5. Citibank has the right to amend this Notification Letter at any time, and notify the Client and Client Personnel of the amendments orally, in writi

Transcription

1 N o t ification L e t t er o f Collect ion, Processing a n d Use o f Personal I n formation by Citibank Taiwan Limit ed Citibank Taiwan Limited (including its offshore banking unit and any other branches, Citibank ) may, for the purpose of (1) processing any and all of the transactions with your company (the Client ), handling the account activities for the Client, or providing services to the Client; (2) making recommendation and providing Citibank s products or services to the Client; (3) (i)fulfilling Citibank s legal obligations in the laws and regulations of the Republic of China and/or of the jurisdiction where Citibank s parent company (i.e., Citibank N.A.) is located, or (ii)complying with the financial supervisory requirements of the governmental authorities in the Republic of China or other authorities having jurisdiction over Citibank N.A, or (iii) based on the contractual, quasi-contractual or other legal relationship between Citibank and the Client; (4) the specific purposes listed in the Appendix 2 or Citibank s scope of business registered with the authority, specified in Citibank s Articles of Incorporation, or permitted by applicable laws and regulations; (5) the business decision and risk by the global or regional headquarters of Citigroup for its supervision of its subsidiaries (for example, the layered responsibility policies of the global/ regional headquarters, business statistic, analysis and planning, internal control and audit, monitoring and of accounts, checking and adjustments of accounts, customer, risk (including but not limited to credit risk, operational risk, information security, market risk, liquidity risk, legal or regulatory risk), provision of advisory or other services, development, monitoring and maintenance of the global system); (6) (i) conducting know your customers, (ii) exchanging credit investigation and financial information with other financial institutions, (iii) providing Client Data (as defined below) to the entities listed in the Appendix 2 (other than Citibank) ; and (7) outsourcing relevant matters to third parties (see Appendix 1 for details), collect, process, use and internationally transmit any and all personal data ( Personal Data ) and transaction information (collectively, Client Data ) Client, its responsible person, directors, supervisors, shareholders, managers, relevant employees, authorized personnel, beneficiaries, transaction counterparties of the Client (collectively, the Client Personnel ). Citibank hereby, pursuant to the Personal Data Protection Act ( PDPA ) and Enforcement Rules of the PDPA ( PDPA Enforcement Rules ), notify the Client of the following matters: 1. Regarding the type of Personal Data of the Client Personal to be collected, time period, areas and manners of use of such Personal Data and entities to use such Personal Data, please see Appendix 2 for details, provided however that, the actual contents regarding collection, processing and use of such Personal Data will depend on the actual, account activities and services provided by Citibank to the Client 2. Each of the Client Personnel may exercise the following rights with respect to his/her information according to relevant Articles set forth in the PDPA: (1) to make any enquiries or request for review or making a duplicate copy, except for the Exceptions set forth in Article 10 of the PDPA, provided however that, Citibank may charge a reasonable fee in accordance with Article 14 of the PDPA; (2) to request to supplement or rectify any error, provided that the Client Personnel shall provide Citibank with the adequate explanations in accordance with Article 19 of the PDPA Enforcement Rules; (3) to request Citibank to cease the collection, processing or use of Personal Data if Citibank violates the PDPA to collect, process and use the Personal Data in accordance with Paragraph 4 of Article 11 of the PDPA; (4) to request to cease processing or using the Personal Data if the accuracy of the Personal Data is in dispute in accordance with Paragraph 2 of Article 11 of the PDPA, provided however that, according to the proviso of the same Paragraph, Citibank may not proceed with the cessation request if the Personal Data is required for the performance of the Citibank's business operation and such dispute is recorded or the written consent is obtained from the Client Personnel; and (5) to request to delete or cease processing or using the Personal Data if the specific purpose no longer exists or time period expires in accordance with Paragraph 3 of Article 11 of the PDPA, provided however that, according to the proviso of the same Paragraph, Citibank may not proceed with the deletion or cessation request if such Personal Data is required for the performance of the Citibank's business operation or the written consent is obtained from the Client Personnel. 3. To exercise any of the aforementioned rights, the applicant for any above request ( Applicant ) should provide Citibank with a written request together with the relevant supporting documents. Citibank will, within 15 days from the next day of receiving the written request, send to such Applicant a written notice informing Citibank s determination. Such 15-day period may be extended for another 15 days when necessary, and Citibank will notify the Applicant of the extension in writing. In the case of request for making an inquiry or review documents, the Applicant should, after receiving a notice from Citibank in response to such request, visit the location designated by Citibank in the notice within the time limit specified by Citibank. The Applicant should submit a new request if he/she fails to make an inquiry or review of the Personal Data within the specified time limit. 4. The Client Personnel may choose to opt-out of providing Personal Data. In the case that the Client Personnel decides not to provide the relevant information, Citibank has the right to decide at its sole discretion whether it agrees to proceed with the application made by or the transactions, account activities and services requested by the Client.

