Data Privacy Notice

The Bermuda Corporate Income Tax Agency (CITA) is committed to protecting your privacy and ensuring that your personal information is collected, used, and stored securely and in compliance with the Personal Information Protection Act 2016 (PIPA) and other applicable data protection laws and regulations. This Privacy Notice explains how we collect, use, share and safeguard your personal information when you interact with CITA. This Privacy Notice does not form part of a contract (if any) with CITA and does not confer any contractual right on you or place any contractual obligation on us.

How We Collect Your Personal Information

Most of the personal information that we hold will have been provided by you (for example, when creating an online user account, obtaining a Tax Identification Number, filing or initiating payments using CITA online. The information in this Privacy Notice is an addition to any information provided to you at the point of collection.
Where you provide to us personal information of a third party, you must be authorised to share such personal information with us and we presume that you have obtained the consent of that third party where applicable.

What Information We Collect

CITA may collect the following types of information when you use our services, visit our website or engage with us:

Personal information – Name, contact details, identification numbers and other details required for tax administration.
Financial & tax-related data – Business registration details, corporate tax filings, payment history and compliance records.
Technical data – IP addresses, browser type and website usage analytics collected through cookies and tracking technologies.
Communications & correspondence – Emails, queries and interactions with our team.

We do not intentionally collect sensitive personal information when you use our services, visit our website or engage with us.

Who May Have Access or Receive Your Information

Personal information may be disclosed to the following individuals and/or entities as required for tax administration and compliance:

CITA employees – While undertaking their official duties and as reasonably necessary in tax administration, compliance and enforcement.
Government agencies & regulatory bodies – To fulfill legal obligations, tax compliance and regulatory reporting.
Law enforcement authorities – If required by law, court order or regulatory investigations.
Third-party service providers – For IT support, security, and operational purposes, ensuring compliance with data protection and other applicable laws.
International tax authorities – In accordance with information exchange agreements and international compliance requirements.

How We Use Your Information

We will use your personal information in a lawful and fair manner. CITA uses your personal information to:

Administer and enforce corporate income tax in Bermuda.
Provide taxpayer support and services.
Ensure compliance with tax regulations and international agreements.
Enhance security, detect fraud and prevent tax evasion.
Improve website functionality and user experience.
Where otherwise reasonably necessary in exercising CITA’s official authority.

We only collect and use personal information when it is lawful, necessary and relevant to our statutory functions.

How We Share Your Information

CITA may share your information in the following circumstances:

With government agencies & regulatory bodies – To fulfil legal obligations and facilitate tax compliance.
With law enforcement authorities – If required by law, court order or regulatory investigations.
With third-party service providers – For IT support, security and operational purposes, ensuring compliance with data protection and other applicable laws.
With international tax authorities – In accordance with information exchange agreements and international compliance requirements.

We do not share, sell, rent, or trade your personal information to third parties for the purposes of direct marketing or otherwise.

International Transfers of Personal Information

Where your personal information is transferred to a third party located outside of Bermuda, we will take reasonable steps to ensure that your personal information is adequately protected and transferred in accordance with any applicable data transfer requirements.

Data Retention & Security

CITA retains your data, including personal information, only for as long as necessary to fulfil tax administration and compliance duties, and in accordance with any statutory or regulatory requirements.
We use appropriately secure systems, encryption, and access controls to protect your data against unauthorised access, destruction, use, modification, disclosure or other misuse.
We regularly review our data protection measures to maintain security and compliance.
Our employees, contractors and agents are bound by confidentiality obligations when handling your personal information, and they may be subject to disciplinary measures if they fail to comply with these obligations.

Your Rights & How to Access Your Information

Under PIPA, you have the right to submit a reasonable written request to us to:

Request access to your personal information in our custody or control, the purposes for which we have been or are using your personal information, and the names of persons or types of persons and circumstances for which your personal information has or is being disclosed.
Correct or update any inaccuracies in your information.
Request deletion of your personal information where it is no longer relevant for the purposes of its use (where legally permissible).

Restrict or object to using your personal information for the purposes of advertising, marketing, or public relations, or where the use of that personal information is causing or is likely to cause substantial damage or distress to you or another individual. We do not share, sell, rent, or trade your personal information to third parties for the purposes of direct marketing or otherwise.

Withdraw consent (if our use is based on express consent).

Requests for access, correction, erasure or to object to use of personal information shall be addressed in accordance with PIPA. To exercise your rights or make a privacy-related request, contact our Privacy Officer (see below).

Contacting Us & Our Privacy Officer

Our offices are located at Wellesley House, 1st Floor, 90 Pitts Bay Road, Pembroke, HM08, Bermuda.

If you have any questions about this Privacy Notice or to request more details about your rights and how we collect, use and disclose your personal information, please contact our Privacy Officer at: privacyofficer@cita.bm

Privacy Notices Under PIPA

Under PIPA, CITA is not obliged to provide a Privacy Notice in certain cases, including when:

All of the personal information is publicly available information.
We can reasonably determine that all uses made, or to be made, of the personal information are within the reasonable expectations of the individual to whom the personal information relates.

Cookies & Tracking Technologies

CITA’s website uses cookies to improve functionality and user experience. For more details on how we use cookies, refer to our Cookies Policy and Cookies Preference page.

Changes to This Privacy Notice

CITA may update this Privacy Notice periodically. Any significant changes will be communicated through our website. The date above indicates when this Privacy Notice was last revised.