The current version in pdf format Download

Personal data operator

Banca Transilvania S.A., headquartered in Cluj-Napoca, Calea Dorobanților no. 30-36, registered with the Trade Register under no. J1993004155124, tax identification code RO5022670 (“bank”, „BT”), informs you how it will process, as an operator, the personal data (“personal data”, “date”) in the context of providing the BT Pay Web Internet banking service (”BT Pay Web”). The situations in which BT is not the operator of the processed data are specifically presented in this note. BT Pay Web is offered to BT clients (“clients”, “BT clients”), according to the Terms and Conditions for the use and execution of banking transactions through the internet banking service BT Pay Web (“BT Pay Web Terms and Conditions”).

The persons concerned

This information note refers to the processing of personal data belonging to BT Pay users, as they are defined in the BT Pay Web Terms and Conditions. If you are a BT Pay Web user (regardless of whether you are the user who is also the account holder or an authorized user by the account holder), you are a data subject of this processing. BT will periodically update this notice without imposing less favorable conditions regarding data processing and protection. Changes will be communicated in BT Pay Web, and the updated version will be available at any time for consultation in BT Pay Web and also on BT website, in the section Privacy Hub. BT Pay Web users are always subject to the current version of this notice. If you have any questions or complaints regarding how BT processes personal data, you can contact us at dpo@btrl.ro .

Personal data processed in BT Pay Web, purposes and legal bases of processing

1. For ensuring security in BT Pay Web/fraud prevention

For data security in BT Pay Web and to prevent fraud, we process, based on legal obligations and legitimate interest, the following data:

Device information: ID, model, type/version of operating system, RAM memory, total bandwidth, type of connection used, history of devices used, information regarding recent use of the device for calls (without access to their content or the identity of the persons you are talking to).
IP Address and location IP based
Presence of potentially dangerous applications (ex. malware, remote control applications)

These data are essential for the security of the application. If you oppose their use, you will not be able to use BT Pay Web. Also, to ensure the security of BT Pay Web and prevent fraud, we process data necessary for: authentication in BT Pay Web and transaction authorization.

Depending on the fraud risks, based on the processing of this data, the bank can: block BT Pay Web until unsafe third-party applications are removed, block suspicious transactions, contact the user. Optionally, you will be able to upload a profile picture in BT Pay Web as well. If you upload one, we will process the image for additional protection of your data in BT Pay Web.

2. For identification and authentication in BT Pay Web

If you are designated as a BT Pay Web user through the contract concluded by the client with the bank for this service, to access BT Pay Web it is necessary to identify/verify that you are the user designated by the contract. We carry out these checks through a strict authentication process, in accordance with the legislation regarding payment services. For this purpose, we process: User ID assigned by the bank, password, phone number declared to the bank (for sending unique connection codes in BT Pay Web and, where applicable, for authorizing certain operations, for which you will receive SMS messages) and the BT client code (BT CIF), to identify whether you are also a user of the BT Pay mobile application, so that you can authenticate in BT Pay Web through the BT Pay mobile application or to be able to authorize transactions initiated from BT Pay Web via the mobile application.

3. For using BT Pay Web

For the execution of the contract related to BT Pay Web concluded with the client, for the fulfillment of the bank's legal obligations and based on our legitimate interest, we process personal data as follows:

3.1 Dates related to accounts, cards, and transactions

For viewing, usage and management in BT Pay Web of current accounts, credit accounts and credit card, savings accounts, deposits, BT processes the following categories of personal data related to these accounts, as applicable: IBANs, balances, currencies, cards attached to accounts and Star points related to some credit cards, data regarding transactions (amount, explanations, date, exchange rate, payment recipients' data - name, surname, account number, transaction history), recurring payments, predefined beneficiaries (including the name under which they are saved), data regarding the establishment and management of deposits and savings accounts (amounts, start/end dates, transfer frequency), information about interests and related taxes, and in the case of credit products also the current account data from which the monthly installment is deducted, contract number, credit account balance, contracted loan amount, loan start and end date, amount related to the monthly installment, any arrears, repayment schedule, loan-related insurances and their status.

3.2. Other data processed for various functionalities of BT Pay Web

Beneficiary Name Display Service (SANB) for the purpose of fraud prevention

We have the legal obligation and legitimate interest to prevent banking frauds. To protect you in case interbank transactions (payments to accounts in other banks), BT together with other associated operators, process your personal data according to the details in Information note on the processing of personal data within the Beneficiary Name Display Service (SANB) . In case intrabank settlements (payments to BT accounts), BT processes the same categories of personal data on its own as those used within SANB. The basis for processing your data is BT's legitimate interest in preventing fraud in the case of intrabank payments (BT-BT). The first name(s) (one or more, as applicable) in full and the initial of your registered last name at BT will be displayed to other BT clients who initiate a payment to your BT account from a bank application, regardless of whether the payment is completed or not.

