Common use of Disclosure Regarding Use of Personal Information Clause in Contracts

Disclosure Regarding Use of Personal Information. (a) In connection with the grant of the Award, and the implementation and administration of the Award and the terms of this Agreement, including, without limitation, Participant’s actual participation, or consideration by the Committee for potential future participation in awards at any time, it is or may become necessary for the Firm to collect, transfer, use, and hold certain personal information regarding Participant in and/or outside of Participant’s home country. This processing is based on the Company’s business interests (compensating and retaining the Company’s leaders and achievers), where the personal information collected is limited to the minimum necessary to administer and manage the award such that the interests and fundamental rights of Participant are not overridden. (b) The personal information that the Company may collect, process, store and transfer for the purposes outlined above may include Participant’s name, nationality, citizenship, work authorization, date of birth, age, government/tax identification number, passport number, brokerage account information, or other internal identifying information, home address, work address, job and location history, compensation, business unit, employing entity, and Participant’s beneficiaries and contact information. (c) Participant may obtain more details regarding the access and use of his/her personal information, and may correct or update such information, by contacting his/her human resources representative. Requests for portability or erasure of the personal information should also be made by contacting Participant’s human resources representative. Personal information is retained according to the Company’s Data Retention guidelines, which may be obtained from Participant’s legal and/or compliance representative. Finally, Participant may lodge a complaint with a supervisory authority in regard to the Company’s processing of Participant’s personal information. (d) Use, transfer, storage and processing of personal information, electronically or otherwise, may be in connection with the Company’s internal administration of the Award, or in connection with tax or other governmental and regulatory compliance activities directly or indirectly related to the Award. For such purposes only, personal information may be used by third parties retained by the Company to assist with administration and compliance activities, and may be transferred by the company that employs (or any company that has employed) Participant from Participant’s home country to other members of the Company and third parties located in the United States and in other countries. Transfers to the United States from the European Economic Area are made using on one of following bases: standard contractual clauses or EU-US/Swiss-US Privacy Shield certification. (e) Those parties that may have access to Participant’s information for the purposes described herein include, but are not limited to, (i) human resources personnel responsible for administering the Award; (ii) Participant’s U.S., regional and local employing entity and business unit management, including Participant’s supervisor and his/her superiors; (iii) the Committee or its designee (e.g. which may be the third party described above), which is responsible for administering the Award; (iv) the Company’s technology systems support team (but only to the extent necessary to maintain the proper operation of electronic information systems that support the administration of the Award); and (v) internal and external legal, tax and accounting advisors (but only to the extent necessary for them to advise the Company on compliance and other issues affecting the awards in their respective fields of expertise). (f) At all times, Company personnel and third parties shall be obligated to maintain the confidentiality of Participant’s personal information except to the extent the Company is required to provide such information to governmental agencies or other parties. Such action shall always be undertaken only in accordance with applicable law. (g) The Company has in place administrative, physical and technical safeguards to ensure appropriate security of, and to prevent the unauthorized access, use or disclosure of, the personal information, and shall require any third party designee who processes Participant’s personal information on behalf of the Company to also have in place such safeguards. (h) By accepting the Award, Participant explicitly acknowledges that he/she has read and understands the above paragraphs and consents (i) to the use of such information for the purpose of being considered for participation in future awards (to the extent he/she is eligible, and without any guarantee that any award shall be made); and (ii) to the use, transfer, processing and storage, electronically or otherwise, of his/her personal information, as such use has occurred to date, and as such use may occur in the future, in connection with this Award or any other award.

Disclosure Regarding Use of Personal Information. (a) In connection with the grant of the Award, and any other award under the Plan, and the implementation and administration of the Award and the terms of this AgreementPlan, including, without limitation, Participant’s actual participation, or consideration by the Committee for potential future participation in awards the Plan at any time, it is or may become necessary for the Firm to collect, transfer, use, and hold certain personal information regarding Participant in and/or outside of Participant’s home country. This processing is based on the Company’s business interests (compensating and retaining the Company’s leaders and achievers), where the personal information collected is limited to the minimum necessary to administer and manage the award such that the interests and fundamental rights of the Participant are not overridden. (b) The personal information that the Company may collect, process, store and transfer for the purposes outlined above may include Participant’s name, nationality, citizenship, work authorization, date of birth, age, government/tax identification number, passport number, brokerage account information, or other internal identifying information, home address, work address, job and location history, compensation, business unit, employing entity, and Participant’s beneficiaries and contact information. (c) Participant may obtain more details regarding the access and use of his/her personal information, and may correct or update such information, by contacting his/her human resources representative. Requests for portability or erasure of the personal information should also be made by contacting the Participant’s human resources representative. Personal information is retained according to the Company’s Data Retention guidelines, which may be obtained from the Participant’s legal and/or compliance representative. Finally, a Participant may lodge a complaint with a supervisory authority in regard to the Company’s processing of Participant’s personal information. (d) Use, transfer, storage and processing of personal information, electronically or otherwise, may be in connection with the Company’s internal administration of the AwardPlan, or in connection with tax or other governmental and regulatory compliance activities directly or indirectly related to the AwardAward or any other award under the Plan. For such purposes only, personal information may be used by third parties retained by the Company to assist with the administration and compliance activitiesactivities of the Plan, and may be transferred by the company that employs (or any company that has employed) Participant from Participant’s home country to other members of the Company and third parties located in the United States and in other countries. Transfers to the United States from the European Economic Area are made using on one of following bases: standard contractual clauses or EU-US/Swiss-US Privacy Shield certification. (e) Those parties that may have access to Participant’s information for the purposes described herein include, but are not limited to, (i) human resources personnel responsible for administering the AwardPlan; (ii) Participant’s U.S., regional and local employing entity and business unit management, including Participant’s supervisor and his/her superiors; (iii) the Committee or its designee (e.g. which may be the third party described above), which is responsible for administering the AwardPlan; (iv) the Company’s technology systems support team (but only to the extent necessary to maintain the proper operation of electronic information systems that support the administration of the AwardPlan); and (v) internal and external legal, tax and accounting advisors (but only to the extent necessary for them to advise the Company on compliance and other issues affecting the awards under the Plan in their respective fields of expertise). (f) At all times, Company personnel and third parties shall be obligated to maintain the confidentiality of Participant’s personal information except to the extent the Company is required to provide such information to governmental agencies or other parties. Such action shall always be undertaken only in accordance with applicable law. (g) The Company has in place administrative, physical and technical safeguards to ensure appropriate security of, and to prevent the unauthorized access, use or disclosure of, the personal information, and shall require any third party designee who processes Participant’s personal information on behalf of the Company to also have in place such safeguards. (h) By accepting the Award, Participant explicitly acknowledges that he/she has read and understands the above paragraphs and consents (i) to the use of such information for the purpose of being considered for participation in future awards under the Plan (to the extent he/she is eligibleeligible under the Plan, and without any guarantee that any award shall be made); and (ii) to the use, transfer, processing and storage, electronically or otherwise, of his/her personal information, as such use has occurred to date, and as such use may occur in the future, in connection with this Award or any other awardaward under the Plan, as further described below.