2 5. Citibank has the right to amend this Notification Letter at any time, and notify the Client and Client Personnel of the amendments orally, in writing, or by telephone, text messaging, , facsimile, electronic documents, or other methods that may give the data subject direct or constructive notice (including but not limited to notification made via the aforementioned method to provide a website for reference to the contents of this Notification Letter). Please refer to such website so provided then. 6. In the event of any inconsistency between this Notification Letter and any consent to collect, process, use, and internationally transmit Personal Data given by the Client or the Client personnel under any agreements or documents previously executed between the Client and Citibank, this Notification Letter shall prevail. APPENDIX 1 Matters Outsourced to Third Parties Matters outsourced to third parties by Citibank including but not limited to: (1) Data processing: Including the data entry, processing, and output of information system, the development, monitoring, control, and maintenance of information system, and logistical support for data processing in connection with Citibank's business. (2) Data Retention. (3) Drawing negotiable instruments for customers. (4) Back office support for trade financing activities. (5) Collection of consumer loans and credit card payment. (6) Preparation of credit analysis reports on credit customers. (7) Marketing of credit card issuance, input of customer information, printing of relevant forms and statements, envelope stuffing, sorting and mailing, computerized and manual card activation, reporting of lost cards, cash advances and emergency services. (8) Electronic customer services. (9) Collection of debts. (10) Hiring real estate closing agent to handle relevant legal matters. (11) Entrusting other institutions to dispose collateral from the assumption of debts, and the appraisal of real estate. (12) Internal audit operations. (13) Valuation, classification, bundling and sale of non-performing loans. (14) Transporting securities, checks, forms and statements, and cash. (15) Other operations approved by the competent authority for outsourcing.

3 APPENDIX 2 Specific Purpose Details category Specific Purposes and Corresponding Codes for each Ⅰ Deposit and Remittance business exchange business 036 Deposit and remittance 067 of credit card, cash card, debit card and electronic bills 082 deposit and lending of the depositors 112 Bill exchange business 181 Other in compliance with business items or those specified in Articles of TWD deposit, foreign currency deposit, inward and outward remittances, other relevant authorized by the Central Competent Ⅱ Credit Extension exchange business 067 of credit card, cash card, debit card and electronic bills 082 deposit and lending of the depositors 088 Loan approval and credit extension business 106 Credit extension business 111 Bill business 126 Purchase and discounted cash business of credit rights 154 Credit investigation 181 Other in compliance with business items or those specified in Articles of bills and notes discounting, commercial drafts accepting, letters of credit issuance, letter of guarantee for issuance of bonds, engaging in domestic guarantee, other relevant Central Competent Authorities, Ⅲ Credit Card exchange business 067 of credit card, cash card, debit card and electronic bills 082 of the depositors 088 Loan approval and credit 106 Credit 154 Credit investigation 181 Other in those specified in Articles of card issuing and acquiring business, consuming Information of the card holders of commercial cards, risk of merchants of credit card, other relevant Ⅳ Foreign Exchange exchange business 036 Deposit and remittance 082 of the depositors 088 Loan approval and credit 106 Credit 154 Credit investigation 181 Other in those specified in Articles of foreign exchange for import and export, inward and outward remittances, foreign currency deposit, foreign currency loan and guarantee for payments, foreign currency margining transactions, other relevant Ⅴ Securities 037Registration of s ecurities and securit ies holders 044 Investment 082 of the depositors 088 Loan approval and credit 097 Management of retirement funds 106 Credit 111 Bill business 154 Credit investigation 166 related to securities, futures, securities investment trust and consultancy181 Other in those specified in Articles of investment in securities, underwriting securities, proprietary trading of securities, brokerage and proprietary trading of short-term bills and notes, acting as agent for issuance/transfer/re gistration of securities and distribution of dividends/interests/ bonus, advisory service for issuance and offering of securities, certificating securities, acting as Ⅵ Wealth Management exchange business 036 Deposit and remittance 037Registration of s ecurities and securiti es holders 044 Investment 068 Trust business 082 of the depositors 094 Property 166 related to securities, futures, securities investment trust and consulting 181 Other in those specified in Articles of money trust, trust of loans and related security interests, securities trust, real