Issuance/reissuance of a card

From BT Pay Web you will be able to request the issuance/reissuance of a card for yourself, if you are the account holder user. In this case, we process, as appropriate: date of the issued/reissued card, the IBAN of the account to which it will be attached, the delivery address of the card.

Setting trading limits on accounts and/or blocking cards

From BT Pay Web, it is possible to set transaction limits on BT accounts, to temporarily or permanently block these cards, and to request the unblocking of temporarily blocked cards. We process iInformation about set limits, status and account data, as well as the phone number declared at BT (these operations being allowed only on the basis of the OTP code sent via SMS).

Cash withdrawal from BT ATM based on code

From BT Pay Web you can generate a temporary code for cash withdrawal from ATM (valid only for cards issued to individuals). We process phone number (selected from the agenda/entered by you) for sending the code, card and account details, transaction details.

Enrollment in Open Banking

For using the Open Banking functionality (available for non-BT accounts added in BT Pay Web), BT processes the following information which are, as applicable, personal data: The IBAN, the balance of the non-BT account and the history/data of transactions from the non-BT accounts (date, amount, transaction details, counterparty of the transaction made in the non-BT account).)

Phone card recharge

When you use this option, we process:phone number for which the recharge is made, account details from which you are performing the loading, including balance of this one.

Purchase of road vignette

When you purchase or renew the road vignette for Romania from BT Pay Web, BT will process: data about the vehicle, the account from which you make the payment and the available balance

Viewing/expressing/modifying options regarding data processing for advertising purposes

In BT Pay Web you can express your choices regarding the processing of your data for advertising purposes (consent or refusal, as the case may be), including to see which marketing options you have previously expressed to BT regarding the processing of your data for this purpose. Details about this processing can be found in section C point 12 of BT Privacy Policy.

Investments

Products in this BT Pay Web section are offered by subsidiaries of the bank (member entities of the BT Financial Group). In this case, Banca Transilvania processes your data as an authorized person, and the subsidiary is the operator. Your data from the bank's records necessary for concluding/performance of the contract you conclude with the subsidiary (identification data, contact data, other data necessary for the application of customer knowledge measures), they will be sent to the respective subsidiary, which will process them according to the provisions of its own Privacy Policy.

Find details below:

For the acquisition and management of units in funds managed by the bank's subsidiary - BT Asset Management SAI (BTAM) - from BT Pay you can become an investor in the funds managed by BTAM by signing the brokerage contract with BT, to buy/sell and manage fund units (UF) in the fund you choose. Your personal data will be processed by the BTAM operator such as: name, first name, CNP, BTAM client ID, investment account number, transaction history, balance held in investment funds managed by BTAM, information regarding gain/loss and withholding tax. You will become a BTAM client. Details about the processing of personal data carried out by the BTAM operator can be found in the BTAM Privacy Policy, available on the website www.btassetmanagement.ro

4. For communication with BT Pay Web users

4.1. Communications to contact details

For the execution of the contract with the bank, based on our legitimate interest and, where applicable, on your consent (e.g. advertising messages), we process your personal data for communication purposes, as follows:

When using BT Pay Web we will use phone number for sending you messages about initiated transactions, including codes based on which you will approve the transactions from BT Pay Web (if applicable). To allow you to authenticate and authorize from the BT Pay mobile application the transactions initiated from BT Pay Web, we send you notifications in the BT Pay mobile app. You receive them as push notifications if you have this type of notifications activated or you find them in the notifications section of the mobile app if you have not allowed push notifications.
We use phone number or email address which you have declared at the bank to inform you or to request additional details related to the transactions initiated from BTPay Web, as well as to prevent fraud attempts (for example, phishing). If you make requests (such as issuing a card) or contract BT services available in BTPay Web (for example, SMS Alert, setting up deposits, etc.), we will use the phone number to send you notifications regarding the activation of the services or, as appropriate, to inform you when the issued card has arrived at the chosen BT unit for pickup.
When you send documents from BT Pay Web (e.g. payment proofs, statements or road toll slips), we will process e-mail address entered in the dedicated field. This address may also belong to other persons, however we recommend that you use only your address . If you choose to send the documents to third parties' e-mail addresses, you assume the responsibility of informing them beforehand that the message they will receive from the e-mail address contact@btrl.ro is from you. Also, you understand that BT is not responsible if the entered address does not exist, is incorrect, or belongs to someone other than the intended recipient of the documents (which may lead to the disclosure of bank data to unauthorized persons). BT is also not responsible for situations where third parties to whom you choose to send the documents are bothered by receiving the message.

