Citizens Privacy Policies

Online Privacy Policy

Effective Date: February 29, 2024

Your privacy is important to us. This Privacy Policy (“Policy”) describes how Citizens and its family of companies collect, use, share, and protect your personal information. This Policy applies to consumers, our customers, and other individuals from whom we collect personal information through our websites and mobile applications, physical locations, such as branches, and other Citizens’ products or services (collectively “Sites” or “Services”). If you are a job applicant, please refer to the Job Applicant Data Privacy Policy. If you are an employee, contractor, or intern, please refer to your Employment Data Privacy Policy.

Citizens refers to Citizens Financial Group, Inc., and its family of companies, including Citizens Bank, N.A., Investors Bank, a division of Citizens Bank, N.A., Citizens Securities, Inc., Clarfeld Financial Advisors, LLC, Estate Preservation Services, LLC, and other banks or companies that may be acquired or established from time to time. Those companies may also conduct business under brand names including Citizens Access and Clarfeld Citizens Private Wealth. This Privacy Policy does not cover the Services offered through the College Raptor platform. Please reference the College Raptor Privacy Policy for more information.

As you review this Policy, please keep the following in mind:

• We use the term “personal information” to describe information that can be associated with you and can be used to identify you. Personal information does not include information that does not identify a specific person or that is publicly available.
• If you have a financial product or service for personal, family or household purposes, we will use and share any information that we collect from or about you in accordance with our Consumer Privacy Notice which offers you certain choices with respect to the use and sharing of your information.
• By utilizing our Services, you consent to the practices described in this Policy. We may change this Policy from time to time by updating it with a new “Effective” date. Please check this Policy regularly to ensure that you are familiar with its contents.
• Our Services linking to this Policy are intended for a United States audience. If you access Citizens’ Services outside the United States, any information you provide to us online will be transferred out of that jurisdiction and into the United States. If you do not want your personal information to leave that jurisdiction, do not provide the information to us. By providing personal information to us, you explicitly consent to the transfer of your information to the United States.
• Our online Services are for a general audience and are not intended for the use of children under the age of 13. We do not knowingly collect or retain any personal information from individuals under the age of 13 online.
• If you are a California resident, you may have rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”). Please see our CCPA Policy and Notice below.
• Keeping your information accurate and up to date is very important. If your personal or account information is incomplete, inaccurate, or not current, please contact us at 1.800.922.9999.

We collect personal information in a variety of ways. For example, when you use our Services, communicate to us through our representatives, use our online tools such as our chat features, or complete a survey, we may collect personal information directly from you or your authorized representative. We also collect information from your devices automatically when you interact with us online, such as through cookies, pixels, web beacons and similar technologies. We also collect information from our affiliates and subsidiaries, credit reporting agencies, our service providers, vendors, and other third parties, as well as publicly available sources, such as websites that enable social sharing and social media sites.

Personal information we collect can include but is not limited to:

• Contact Information and other personal identifiers such as name, postal address, telephone number, social security number, passport number, driver’s license number or state identification card, birth date, email address, online and device identifiers and Internet Protocol address.
• Account Information such as your account number, transaction history, credit card number, debit card number, username and password, and PIN.
• Financial Information such as your income, investment preferences, and information about your financial standing such as credit score and credit history.
• When you authorize us to do so, we may collect the names, telephone number and/or email address of your mobile contacts to facilitate a payment to your contact(s) through one of our Services.
• Professional or employment information such as current and prior employers and income.
• Education information such as degrees held and years of schooling.
• Characteristics of protected classifications, such as gender, citizenship, and marital status.
• Precise geolocation data, such as device location.
• Audio, electronic, visual, or similar information, such as photographs you share, branch security video, and customer service audio recordings.
• Internet, device, or electronic network activity information such as your browsing and search history, browser type, and interactions with websites and advertisements.
• Inferences drawn from any of the Personal Information listed above to create a profile about, for example, and individual’s preferences and characteristics.
• Sensitive Personal Information, such as driver's license, state identification card, or passport number, precise geolocation (within a radius of 1,850 feet), and information on racial or ethnic origin.

