1. Who is the personal data controller, the data subjects, and what are the purposes of processing
1. Who is the personal data controller, the data subjects, and what are the purposes of processing
Banca Transilvania, S.A. credit institution with registered office in Cluj-Napoca, Calea Dorobanților street, no. 30-36, Cluj county, registered at the Trade Register under no. J1993004155124, VAT number RO 5022670, contact phone: 02648028 (hereinafter referred to as “BT”) provides its corporate clients with the Internet and Mobile Banking service – BT Go (hereinafter referred to as “BT Go”) according to Terms and conditions of use BT Go. In this context, processes as a personal data operator ("personal data"), as further informed below.
If you are a natural person who uses BT Go on behalf of one or more BT legal entity client(s) of Banca Transilvania from Romania or of Banca Transilvania – Italy Branch (for the functionalities available in BT Go available to them), you have the status of user of this service on behalf of the legal entity client(s) who designated you (hereinafter “client”) and you are a data subject of the personal data processing.
Also, it is a data subject including the account holder client who contracted/uses BT Go, if they are of the type P.F.A., Individual Enterprise, individual form of practicing liberal professions (hereinafter “individual professional”).
BT will periodically update this notice, without imposing less favorable conditions regarding the processing and protection of personal data. The changes will be communicated to you, and the updated version will be available at any time for consultation in BT Go and also on the BT website, in the Privacy Hub section. BT Go users are always subject to the current version of this notice. If you have any questions or complaints regarding the way BT processes personal data, you can contact the data protection officer designated by BT at dpo@btrl.ro
2. What personal data we process, on what legal grounds, what individual automated decisions we make and what happens if you refuse their processing
2. What personal data we process, on what legal grounds, what individual automated decisions we make and what happens if you refuse their processing
a. What data we collect when you open the legal entity's business relationship with the bank through BT Go
At the opening of a business relationship through BT Go mobile for the legal entity you represent, we use remote identification through video means, which involves processing data from the identity document, contact data, and biometric data (facial recognition), in accordance with applicable legislation. The details are presented in Information note regarding the processing of personal data for opening a business relationship with BT through BT Go - legal entities
b. What data do we collect for the identification/authentication of BT Go users
To be able to use BT Go, we have the legal obligation to verify your identity, respectively to identify you as an authorized user to use this service, according to the obligation established in our charge by the legislation in the field of payment services, which requires us to verify who you are, what you own and what you know (strict customer authentication).
For identification, we process the following types of personal data, depending on the situation:
- the data from the identity document, which you will need to photograph in certain situations (this involves access to the camera). We will compare this information with the existing ones in the bank's records.
- the image faces in motion, from the selfie video that we will ask you to record in certain cases (requires access to the camera).
- the biometric data of the face, obtained through biometric comparison of the image from the selfie with that from the identity document photographed in the BT Go application and/or with the image already existing in the bank's records. We will process these data only if you give your explicit consent, which we will request from you in BT Go before carrying out such processing . Biometric comparison is based on criteria such as the color, size, and tilt of the eyes, the position and distance between the eyes, eyebrows, lips, and nose. In the situation where the score issued by the facial recognition tool is unsatisfactory or if you do not wish to express your consent for the processing of this type of personal data, we can identify you at any BT branch or through the call center, where we will not use biometric data.
- Login ID in BT Go (hereinafter referred to as “user ID”)
- phone number declared to the bank
- security code (PIN) set for BT Go
When using the BT Go mobile version, you can choose to log in either with the PIN you set for this application or with biometric data (e.g., fingerprint, Face ID from the device you are using). You can also set biometric authentication for the BT Go web version. If you opt for this login method, BT does not have access to the biometric data; they are stored on the device you are using. BT only receives information that the biometric authentication method has been validated by your phone.
Special notice addressed to US users of BT Go, regarding the processing of personal data necessary for identification through Onfido
US users of BT Go, as defined in the Terms of Use and carrying out banking transactions through Internet/Mobile Banking BT Go, should be aware that, in accordance with applicable US legislation for biometric data processing, including the Illinois Biometric Information Privacy Act (BIPA), their personal data of this type is processed by Onfido, as detailed in the Onfido Facial Scan and Voice Recording Policy, found at the following link: https://onfido.com/facial-scan-policy-and-release/. If you are a US user of BT Go, by continuing the identification process in the Application as described above, you confirm that you have read, understood, and accept the Onfido Facial Scan and Voice Recording Policy, as well as Onfido Privacy Policy and Onfido Terms and Conditions.
c. What data do we collect to ensure the security of BT Go
To be able to protect the transactions ordered through BT Go and the information within this platform, we will collect and use DeviceID of the device on which you have the BT Go mobile application installed, other device security identifiers (ex. Instance ID/Device Identifier), including the history of the devices on which you used BT Go and the generated tokens, the model, the phone manufacturer and its operating system type, to verify that at each login you are still using the same phone with which you registered to use the BT Go application.