estate trust, trust of superficies, securities investment trust funds, other relevant Ⅶ Other in Compliance with Items or es Registered in Corporate Registration or Those Specified in Articles of Constitutional Documents, or Other Relevant es Approved by the Authorities(e.g., acting as agent for sale of government bonds, treasury notes, bonds and stocks, derivative business approved by the regulators, relevant authorized and approved in accordance with the Trust Enterprise Act, of securities underwriting, propriety trading or agency business, conducting custodian business, financial advisory for loan related business, gold deposit business, E-banking business, acting as collecting and paying agent, etc.) exchange business 036 Deposit and remittance 037Registration of securities and securities ho lders 044 Investment 068 Trust business 082 of the depositors 088 Loan approval and credit 094 Property 097 Management of retirement funds 106 Credit extension business 148 Internet purchasing and other e- business service 154 Credit investigation 166 related to securities, futures, securities investment trust and consulting 181 Other in business items or those specified in Articles of documents (e.g., acting as agent for sale of government bonds, treasury notes, bonds and stocks, derivative business approved by the regulators, relevant authorized and approved in accordance with the Trust Enterprise Act, of securities underwriting, propriety trading or agency business, conducting custodian business, financial advisory for loan related business, gold deposit business, E-banking business, acting as collecting and paying agent, etc.)

4 Specific purposes and Corresponding Codes for Citibank as a whole Type of Personal Data Time Period to Use Personal Data Areas where Personal Data are Used etc.) trustee of bond issuance and handling relevant agency service, proprietary trading of bonds, other relevant Pursuant to the Categories of Specified Purposes and Personal Data under Personal Data Protection Act promulgated by the Ministry of Justice of the Republic of China, the specific purposes and corresponding codes are listed as follows for handling and offering relevant transactions, account activities and service to the Client, provided however that, the actual purposes for collecting, processing and using the Personal Data will depend on the actual, account activities and services provided by Citibank to the Client: 013 Public relationship 014 Property reporting, recusal of conflict interest and political contributions of public servants 020 Agency and brokerage business 025 Crime prevention, criminal investigation, enforcement, correction and protection of criminal victim and rehabilitation matters 032 Management of criminal case information 040 Marketing (including cross selling for financial holding company) 052 Internal lists of legal entities to their shareholders, members (including the representatives of shareholders and members), directors, supervisors and other members 059 Collection, processing and use conducted by financial service enterprises as required by the laws and regulations and financial supervisory need 060 Financial dispute resolution 061 Financial supervisory, and examination 063 Personal information collection, process and use by non-governmental agency pursuant to its legal obligations 069 Management of other contractual relationship, quasi-contractual relationship or legal relationship 090 Management and Service to consumers and customers 091 Consumer protection 098 and Technical Information 104 Account and sale and purchase of credit rights business 113 Petition and prosecution matters 122 Administrative appeals and remedies 127 Donation business (including the donation for public welfare)129 Accounting and other related service 136 Information technology and database 137 Information security and 150 Assistance and logistics support 157 Investigation, statistics, research and analysis 160 Management of certification business 177 Other financial business 182 Other advisory and consulting business In addition to the aforementioned specific purposes, other specific purposes are listed as follows for handling and offering relevant transactions, account activities and service, provided however that, the actual purposes for collecting, processing and using the Personal Data will depend on the actual, account activities and services provided by Citibank to the Client: Cooperation with the investigation of terrorism and US economic sanctions US Tax reporting Interbank (inter-institutional) financial information service and Outsourcing matters Outsourced human resource Repayment by relatives or third parties Collection, process and use of information related to interested parties Assistance in handling of enforcement procedure Matters related to litigation, non-litigation or other dispute resolutions Risk (including but not limited to credit risk, operational risk, information security, market risk, liquidity risk, legal or regulatory risk) Prevention of anti-money laundering, account opening review or KYC process Internal control and audit Requirement from laws, regulations, statutes, and external payment