Careers Privacy Notice for Job Applicants

Last Updated:

June 09, 2026

Version 2.0

Translations

Spanish / Espanol

Malaysian / Bahasa Malaysia

Portuguese / Portugues

This Careers Privacy Notice for Job Applicants (“Notice”) applies to all candidates applying for a role or position at Citibank, N.A. with office address at 388 Greenwich Avenue, New York, NY 10013 in the United States of America and its parent, subsidiaries, affiliates and branches (collectively, “Citi,” “we,” or “us”). This Notice describes how Citi collects, uses, transfers, stores, disposes and in general ‘processes’ the Personal Information (as defined below) of job applicants through this Site (i.e. https://jobs.citi.com) and all Citi Careers branded sub-sites (including those hosted by others, e.g., Workday®), in accordance with applicable laws. Citibank, N.A. operates this Site.

Citibank N.A., and the legal entity to which you are applying for a role or position are separate and independent “Data Controllers” of your Personal Information and are your primary contacts for matters relating to Citi’s collection, use or processing of your Personal Information. “Data Controller” includes any equivalent legal definitions as specified separately by jurisdiction. Please find a list of Citi Data Controllers here.

For purposes of this Notice, “Personal Information” means any data or information about you as an individual that Citi collects, uses, stores or otherwise processes, that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. We use the term “Personal Information,” which is also known as Personal Data in some jurisdictions. Please note, the jurisdiction you are applying in may use a different term to describe Personal Information and such definition may have a slightly different meaning. If that is the case, we will reflect the applicable terminology and definition in the relevant Jurisdiction-Specific Supplement.

Special Categories of Personal Information, also referred to in some jurisdictions as Protected Categories or Sensitive Personal Information generally consists of information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. It may also include genetic data, data concerning health or data concerning a natural person’s sex life or sexual orientation, criminal background including data on crimes and offences you were accused or convicted of, that are collected and stored by law enforcement and background checking agencies. In certain jurisdictions, Special Categories of Personal Information may include Social Security numbers, taxation IDs, credit history or financial transactions, government issued identification documents or numbers, and military or veteran status and records. Please note that the jurisdiction in which you are applying may use a different term for Special Categories of Personal Information, and its definition may vary. If that is the case, we will reflect the applicable terminology and definition in the relevant Jurisdiction-Specific Supplement.

Current or former Citi employees, contingent workforce (non-employees), such as individual contractors, consultants, temporary agency staff, or other persons engaged through an intermediary (supplier or service provider), who are not applying to a job are not in the scope of this Notice and should refer to other applicable privacy notices. Those contingence workforce individuals may refer to the Citigroup COO Global Non-Employee & Supplier - Contingent Workforce - Privacy Notice available here.

Citi may collect, store, process, disseminate or use your Personal Information in a manner that causes it to be transferred or accessed from computer systems owned or operated by or on behalf of Citi (or a vendor to Citi). Please review the Jurisdictional Considerations for information about our privacy practices in your region.

Table of Contents

• Collection and Use of Personal Information
• Disclosure of Your Personal Information
• International Data Transfers
• Security
• Data Storage and Retention Periods
• Your Rights
• Cookies
• Contact us
• Updates
• Jurisdiction-Specific Supplements

Collection and Use of Personal Information

Sources of Personal Information

A. Personal Information received directly from you
Citi obtains certain Personal Information directly from you during the job application and job search process, including your name, address, email, telephone number, contact information, date of birth, governmental and other national ID numbers, Site password, CV or resume, education and employment information.

Depending on the location of the job that you are applying for and/or the country you are applying from, you may be asked to provide other Sensitive Personal Information as part of your application, such as your gender, race, religion, ethnicity, disability status or sexual orientation; provided, however, you are only required to answer the questions marked as mandatory in order for your application to be processed, while other questions that are not marked as mandatory may be answered on a voluntary basis and your election not to answer such voluntary questions will not affect your application. If you volunteer such Sensitive Personal Information, we will, as a general rule, process it pursuant to your consent, which you may withdraw or revoke at any time. Where required by applicable law, we will obtain separate consent for the processing of Sensitive Personal Information.