Also, we have the legitimate interest and, where appropriate, the legal obligation to collect and use address/ IP addresses of the devices with which you connect to BT Go, from which also results the geographical location from where you make the transaction through BT Go. If you refuse to grant us access to these data, you will not be able to use the BT Go service.
At the same time, we use a tool that scans device application list with which you connect to BT Go, to detect if there is malware, including applications of the type that allow remote/remote connection and/or if you use the device for calls while using BT Go. In case such applications/situations or other cases suggesting a compromise of your user accounts in other applications offered by BT are identified, we will block your access to the BT Go user account and/or we will block the use of BT Go on the potentially compromised device. This blocking is an individual automated decision that we make based on the legal obligations imposed on us.
Not least, we are obliged by the applicable legal provisions in the field of payment services to we monitor transactions in order to prevent fraud. In case we detect transactions that are suspected of fraud, we may decide to block their processing.
We process this data to protect the information in BT Go. If you refuse their processing, you will not be able to use BT Go.
d. What data do we process when you use BT Go
To fulfill the legal obligations we have, to provide you the BT Go service that you have contracted for your company, and, where appropriate, because we have a legitimate interest in preventing fraud and communicating with BT Go users to provide support and to request their evaluation of the quality of the BT Go service, we use:
-> Date related to accounts, cards, and transactions
When you will use the different functionalities of BT Go, we will have implicit access to informationregarding: bank accounts (of the legal entity and of the payment beneficiaries), balances, transactions ordered through the legal entity's accounts or related to the amounts collected in its accounts, including information mentioned in the payment explanations, data about the legal entity's BT products (including loans held or that you wish to repay, deposits, investments held or that you make and their history, cards issued/requested for designated card users and details about them). Although this service is dedicated exclusively to legal entity customers of Transilvania Bank, and information about legal entities is not considered personal data, information about customers who are individual professionals is subject to personal data regulations and the bank will handle it in compliance with the applicable legal provisions in this field.
As well, we process your personal data and/or that of other persons, such as individual payment beneficiaries or profesioniindividual knowledge or other similar persons mentioned in the payment explanations (e.g. the name you want to insert for the predefined beneficiary, address, IBAN) or whom you define as predefined beneficiaries (name/first and last name, IBAN).
At the same time, for the provision of the Beneficiary Name Display Service (SANB) in order to prevent fraud in the case of initiated interbank payments, if you are a legal entity client of the types indicated above, whose information has the status of personal data, we inform you that it is processed according to the details in Information note regarding the processing of personal data within the Beneficiary Name Display Service (SANB), available on the bank's website, at the following link: https://www.bancatransilvania.ro/nota-de-informare-sanb.
Also for prevention of fraud, in the case of intrabank payments initiated from BT Go, BT processes – as an independent operator – the same categories of personal data used also within SANB, but without involving other participating banks or Transfond. The legal basis for processing personal data is BT's legitimate interest to prevent fraud in intrabank payments (BT-BT). The truncated name of the entity, as registered at BT, will be displayed to other BT customers who initiate, from a bank application, a payment to the entity's account opened at the bank, regardless of whether the payment is completed or not.
When request/contract an online loan from BT Go, we process your personal data as detailed in Information note regarding the processing of personal data for obtaining an online BT loan dedicated to legal entities.
If you integrated from BT Go with the FGO invoicing platform and allow the provider of this platform access including the transaction history from the corporate accounts that you connect to the FGO, you assume the obligation to comply with the legal provisions applicable in the field of processing and protection of personal data, including those of informing and, where appropriate, obtaining the consent from the data subjects to whom the legal person has transferred amounts or from whom it has collected amounts within these transactions or whose personal data are found in the transaction explanations, considering that this personal data will thus be disclosed to the FGO provider.
