1. Who is the data controller and what is the purpose of processing?
1. Who is the data controller and what is the purpose of processing?
BT must ensure that payments in the online environment are secure. That is why, in BT Pay, we apply identification rules according to the legislation in the field of payment services, through which we verify who you are, what you own, and what you know, so that we can ensure your identity. We verify your identity in the application for this purpose in several phases: when you register/re-register in BT Pay, when you set/reset/unlock the PIN (security code) in the application, when you access the application or authorize transactions from it.
2. What are the data we use and what happens if you refuse their processing?
2. What are the data we use and what happens if you refuse their processing?
For registration in BT Pay
- For registration in BT Pay, re-registration if you have not set a PIN or if you have a PIN but forgot it
We use the following types of personal data that concern you:
- the data from the identity document - it will be necessary to photograph it (requires access to the camera). We will compare this information with the existing records of the bank.
- the image faces in motion, from the selfie video you will have to make (requires access to the camera)
- the biometric data of the face, obtained by biometric comparison of the selfie image with that from the photographed identity document and with your image from the bank's records. Biometric comparison is based on criteria such as the color, size, and tilt of the eyes, the position and distance between the eyes, eyebrows, lips, and nose. Biometric data uniquely identifies you. They are data with special/sensitive character. We use biometric data only on the basis of explicit consent.
- If you are adult user, you express this consent for yourself and/or, as appropriate, for a minor over 14 years old whom you legally represent (e.g. you are a parent/guardian), by ticking the box/pressing the specific button expressing this agreement, which will be displayed in the application. If you do not wish to give your consent for the processing of this type of data, we can identify you and, where appropriate, the minor, at any BT unit, where we will not use biometric data.
- If you are a minor over 14 years old, we will be able to process your biometric data in BT Pay only if your parent gives us consent explicit (as specified in the previous paragraph) . Even if a parent gives their consent for us to process your biometric data for identification in BT Pay, if you do not feel comfortable with us using such data, do not start the registration process in BT Pay and ask your parent to go to a BT unit, where you can be identified without us processing your biometric data.
- For re-registration in BT Pay after setting a PIN in the app, for setting, resetting and unlocking the PIN
We use for your identification, as applicable, all or part of the following personal data: phone number declared to the bank, PIN-ul setat pentru aplicație (dacă ești utilizator major), the image from the selfie you will need to take (requires access to the camera) and the one from the identity document in the bank's records which we will compare biometrically, thus using the biometric data of the face tales (only if you give your consent for the processing of this type of data, through an explicit action that will be requested of you on a dedicated screen)
- For accessing the application and authorizing transactions in BT Pay (together called “authentication in BT Pay”)
For your identification for authentication in BT Pay, regardless of whether the identification for registration in BT Pay was done directly in the Application or in a BT unit, we process the following categories of personal data, depending on the method you used for authentication:
- dacă nu ai PIN setat în BT Pay, we processmethod of unlocking the phone your (whatever it may be: fingerprint, face ID, PIN, or phone unlock pattern). In this case, the Bank does not know the unlock method used, but implicitly finds out that it was entered correctly if the transaction authorization is successfully completed.
- if you have a PIN set in the app, we use for your identification PIN.
Additionally, if you choose to activate the usebiometric data from the devicefor authentication in BT Pay (fingerprint, face ID – biometric features of the face) we also use this data, without however having access to it. BT only uses the result of the comparison between the fingerprint/face features applied/scanned with the fingerprint/face features stored on the device you are using, to allow you to authenticate in the application. If biometric authentication fails, you will need to use the PIN set in BT Pay for authentication.
For carrying out/authorizing certain transactions, we will also usethe biometric data of the face your stories (only if you express your consent for the processing of this type of data, through an explicit action that will be requested on a dedicated screen). If you do not want us to use this type of data, you can request the processing of the transaction at a BT unit.
3. Data recipients and the transfer of data to third countries
3. Data recipients and the transfer of data to third countries
For identification in BT Pay which involves photographing the identity document and/or the face (selfie/video selfie), BT uses the services of the provider Onfido and some of its subcontractors, who process, only on behalf of and under the instructions of the bank, data from the identity document, the image (including that from the video selfie made in BT Pay) and respectively the biometric data of the face, used for identification in BT Pay. Data processing will be carried out in some cases also in third countries. The transfer of personal data to these states is based either on adequacy decisions issued by the European Commission (e.g. in the United Kingdom), or other appropriate guarantees, in accordance with the mechanisms of the GDPR provisions consisting of Standard Contractual Clauses approved by the European Commission which you can find here: https://eurlex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0915&from=RO.
4. Special notice addressed to US users of the Application, regarding the processing of personal data necessary for identification
4. Special notice addressed to US users of the Application, regarding the processing of personal data necessary for identification
US users of BT Pay, as defined in the Terms and Conditions of Use of the Application, should bear in mind that, in accordance with the applicable US legislation for the processing of biometric data, including the Illinois Biometric Information Privacy Act (BIPA), their personal data of this type are processed by Onfido, as detailed in the Onfido Policy regarding facial scanning and voice recording, found at the following link:https://onfido.com/facial-scan-policy-and-release/
If you are a US BT Pay user, by continuing the identification process in the Application as described above, you confirm that you have read, understood, and accepted the Onfido Policy regarding facial scanning and voice recording, as well as Onfido Privacy Policy and Onfido Terms and Conditions.
The provisions of this specific information note are supplemented by those of Information notes on the processing of personal data within the BT Pay mobile application, respectively with those of Information note regarding the processing in BT PAY of personal data of minor users over 14 years old who have a BT account – (in the case of users under 14 years old who use the functionality for minors who have a BT account), as well as with those of General information notes regarding the processing and protection of personal data belonging to BT Clients. The general information note is an integral part of BT Privacy Policies, which you find on website of Transilvania Bank in the Privacy Hub section or in BT units. In this note, you will find details about the rights you have regarding the processing of your data, the ways you can exercise them, the contact details of the BT DPO, and the data retention period.
For the english version of this privacy notice tap here.