Disclosure Regarding Use of Personal Information. (a) Data Protection Statement and Use of “Personal Information.” (i) Where the General Data Protection Regulation (2016/679) (“GDPR”) applies, please refer to the Data Protection Statement attached as Schedule 1. (ii) Where the GDPR does not apply, the following provisions apply: In connection with the grant of the AwardAwards, and any other award under other incentive award programs, and the implementation and administration of the Award and the terms of this Agreementany such programs, including, without limitation, Participant’s actual participation, or consideration by the Committee Company for potential future participation participation, in awards any program at any time, it is or may become necessary for the Firm Company to collect, transfer, use, and hold certain personal information regarding Participant in and/or outside of Participant’s home countrycountry of employment. This processing is based on the Company’s business interests (compensating and retaining the Company’s leaders and achievers), where the The “personal information collected is limited to the minimum necessary to administer and manage the award such that the interests and fundamental rights of Participant are not overridden. (b) The personal information information” that the Company may collect, process, use, store and transfer for the purposes outlined above may include includes Participant’s name, nationality, citizenship, tax or other residency status, work authorization, date of birth, age, government/tax identification number, passport number, brokerage account information, GEID or other internal identifying information, home address, work address, job and location history, compensationcompensation and incentive award information and history, business unit, employing entity, and Participant’s beneficiaries and contact information. (c) . Participant may obtain more details regarding the access and use of his/her personal information, and may correct or update such information, by contacting his/her human resources representativerepresentative or local equity coordinator. Requests for portability or erasure of the personal information should also be made by contacting Participant’s human resources representative. Personal information is retained according to the Company’s Data Retention guidelines, which may be obtained from Participant’s legal and/or compliance representative. Finally, Participant may lodge a complaint with a supervisory authority in regard to the Company’s processing of Participant’s personal information. (d) Use, transfer, storage and processing of personal information, electronically or otherwise, may shall be in connection with for the performance of this Agreement and the Company’s internal administration of the Awardits incentive award programs, or and in connection with tax or other governmental and regulatory compliance activities directly or indirectly related to an incentive award program, including the Awardprevention, detection and prosecution of crime or other grounds of public interest. In accordance with the Company’s personal information and data policies and standards, personal information may be stored in, or accessed from or transferred to countries where data privacy laws may not be as protective as those in the country from which the personal information was provided. Participant agrees to the processing of personal information as described herein under confidentiality and privacy terms to the same standard set out herein. For such purposes only, personal information may be used by third parties retained by the Company to assist with the administration and compliance activitiesactivities of its incentive award programs, and may be transferred by the company that employs (or any company that has employed) Participant from Participant’s home country of employment to other members of the Company Citigroup entities and third parties located in the United States and in other countries. Transfers to the United States from the European Economic Area are made using on one of following bases: standard contractual clauses or EU-US/Swiss-US Privacy Shield certification. (e) Those Specifically, those parties that may have access to Participant’s information for the purposes described herein include, but are not limited to, (i) human resources personnel responsible for administering the Awardaward programs, including local and regional equity award coordinators, and global coordinators located in the United States; (ii) Participant’s U.S. broker and equity account administrator and trade facilitator; (iii) Participant’s U.S., regional and local employing entity and business unit management, including Participant’s supervisor and his/her superiors; (iiiiv) the Committee or its designee (e.g. which may be the third party described above)designee, which is responsible for administering the AwardStock Incentive Plan and DCAP; (ivv) the CompanyCitigroup’s technology systems support team (but only to the extent necessary to maintain the proper operation of electronic information systems that support the administration of the Awardincentive award programs); and (vvi) internal and external legal, tax and accounting advisors (but only to the extent necessary for them to advise the Company on compliance and other issues affecting the awards incentive award programs in their respective fields of expertise). (f) . At all times, Company personnel and third parties shall will be obligated to maintain the confidentiality of Participant’s personal information except to the extent the Company is required to provide such information to governmental agencies or other parties. Such action shall will always be undertaken only in accordance with applicable law. (g) The Company has in place administrative, physical and technical safeguards to ensure appropriate security of, and to prevent the unauthorized access, use or disclosure of, the personal information, and shall require any third party designee who processes Participant’s personal information on behalf of the Company to also have in place such safeguards. (h) By accepting the Award, Participant explicitly acknowledges that he/she has read and understands the above paragraphs and consents (i) to the use of such information for the purpose of being considered for participation in future awards (to the extent he/she is eligible, and without any guarantee that any award shall be made); and (ii) to the use, transfer, processing and storage, electronically or otherwise, of his/her personal information, as such use has occurred to date, and as such use may occur in the future, in connection with this Award or any other award.