We use your personal information for various business purposes, including but not limited to:

• Process transactions and administer your account – facilitating the processing and servicing of your requested transactions.
• Communicate with you – to respond to your requests, feedback, and inquiries.
• Prevention of Fraud and other Harm - to verify your identity, detect, prevent, or investigate fraudulent transactions, potential security breaches, and monitor against theft.
• Provide, market, and develop our products and services – marketing our products and services to you and tracking the effectiveness of our advertisements.
• Internal Business Operations -we use your information to improve the effectiveness of our services, maintain our websites and mobile applications, conduct research and analysis, or to perform other business activities as needed.
• Comply with law - we may use personal information to comply with our legal and regulatory obligations, to defend ourselves in litigation and investigations, and to prosecute litigation.
• In accordance with our financial services Consumer Privacy Notice - and to enforce our Terms of Use and any other agreements.
• Marketing- We may use personal information for marketing and promotional purposes to show you advertisements for products and/or services tailored to your interests on social media and other websites.
• Citizens and its service providers may also use and share anonymized, de-identified or aggregated information for analysis to understand more about our customers and our industry, or for other commercial purposes permitted by law. This information is not personal information.

General Marketing Practices

We offer you additional choices to limit our marketing to you including limiting our mail, telephone, and email marketing. Please contact us at 1-800-922-9999 24 hours a day, 7 days a week.

We may share your personal information in the following ways:

• Affiliates and Subsidiaries: We may share your personal information among our affiliates and subsidiaries.
• Service Providers: We may provide personal information to vendors, contractors, business and service providers, or other third parties who provide services to us including data storage firms, credit reporting agencies, payment companies, technology suppliers, technology services, customer service, risk solution providers, analysis firms, fraud prevention companies, advertisers, marketers, and others.
• Governmental Authorities: As required by law or legal process, we may share your personal information with federal or state regulatory agencies, law enforcement, courts, and other governmental authorities or when we believe that disclosure is necessary to detect, prevent or report suspicious activities, prevent physical harm, financial loss or violations of our agreements and policies.
• Collaborators and Professional Advisors: We may share your personal information with our professional advisors, such as auditors and law firms, as well as other financial institutions and entities with whom we jointly develop or offer, endorse, or sponsor financial products or services.
• Parties Involved with Business Transfers: We may share your personal information to third parties in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution, or liquidation).
• At your direction: We may disclose your personal information at your direction or with your consent.
• Please note: If you have a financial product or service with us primarily for personal, family, or household purposes, we will use and share any information that we collect from or about you in accordance with our Consumer Privacy Notice which offers you certain choices with respect to the use and sharing of your personal information. Where appropriate, we will limit the sharing of your information in accordance with the choices you have provided us in response to our Consumer Privacy Notice.

When you authorize us to do so, we may share your mobile subscriber details with service providers which will request your mobile carrier to use your mobile subscriber details for verifying your identity. Those details may include name, billing address, email, and phone number. This information may also include location information, if available. Additional use of your mobile subscriber data may be subject to third party privacy policies.

We take our responsibility to protect your information very seriously. We use commercially reasonable physical, technical, and procedural safeguards to secure your information from unauthorized use, access, alteration, or disclosure. However, the confidentiality of information transmitted over the internet cannot be guaranteed. Please only submit personal information to Citizens through secure channels such as online applications, over the phone, or as otherwise directed by a Citizens representative. Please be advised Citizens will never ask for you to send personal or financial information by, in response to, or via a link in an email or text. Do not provide sensitive personal information, such as your social security number or account number, in public forums, such as social media websites. Please carefully review the Terms of Use and Privacy Policies on these social media and other sites as they may be different than our own policies.

Please see Security section for additional information.

