Last Updated: July 2020

U.S. Privacy Notice for Consumers at Department Stores National Bank (“DSNB”), the Issuer of Macy’s and Bloomingdale’s Credit Cards.

Your trust and confidence in how we collect, use, and share information about you is a priority. This U.S. Privacy Notice for Consumers (Notice) applies to our U.S. websites, e-mail, phone, and other U.S. online or offline services that link to or from this Notice as well as any interactions you may have with our digital advertising campaigns (collectively, the Sites/Services).

This Notice explains how we collect, share, use, and protect information when you visit or use the Sites/Services. We advise you to read this Notice in its entirety, including the jurisdiction-specific provisions in the appendix to this Notice, which will apply to users in certain jurisdictions. By using the Sites/Services, you agree to this Notice.

This Notice does not apply to websites, mobile applications, email, or social media sites or pages that are owned or operated by Macy’s, Inc. (e.g. macys.com, bloomingdales.com), (“Macy’s Sites”). Macy’s has its own privacy notices that are different from this one for the information it may access through your use of Macy’s Sites.

As you review this Notice, here are a few important things to keep in mind:

• If you have a financial product or service with us for personal, family or household use with us, we would also have delivered to you a U.S. Customer Privacy Notice (Customer Privacy Notice) that explains how we collect, use and share information about you and offers you certain choices with respect to the use and sharing of your personal information.
• This Site is not intended for children under 13 years of age. We do not knowingly solicit information online from, or market online to, children under 13 years of age.
• Wireless service providers, Internet service providers, device manufacturers and/or social media platforms may have their own privacy notices that are different from this one for the information they may access through your use of the Sites. We encourage you to read their privacy notices as the collection, uses and sharing of information by those third parties may be different than DSNB.
• Our mobile, social media, or other online services, sites or pages may have additional terms about the privacy or use of your information. Please review the privacy notice for the specific Site/Service you are using.

1. Information We Collect Through the Sites/Services
2. Use of Information
3. Sharing of Personal Information
4. Managing Your Personal Information
5. Aggregation Services
6. Online Advertising
7. Your Choices Regarding Your Personal Information
8. Security of Personal Information
9. Other Important Information
10. Contact Us

Appendix

1. Information We Collect Through the Sites/Services

We collect two types of information: Personal Information and Other Information

“Personal Information” is any information:

• that identifies or can be used to identify you or your household;
• that relates to, describes, is capable of being associated with, or could reasonably be linked (directly or indirectly) with you or your household;
• that can be used to authenticate you or provide access to an account;
• that relates to you and that might be sensitive (such as personal medical or health information, account number, account value).

In addition to Personal Information you provide directly to us, we may collect other information about you, including acquiring and using services provided by third parties who collect and analyze customer data (“Other Information”). We share Other Information we collect about you with our affiliates, including Macy’s.

2. Use of Information

We may use the personal and other information we collect from and about you to:

• Authenticate you so that you can access the Sites and conduct account transactions on the Sites;
• Recognize you, your device or your browser when you use the Sites/Services so that we can facilitate navigation, display information more effectively, store your preferences and otherwise personalize your experience and enhance the use of the Sites/Services;
• Process your applications and transactions;
• Respond to your inquiries, fulfill requests and request your feedback;
• Service your account and market to you, including advertisements and other communications tailored to you, on our Sites/Services and third party sites, as well as offline (please see the “Online Advertising” section for more information on our online advertising practices);
• To track responses to our e-mails and advertisements and to measure the success of our marketing campaigns;
• Provide you with account information
• Facilitate social sharing functionality, where appropriate;
• For our business purpose and other lawful purposes, such as for data analysis, audits, fraud monitoring and prevention, information security, improving the Sites/Services, developing new products and services, managing our business effectively, identifying usage trends, and expanding our business activities;
• Review statistical information about use of the Sites/Services in order to improve their design and functionality, to understand how they are used, and to assist us with resolving questions about the Sites; and
• Ensure that the Sites function properly and otherwise administer the Sites/Services.

We may use, or share with others (in anonymous or non-readable form where appropriate) your information in order to better recognize you when visiting the Site and to provide relevant advertising (for DSNB, Macy’s or third party’s products/services), based on your interests, on the Site, on other sites and apps and other channels including television, email and direct mail.

3. Sharing of Personal Information

• During at least the past 12 months, we have disclosed your Personal Information for the following business purposes with our affiliates, and with Macy's, to the extent permissible under applicable law;
• with third parties, to permit them to send you marketing communications on our behalf;
• with our service providers, who provide services such as website hosting, data analysis, information technology and related infrastructure provision, customer service, processing your transactions, e-mail delivery, auditing, and other services;
• with individuals you associate with your social media account and to your social media account provider, in connection with your social sharing activity; and
• with a third party in the event of any proposed reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

We also may use and disclose your personal information as we believe to be necessary or appropriate: (a) under applicable law, which may include laws outside your country of residence; (b) to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include such authorities outside your country of residence; (c) to enforce our terms and conditions; and (d) to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or others.

Where appropriate, we will limit sharing of your personal information in accordance with the choices you have provided us in response to our Customer Privacy Notice(s) or other privacy choices that we may make available.

We may share de-identified or aggregated information with third parties to help deliver products, services, and content that are tailored to the users of our Sites and for other business purposes.

We may transfer information to affiliated companies or other parties throughout the world to process transactions and provide you with products and services. Regardless of where we process your information, we still treat it in accordance with this Notice and applicable law.

4. Managing Your Personal Information

Keeping your account information accurate and up to date is very important. If your account information is incomplete, inaccurate or not current, please use the Contact Us option on our Site, or call or write to us at the telephone numbers or appropriate address for changes listed on your account statements, records, online or other account materials.