system Layered responsibility policies among the global/ regional headquarters Monitoring and of accounts Checking and adjustments of accounts Development, monitoring and maintenance of the global system Name, ID card number, gender, date of birth, communication method or other information as required in any application form, contract or agreement with Citibank. Pursuant to the Categories of Specified Purposes and Personal Data under Personal Data Protection Act promulgated by the Ministry of Justice of the Republic of China, Citibank will collect the following personal information from the Client and the Client Personnel, provided however that, the actual information so collected, processed and used will depend on the actual, account activities and services provided by Citibank to the Client or the information provided by the Client or any third party (e.g., Joint Credit Information Center): (1) Identification Information from C001 to C003 (e.g., name, title, address, work address, home phone number, mobile phone number, fax number, address, ID card number, passport number, and any other information by which individual can be identified, etc.) (2) Characteristics Information C011 and C012 (e.g., gender, date of birth, place of birth and nationality, etc.) (3) Family Status C021 and C023 (e.g., marriage status, spouse's name, children, etc.) (4) Social Situation C032, C033, C038 and C039 (e.g., property information, work permit, residence documents, occupations, license, etc.) (5) Information Regarding Education, Examination, Technique and Professional Skill C052 (e.g., educational background, work experience, etc.) (6) Employment Status C061 (e.g., name of employers, job position) (7) Financial Details C081 and C086 (e.g., asset, shareholding ratio in certain investments, bills of credit, etc.) (8) Others C131 to C132 (e.g., that cannot be classified, etc.) Citibank may use the Personal Data until the later of (i) the existence period of the specific purposes for collection of personal data; (ii) the data retention period required by applicable laws and regulations (e.g., Accounting Act) or Citibank s internal policies, or set by Citibank due to business operation needs; or (iii) the retention period agreed in the respective contract or agreement executed with the Client. Any jurisdictions where the entities described in the following paragraph Entities to Use Personal Data are located. Entities to use Personal Data. 1. Citibank, Citigroup Inc. and any of its subsidiaries and branches, Citibank N. A. and any of its subsidiaries and branches, providers of outsourced services engaged by Citibank (including but not limited to Citibank N. A. Singapore branch, London branch, Hong Kong branch and Dublin branch, Citibank N.A. Regional Operating Headquarter, TCS Limited, Citigroup Transactions Services (Malaysia) Sdn Bhd, Citicorp International Limited and Citigroup Technology Inc.) and third parties engaged by aforementioned entities; 2. Entities using the Personal Data per laws and regulations (e.g., Citibank N.A. or its holding companies); 3. Entities entering into contracts with Citibank for their business needs or any other relevant institutions with business relationship with Citibank (e.g., correspondent banks, the Joint Credit Information Center, National Credit Card Center of R.O.C., Financial Information Service Co., Ltd., the Taiwan Clearing House, or institutions designated by the Ministry of Finance or the Financial Supervisory Commission, Agricultural Credit Guarantee Fund, Small and Medium Enterprise Credit Guarantee Fund of Taiwan, Financial Ombudsman Institution, credit guarantee institutions, credit card international organizations, acquirers, merchants and their agents and other similar institutions, other credit rating agencies, other entities engaging in financial lending business, entities worked with Citibank for cooperative promotion, Taiwan Stock Exchange Corporation, Taiwan Futures Exchange, GreTai Securities Market, Taiwan Depository & Clearing Corporation, various industrial associations, Securities and Futures Investors Protection Center, etc.); 4. Parties with the consent from the Client and the Client Personnel to use their Personal Data (e.g. entities for joint marketing or mutual use of customers data and entities working with Citibank for cooperative promotion and for soliciting business); 5. Other recipients of internationally transmitted Personal Data without subject to restrictions imposed by the Central Government Authorities and other counterparties of Citibank who need to collect, process, use or internationally transmit the Personal Data; and. 6. Competent authorities, financial supervisory authorities, judicial authorities, tax authorities or other governmental agencies having jurisdiction and investigation power over the foregoing entities. Manners of Using Personal Data. The Personal Data will be collected, processed, used, and internationally transmitted through automatic machine or non-automatic methods (e.g. via electronic documents, paper format, or other appropriate manners conform to the technology available at that time) in the PDPA and any relevant laws and regulations.

