Privacy policy.

Last updated: 27 October 2026

1. Introduction

Welcome to CITI Fixed Savings. We respect your privacy and are committed to protecting the personal information you may provide when visiting our website or interacting with our services. This Privacy Policy explains how personal information may be collected, used, stored and protected when you access our website, submit an enquiry or communicate with us.

We aim to handle personal information responsibly and in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information we may collect

Depending on how you interact with our website, we may collect the following types of information:

• Personal information: Information you voluntarily provide, such as your name, email address and other contact details when submitting an enquiry.
• Enquiry information: Details contained in messages or requests you send to us, including information about your energy-saving interests or requirements.
• Technical information: Certain technical information may be collected when you visit our website, such as your IP address, browser type, device information and operating system.
• Website usage information: Information about how visitors interact with our website, including pages viewed, time spent on pages and general website performance data, where applicable.

We only intend to collect information that is relevant and necessary for the purposes described in this policy.

3. How we use your information

Personal information may be used to:

• Respond to enquiries and requests.
• Provide information about our energy-saving approach and relevant services.
• Communicate with visitors who have contacted us.
• Maintain, operate and improve our website.
• Monitor website performance and understand general visitor activity, where applicable.
• Protect our website against misuse, fraudulent activity and security threats.
• Comply with applicable legal and regulatory obligations.

We will not use personal information for purposes that are incompatible with those described in this policy without an appropriate legal basis.

4. Lawful basis for processing

Where UK data protection law applies, we will process personal information only when an appropriate lawful basis exists. Depending on the circumstances, these bases may include:

• Consent: Where you have freely agreed to a specific use of your information.
• Legitimate interests: Where processing is necessary for legitimate business purposes and your rights and interests do not override those purposes.
• Contractual necessity: Where processing is necessary to take steps at your request or perform a contract.
• Legal obligations: Where processing is required to comply with applicable law.

The lawful basis will depend on the particular processing activity.

5. Cookies and similar technologies

Our website may use cookies and similar technologies to support essential website functions, remember preferences, understand website performance or improve the browsing experience. Where required by law, we will request consent before placing non-essential cookies or using similar technologies.

You may be able to manage cookie preferences through our website’s cookie settings or your browser settings. Disabling certain cookies may affect website functionality. The specific cookies used will depend on the technologies and services implemented on our website.

6. Sharing your information

We do not intend to sell your personal information to third parties. Where necessary, information may be shared with trusted service providers that support our website operations, hosting, security, communications or analytics.

We may also disclose information where required by law, to comply with lawful requests from relevant authorities or to protect our legal rights and the security of our website. Where third parties process personal information on our behalf, appropriate safeguards should be implemented in accordance with applicable data protection requirements.

7. Data storage and security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, accidental loss, alteration, disclosure or destruction. However, no method of electronic transmission or internet storage can be guaranteed to be completely secure. Access to personal information should be restricted to individuals and service providers who require it for legitimate purposes.

8. Data retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including responding to enquiries, maintaining relevant records, meeting legal obligations and resolving disputes. Retention periods may vary depending on the nature of the information and the reason for processing. When personal information is no longer required, it should be securely deleted or anonymised where appropriate.

9. Your data protection rights

Depending on the circumstances and applicable law, you may have the right to:

• Request access to personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request erasure of your personal information.
• Request restriction of certain processing activities.
• Object to processing carried out on the basis of legitimate interests.
• Request the transfer of certain personal information to you or another organisation.
• Withdraw consent where processing is based on consent.
• Complain to the Information Commissioner’s Office (ICO).

These rights are subject to applicable legal conditions and exceptions. For more information, visit the Information Commissioner’s Office website.

10. Third-party websites

Our website may contain links to third-party websites or services. These external websites operate independently and may have their own privacy policies and data-handling practices. We are not responsible for the privacy practices, content or security of third-party websites. We encourage visitors to review the relevant privacy policies before providing personal information to external services.

11. Children’s privacy

Our website is not intended to knowingly collect personal information from children without an appropriate legal basis and any necessary permissions. If we become aware that personal information has been collected inappropriately from a child, we will take reasonable steps to address the situation in accordance with applicable law.

12. International data transfers

Where personal information is transferred outside the United Kingdom, we will take appropriate steps to ensure that the transfer complies with applicable data protection legislation. Depending on the circumstances, these steps may include relying on an adequacy regulation or implementing appropriate contractual safeguards.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our website, business practices, technology or legal obligations. Any revised version will be published on this page, together with an updated revision date where appropriate. We encourage visitors to review this page periodically to remain informed about our privacy practices.

14. Contact and privacy enquiries

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please use the appropriate contact method provided on our website. We will review privacy-related requests and respond in accordance with applicable legal requirements.