5. Aggregation Services

If you provide your user credentials or other information about your Macy's or Bloomingdale's credit card to a third-party aggregation services provider, we will consider that you have authorized all transactions or actions initiated by such access information you provide, whether or not you were aware of a specific transaction or action. If you decide to revoke the authority you have given to an aggregation website, we strongly recommend that you change your password for Account Online to ensure that the aggregation website cannot continue to access your account information.

6. Online Advertising

We may, directly or through third parties, serve ads regarding products and services intended to be of interest to you on the Site and on third party sites or apps. We and others may use the online technologies described in the “Use of Information” section above to make inferences and predictions about your characteristics, interests and preferences based on your online interests and activities across other sites. We may also use technologies to associate and recognize your various mobile and desktop devices in order to deliver ads and other content in a consistent manner across the devices you use. Information we collect using the technologies described above may also be associated or linked with Personal Information, such as email or postal address, you provided directly to us or others. Alternatively, Personal Information may also be linked with characteristics or attributes about you, such as lifestyle interests, in support of our marketing efforts. If you opt out of interest based advertising, as described in the section entitled “Your Choices Regarding Your Personal Information” below, you will not receive such customized ads on the Site or in other places.

7. Your Choices Regarding Your Personal Information

You have certain rights with regard to your Personal Information.

Your California Privacy Rights. If you are a California resident, you have the right to request and receive certain information about disclosure of your Personal Information to third parties for their direct marketing purposes. Because it is our policy not to share your Personal Information with third parties for third-party direct marketing purposes without your consent, we are exempt from the requirement to respond to such requests. If you have any questions related to our policy, please contact us using the information provided in the “Contact Us” section below.

For information regarding how to exercise your rights as a consumer under the California Consumer Privacy Act. Please see “Supplemental provisions for California residents” in the Appendix to this Notice.

Cookies and Interest-Based Advertising.

Both the Network Advertising Initiative and the Digital Advertising Alliance (to whose principles we adhere) provide information about and technologies to opt-out of receiving some or all interest based advertising. You can also opt-out of interest based advertising by clicking on the appropriate icon within an interest based ad which will take you to tools to help you manage these choices. These technologies are browser and device specific, they must be adopted on each device you use. If you block or clear cookies, these technologies may not work. You will continue to see ads on the Site which reflect how you use the Site and our Services.

If you would prefer not to receive interest-based advertising, you can opt-out of this activity at the DAA website by visiting https://www.aboutads.info/choices/ (for U.S. residents).

You can choose whether to accept cookies through your browser settings (check the “Help” file). For example, most browsers allow you to automatically decline cookies or decline or accept a particular cookie (or cookies) from a particular site when browsing. If you decide not to accept cookies, some features of the Site may not work properly because we may not be able to recognize your device and associate you with your Macy’s or Bloomingdale’s credit card account(s). In addition, the offers or content we provide when you visit the Site or on third party sites may not be as relevant to you or tailored to your interests.

Local Shared Objects, sometimes referred to as flash cookies may be stored on your hard drive using a media player or other software installed on your device. Local Shared Objects are similar to cookies in terms of their operation, but may not be managed in your browser in the same way. Restricting acceptance of Local Shared objects may impede the functionality of some Flash applications, including those used in connection with the Site including animation and video presentations. For more information on managing Local Shared Objects, click here.

Do Not Track. Some browsers have a do not track feature that lets you tell websites that you do not want to have your online activities tracked. At this time, we do not respond to browser do not track signals.

8. Security of Personal Information

The security of personal information about you is a priority. We seek to protect this information by implementing and maintaining reasonable physical, electronic, and procedural security measures and safeguards designed to protect Personal Information within our organization. We provide employee training in the proper handling of Personal Information. Unfortunately, no data transmission over the Internet or wireless network or data storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately contact us in accordance with the “Contact Us” section below.

9. Other Important Information

Notice of Changes. We may change this Notice from time to time. Please take a look at the “Last Updated” legend at the beginning of this Notice to see when this Privacy Notice was last revised. When we do, we will post the revised Notice on this page with a new effective date. Any changes will become effective when we post the revised Notice on the Site. Your use of the Sites following these changes means that you accept the revised Notice.

Third-Party Sites and Services. This Notice does not address, and we are not responsible for, the privacy, security, or other practices of any third parties, including any third party operating any site or service to which the Site links. The inclusion of a link on the Site does not imply endorsement of the linked site or service by us or by our affiliates.

In addition, we are not responsible for the information collection, usage, disclosure, or security policies or practices of other organizations, such as Facebook, Apple, Google, Microsoft, or any other third-party app provider, social media platform provider, operating system provider, device manufacturer, or wireless service provider, including with respect to any Personal Information you disclose to other organizations through or in connection with the Site/Services.

Jurisdictional Issues. The Site is controlled and operated by us from the United States and are not intended to subject us to the laws or jurisdiction of any state, country, or territory other than those of the United States. Information about you may be stored and processed in any country where we have facilities or in which we engage service providers, and, by using the Site, you consent to the transfer of information to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access your personal information.

10. Contact Us

If you have any questions about this Notice, please contact us. For more information call us toll-free at 1-866-470-8613.

If you would like to submit a request pursuant to the California Consumer Privacy Act (“CCPA”), please visit our Privacy Hub at online.citi.com/dataprivacyhub or call (833) 971-1191. If you wish to submit a request to have your Personal Information deleted (see section I.A.3 in the Appendix below) or wish to opt-out of the selling of your Personal Information, call at (833) 981-0270.