5 花旗 ( 台灣 ) 商業銀行股份有限公司蒐集 處理及利用個人資料告知書 花旗 ( 台灣 ) 商業銀行股份有限公司 ( 包括其國際金融分行及其他分支機構, 下稱 花旗台灣 ) 為 (1) 處理花旗台灣與貴公司 ( 下稱 客戶 ) 各項往來之交易 辦理客戶帳戶事宜, 或提供服務予客戶 (2) 推介與提供客戶花旗台灣之產品或服務 (3) (i) 依中華民國及 / 或花旗台灣母公司 ( 即美商花旗銀行 ) 所在地之法令, 履行花旗台灣之法定義務, 或 (ii) 遵循中華民國政府機關或其他對美商花旗銀行有權機關之金融監理要求, 或 (iii) 依據花旗台灣與客戶間契約 類似契約關係或其他法律關係 (4) 如附表二說明之特定目的 或花旗台灣營業登記項目或章程所定業務或適用之法令所准許之各項目的 (5) 花旗台灣之業務或營運管理或花旗集團全球或區域總部基於總機構對子公司之管理事項範疇所為之業務決策及風險管理, 例如總行 / 區域總部層級之分層負責決策 業務統計 分析與規劃 內部控制及稽核 帳務監督管理 帳務勾稽調節 客戶管理 風險管理 ( 包括但不限於信用風險 作業風險 資訊安全管理 市場風險 流動性風險 法律或法規遵循風險等 ) 諮詢服務或其他服務之提供 全球系統開發 監控與維護 (6) (i) 進行認識客戶 (Know Your Customers) 之程序 及 (ii) 與其他金融機構進行徵信與財務資訊之交換, 提供客戶資料 ( 定義如後 ) 予除花旗台灣外之附表二所示之利用對象 及 (7) 委託他人處理相關事務 ( 詳附表一說明 ), 而蒐集 處理 利用及國際傳輸涉及客戶及負責人 董事 監察人 股東 經理人 相關員工 授權人員 受益人 交易相對人等人 ( 下合稱 客戶人員 ) 之各項個人資料及交易資訊等 ( 下稱 客戶資料 ), 花旗台灣茲依據個人資料保護法 ( 下稱 個資法 ) 及其施行細則 ( 下稱 個資法施行細則 ) 之規定, 告知下列事項 : 一 有關所蒐集個人資料類別及個人資料利用之期間 地區 對象及方式等內容, 請詳閱如後附表二 但實際蒐集 處理及利用個人資料之情形, 仍以花旗台灣對客戶提供之實際往來業務 帳戶及服務為準 二 依據個資法相關規定, 各客戶人員就其個人資訊得行使下列權利 : ( 一 ) 除有個資法第十條所規定之例外情形外, 得要求查詢 請求閱覽或請求製給複製本, 惟花旗台灣依個資法第十四條規定得酌收合理費用 ; ( 二 ) 得請求補充或更正錯誤, 惟依個資法施行細則第十九條規定, 客戶人員應提供花旗台灣適當說明 ; ( 三 ) 花旗台灣如有違反個資法規定蒐集 處理或利用個人資料, 依個資法第十一條第四項規定, 向花旗台灣請求停止蒐集 處理或利用個人資料 ; ( 四 ) 依個資法第十一條第二項規定, 個人資料正確性有爭議者, 得請求停止處理或利用個人資料 惟依該項但書規定, 花旗台灣因執行業務所必須並註明其爭議或經客戶人員書面同意者, 花旗台灣得不停止處理或利用 ; 及 ( 五 ) 依個資法第十一條第三項規定, 個人資料蒐集之特定目的消失或期限屆滿時, 得請求刪除或停止處理或利用個人資料 惟依該項但書規定, 花旗台灣因執行業務所必須或經客戶人員書面同意者, 花旗台灣得不刪除或停止處理或利用 三 若客戶人員擬提出上述任一請求 ( 下稱 申請人 ), 請檢附相關證明文件向花旗台灣提出書面請求, 花旗台灣將於收到書面請求之次日起 15 日內以書面通知申請人花旗台灣之決定 前述 15 日期間於必要時, 得予再延長 15 日, 花旗台灣並將以書面通知申請人期間之延長 如係請求查詢或閱覽文件, 申請人應於收受花旗台灣通知後, 於花旗台灣指定之期間內, 至花旗台灣通知函指定之地點查詢或閱覽 如申請人逾期未查詢或閱覽個人資料者, 應重新提出請求 四 客戶人員得自由選擇是否提供個人資料, 惟若拒絕提供相關個人資料, 花旗台灣有權依其自己判斷, 決定是否同意處理客戶的申請或客戶請求提供之各項往來之業務 帳戶及或服務 五 花旗台灣有權隨時修訂本告知書, 