If you intend to provide us with any Personal Information about a reference or any other third party as part of your CV/resume or job application, you hereby represent to Citi that you have obtained such third party's consent prior to passing their Personal Information to us.

You are responsible for the content of the information you provide to us, and you must ensure it is legal, honest, truthful, accurate and not misleading in any way.

B. Personal Information received indirectly
From time to time, Citi receives Personal Information about you from third parties. For example, we may receive Personal Information from background screening providers. In addition, we may also receive Personal Information from immigration authorities, law enforcement agencies, public sources and recruitment agencies.  

In certain cases, we receive Personal Information from your previous employers, and public sources, including social media (from public social media profiles). Where we collect Personal Information about you from third parties, we will take reasonable steps to notify you of that collection and of other matters we are required to tell you, where required by applicable local laws.

Personal Information that we collect about you, and transfer to other Citi entities during the job application process, is limited to what is reasonably required for Citi to process your application.

Note that we may collect, use and share information that does not identify you (including information that has been aggregated or de-identified) except as prohibited by applicable laws. Based on the personal data provided, Citi may prepare statistical data that is processed in a way that individuals cannot be identified. Citi may use the non-identifiable statistical data for the purpose of improving Citi’s recruitment and employment. Citi may also use the statistical data for other purposes including making proposals and/or providing reports to our customers, and/or developing new Citi services. The Copyright and all other rights to the statistical data and/or any deliverables that include the statistical data shall belong to Citi.

C. Personal Information we create (Inference, Predictive AI, or Generative AI)
We create information with Personal Information that we obtain from you and third parties and inferring information about you, to the extent permitted by applicable law, including through predictive or generative artificial intelligence. For clarity, none of our automated processing tools result in automated decision-making or profiling that results or may result in a legal or similarly significant outcome. Please see Automated Processing and Artificial Intelligence to learn more about our use of AI for Employment purposes.

Lawful Basis of Data Processing

Where a lawful basis is required, we rely on those applicable in the country or jurisdiction where you are applying, which may include:

• Consent: We use consent as a lawful basis, subject to conditions applicable in the jurisdiction where consent is collected, only where:
  
  
  • We are required by law to obtain consent;
  • It is the default or expected lawful basis for the processing of Personal Information; and/or
  • Where consent can be assumed or inferred from your conduct.
• Performance or Delivery of a Contract: where the processing is necessary to take steps at your request prior to entering into a contract with you;
  
  
• Legal Obligations: where the processing is necessary to comply with our legal obligations;
  
  
• Legitimate Interests: where the processing is necessary for the purposes of legitimate interests pursued by us (if available under applicable law) or reasonably, by a third party.
  
  The legitimate interests pursued by us may include:
  • evaluating an applicant’s suitability for employment;
  • managing and administering the recruitment process;
  • protecting our legal rights, interests, business, and reputation;
  • maintaining talent pools for future opportunities;
  • improving the recruitment process and candidate experience; and
  • ensuring the security of systems, premises, and personnel.

Certain jurisdictions may rely on differing lawful bases for data processing. As such, please refer to your Jurisdiction’s Specific Supplement, if any, for additional information.

Categories of Personal Information and Purposes of Processing

We collect, receive, use, store and otherwise process your Personal Information (both manually and electronically) for the following purposes (to the extent permitted by applicable laws or regulations) during your job application. We retain it afterwards for a length of time according to the data retention requirements applicable in your jurisdiction of prospective employment. 

While the below list of categories and purposes is detailed, it may not be an exhaustive list of all examples and use cases under each category of Personal Information that Citi collects, uses, or otherwise processes in the context of your job application.