In case of accessing the functionality of investments, certain users will be able to invest on behalf of the legal entity in funds managed by BT Asset Management SAI (BTAM) by signing the intermediary contract with BT, to buy/sell fund units (UF) in the chosen fund, to set, modify or cancel a recurring investment, to view the transactions in process, the transaction history and balance, to generate portfolio statements and transaction confirmations, details about ex post costs and certificates of the investment accounts held. Banca Transilvania will process, as a person authorized by the BTAM operator, as applicable, the following personal information / data concerning you: name, first name, personal identification number (CNP), BTAM client ID, investment account number, transaction history, balance held in investment funds managed by BTAM, information regarding gain/loss and withholding tax.
-> Permissions requested in the context of using the application
When you install the application, you will be asked for permissions to access the status and identity of the phone, as well as at camera photo to the device, necessary for photographing the identity document in the identification procedure for registration in BT Go. Depending on the Android/iOS version of the phone, you can grant access as follows:
- Allow/Deny access
- Allow/Deny/While using the app
- Allow/Deny/Only this time
If you refuse to grant access to the camera, you will not be able to register in the BT Go application. After registration, you can withdraw this permission, in which case you will not be able to use the BT Go functionalities that require the use of the camera (e.g. invoice scanning), but you will be able to use other sections of BT Go.
Also, upon first connecting to the application, you will be asked for permission to transmission of notifications. If you refuse to grant access you will still be able to use the application, but you will no longer benefit from in-app notifications.
To upload invoices, the application will need access to section ofphotos/files of the device.
Other permissions required for the use and operation of the application, as established by the operating system provider of the device you are using and for which explicit user consent is not required, are presented in detail in the "permissions" section of the Play Store/Apple Store/App Gallery for the BT Go application (e.g., permissions to notify you when you do not have an internet connection).
-> Data used for communications with BT Go users
a. Notifications in BT Go
Through BT Go we will send you different types of notifications, depending on the actions you take and/or the category of user you belong to, namely notifications:
- For authentication in the BT Go web version
- For authorizing payments made in the internet banking application
- About transactions on the customer's account (e.g. collections, payments, cash deposits/withdrawals at BT equipment or at the counter, establishment or lifting of garnishments)
- About products owned or that can be contracted by the client (e.g. about credits, deposits, cards)
- About new functionalities/updates of BT Go
- Of general or particular interest for BT Go users
- About offers/promotions (activation only)
You will be able to enable/disable push notifications from BT Go for mobile as you wish. If you refuse to receive notifications/some types of notifications, you will still be able to use the application, but you will no longer benefit from push alerts, which may make it more difficult for you to use BT Go (e.g., you will have to access different sections in BT GO to identify operations that require actions from you).
b. Contact information
Because we have a legitimate interest in providing you support in using BT Go (support) and because we want to know your opinion about this service (service quality evaluation), we will use the contact details you have declared to the bank in your capacity as a client. You have the right to object to such contact. For details, please read the section regarding the rights you have in connection with the processing of your personal data.
If you have a sole proprietorship, we will process its contact details (primary and secondary phone numbers and email addresses) to update them in the bank's records, within the BT Go mobile application.
c. Assistance and support through the BT Go chatbot
Through the BT Go chatbot you can quickly receive answers about the functionalities available in BT Go or you can chat in real time with a BT consultant. In this context, we process data such as: name, BT client code, product type or the situation for which you request support, application version, phone operating system and the language selected in the chat, for identification and support.
-> Data for identification through BT Go in BT units
If you choose identification through the BT Go mobile application at a BT unit, we will process your personal data: BT client status BT Go user, phone number, authentication method (PIN, biometrics, phone unlock), and application version.
3. To whom can we disclose the data as a result of using BT Go
3. To whom can we disclose the data as a result of using BT Go
For individual professional clients, data about their accounts and transactions in BT Go indirectly identify the natural person representing the individual professional, thus being personal data. We will disclose this data, as appropriate, to:
➢ other Clients BT who have the right and need to know them
- BT Go users (all BT Go users are BT Clients) - to persons with BT Go user rights on the accounts of the legal entity opened at BT, we will disclose - within BT Go - the banking data (accounts, transactions, account and transaction identifiers, personal data from transactions of the counterparties in the legal entity client's transactions, etc.) corresponding to the accounts on which user rights have been granted, as well as other personal data (e.g. identification data) of the natural persons indicated in the client's documents available in BT Go
- BT Clients to whom you order payments from BT Go
- When you perform transactions via BT Go to accounts of other BT clients, the data related to these transactions (usually, the name of the individual professional, amount, BT account IBAN, payment explanations) will be accessible to the beneficiaries to whom you made the payment.