並以言詞 書面 電話 簡訊 電子郵件 傳真 電子文件或其他足以使資料主體知悉或可得知悉之方式 ( 包括但不限於以前述方式告知提供載明本告知書內容之網站連結 ) 通知客戶及客戶人員, 屆時, 請詳閱指定網站內容 六 如客戶或客戶人員依客戶與花旗台灣先前簽訂之契約或文件所提供之個人資料蒐集 處理 利用與國際傳輸之同意, 與本告知書有所歧異者, 以本告知書為準 附表一 : 委託他人處理事務之項目 花旗台灣委託他人處理事務之項目包括但不限於 : ( 一 ) 資料處理 : 包括資訊系統之資料登錄 處理 輸出, 資訊系統之開發 監控 維護, 及辦理業務涉及資料處理之後勤作業 ( 二 ) 資料保存 ( 三 ) 代客開票作業 ( 四 ) 貿易金融業務之後勤處理 ( 五 ) 代收消費性貸款或信用卡帳款 ( 六 ) 提供信用額度之往來授信客戶之信用分析報告編製 ( 七 ) 信用卡發卡業務之行銷 客戶資料輸入 表單列印 裝封作業 付交郵寄, 及開卡 停用掛失 預借現金 緊急性服務等信用卡相關事項之電腦及人工授權

6 ( 八 ) 電子通路客戶服務 ( 九 ) 應收債權催收 ( 十 ) 委託不動產代書處理事項 ( 十一 ) 委託其他機構處理因債權承受之擔保品 鑑價作業 ( 十二 ) 內部稽核作業 ( 十三 ) 不良債權之評價 分類 組合及銷售 ( 十四 ) 有價證券 支票 表單及現 S 鈔運送作業 ( 十五 ) 其他經花旗台灣主管機關核定得委外之作業項目附表二 : 特定目的說 明 業務類別 一 存匯業務 二 授信業務 三 信用卡業務 四 外匯業務 五 有價證券業務 六 財富管理業務七 其他經營合於營業登記項目或組織章程所定之業務, 或經中央主管機關核准辦理之其他有關業務 ( 例如 : 代銷公債 / 國庫債 / 公司債券及股票 經主管機關核准辦理之衍生性金融商品業務 依信託業法核定辦理之業務 有價證券之承銷 自營買賣或代客買賣業務管理 辦理保管業務 與融資業務相關之財務顧問業務 黃金存摺業務 電子金融業務 代理收付款項業務等 ) 特定目的及代 022 外匯業務號 036 存款與匯款 067 信用卡 現金卡 轉帳卡或電子票證業務 082 借款戶與存款戶存借作業綜合管理 112 票據交換業務 181 其他經營合於營業登記項目或組織章程所定之業務 ( 例如 : 台幣存款 外匯存款 一般匯出及匯入款 其他經中央主管機關核准辦理之有關業務等 ) 022 外匯業務 067 信用卡 現 金卡 轉帳卡或 電子票證業務 082 借款戶與存 款戶存借作業綜 合管理 088 核貸 與授信業務 106 授信業務 111 票 券業務 126 債權 整貼現及收買業 務 154 徵信 181 其他經營合於營 業登記項目或組 織章程所定之業 務 ( 例如 : 票據 貼現 商業匯票 承兌 簽發信用 狀 保證發行公 司債 辦理國內保證業務 其他經中央主管機關核准辦理之有關業務等 ) 022 外匯業務 外匯業務 有價證券與有價 022 外匯業務 外匯業務 036 存款與匯款信用卡 現金卡 存款與匯款 082 證券持有人登記 044 存款與匯款 037 有 037 有價證券與有價證券持有人登轉帳卡或電子票證借款戶與存款戶存投資管理 082 借款價證券與有價證券記 044 投資管理 068 信託業務業務 082 借款戶與借作業綜合管理戶與存款戶存借作業持有人登記 044 投 082 借款戶與存款戶存借作業綜合存款戶存借作業綜 088 核貸與授信業綜合管理 088 核貸資管理 068 信託業管理 088 核貸與授信業務 094 財合管理 088 核貸與務 106 授信業務與授信業務 097 退務 082 借款戶與存產管理 097 退撫基金與退休金管 授信業務 106 授信 154 徵信 181 其撫基金與退休金管理款戶存借作業綜合理 106 授信業務 148 網路購物及業務 154 徵信 181 他經營合於營業登 106 授信業務 111 管理 094 財產管理其他電子商務服務 154 徵信 166 