Automated Processing and Artificial Intelligence

We do not engage in automated decision-making, or in profiling that results or may result in a legal or similarly significant negative outcomes, nor do we rely solely on automated processing for assessments or decisions (supervised or unsupervised) about our job applicants. While we may use AI technologies to bring speed, processing power and advanced analytics to assist in fraud prevention (for example detecting fraud patterns) and for strategic resource planning, all hiring decisions, including determining your suitability for a role, are conducted, checked and decided by individuals. We may also use AI tools to train AIs matching abilities to job titles, and to identify and align an applicant’s skills and abilities to other suitable roles at Citi. We will use Personal Information to train, test and validate the accuracy of AI tools. 

Please refer to the Jurisdiction-Specific Supplements (where relevant) for any country-specific provisions that may apply.

Statistical Data

Based on the Personal Information provided, Citi may prepare statistical data that is processed in a way that individuals cannot be identified. Citi may use the non-identifiable statistical data for the purpose of improving Citi’s recruitment and employment.

Disclosure of Your Personal Information

Citi may process your Personal Information directly (either by the Citi entity in the country to which you are applying or other Citi entities in our organization that act as separate and independent controllers or as processors) and disclose it to third parties with which we have business relationships and are bound by service contracts to protect your data and keep it confidential. To review a list of the Citi entities in our organization that act as Data Controllers in each jurisdiction, please review the “HR Data Controllers and Key Data Processors” table below. We only disclose information that is strictly necessary, when required or permitted by applicable laws and regulations or as otherwise described in this Notice. Where we disclose your Personal Information to third parties, this is on the basis that they agree to comply with applicable laws.

The recipients of your Personal Information are limited, and include the following:

• recruiters and Citi’s Human Resources department, to the extent relevant for particular personnel to carry out their activities in connection with the processing and utilization of Personal Information;
  
  
• competent regulatory, prosecuting, tax or governmental authorities, courts or other tribunals in any jurisdiction or markets, domestic or foreign, upon their request or in accordance with or as permitted by or as desirable in respect of any applicable law or court/tribunal/regulator decision (for example, the immigration department);
  
  
• managers and/or their designees in order for them to carry out their activities;
  
  
• senior leadership to support business, talent, and diversity strategies;
  
  
• authorized persons or departments within Citi that handle compliance, legal and regulatory affairs, risk and audit and security of premises and persons or information, but only to the extent necessary in order to perform their duties and tasks and to any other accountants, attorneys or professional advisers;
  
  
• to third parties to exercise or defend or to protect legal claims, including in relation to our contracts with our clients and in order to protect the rights, property or safety of our business, our employees, any Citi company, our clients or others, including to legal advisors, our regulators, government and law enforcement authorities and with other parties involved in, or contemplating, legal proceedings;
  
  
• service providers that provide hosting services and technology service providers, business process outsourcing service providers, to the extent necessary to provide these services;
  
  
• service providers that perform background checks on behalf of Citi at pre-employment, and
  
  
• third parties that may be interested in acquiring a certain Citi business.

Citi may also disclose Personal Information about you in order to: (1) protect the legal rights, privacy or safety of Citi or its workforce members (e.g. employees, agents and contractors); (2) protect the safety and security of visitors to our web sites or other properties; (3) protect against fraud or other illegal activity or for risk management purposes; (4) respond to inquiries under this Notice or inquiries or requests from public or other authorities; (5) permit us to pursue available remedies or limit the damages that we may sustain; (6) enforce our Terms and Policies; or (7) comply with applicable laws or legal process.

International Data Transfers

As a global financial institution, Personal Information may be processed by or on behalf of your Data Controller in central locations globally in a manner that causes your data to be transferred across borders or stored or accessed from IT systems located or operated in another country, whether on infrastructure owned by Citi or operated on its behalf by a third-party. In most countries, such activities (known as international data transfers) are subject to certain requirements such as conditions and restrictions. Your Data Controllers will only transfer your Personal Information in accordance with those requirements. Our IT systems and support teams are located in the United States, Costa Rica, United Kingdom, Hungary, Poland, Ireland, Singapore, India, and the Philippines.  To learn more about the Citi possible recipients of your Personal Information, please see the list of Data Controllers and key Data Processors here.