Social Media

You may also find additional information on our products and services through our social media sites such as Facebook, LinkedIn, or Twitter. Please keep in mind that any information you share is visible to all participants on these social media sites and you should never post any sensitive personal information (such as account number or tax identification). Please carefully review the Terms of Use and Privacy Policy on these social media sites as they may be different than our own policies.

Physical Hardware Beacons at Our Bank Locations

Our customer-facing physical locations such as branches, ATM vestibules, and Citizens’ sponsorship/marketing events may also utilize your mobile device location services to identify when you are in or around one of our physical locations. You will be prompted to allow Citizens access to your location services. We may use your location services including your mobile device identifier to communicate with you including welcoming you to our properties, personalized offers, or offering other services such as automatically unlocking an ATM vestibule as you approach and locating a nearby branch. When you download our mobile application, you are provided additional information on this data collection and how to enable or disable the sharing over your mobile device information. You can enable/disable location sharing for our mobile applications within Settings of the Citizens Bank Applications on your own device at any time.

Cookies

Cookies are small text files that are placed on your computer to distinguish you from other visitors to our Sites. The use of cookies helps us to improve your experience on our Sites by providing data on which of our Site’s features and services are popular. The use of cookies is a standard practice. We or our third-party advertising service providers may place cookies or similar files on your hard drive. Certain web browsers can inform you every time a cookie is being sent to you and certain web browsers allow you to choose not to accept cookies. You can also delete cookies from your computer at any time. If you refuse cookies, the functionality of our website may be impacted or become non-functional. Since every browser and computer is different, you will need to follow your browser’s instructions for disabling or deleting cookies.

We differentiate between cookies that are essential for the technical features of the Sites and optional analytics and advertising cookies.

Pixels, Web Beacons, and Other Technologies

We or our third-party advertising service providers may also use technologies to track users’ interactions with our Sites. Some of these technologies include web beacons (transparent graphical images placed on a website), pixels, tags, and Flash objects (also referred to as “Local Shared Objects”). Please refer to your browser’s instructions to remove cached Sites, history, and images from your computer.

How to Opt-Out of Online Behavioral Advertising

To Opt-Out of behavioral advertising please reference the How to Exercise Your Rights section below. Opting out of behavioral advertising will not stop you from receiving advertisements. You will still see the same number of advertisements as before, but they may not be as relevant to you. If you use other computers or browsers and want to opt out of interest-based advertisements, you will need to repeat this process for each computer or browser. If you delete your cookies and want to continue to be opted out of behavioral advertisements, you will have to repeat this opt-out process.

We will endeavor to recognize commercially recognized opt out signals (e.g., Global Privacy Control). Recognition of this signal will only take place with respect to the device and/or browser that communicates the signal.

Please note that not all browsers process your opt out requests in the same manner. Please reference your specific browser options and instructions for more information.

If you have any questions, comments, or concerns about this Policy or regarding our privacy practices, please contact us at 1.800.922.1927.

California Consumer Privacy Act Notice

Effective Date: February 29, 2024

This California Consumer Privacy Act Notice explains how Citizens collects, uses, and discloses personal information relating to California residents covered by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”). This “Notice” constitutes our notice at collection and our privacy policy pursuant to the CCPA. If you are a Job Applicant, please refer to the Job Applicant Data Privacy Policy. If you are an employee, contractor, or intern, please refer to the Employment Data Privacy Policy.

Under the CCPA, “Personal Information” is information that identifies, relates to, or could reasonably be linked directly or indirectly with a particular California resident.

Please note, however, that the CCPA does not apply to certain information, such as information subject to the Gramm-Leach-Bliley Act (“GLBA”), the Fair Credit Reporting Act (“FCRA”) or Health Insurance Portability and Accountability Act (“HIPPA”). For example, if you are a California resident and you have a personal financial product with us, such as a personal credit card, the CCPA rights do not apply to the personal information associated with that account. For more information about how we collect, disclose, and secure information relating to these customers, please refer to our Consumer Privacy Notice.