Disclosure Regarding Use of Personal Information. (a) Data Protection Statement and Use of “Personal Information.” (i) Where the General Data Protection Regulation (2016/679) (“GDPR”) applies, please refer to the Data Protection Statement attached as Schedule 1. (ii) Where the GDPR does not apply, the following provisions apply: In connection with the grant of the Award, and any other award under other incentive award programs, and the implementation and administration of the Award and the terms of this Agreementany such program, including, without limitation, Participant’s actual participation, or consideration by the Committee Company for potential future participation participation, in awards any program at any time, it is or may become necessary for the Firm Company to collect, transfer, use, and hold certain personal information regarding Participant in and/or outside of Participant’s home countrycountry of employment. This processing is based on the Company’s business interests (compensating and retaining the Company’s leaders and achievers), where the The “personal information collected is limited to the minimum necessary to administer and manage the award such that the interests and fundamental rights of Participant are not overridden. (b) The personal information information” that the Company may collect, process, use, store and transfer for the purposes outlined above may include includes Participant’s name, nationality, citizenship, tax or other residency status, work authorization, date of birth, age, government/tax identification number, passport number, brokerage account information, GEID or other internal identifying information, home address, work address, job and location history, compensationcompensation and incentive award information and history, business unit, employing entity, and Participant’s beneficiaries and contact information. (c) . Participant may obtain more details regarding the access and use of his/her personal information, and may correct or update such information, by contacting his/her human resources representativerepresentative or local equity coordinator. Requests for portability or erasure of the personal information should also be made by contacting Participant’s human resources representative. Personal information is retained according to the Company’s Data Retention guidelines, which may be obtained from Participant’s legal and/or compliance representative. Finally, Participant may lodge a complaint with a supervisory authority in regard to the Company’s processing of Participant’s personal information. (d) Use, transfer, storage and processing of personal information, electronically or otherwise, may shall be in connection with for the performance of this Agreement and the Company’s internal administration of the Awardits incentive award programs, or and in connection with tax or other governmental and regulatory compliance activities directly or indirectly related to an incentive award program, including the Awardprevention, detection and prosecution of crime or other grounds of public interest. In accordance with the Company’s personal information and data policies and standards, personal information may be stored in, or accessed from or transferred to countries where data privacy laws may not be as protective as those in the country from which the personal information was provided. Participant agrees to the processing of personal information as described herein under confidentiality and privacy terms to the same standard set out herein. For such purposes only, personal information may be used by third parties retained by the Company to assist with the administration and compliance activitiesactivities of its incentive award programs, and may be transferred by the company that employs (or any company that has employed) Participant from Participant’s home country of employment to other members of the Company Citigroup entities and third parties located in the United States and in other countries. Transfers to the United States from the European Economic Area are made using on one of following bases: standard contractual clauses or EU-US/Swiss-US Privacy Shield certification. (e) Those Specifically, those parties that may have access to Participant’s information for the purposes described herein include, but are not limited to, (i) human resources personnel responsible for administering the Awardaward programs, including local and regional equity award coordinators, and global coordinators located in the United States; (ii) Participant’s U.S. broker and equity account administrator and trade facilitator; (iii) Participant’s U.S., regional and local employing entity and business unit management, including Participant’s supervisor and his/her superiors; (iiiiv) the Committee or its designee (e.g. which may be the third party described above)designee, which is responsible for administering the AwardStock Incentive Plan; (ivv) the CompanyCitigroup’s technology systems support team (but only to the extent necessary to maintain the proper operation of electronic information systems that support the administration of the Awardincentive award programs); and (vvi) internal and external legal, tax and accounting advisors (but only to the extent necessary for them to advise the Company on compliance and other issues affecting the awards incentive award programs in their respective fields of expertise). (f) At all times, Company personnel and third parties shall be obligated to maintain the confidentiality of Participant’s personal information except to the extent the Company is required to provide such information to governmental agencies or other parties. Such action shall always be undertaken only in accordance with applicable law. (g) The Company has in place administrative, physical and technical safeguards to ensure appropriate security of, and to prevent the unauthorized access, use or disclosure of, the personal information, and shall require any third party designee who processes Participant’s personal information on behalf of the Company to also have in place such safeguards. (h) By accepting the Award, Participant explicitly acknowledges that he/she has read and understands the above paragraphs and consents (i) to the use of such information for the purpose of being considered for participation in future awards (to the extent he/she is eligible, and without any guarantee that any award shall be made); and (ii) to the use, transfer, processing and storage, electronically or otherwise, of his/her personal information, as such use has occurred to date, and as such use may occur in the future, in connection with this Award or any other award.