4.2. Communications through secure messaging

BT Pay Web We will use the secure messaging inbox for sending you various informational messages related to BT and/or the bank's products and services (e.g. messages about changes to the GTC, the BT Pay Web Privacy Policy, about the opening hours of bank units or possible malfunctions of some bank systems, non-banking working days etc).

4.3. Communications of advertising messages in BT Pay Web

If you have given your consent for your data to be processed for advertising purposes, we will be able to send you such messages also within the BT Pay Web service.

5. Use of cookies through BT Pay Web

In BT Pay Web we use cookies as detailed in the dedicated Cookies Policy, available on the following page Cookie policy. Strictly necessary cookies for the functioning of BT Pay Web can be placed on the device used by users without requiring their consent. Other types of cookies will be placed only if/after the user expresses their consent in this regard.

Period of retention of personal data processed in BT Pay Web

Your data, as a BT client, as well as the data regarding the transactions carried out through BT Pay Web will be kept for a period of 5 years from the termination of the business relationship with the bank, in accordance with applicable legal provisions, except for the data that must be kept for a period of 10 years, according to the legal provisions in the financial accounting and fiscal field.

Recipients of the personal data processed in BT Pay Web

The data provided directly by BT Pay Web users or those that the Bank may become aware of in the context of accessing and using this service may be disclosed by Banca Transilvania to certain categories of recipients, as follows:

other BT Clients who have the right and need to know them (all BT Pay Web users are BT Clients)

a. users to whom you have granted rights on your accounts and in BT Pay Web

If you are an account holder user and have authorized persons with rights also in BT Pay, they will have access within this internet banking service to your personal data mentioned in point 3.1 of this information note, according to the rights granted, except for information about the cards attached to the accounts. Authorized persons can view this data, make transfers and currency exchanges, access statements and transaction history, share the IBAN, set up recurring payments, and manage savings and deposits.

b. BT clients who granted you operating rights on their accounts opened at BT, including in BT Pay Web

If you are a user to whom other BT clients, individuals, account holders, have granted operating rights on their BT accounts and have provided you these rights also in BT Pay Web, they have access to your data, such as: name, first name, your capacity as an authorized person on the accounts, and your capacity as their designated user in BT Pay Web. When you perform transactions on these clients' accounts, we will disclose the transaction data you carry out (including information about the persons to whom you make payments from these accounts).

c. BT clients on whose account you hold an additional card issued in your name

If you have an additional card issued on another BT client's account, the account holder client will also be able to see in BT Pay Web details about the transactions you made with that card (amount, merchant, date, etc).

d. BT clients, natural or legal persons, to whom you make payments from BT Pay Web

When making transactions through BT Pay Web to accounts of other BT clients from accounts belonging to you, the data related to these transactions (usually, your first and last name, the amount, the currency, the account number, the payment explanations), will be accessible to the beneficiaries to whom you have made the payment.

persons to whom you choose to send documents/information from BT Pay Web

If you choose to send proof of payments, statements, account numbers to email addresses entered in the dedicated field in BT Pay Web that do not belong to you, your data from those documents will be disclosed to the persons who have access to the respective email address. BT does not know the identity of those persons.

contractual partners of the bank

Service providers who assist us in providing BT Pay Web and in activities adjacent to it (e.g. SMS transmission service providers, e-mail.

Data processing will be carried out in some cases also in third countries. The transfer of personal data to these states is based either on adequacy decisions issued by the European Commission, or other appropriate safeguards, in accordance with the mechanisms provided by the GDPR, consisting of Standard Contractual Clauses approved by the European Commission which you can find here: content/RO/TXT/PDF/?uri=CELEX:32021D0914) https://eur-lex.europa.eu/legal. The list of recipients above is completed with that provided in General information note regarding the processing and protection of personal data belonging to BT Clients, section VIII.

Rights related to the processing of personal data in BT Pay Web

Your processing of your personal data within BT Pay Web is subject, in addition to this notice, to the provisions General information notes regarding the processing and protection of personal data belonging to BT clients, integral part of BT Privacy Policies, which you can find on the website www.bancatransilvania.ro, in the section Privacy Hub or upon request at any unit of the bank. Within the mentioned General Information Note, you will also find the rights that you can exercise regarding the processing of your personal data, the ways in which you can exercise them, as well as the contact details of the Data Protection Officer (DPO) and how you can contact him/her.

Information regarding the processing and protection of personal data in the context of providing the BT Pay Web Internet banking service ("BT Pay Web Privacy Policy")