其他經營合於營業 記項目或組織章程票券業務 154 徵信 166 證券 期貨 證券 期貨 證券投資信託及顧問 登記項目或組織章程所定之業務 ( 例 所定之業務 ( 例如 : 辦理出口外 166 證券 期貨 證證券投資信託及顧券投資信託及顧問相問相關業務 181 其 相關業務 181 其他經營合於營業登記項目或組織章程所定之業務 如 : 信用發卡與收 匯 進口外匯 一關業務 181 其他經 他經營合於營業登 ( 例如 : 代銷公債 / 國庫債 / 公司 單業務 企業卡持卡人消費資訊 信用卡特約商店風險管理業務 其他經中央主管機關核准 般匯出及匯入款 營合於營業登記項目記項目或組織章程外匯存款 外幣貸或組織章程所定之業所定之業務 ( 例款及外幣擔保付款務 ( 例 : 投資有價證如 : 金錢之信託 之保證業務 辦理券 承銷有價證券 金錢債權及其擔保外幣間保證金交易自營有價證券 短期物權之信託 有價 債券及股票 經主管機關核准辦理之衍生性金融商品業務 依信託業法核定辦理之業務 有價證券之承銷 自營買賣或代客買賣業務管理 辦理保管業務 與融資業務相 辦理之有關業務 業務 其他經中央票券經紀及自營業 證券之信託 不動 關之財務顧問業務 黃金存摺業 等 ) 主管機關核准辦理務 代理有價證券發產之信託 地上權 務 電子金融業務 代理收付款項 之有關業務等 ) 行 / 轉讓 / 登記及股息之信託 證券投資 業務等 ) / 利息 / 紅利之發放事信託基金 其他經 項 提供有價證券發中央主管機關核准行 / 募集之顧問服辦理之有關業務務 辦理有價證券簽等 ) 證 擔任債券發行受託人及辦理有關之代理服務事項 辦理債券自行買賣業務 其他經中央主管機關核准辦理之有關業務等 )

7 共通特定目的謹依據中華民國法務部頒佈 個人資料保護法之特定目的及個人資料之類別, 說明為處理與提供客戶相關往來業務 帳戶或服務, 所涉及之特定目的及代號及代號如下 但蒐集 處理及利用個人資料之實際目的, 仍以花旗台灣對客戶提供之實際往來業務 帳戶及服務為準 : 013 公共關係 014 公職人員財產申報 利益衝突迴避及政治獻金事務 20 代理與仲介業務 025 犯罪預防 刑事偵查 執行 矯正 保護處分 犯罪被害者保護或更生保護事務 032 刑案資料管理 040 行銷 ( 包含金控共同行銷業務 )052 法人或團體對股東 會員 ( 含股東 會員指派之代表 ) 董事 監察人 理事 監事或其他成員名冊之內部管理 059 金融服務業依法令規定及金融監理需要, 所為之蒐集處理及利用 060 金融爭議處理 061 金融監督 管理與檢查 063 非公務機關依法定義務所進行個人資料之蒐集處理及利用 069 契約 類似契約或其他法律關係事務 090 消費者 客戶管理與服務 091 消費者保護 098 商業與技術資訊 104 帳務管理及債權交易業務 113 陳情 請願 檢舉案件處理 122 訴願及行政救濟 127 募款 ( 包含公益勸募業務 )129 會計與相關服務 136 資 ( 通 ) 訊與資料庫管理 137 資通安全與管理 150 輔助性與後勤支援管理 157 調查 統計與研究分析 160 憑證業務管理 177 其他金融管理業務 182 其他諮詢與顧問服務除前揭特定目的外, 花旗台灣為處理與提供相關往來業務 帳戶或服務所涉及之特定目的如下, 惟蒐集 處理及利用個人資料之實際目的, 仍以花旗台灣對客戶提供之實際往來業務 帳戶及服務為準 : 配合打擊恐佈分子之調查與遵守美國經濟制裁 美國稅務申報 跨行 ( 社 ) 金融資訊服務及管理 辦理委外作業 委外人力管理 親屬或第三人代償業務 利害關係人資訊蒐集 處理及利用 協助執行程序之處理 訴訟或非訟或其他紛爭解決方式之業務 風險管理 ( 包括但不限於信用風險 作業風險 資訊安全管理 市場風險 流動性風險 法律或法規遵循風險等 ) 洗錢防制 開戶審查或暸解客戶業務 內部控制及稽核 應相關法律 規範 法典及外部支付系統之要求 總行 / 區域總部層級之分層負責決策 帳務監督管理 