Citi complies with applicable legal frameworks relating to the international transfer of Personal Information. For example, for certain jurisdictions, Citi transfers personal information on the basis of determinations by the competent authority that certain countries adequately protect personal information, or use Binding Corporate Rules, Standard Contractual Clauses (SCC), and other valid transfer mechanisms permitted under applicable local laws. In certain cases, BCRs and SCCs are accompanied by Transfer Impact Assessments (TIAs) and contractual, operational, and technical measures intended to mitigate any risks that are detected by the TIAs. Where local law requires specific or additional measures or conditions (e.g. obtaining separate consent, entering into standard contracts or obtaining certification) for transfers of Personal Information to another country, we will comply with those requirements.

Further, for certain jurisdictions, Citi relies on Binding Corporate Rules (BCRs) for the transfer of job applicant data from those geographies to a number of Citi entities globally which implemented a data security program to comply with BCR commitments. Our principal employment database service providers are Workday, Inc, which operates a private cloud divided in ‘tenancies’ (one per country) that maintains HR information for Data Controllers (except in countries that have data localization requirements). Each tenancy is separated by technical means (including encryption) from information in other ‘tenancies.’ We also use the services of Eightfold AI for advanced analytics and Salesforce for database management.

Systems that process HR data have a follow-the-sun model of support teams that may access and back up information (except for countries with data localization requirements). Countries with certain data localization requirements have their own separate infrastructure.

Security

We implement technical and organizational measures where required by applicable laws and as appropriate to the risk, in order to help protect the Personal Information that we process about you, and for international data transfers.

Data Storage and Retention Periods

We store Personal Information for as long as necessary to carry out the purposes for which it was collected and (if applicable) for other legitimate business purposes, including to meet our legal, regulatory, other compliance obligations. Personal Information of job applicants will be retained in accordance with local requirements and those of the country to which you are applying.

Citi may delete your profile on the Site or some or all of the Personal Information that we have about you at any time (including your CV/resume), for any reason and without notice. Therefore, please retain your own copy of the Personal Information you provide us.

All data retention obligations will be observed for the country to which you are applying.

Your Rights

You may have individual privacy rights under applicable law in your jurisdiction. For example, many countries grant four basic rights: Access, Rectification, Cancellation and Objection. Where required under applicable law, Citi extends some of these, and other rights as may be described in Jurisdiction-Specific Supplements, if applicable.

Where applicable, you can contact us by emailing hrdataprivacy@citi.com to request any of the following rights:

• Right to be informed/know/access and request access to your Personal Information (commonly known as a “data subject access request”): Where applicable, you can contact us to receive a copy of the Personal Information we hold about you. If you are requesting a specific period of communications or an event where you wish to focus our attention, please provide as much detail as possible in your request to ensure a timely and accurate outcome. You may also have the right to be informed of sub-processors that receive your data and of technical and operational measures, and of data transfer assessments in relation to international data transfers.
  
  
• Right to rectify or request the correction of the Personal Information that we hold about you which you believe is inaccurate or incomplete: Where applicable, you can contact us to make changes to your contact information and certain other personal details by logging into the Site and editing your profile information.
  
  
• Right to erasure/deletion of your Personal Information: Where applicable, you can contact us in certain circumstances to request erasure (also known as deletion) of your Personal Information. If you would like to request deletion of your profile, please note that data retention guidelines will be observed for the country to which you are applying. You also have the right to request us to delete or remove your Personal Information where you have withdrawn or revoked your consent or exercised a right to object to processing.
  