Disclosure Regarding Use of Personal Information. (a) Data Protection Statement and Use of “Personal Information.” (i) Where the General Data Protection Regulation (2016/679) (“GDPR”) applies, please refer to the Data Protection Statement attached as Schedule 1. (ii) Where the GDPR does not apply, the following provisions apply: In connection with the grant of the Deferred Cash Award, and any other award under other incentive award programs, and the implementation and administration of the Award and the terms of this Agreement, including, without limitation, Participant’s actual participation, or consideration by the Committee for potential future participation in awards at any timesuch program, it is or may become necessary for the Firm Company to collect, transfer, use, and hold certain personal information regarding Participant in and/or outside of Participant’s home countrycountry of employment. This processing is based on the Company’s business interests (compensating and retaining the Company’s leaders and achievers), where the The “personal information collected is limited to the minimum necessary to administer and manage the award such that the interests and fundamental rights of Participant are not overridden. (b) The personal information information” that the Company may collect, process, use, store and transfer for the purposes outlined above may include includes Participant’s name, nationality, citizenship, tax or other residency status, work authorization, date of birth, age, government/tax identification number, passport number, brokerage account information, GEID or other internal identifying information, home address, work address, job and location history, compensationcompensation and incentive award information and history, business unit, employing entity, and Participant’s beneficiaries and contact information. (c) . Participant may obtain more details regarding the access and use of his/her his personal information, and may correct or update such information, by contacting his/her his human resources representativerepresentative or local equity coordinator. Requests for portability or erasure of the personal information should also be made by contacting Participant’s human resources representative. Personal information is retained according to the Company’s Data Retention guidelines, which may be obtained from Participant’s legal and/or compliance representative. Finally, Participant may lodge a complaint with a supervisory authority in regard to the Company’s processing of Participant’s personal information. (d) Use, transfer, storage and processing of personal information, electronically or otherwise, may shall be in connection with for the performance of this Agreement and the Company’s internal administration of the Awardits incentive award programs, or and in connection with tax or other governmental and regulatory compliance activities directly or indirectly related to an incentive award program, including the Awardprevention, detection and prosecution of crime or other grounds of public interest. In accordance with the Company’s personal information and data policies and standards, personal information may be stored in, or accessed from or transferred to countries where data privacy laws may not be as protective as those in the country from which the personal information was provided. Participant agrees to the processing of personal information as described herein under confidentiality and privacy terms to the same standard set out herein. For such purposes only, personal information may be used by third parties retained by the Company to assist with the administration and compliance activitiesactivities of its incentive award programs, and may be transferred by the company that employs (or any company that has employed) Participant from Participant’s home country of employment to other members of the Company Citigroup entities and third parties located in the United States and in other countries. Transfers to the United States from the European Economic Area are made using on one of following bases: standard contractual clauses or EU-US/Swiss-US Privacy Shield certification. (e) Those Specifically, those parties that may have access to Participant’s information for the purposes described herein include, but are not limited to, (i) human resources personnel responsible for administering the Awardaward programs, including local and regional equity award coordinators, and global coordinators located in the United States; (ii) Participant’s U.S. broker and equity account administrator and trade facilitator; (iii) Participant’s U.S., regional and local employing entity and business unit management, including Participant’s supervisor and his/her his superiors; (iiiiv) the Committee or its designee (e.g. which may be the third party described above)designee, which is responsible for administering the AwardDCAP; (ivv) the CompanyCitigroup’s technology systems support team (but only to the extent necessary to maintain the proper operation of electronic information systems that support the administration of the Awardincentive award programs); and (vvi) internal and external legal, tax and accounting advisors (but only to the extent necessary for them to advise the Company on compliance and other issues affecting the awards incentive award programs in their respective fields of expertise). (f) . At all times, Company personnel and third parties shall will be obligated to maintain the confidentiality of Participant’s personal information except to the extent the Company is required to provide such information to governmental agencies or other parties. Such action shall will always be undertaken only in accordance with applicable law. (gb) The Company has in place administrative, physical and technical safeguards to ensure appropriate security of, and to prevent the unauthorized access, use or disclosure of, the personal information, and shall require any third party designee who processes Participant’s personal information on behalf of Consent (not applicable where the Company to also have in place such safeguardsGDPR applies). BY ACCEPTING THE DEFERRED CASH AWARD, PARTICIPANT EXPLICITLY CONSENTS TO THE USE, TRANSFER, PROCESSING AND STORAGE, ELECTRONICALLY OR OTHERWISE, OF HIS PERSONAL INFORMATION, AS SUCH USE HAS OCCURRED TO DATE, AND AS SUCH USE MAY OCCUR IN THE FUTURE, IN CONNECTION WITH THIS OR ANY OTHER DEFERRED CASH OR OTHER AWARD, AS DESCRIBED ABOVE. (h) By accepting the Award, Participant explicitly acknowledges that he/she has read and understands the above paragraphs and consents (i) to the use of such information for the purpose of being considered for participation in future awards (to the extent he/she is eligible, and without any guarantee that any award shall be made); and (ii) to the use, transfer, processing and storage, electronically or otherwise, of his/her personal information, as such use has occurred to date, and as such use may occur in the future, in connection with this Award or any other award.

Disclosure Regarding Use of Personal Information. (a) Data Protection Statement and Use of “Personal Information.” (i) Where the General Data Protection Regulation (2016/679) (“GDPR”) applies, please refer to the Data Protection Statement attached as Schedule 1.8 (ii) Where the GDPR does not apply, the following provisions apply: In connection with the grant of the Deferred Cash Award, and any other award under other incentive award programs, and the implementation and administration of the Award and the terms of this Agreementany such program, including, without limitation, Participant’s actual participation, or consideration by the Committee Company for potential future participation participation, in awards any program at any time, it is or may become necessary for the Firm Company to collect, transfer, use, and hold certain personal information regarding Participant in and/or outside of Participant’s home countrycountry of employment. This processing is based on the Company’s business interests (compensating and retaining the Company’s leaders and achievers), where the The “personal information collected is limited to the minimum necessary to administer and manage the award such that the interests and fundamental rights of Participant are not overridden. (b) The personal information information” that the Company may collect, process, use, store and transfer for the purposes outlined above may include includes Participant’s name, nationality, citizenship, tax or other residency status, work authorization, date of