citigroup Global Markets Limited (Zweigniederlassung Zurich), Cititrust Private Trust Zurich GmbH and Citibank (Switzerland) AG. We refer to these entities as ‘us’.
Unless certain exceptions apply, the revised Federal Act on Data Protection (FADP) requires that we inform you appropriately about the collection of personal data from you. Such duty of information also applies when data is not directly collected from you.
Your personal information will only be used for the purposes for which it was collected (as stated in the Authenticator Privacy Notice) or a directly related purpose. If we intend to use your personal data for further purposes, we will inform you about the new processing in advance. Where necessary, we will request your consent (for example if sensitive personal data is to be processed or for high-risk profiling; where data processing principles may not be fulfilled by the subsequent processing or if you, the data subject had raised an objection to processing).
What rights do you have over your personal information?
You have certain rights with respect to your personal data that is processed by us, in order for you to control or influence our processing. These are:
-
Information:You have the right to obtain information about your personal data processed by us at any time in writing and generally free of charge.
-
Correction:You may, at any time and free of charge, request that we correct, complete or update your personal data if it is incorrect. You may request that a note of contest is added in case if neither the accuracy nor the inaccuracy of the personal data in question can be established.
-
Objection and deletion:You may object to our data processing and request that we delete your personal data at any time if we are not obliged to continue processing or storing this data and if it is not necessary for the employment contract.
-
Objection and deletion:If we process your personal data based on your consent (see section 3), you may withdraw consent at any time. Such withdrawal of consent is only effective for future data processing.
Some of these rights may not apply in individual cases, and we may be entitled or obligated to restrict or postpone the fulfilment of a right. We will inform you accordingly in such a case.
Automated decision-making
We may process and analyse your data automatically only for security purposes, and use behavioural data. Insofar as a decision is made exclusively by automated means and this decision has a negative legal effect on you or has a significant adverse effect on you in any other way, we will inform you in each case, and you will have the right to explain your point of view and to demand that a natural person reviews the relevant decision.
International Transfers and Disclosures of personal data abroad
Data Recipients will be located outside the European Economic Area (EEA), the European Union (EU), the United Kingdom and Switzerland. In particular, our global data centre supporting the Authenticator App is located in the United States.
We transfer data internationally whether you have consented to the corresponding disclosure (when installing the Authenticator App) or where the transfer and disclosure is necessary for the performance of the service, as explained in the Authenticator EULA (Terms and Conditions), and also for the establishment, exercise or enforcement of legal claims or in the event of overriding public interests: For example, we may transfer data to authorities and other persons abroad if we are legally obliged to do so or, in the context of a company sale or legal proceedings.
Not all countries where we process your personal data (including specifically the United States) currently guarantee an adequate level of data protection according to the standards of Swiss law. We therefore take contractual precautions to contractually compensate for the lower level of legal protection, especially using standard contractual clauses issued by the European Commission and recognized by the Swiss Data Protection and Information Commissioner (FDPIC), assisted with Transfer Impact Assessments (TIAs) and additional operational and technology measures to address any issues uncovered in the TIAs. For more information and a copy of these clauses, please visit www.edoeb.admin.ch/edoeb/en/home/data-protection/handel-und-wirtschaft/transborder-data-flows.html.
In certain cases, we may transfer data in accordance with data protection law requirements even without reference to the Authenticator EULA (Terms and Conditions) if you have consented to the corresponding disclosure or if the disclosure is necessary for the performance of the contracted Authenticator service, or is for the establishment, exercise or enforcement of legal claims or overriding public interests.
Contact Us
If you have any questions or concerns about this Privacy Notice or this App, please contact us at citiauthenticatorsupport@citi.com.
You may contact us at citiauthenticatorsupport@citi.com to exercise any data rights you have under applicable law
You may contact your Data Protection Advisor (Switzerland) at the following address:
Swiss Data Protection Advisor
Citi
Hardstrasse 201
8005 Zurich
Switzerland
E: swissdataprotectionadvisor@citi.com
If you feel that your data has not been handled correctly Citi, or you are unhappy with our response or have concerns regarding the use of your data, you have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC): https://www.edoeb.admin.ch/edoeb/en/home.html
List of Jurisdictions where personal data may be accessed
Production Environments
| Citi Supplier | Facility Name |
|---|---|
| Threatmatrix Inc |
Amsterdam, Netherlands San Jose, CA US |
| Akamai Technologies | Amsterdam, Netherlands Singapore Cambridge, Massachusetts, US |
| Citi Affiliates | Registered AddressName |
| Citibank Europe, public limited company | 1 North Quay Wall, Dublin 1, D01 T8Y1, Republic of Ireland |
| CSC- Citibank Europe plc Hungarian Branch | 8 Vaci ut, Budepest, H-1133, Hungary |
| CSC- Citibank N.A. Israel | Azrieli Sarona Building, 121 Menachem Begin Street, Tel Aviv |
| CSC- Citicorp Services India | First International Financial Centre, Plot Nos. C-54 and C-55, G-Block, Bandra Kurla Complex, Bandra East, Mumbai 400098 |
| CSC -Citibank N.A. | 388 Greenwich Street, New York, NY 10013, United States of America |
| CSC- Citigroup Technologies Inc | 700 Edwin L. Ward St Memorial Hwy, Rutherford NJ 07070, United States |
Storage and Continuity of Business Environments
| Citi Supplier | Facility Name |
|---|---|
| Google LLC | Northern Virginia, NY and NJ, US |
| Akamai Technologies | Amsterdam, Netherlands Singapore Cambridge, Massachusetts, US |
For security reasons we are unable to provide detail.