帳務勾稽調節 全球系統開發 監控與維護 蒐集之個人資料類別 姓名 身分證統一編號 性別 出生年月日 通訊方式及花旗台灣相關業務申請書 契約書或合約書所要求之其他資訊 謹依據中華民國法務部頒佈 個人資料保護法之特定目的及個人資料之類別 說明花旗台灣蒐集客戶及客戶人員之個人資料類別如下 但實際蒐集 處理及利用之資料, 仍以花旗台灣對客戶提供之實際往來業務 帳戶或服務及客戶或第三人 ( 例如 : 財團法人金融聯合徵信中心 ) 所提供之資訊為準 : (1) 識別類 C001 至 C003 ( 如姓名 職稱 住址 工作地址 電話 行動電話號碼 傳真號碼 電子郵件地址 身份證統一編號 護照號碼等任何可辨識資料本人者 ) (2) 特徵類 C011 C012 ( 如性別 出生年月日 出生地及國籍等 ) (3) 家庭情形 C021 及 C023 ( 如婚姻狀態 配偶姓名 子女等 ) (4) 社會情況 C032 C033 C038 及 C039 ( 如財產資料 工作許可文件 居留證明文件 職業及執照等 ) (5) 教育 考選 技術或其他專業 C052 ( 如學 經歷等 ) (6) 受僱情形 C061 ( 僱主名稱 擔任職務等 ) (7) 財務細節 C081 C086 ( 如資產 投資持股比率 票據信用等 ) (8) 其他各類資訊 C131 至 C132 ( 如無法歸類之電子郵件等 ) 個人資料利用之期間花旗台灣得使用個人資料至下述期間較長者 : 一 個人資料蒐集之特定目的存續期間 ; 二 依相關法令所定 ( 例如商業會計法等 ) 或花旗台灣內部政策所定或因執行業務所必須之資料保存期間 ; 或三 依客戶簽署之個別契約或合約所同意之之保存期限 個人資料利用之地區 個人資料利用之對象 個人資料利用之方式 下述 個人資料利用之對象 欄位所列之利用對象之所在地 一 花旗台灣 花旗集團 (Citigroup Inc.) 及其子公司與分支機構 美商花旗銀行 (Citibank N. A.) 及其子公司與分支機構 受花旗台灣委託處理事務之委外機構 ( 包括但不限於美商花旗銀行新加坡分行 倫敦分行 香港分行及都柏林分行 美商花旗銀行區域性作業總部 TCS Limited Citigroup Transactions Services (Malaysia) Sdn Bhd Citicorp International Limited 及 Citigroup Technology Inc. 等 ) 及上述機構所委任之第三人 ; 二 依法令規定利用個人資料之機構 ( 例如 : 美商花旗銀行或其控股公司等 ); 三 與花旗台灣因業務需要而定有契約之機構或其他與花旗台灣有業務關係之相關機構 ( 如 : 通匯行 財團法人金融聯合徵信中心 財團法人聯合信用卡處理中心 財金資訊股份有限公司 台灣票據交換所或其他經財政部或金融監督管理委員會指定之機構 財團法人農業信用保證基金 中小企業信用保證基金 財團法人金融消費評議中心 信用保證機構 信用卡國際組織 收單機構暨特約商店與其履行輔助人 其他類似機構 其他各種信用評等機構及其他從事於金融借貸業務之金融機構 花旗台灣之合作推廣對象 臺灣證券交易所股份有限公司 臺灣期貨交易所股份有限公司 財團法人中華民國證券櫃檯買賣中心 臺灣集中保管結算所股份有限公司 同業公會 財團法人證券投資人及期貨交易人保護中心等 ); 四 客戶與客戶人員同意使用其個人資料之對象 ( 例如花旗台灣共同行銷或交互運用客戶資料之公司 與花旗台灣合作共同推廣業務或引薦業務之公司等 ); 五 其他未受中央目的事業主管機關限制之國際傳輸個人資料之接收者, 或其他花旗台灣之交易相對人而有蒐集 處理 利用及國際傳輸個人相關資料必要者 ; 及六 對前開機構依法有管轄權或調查權之機關 金融監理機關 司法主管機關 稅捐主管機關或其他政府機構 符合個資法及相關法令以自動化機器或其他非自動化之利用方式之蒐集 處理 利用與國際傳輸個人資料 ( 例如使用電子文件 紙本或其他合於當時科學技術之適當方式等 )