birth, age, government/tax identification number, passport number, brokerage account information, GEID or other internal identifying information, home address, work address, job and location history, compensationcompensation and incentive award information and history, business unit, employing entity, and Participant’s beneficiaries and contact information. (c) . Participant may obtain more details regarding the access and use of his/her personal information, and may correct or update such information, by contacting his/her human resources representativerepresentative or local equity coordinator. Requests for portability or erasure of the personal information should also be made by contacting Participant’s human resources representative. Personal information is retained according to the Company’s Data Retention guidelines, which may be obtained from Participant’s legal and/or compliance representative. Finally, Participant may lodge a complaint with a supervisory authority in regard to the Company’s processing of Participant’s personal information. (d) Use, transfer, storage and processing of personal information, electronically or otherwise, may shall be in connection with for the performance of this Agreement and the Company’s internal administration of the Awardits incentive award programs, or and in connection with tax or other governmental and regulatory compliance activities directly _______________________________ 8 Agreement language may be updated as needed to comply with or otherwise respond to changes or anticipated changes in law, regulation, or regulatory guidance or in Company policy. or indirectly related to an incentive award program, including the Awardprevention, detection and prosecution of crime or other grounds of public interest. In accordance with the Company’s personal information and data policies and standards, personal information may be stored in, or accessed from or transferred to countries where data privacy laws may not be as protective as those in the country from which the personal information was provided. Participant agrees to the processing of personal information as described herein under confidentiality and privacy terms to the same standard set out herein. For such purposes only, personal information may be used by third parties retained by the Company to assist with the administration and compliance activitiesactivities of its incentive award programs, and may be transferred by the company that employs (or any company that has employed) Participant from Participant’s home country of employment to other members of the Company Citigroup entities and third parties located in the United States and in other countries. Transfers to the United States from the European Economic Area are made using on one of following bases: standard contractual clauses or EU-US/Swiss-US Privacy Shield certification. (e) Those Specifically, those parties that may have access to Participant’s information for the purposes described herein include, but are not limited to, (i) human resources personnel responsible for administering the Awardaward programs, including local and regional equity award coordinators, and global coordinators located in the United States; (ii) Participant’s U.S. broker and equity account administrator and trade facilitator; (iii) Participant’s U.S., regional and local employing entity and business unit management, including Participant’s supervisor and his/her superiors; (iiiiv) the Committee or its designee (e.g. which may be the third party described above)designee, which is responsible for administering the AwardDCAP; (ivv) the CompanyCitigroup’s technology systems support team (but only to the extent necessary to maintain the proper operation of electronic information systems that support the administration of the Awardincentive award programs); and (vvi) internal and external legal, tax and accounting advisors (but only to the extent necessary for them to advise the Company on compliance and other issues affecting the awards incentive award programs in their respective fields of expertise). (f) . At all times, Company personnel and third parties shall will be obligated to maintain the confidentiality of Participant’s personal information except to the extent the Company is required to provide such information to governmental agencies or other parties. Such action shall will always be undertaken only in accordance with applicable law. (gb) The Company has in place administrative, physical and technical safeguards to ensure appropriate security of, and to prevent the unauthorized access, use or disclosure of, the personal information, and shall require any third party designee who processes Participant’s personal information on behalf of Consent (not applicable where the Company to also have in place such safeguards. GDPR applies). BY ACCEPTING THE DEFERRED CASH AWARD, PARTICIPANT EXPLICITLY CONSENTS (hI) By accepting the AwardTO THE USE OF PARTICIPANT’S PERSONAL INFORMATION FOR THE PURPOSE OF BEING CONSIDERED FOR PARTICIPATION IN FUTURE EQUITY, Participant explicitly acknowledges that heDEFERRED CASH OR OTHER AWARD PROGRAMS (TO THE EXTENT HE/she has read and understands the above paragraphs and consents (i) to the use of such information for the purpose of being considered for participation in future awards (to the extent he/she is eligibleSHE IS ELIGIBLE UNDER THE TERMS OF SUCH PLAN OR PROGRAM, and without any guarantee that any award shall be madeAND WITHOUT ANY GUARANTEE THAT ANY AWARD WILL BE MADE); and AND (iiII) to the useTO THE USE, transferTRANSFER, processing and storagePROCESSING AND STORAGE, electronically or otherwiseELECTRONICALLY OR OTHERWISE, of hisOF HIS/her personal informationHER PERSONAL INFORMATION, as such use has occurred to dateAS SUCH USE HAS OCCURRED TO DATE, and as such use may occur in the futureAND AS SUCH USE MAY OCCUR IN THE FUTURE, in connection with this Award or any other awardIN CONNECTION WITH THIS OR ANY OTHER DEFERRED CASH OR OTHER AWARD, AS DESCRIBED ABOVE.

Disclosure Regarding Use of Personal Information. (a) Data Protection Statement and Use of “Personal Information.” (i) Where the General Data Protection Regulation (2016/679) (“GDPR”) applies, please refer to the Data Protection Statement attached as Schedule 1.10 (ii) Where the GDPR does not apply, the following provisions apply: In connection with the grant of the Award, and any other award under other incentive award programs, and the implementation and administration of the Award and the terms of this Agreementany such program, including, without limitation, Participant’s actual participation, or consideration by the Committee Company for potential future participation participation, in awards any program at any time, it is or may become necessary for the Firm Company to collect, transfer, use, and hold certain personal information regarding Participant in and/or outside of Participant’s home countrycountry of employment. This processing is based on the Company’s business interests (compensating and retaining the Company’s leaders and achievers), where the The “personal information collected is limited to the minimum necessary to administer and manage the award such that the interests and fundamental rights of Participant are not overridden. (b) The personal information information” that the Company may collect, process, use, store and transfer for the purposes outlined above may include includes Participant’s name, nationality, citizenship, tax or other residency status, work authorization, date of birth, age, government/tax identification number, passport number, brokerage account information, GEID or other internal identifying information, home address, work address, job and location history, compensationcompensation and incentive award information and history, business unit, employing entity, and Participant’s beneficiaries and contact information. (c) . Participant may obtain more details regarding the access and use of his/her personal information, and may correct or update such information, by contacting his/her human resources representativerepresentative or local equity coordinator. Requests for portability or erasure of the personal information should also be made by contacting Participant’s human resources representative. Personal information is retained according to the Company’s Data Retention guidelines, which may be obtained from Participant’s legal and/or compliance representative. Finally, Participant may lodge a complaint with a supervisory authority in regard to the Company’s processing of Participant’s