Categories of Personal Information We Collect

The categories of Personal Information that Citizens has collected in the preceding 12 months include:

• Contact Information and other personal identifiers such as name, postal address, telephone number, social security number, passport number, driver’s license number or state identification card, birth date, email address, online and device identifiers and Internet Protocol address.
• Account Information such as your account number, transaction history, credit card number, debit card number, username and password, and PIN.
• Financial Information such as your income, investment preferences, and information about your financial standing such as credit score and credit history.
• When you authorize us to do so, we may collect the names, telephone number and/or email address of your mobile contacts to facilitate a payment to your contact(s) through one of our Services.
• Professional or employment information such as current and prior employers and income.
• Education information such as degrees held and years of schooling.
• Characteristics of protected classifications, such as gender, citizenship, and marital status.
• Precise geolocation data, such as device location.
• Audio, electronic, visual, or similar information, such as photographs you share, branch security video, and customer service audio recordings.
• Internet, device, or electronic network activity information such as your browsing and search history, browser type, and interactions with websites and advertisements.
• Inferences drawn from any of the Personal Information listed above to create a profile about, for example, and individual’s preferences and characteristics.
• Sensitive Personal Information, such as driver's license, state identification card, or passport number, precise geolocation (within a radius of 1,850 feet), and information on racial or ethnic origin.

We only collect and process Personal Information that is Sensitive Personal Information under the CCPA for the purposes set forth in Section 3. We do not collect or process Sensitive Personal Information with the purpose of inferring characteristics about you and/or in a manner that would trigger a right to limit under the CCPA.

Sources of Personal Information

The categories of sources from which we may collect Personal Information depends on our relationship or interaction with you, and the business purpose for which the Personal Information is collected.

During the 12-month period prior to the Effective date of this Notice, we may have obtained Personal Information about you from the following sources:

• Directly from you, a California resident, or your representative.
• Our affiliates or subsidiaries.
• Our Service Providers and third parties who provide it to us (e.g., our customers, credit reference agencies and law enforcement authorities).
• Public records or public sources.
• Your devices, such as when you visit our websites or use our mobile applications.
• Joint marketing or other commercial business partners.
• Online advertising networks and cookies/ automatic data collection technologies.

Purposes for Our Collection

The purposes for which we collect, use, and disclose Personal Information depend on, among other things, our relationship or interaction with a specific California resident and is described in the How We Use Your Information section above. Specifically, we collect Personal Information to process transactions and administer your account, communicate with you, prevent fraud and other harms, to provide, market, and develop our products and services, for our internal business operations, to comply with law, and in accordance with our financial services Consumer Privacy Notice and other agreements.

Retention of Personal Information

The length of time that we intend to retain each category of Personal Information will depend on a number of criteria, including (i) the length of time we are required to retain Personal Information in order to comply with applicable legal and regulatory requirements, (ii) the length of time we may need to retain Personal Information in order to accomplish the business or commercial purpose(s) for which such Personal Information is collected, used or disclosed (as indicated in this Notice), and (iii) whether you choose to exercise your right, subject to certain exceptions, to request deletion of your Personal Information.

Categories of Personal Information Disclosed for Business Purposes

As described in the How We Share Your Information section, we disclose information for business purposes with third parties who are considered “service providers” as defined under California law since we disclose Personal Information to them for our business purposes.

During the 12-month period prior to the Effective date of this Notice, we may have disclosed the following categories of Personal Information about you to our affiliates and subsidiaries, our service providers, governmental authorities, professional advisors, and parties involved with business transfers as follows.