➢ contractual partners you have the bank
a. service providers who assist us in providing BT Go and in activities adjacent to it (e.g. SMS transmission service providers, e-mail; trusted service providers for signing documentation in the application with extended/qualified electronic signature etc); identification service providers (for identification in BT Go that involves photographing the identity document and/or the face - selfie/video selfie - , BT uses the provider's services Onfido and those of some of its subcontractors, who process, only on behalf of and under the instructions of the bank, the data from the identity document, the image - including that from the video selfie made in BT Go - and respectively the biometric data of the face, used for identification in BT Pay. The data processing will be carried out in some cases also in third countries. The transfer of personal data to these countries is based either on adequacy decisions issued by the European Commission (e.g., in the United Kingdom), or other appropriate safeguards, in accordance with the mechanisms provided by the GDPR provisions consisting of Standard Contractual Clauses approved by the European Commission which you can find here: https://eur-lex.europa.eu/legal-content/RO/TXT/PDF/?uri=CELEX:32021D0914)
b. other BT Financial Group entities whose services/products are accessible through BT Go (e.g. distribution of fund units through BTAM)
- c. BT partners whose services/products are accessible through BTBT Go allows connection to services offered by contractual partners of the bank (e.g. billing services). If you use these functionalities, the data necessary for activation/connection/operation of these services is disclosed to these partners.
➢ entitățfinancial-banking
- when making transactions through BT Go to clients of other banks/payment institutions, the payment data (usually, the name of the professional paying client, the amount, the payment explanations), will be sent to the beneficiary bank for transaction processing
- when you use the open banking functionality from BT Go for the corporate accounts for which you are a user, we will disclose to the financial institutions to which you grant access, respectively for the accounts for which you grant access, as applicable: the account number, balance, and transactions carried out through these BT accounts (with all their details – date, amount, currency, account number and name/denomination of the transaction counterparty, etc)
The list of recipients is completed with the one provided within General information notes regarding processing and protection of personal data belonging to BT clients, section VIII.
4. How long do we keep the processed data in the context of providing the BT Go service
4. How long do we keep the processed data in the context of providing the BT Go service
Your data, as a BT client, as well as the data regarding the operations carried out through the accounts (including through BT Go) are subject to the retention regime provided by the applicable normative acts, being at least 5 years from the termination of your business relationship with the bank, if longer legal terms are not applicable, which can be up to 10 years from the end of the business relationship.
5. What are the rights that BT Go users benefit from
5. What are the rights that BT Go users benefit from
Your personal data processing within BT Go is subject, in addition to this notice, to the provisions General information notes regarding the processing and protection of personal data belonging to BT clients, integral part of BT Privacy Policies, which you can find on the website www.bancatransilvania.ro, in the Privacy Hub section or on request at any bank unit.
Within the mentioned General Information Note you will also find the rights you can exercise regarding the processing of your personal data, the ways in which you can exercise them, as well as the contact details of the Data Protection Officer (DPO) and how you can contact him.
You can exercise the following rights regarding the processing of your data by the BT operator: a. the right of access, b. the right to rectification of data, c. the right to erasure (the "right to be forgotten"), d. the right to withdraw consent, e. the right to object, f. the right to restriction of processing, g. the right to data portability, h. the right to object to decisions based solely on the automated processing of personal data, including profiling, i. the right to file a complaint with the National Supervisory Authority for Personal Data Processing (N.S.A.P.D.P.), at the contact details of the authority available on the website www.dataprotection.ro.
For exercising at BT the rights mentioned in points a. – h. above, please use the contact details of the data protection officer appointed by BT (DPO BT), sending the request in any of the following ways: 1. to the e-mail address dpo@btrl.ro; 2. by postal mail, to the address in Cluj-Napoca city, Calea Dorobanților Street, no. 30-36, Cluj County, with the mention "to the attention of the data protection officer", 3. by filling out the online form available for Clients in the section: ”How to exercise your GDPR rights at BT”, available on Privacy Hub.
This BT Go privacy policy may be revised by BT at certain intervals. Users will find in the app and on the BT website, in the section Privacy Hub –specific information notes, the up-to-date version of the note.