personal information. (d) Use, transfer, storage and processing of personal information, electronically or otherwise, may shall be in connection with for the performance of this Agreement and the Company’s internal administration of the Awardits incentive award programs, or and in connection with tax or other governmental and regulatory compliance activities directly or indirectly related to an incentive award program, including the Awardprevention, detection and prosecution of crime or other grounds of public interest. In accordance with the Company’s personal information and 10 Agreement language may be updated as needed to comply with or otherwise to respond to changes or anticipated changes in law, regulation, or regulatory guidance or in Company policy. data policies and standards, personal information may be stored in, or accessed from or transferred to countries where data privacy laws may not be as protective as those in the country from which the personal information was provided. Participant agrees to the processing of personal information as described herein under confidentiality and privacy terms to the same standard set out herein. For such purposes only, personal information may be used by third parties retained by the Company to assist with the administration and compliance activitiesactivities of its incentive award programs, and may be transferred by the company that employs (or any company that has employed) Participant from Participant’s home country of employment to other members of the Company Citigroup entities and third parties located in the United States and in other countries. Transfers to the United States from the European Economic Area are made using on one of following bases: standard contractual clauses or EU-US/Swiss-US Privacy Shield certification. (e) Those Specifically, those parties that may have access to Participant’s information for the purposes described herein include, but are not limited to, (i) human resources personnel responsible for administering the Awardaward programs, including local and regional equity award coordinators, and global coordinators located in the United States; (ii) Participant’s U.S. broker and equity account administrator and trade facilitator; (iii) Participant’s U.S., regional and local employing entity and business unit management, including Participant’s supervisor and his/her superiors; (iiiiv) the Committee or its designee (e.g. which may be the third party described above)designee, which is responsible for administering the AwardStock Incentive Plan; (ivv) the CompanyCitigroup’s technology systems support team (but only to the extent necessary to maintain the proper operation of electronic information systems that support the administration of the Awardincentive award programs); and (vvi) internal and external legal, tax and accounting advisors (but only to the extent necessary for them to advise the Company on compliance and other issues affecting the awards incentive award programs in their respective fields of expertise). (f) . At all times, Company personnel and third parties shall will be obligated to maintain the confidentiality of Participant’s personal information except to the extent the Company is required to provide such information to governmental agencies or other parties. Such action shall will always be undertaken only in accordance with applicable law. (gb) The Company has in place administrative, physical and technical safeguards to ensure appropriate security of, and to prevent the unauthorized access, use or disclosure of, the personal information, and shall require any third party designee who processes Participant’s personal information on behalf of Consent (not applicable where the Company to also have in place such safeguards. GDPR applies). BY ACCEPTING THE AWARD, PARTICIPANT EXPLICITLY CONSENTS (hI) By accepting the AwardTO THE USE OF PARTICIPANT’S PERSONAL INFORMATION FOR THE PURPOSE OF BEING CONSIDERED FOR PARTICIPATION IN FUTURE EQUITY, Participant explicitly acknowledges that heDEFERRED CASH OR OTHER AWARD PROGRAMS (TO THE EXTENT HE/she has read and understands the above paragraphs and consents (i) to the use of such information for the purpose of being considered for participation in future awards (to the extent he/she is eligibleSHE IS ELIGIBLE UNDER THE TERMS OF SUCH PLAN OR PROGRAM, and without any guarantee that any award shall be madeAND WITHOUT ANY GUARANTEE THAT ANY AWARD WILL BE MADE); and AND (iiII) to the useTO THE USE, transferTRANSFER, processing and storagePROCESSING AND STORAGE, electronically or otherwiseELECTRONICALLY OR OTHERWISE, of hisOF HIS/her personal informationHER PERSONAL INFORMATION, as such use has occurred to dateAS SUCH USE HAS OCCURRED TO DATE, and as such use may occur in the futureAND AS SUCH USE MAY OCCUR IN THE FUTURE, in connection with this Award or any other awardIN CONNECTION WITH THIS OR ANY OTHER EQUITY OR OTHER AWARD, AS DESCRIBED ABOVE.

Disclosure Regarding Use of Personal Information. (a) Data Protection Statement and Use of “Personal Information.” (i) Where the General Data Protection Regulation (2016/679) (“GDPR”) applies, please refer to the Data Protection Statement attached as Schedule 1. (ii) Where the GDPR does not apply, the following provisions apply: In connection with the grant of the Award, and any other award under other incentive award programs, and the implementation and administration of the Award and the terms of this Agreementany such program, including, without limitation, Participant’s actual participation, or consideration by the Committee Company for potential future participation participation, in awards any program at any time, it is or may become necessary for the Firm Company to collect, transfer, use, and hold certain personal information regarding Participant in and/or outside of Participant’s home countrycountry of employment. This processing is based on the Company’s business interests (compensating and retaining the Company’s leaders and achievers), where the The “personal information collected is limited to the minimum necessary to administer and manage the award such that the interests and fundamental rights of Participant are not overridden. (b) The personal information information” that the Company may collect, process, use, store and transfer for the purposes outlined above may include includes Participant’s name, nationality, citizenship, tax or other residency status, work authorization, date of birth, age, government/tax identification number, passport number, brokerage account information, GEID or other internal identifying information, home address, work address, job and location history, compensationcompensation and incentive award information and history, business unit, employing entity, and Participant’s beneficiaries and contact information. (c) . Participant may obtain more details regarding the access and use of his/her personal information, and may correct or update such information, by contacting his/her human resources representativerepresentative or local equity coordinator. Requests for portability or erasure of the personal information should also be made by contacting Participant’s human resources representative. Personal information is retained according to the Company’s Data Retention guidelines, which may be obtained from Participant’s legal and/or compliance representative. Finally, Participant may lodge a complaint with a supervisory authority in regard to the Company’s processing of Participant’s personal information. (d) Use, transfer, storage and processing of personal information, electronically or otherwise, may shall be in connection with for the performance of this Agreement and the Company’s internal administration of the Awardits incentive award programs, or and in connection with tax or other governmental and regulatory compliance activities directly or indirectly related to an incentive award program, including the Awardprevention, detection and prosecution of crime or other grounds of public interest. In accordance with the Company’s personal information and data policies and standards, personal information may be stored in, or accessed from or transferred to countries where data privacy laws may not be as protective as those in the country from which the personal information was provided. Participant agrees to the processing of personal information as described herein under confidentiality and privacy terms to the same standard set out herein. For such purposes only, personal information may be used by third parties retained by the Company