• Identifiers, such as name, address, and Social Security Number.
• Characteristics of protected classifications under California or federal law, such as sex and marital status.
• Commercial information: such as products or services purchased, obtained, or considered, other purchasing or consuming histories or tendencies.
• Employment information such as current and prior employers and incomes.
• Education information such as degrees held and years of schooling.
• Internet or network activity information, such as browsing history and interactions with our website.
• Geolocation data, such as device location.
• Audio, electronic, visual, or similar information, such as photographs you share, branch security video, and customer service audio recordings.
• Inferences drawn from any of the Personal Information listed above to create a profile about, for example, and individual’s preferences and characteristics.
• Sensitive Personal Information, such as driver's license, state identification card, or passport number, precise geolocation (within a radius of 1,850 feet), and information on racial or ethnic origin.

The categories of service providers to which we may share the above-described categories include Payment Processing Companies, Data Analytics Providers, Fraud Prevention Providers, Cloud Storage Providers, IT Service Providers, Professional Service Providers, Delivery Partners, and Marketing Companies.

Selling and Sharing of CA Personal Information

As described above in the How We Share Your Information section, we may share the following categories of Personal Information with third parties who are considered "third parties" as defined under California law since we disclose Personal Information to them which they may use for cross context behavioral advertising. Our disclosure of Personal Information to the third parties who use the information for these purposes may constitute a "sharing" of Personal Information as defined under California law. Please note that we do not “sell” Personal Information in the traditional sense.

In the 12 months prior to the Effective date of this Notice, we shared for cross context behavioral advertising and may continue to share, the following categories of Personal Information:

• Identifiers, such as name and contact information.
• Internet or network activity information, such as browsing history and interactions with our website.

The categories of third parties to which we may share (as defined by California law) the above-described categories of Personal Information include online Advertising Networks, Marketing Companies, and Social Media Companies. Please note, we do not knowingly sell or share the Personal Information of individuals under the age of 16. Please see our How to Exercise Your Rights section below on how to opt-out of the sharing of your Personal Information.

Rights under the CCPA

If you are a California resident covered by the CCPA, you have the following rights:

• Right to Know and Access. To request a disclosure of the categories of Personal Information that have been collected; the categories of sources from which the information was collected; the business or commercial purpose for collecting, selling, or sharing the Personal Information; the categories of third parties to whom the business discloses Personal Information; and access to the specific pieces of Personal Information Citizens has collected about you in a portable format.
• Right to Request Deletion of Personal Information. To request that Citizens delete Personal Information that we have collected from you, subject to certain exceptions provided under the CCPA.
• Right To Correct Inaccurate Personal Information. To request that Citizens correct any inaccurate Personal Information that it maintains about you.
• Right to Opt-Out of the Sale of Personal Information or Sharing of Personal Information for Cross-Context Behavioral Advertising. Our use of cookies or other tracking technologies for cross-contextual advertising purposes is deemed a “sale” or “share” of Personal Information under the CCPA.
• Right of No Retaliation Following Opt-Out or Exercise of Other Rights. To not be denied a product or service, charged a different price or rate, denied a discount or other benefit because the consumer exercised any of his/her rights under the CCPA.
• Automated Processing. Under certain circumstances, you have the right to object to a significant decision based solely on automated processing (i.e., without human intervention) unless that decision is required or authorized by law.
• Right to Opt-Out of our Use of your Sensitive Personal Information (in certain instances and if permissible under applicable law). We do not disclose sensitive personal information for purposes other than those which cannot be limited under applicable law.

In order to exercise your Right to Opt-Out of the Selling or Sharing of your Personal Information, please visit our “Do Not Sell or Share My Personal Information” link located at the footer of our Site. In order to exercise your other rights described above, please navigate to our online web portal available at CCPA Privacy Rights Portal or by calling us at 1.888.999.1927.

Please also note that prior to processing your request and to protect your Personal Information, Citizens will perform reasonable processes to verify your identity which will require you to provide certain information for us to confirm against independent sources.

To authorize an agent to exercise your privacy rights on your behalf, your authorized agent can submit a request by calling 1-888-999-1927. We may require proof from your authorized agent, such as a Power of Attorney and other information for verification of identity.

Please note that Citizens does not collect or process household information. For inquiries and requests related to households you can contact 1.888.999.1927.