  
• Right to withdraw or revoke your consent: Where applicable, you can contact us in certain circumstances, to withdraw your consent to Citi’s processing of your Personal Information. If you withdraw your consent, we may not be able to perform specific activities that require your Personal Information (g., process your job application). Withdrawing your consent will not affect the validity or legality of any activities carried out prior to its withdrawal or revocation. There may be situations where we are unable to stop processing your Personal Information after you withdraw consent where it is a legal requirement for us to continue using or storing such information.
  
  
• Right to object to the processing of your Personal Information: Where applicable, you can contact us to ask us to stop processing your Personal Information; however, we may not always be able to approve your request, particularly if we need to continue to process your information for our business, legal and regulatory, and other purposes.
  
  
• Right to request the restriction of the processing of your Personal Information: Where applicable, you can contact us to ask us to restrict or suspend the processing of your Personal Information. We will only agree to stop processing your Personal Information in limited circumstances, such as where ongoing processing is unlawful.
  
  
• Right to transfer your information to another organization (or ‘right to data portability’): Where applicable you can contact us to ask us to transfer Personal Information to other organizations. There may be instances where we are not able to transfer your data because it is not required or appropriate under applicable law.

No Fee Usually Required

Normally, you are not required to pay a fee to access your Personal Information or to exercise any of the other data rights, where applicable. However, we may inform you in advance if we believe that charging a reasonable fee would be applicable, based on our administrative costs, if we consider your request for access to be unfounded, excessive, or repetitive. Alternatively, we may decline a request in such circumstances. In that event, we will explain to you why we have declined your request.

Cookies

This Site uses cookies. For example, the Site uses session-based cookies, which are cookies that are downloaded to your computer only for the duration of your visit to the Site. It helps you to move around the Site faster, and measures traffic activity on the Site. This type of cookie automatically expires when you close down your browser. For more information, visit our Cookie Notice.

Do Not Track: Most web browsers allow you to change your cookie options to accept all, some, or no cookies or to warn before accepting cookies; however, setting your web browser to not accept any cookies may inhibit the performance of this Site. Our Site currently responds to browser do not track signals.

Contact Us

If you have any questions about this Notice or the ways in which Citi collects, uses and otherwise processes your Personal Information as described in this Notice, please contact us by emailing hrdataprivacy@citi.com or through the contact information in the Jurisdiction-Specific Supplement linked above applicable to you.

If you have any concerns about the use of your personal data, in certain jurisdictions, you may also contact the Data Protection Officer using the contact details indicated below:

Updates

This Notice may be updated or replaced in whole or in part at any time, by Citi in its (sole and absolute) discretion. If we modify this Notice, new versions will be posted on the https://jobs.citi.com site. 

Jurisdiction-Specific Supplements

If you are applying to a role in any of the jurisdictions noted below, please click on the linked provided for additional local/regional privacy provisions that apply to your personal information in that location. Please note that the Supplements are intended to be read with, and not supersede, this Notice. To the extent there is any conflict between a provision in this Notice and a provision in the Supplement for your country/region, or where this Notice does not address a topic that is addressed in that Supplement, the Supplement will prevail.

• Argentina
• Brazil
• China
• Colombia
• Ecuador
• Europe and United Kingdom
• Hong Kong
• Indonesia
• Israel
• Jamaica
• Kenya
• Malaysia
• New Zealand
• Peru
• Philippines
• Sri Lanka
• Thailand
• The United States – California
• The United States – Illinois
• Vietnam

If you are applying for a role in Bank Handlowy, please click on the link provided below:

• Poland - Bank Handlowy

You can access Citi’s Binding Corporate Rules for the transferred of European and UK data using the links below:

• European BCRs and Third Party Beneficiary Deed

Appendix I: Local Data Protection Authorities Information

In certain jurisdictions, if you have further concerns about Data Privacy Protection, you may also contact the Data Protection Authority.

Appendix II: Data Controller and Data Processor