to assist with the administration and compliance activitiesactivities of its incentive award programs, and may be transferred by the company that employs (or any company that has employed) Participant from Participant’s home country of employment to other members of the Company Citigroup entities and third parties located in the United States and in other countries. Transfers to the United States from the European Economic Area are made using on one of following bases: standard contractual clauses or EU-US/Swiss-US Privacy Shield certification. (e) Those Specifically, those parties that may have access to Participant’s information for the purposes described herein include, but are not limited to, (i) human resources personnel responsible for administering the Awardaward programs, including local and regional equity award coordinators, and global coordinators located in the United States; (ii) Participant’s U.S. broker and equity account administrator and trade facilitator; (iii) Participant’s U.S., regional and local employing entity and business unit management, including Participant’s supervisor and his/her superiors; (iiiiv) the Committee or its designee (e.g. which may be the third party described above)designee, which is responsible for administering the AwardStock Incentive Plan; (ivv) the CompanyCitigroup’s technology systems support team (but only to the extent necessary to maintain the proper operation of electronic information systems that support the administration of the Awardincentive award programs); and (vvi) internal and external legal, tax and accounting advisors (but only to the extent necessary for them to advise the Company on compliance and other issues affecting the awards incentive award programs in their respective fields of expertise). (f) . At all times, Company personnel and third parties shall will be obligated to maintain the confidentiality of Participant’s personal information except to the extent the Company is required to provide such information to governmental agencies or other parties. Such action shall will always be undertaken only in accordance with applicable law. (gb) The Company has in place administrative, physical and technical safeguards to ensure appropriate security of, and to prevent the unauthorized access, use or disclosure of, the personal information, and shall require any third party designee who processes Participant’s personal information on behalf of Consent (not applicable where the Company to also have in place such safeguards. GDPR applies). BY ACCEPTING THE AWARD, PARTICIPANT EXPLICITLY CONSENTS (hI) By accepting the Award, Participant explicitly acknowledges that he/she has read and understands the above paragraphs and consents (i) to the use of such information for the purpose of being considered for participation in future awards (to the extent he/she is eligible, and without any guarantee that any award shall be made); and (ii) to the use, transfer, processing and storage, electronically or otherwise, of his/her personal information, as such use has occurred to date, and as such use may occur in the future, in connection with this Award or any other award.TO THE USE OF PARTICIPANT’S PERSONAL INFORMATION FOR THE PURPOSE OF BEING CONSIDERED FOR PARTICIPATION IN

Disclosure Regarding Use of Personal Information. (a1) In connection with the grant of the Award, and any other award under the Plan, and the implementation and administration of the Award and the terms of this AgreementPlan, including, without limitation, Participant’s actual participation, or consideration by the Committee for potential future participation in awards the Plan at any time, it is or may become necessary for the Firm to collect, transfer, use, and hold certain personal information regarding Participant in and/or outside of Participant’s home country. This processing is based on the Company’s business interests (compensating and retaining the Company’s leaders and achievers), where the personal information collected is limited to the minimum necessary to administer and manage the award Award such that the interests and fundamental rights of the Participant are not overridden. (b2) The personal information that the Company may collect, process, store and transfer for the purposes outlined above may include Participant’s name, nationality, citizenship, work authorization, date of birth, age, government/tax identification number, passport number, brokerage account information, or other internal identifying information, home address, work address, job and location history, compensation, business unit, employing entity, and Participant’s beneficiaries and contact information. (c3) Participant may obtain more details regarding the access and use of his/her personal information, and may correct or update such information, by contacting his/her human resources representative. Requests for portability or erasure of the personal information should also be made by contacting the Participant’s human resources representative. Personal information is retained according to the Company’s Data Retention guidelines, which may be obtained from the Participant’s legal and/or compliance representative. Finally, a Participant may lodge a complaint with a supervisory authority in regard to the Company’s processing of Participant’s personal information. (d4) Use, transfer, storage and processing of personal information, electronically or otherwise, may be in connection with the Company’s internal administration of the AwardPlan, or in connection with tax or other governmental and regulatory compliance activities directly or indirectly related to the AwardAward or any other award under the Plan. For such purposes only, personal information may be used by third parties retained by the Company to assist with the administration and compliance activitiesactivities of the Plan, and may be transferred by the company that employs (or any company that has employed) Participant from Participant’s home country to other members of the Company and third parties located in the United States and in other countries. Transfers to the United States from the European Economic Area are made using on one of following bases: standard contractual clauses or EU-US/Swiss-US Privacy Shield certification. (e5) Those parties that may have access to Participant’s information for the purposes described herein include, but are not limited to, (i) human resources personnel responsible for administering the AwardPlan; (ii) Participant’s U.S., regional and local employing entity and business unit management, including Participant’s supervisor and his/her superiors; (iii) the Committee or its designee (e.g. which may be the third party described above), which is responsible for administering the AwardPlan; (iv) the Company’s technology systems support team (but only to the extent necessary to maintain the proper operation of electronic information systems that support the administration of the AwardPlan); and (v) internal and external legal, tax and accounting advisors (but only to the extent necessary for them to advise the Company on compliance and other issues affecting the awards under the Plan in their respective fields of expertise). (f6) At all times, Company personnel and third parties shall be obligated to maintain the confidentiality of Participant’s personal information except to the extent the Company is required to provide such information to governmental agencies or other parties. Such action shall always be undertaken only in accordance with applicable law. (g7) The Company has in place administrative, physical and technical safeguards to ensure appropriate security of, and to prevent the unauthorized access, use or disclosure of, the personal information, and shall require any third party designee who processes Participant’s personal information on behalf of the Company to also have in place such safeguards. (h) 8) By accepting the Award, Participant explicitly acknowledges that he/she has read and understands the above paragraphs and consents (i) to the use of such information for the purpose of being considered for participation in future awards under the Plan (to the extent he/she is eligibleeligible under the Plan, and without any guarantee that any award shall be made); and (ii) to the use, transfer, processing and storage, electronically or otherwise, of his/her personal information, as such use has occurred to date, and as such use may occur in the future, in connection with this Award or any other awardaward under the Plan, as further described below.

Disclosure Regarding Use of Personal Information. (a) Data Protection Statement and Use of “Personal Information.” (i) Where the General Data Protection Regulation (2016/679) (“GDPR”) applies, please refer to the Data Protection Statement attached as Schedule 1. (ii) Where the GDPR does not apply, the following provisions apply: In connection with the grant of the Award, and any other award under other incentive award programs, and the implementation and administration of the Award and the terms of this Agreementany such program, including, without limitation, Participant’s actual participation, or consideration by the Committee Company for potential future participation participation, in awards any program at any time, it is or may become necessary for the Firm Company to collect, transfer, use, and hold certain personal information regarding Participant in and/or outside of Participant’s home countrycountry of employment. This processing is based on the Company’s business interests (compensating and retaining the Company’s leaders and achievers), where the The “personal information collected is limited to the minimum necessary to administer and manage the award such that the interests and fundamental rights of Participant are not overridden. (b) The personal information information” that the Company may collect, process, use, store and transfer for the purposes outlined above may include includes Participant’s name, nationality, citizenship, tax or other residency status, work authorization, date of birth, age, government/tax identification number, passport number, brokerage account information, GEID or other internal identifying information, home address, work address, job and location history, compensationcompensation and incentive award information and history, business unit, employing entity, and Participant’s beneficiaries and contact information. (c) . Participant may obtain more details regarding the access and use of his/her personal information, and may correct or update such information, by contacting his/her human resources representativerepresentative or local equity coordinator. Requests for portability or erasure of the personal information should also be made by contacting Participant’s human resources representative. Personal information is retained according to the Company’s Data Retention guidelines, which may be obtained from Participant’s legal and/or compliance representative. Finally, Participant may lodge a complaint with a supervisory authority in regard to the Company’s processing of Participant’s personal information. (d) Use, transfer, storage and processing of personal information, electronically or otherwise, may shall be in connection with for the performance of this Agreement and the Company’s internal administration of the Awardits incentive award programs, or and in connection with tax or other governmental and regulatory compliance activities directly or indirectly related to an incentive award program, including the Awardprevention, detection and prosecution of crime or other grounds of public interest. In accordance with the Company’s personal information and data policies and standards, personal information may be stored in, or accessed from or transferred to countries where data privacy laws may not be as protective as those in the country from which the personal information was provided. Participant agrees to the processing of personal information as described herein under confidentiality and privacy terms to the same standard set out herein. For such purposes only, personal information may be used by third parties retained by the Company to assist with the administration and compliance activitiesactivities of its incentive award programs, and may be transferred by the company that employs (or any company that has employed) Participant from Participant’s home country of employment to other members of the Company Citigroup entities and third parties located in the United States and in other countries. Transfers to the United States from the European Economic Area are made using on one of following bases: standard contractual clauses or EU-US/Swiss-US Privacy Shield certification. (e) Those Specifically, those parties that may have access to Participant’s information for the purposes described herein include, but are not limited to, (i) human resources personnel responsible for administering the Awardaward programs, including local and regional equity award coordinators, and global coordinators located in the United States; (ii) Participant’s U.S. broker and equity account administrator and trade facilitator; (iii) Participant’s U.S., regional and local employing entity and business unit management, including Participant’s supervisor and his/her superiors; (iiiiv) the Committee or its designee (e.g. which may be the third party described above)designee, which is responsible for administering the AwardStock Incentive Plan; (ivv) the CompanyCitigroup’s technology systems support team (but only to the extent necessary to maintain the proper operation of electronic information systems that support the administration of the Awardincentive award programs); and (vvi) internal and external legal, tax and accounting advisors (but only to the extent necessary for them to advise the Company on compliance and other issues affecting the awards incentive award programs in their respective fields of expertise). (f) . At all times, Company personnel and third parties shall will be obligated to maintain the confidentiality of Participant’s personal information except to the extent the Company is required to provide such information to governmental agencies or other parties. Such action shall will always be undertaken only in accordance with applicable law. (gb) The Company has in place administrative, physical and technical safeguards to ensure appropriate security of, and to prevent the unauthorized access, use or disclosure of, the personal information, and shall require any third party designee who processes Participant’s personal information on behalf of Consent (not applicable where the Company to also have in place such safeguards. GDPR applies). BY ACCEPTING THE AWARD, PARTICIPANT EXPLICITLY CONSENTS (hI) By accepting the AwardTO THE USE OF PARTICIPANT’S PERSONAL INFORMATION FOR THE PURPOSE OF BEING CONSIDERED FOR PARTICIPATION IN FUTURE EQUITY, Participant explicitly acknowledges that heDEFERRED CASH OR OTHER AWARD PROGRAMS (TO THE EXTENT HE/she has read and understands the above paragraphs and consents (i) to the use of such information for the purpose of being considered for participation in future awards (to the extent he/she is eligibleSHE IS ELIGIBLE UNDER THE TERMS OF SUCH PLAN OR PROGRAM, and without any guarantee that any award shall be madeAND WITHOUT ANY GUARANTEE THAT ANY AWARD WILL BE MADE); and AND (iiII) to the useTO THE USE, transferTRANSFER, processing and storagePROCESSING AND STORAGE, electronically or otherwiseELECTRONICALLY OR OTHERWISE, of hisOF HIS/her personal informationHER PERSONAL INFORMATION, as such use has occurred to dateAS SUCH USE HAS OCCURRED TO DATE, and as such use may occur in the futureAND AS SUCH USE MAY OCCUR IN THE FUTURE, in connection with this Award or any other awardIN CONNECTION WITH THIS OR ANY OTHER EQUITY OR OTHER AWARD, AS DESCRIBED ABOVE.