Information note regarding the processing in BT Pay of personal data of minor users over 14 years old who have a BT account

Applicable version from 15 April 2024

1. About this information note

Please read this information note if:

you have at least 14 years but less than 18 years (hereinafter “minor” or “minor user”) and you want to use from the mobile app BT Pay (“BT Pay” or “Application”) the functionalities described in chapter V of Terms and Conditions BT Pay Kiddo for minors who have a BT account (hereinafter “BT Pay for minors who have a BT account”) with a personal card attached to the BT account opened in your name
you are a parent/ guardian/ legal representative of a minor over 14 years old (“parent”) and you intend to allow them to use BT Pay for minors who have a BT account with a card issued in the minor's name and attached to their BT account

This information should be read before the minor begins the identification process in BT Pay.

Through this notification, Banca Transilvania (“BT”, “bank”) informs the minor and his parent how the minor's personal data will be processed in BT Pay.

When we write in this information note “personal data” or “date”, we refer to any information that directly or indirectly identifies the minor (e.g. name, first name, identifiers, phone number, email address, data from the identity card/passport, transactions you make through BT Pay etc) and when we write that we use, collect, verify, keep such data it means that we “we process”.

If you are a minor and do not understand some words used in this information or have questions about how we process your data in BT Pay, ask your parent for help or write to us at the email address dpo@btrl.ro. The person I appointed at BT as responsible for the protection of personal data (“DPO BT”) will help you with responses. We recommend that you do not use BT Pay for minors who have a BT account if you do not understand this information note.

If we modify this information note, we will announce it through messages in BT Pay. The current version of this information note and the date from which it applies are available in BT Pay or on our website – www.bancatransilvania.ro - in the section Privacy Hub.

2. Who processes the minor's personal data in BT Pay

The minor's personal data in BT Pay are processed by Banca Transilvania S.A. Details about the identity and contact details of BT can be found in section III of General information note regarding the processing and protection of personal data belonging to BT Clients, in which we inform how we generally process BT Clients' data.

3. What do we use the minor's data for in BT Pay and on what grounds

We use the minor's data in the Application for:

implementation of measures regarding customer due diligence for the prevention of money laundering and terrorist financing (as a bank, we must collect and process certain data from our clients, according to the law, including from minors, who are also clients of BT);
prevention of fraud (ex. so that people who are not entitled do not gain access to the minor's data and money);
the conclusion and execution of the contract related to the BT Pay service for minors (so that the minor can use BT Pay for minors);
transmission of notifications in the Application (notifications about Application version updates or notifications via push notifications, if different types of notifications in the Application are enabled);
financial education of the minor (by grouping the types of expenses according to the type of stores where minors make payments with the cards);
internal analyzes (including statistics), to analyze whether BT Pay works properly;
archiving information and documents (keeping the data and transactions made from BT Pay at the bank);
BT Pay security assurance (BT Pay is a banking application in which we must protect the data and money of BT Customers who use this Application).

The grounds on which we process this data are, depending on the situation, those in section VII of the general information note for BT Clients, indicated above.

4. What personal data do we process of the minor in BT Pay

identification data: name, first name, BT Pay username, date of birth, personal numeric code (C.N.P.), citizenship, home address, residence, other details from the minor's identity card ("bulletin");
biometric data :
- the face of the minor (facial recognition – face ID) for identification in BT Pay, only with the explicit consent/agreement of the parent. Details about the conditions under which consent can be given for the processing of the minor's biometric data for identification in BT Pay, including the possibility of identification in BT units without the use of biometric data, can be found in Information note on personal data processing for identification purposes in BT Pay which we ask you to read
- related to the minor's phone security methods – e.g. facial recognition or fingerprint-based - if the minor uses such methods. In this case BT does not have access to biometric data, but only relies on them to allow access/use of BT Pay);
information about the family situation – relationship between minor and parent;
the image: contained in the ID card and taken over in the identification process from BT Pay. Details in the information about identification in BT Pay;
voice: taken over in the identification process from BT Pay. Details in the information about identification in BT Pay;
age, to verify if the minor can use BT Pay (must be at least 14 years old) as well as to stop using this service when they become an adult (turn 18 years old),
contact details: phone number (for sending unique codes to verify if the minor has access to this number and for using some functionalities), the email address used in BT Pay (for sending unique codes to verify if the minor has access to this address and for sending some documents, if the minor requests such sendings from BT Pay);
financial data: data about transactions made with the minor's BT cards, data about BT accounts to which the minor's BT cards registered in BT Pay are attached;
identifiers: BT card data and IBAN codes of BT accounts to which the BT cards of the minor are attached, phone identifiers (e.g. device ID, security method, operating system type, phone model), unique codes (SMS-OTP) sent to the phone number declared to BT for the minor's card, payment method chosen for BT Pay, card PIN code, which is checked if the minor withdraws cash contactless from the ATM;
information regarding the locationcarrying out certain transactions (e.g. when the minor pays with the card from BT Pay at certain stores, we will implicitly know that he was at the place where that store is located at the date and time when he made the payment or if he uses BT Pay for cash withdrawal from BT ATMs, we will know that he was at the location of that BT ATM at the respective date and time)
other personal data :
- list of phone applications installed on the minor's phone including BT Pay, to check for malware, including applications of the type that allow remote/distance connection. Depending on the situation, the bank may take the following measures as appropriate: blocking the application until the uninstallation of third-party applications that may compromise the confidentiality of information in BT Pay or contacting the parent by the bank
- data about physical activity (e.g. number of steps, number of kilometers traveled and/or number of active minutes), if the minor connects a activity monitoring application to BT Pay to unlock offers in the Rewards on the move section. We will process this data only to verify if they meet the conditions for unlocking those offers and only as long as necessary to verify these conditions;
- like any application, BT Pay will have some permissions. BT Pay:

a. will have access to read from the phone used by the minor the SMS messages sent by BT, for pre-filling the SMS-OTP codes in the Application,

b. will be able to check if the phone has the NFC function and if it is activated when the minor tries to make payments with the phone in stores or if they want to withdraw contactless cash,

c. will check if the phone used has an Android or IOS operating system to facilitate the registration of cards in Apple Pay,

d. for online payments BT Pay will save in the phone used by the minor the transaction identifier, until the moment when the online payment is confirmed or rejected,

e. will request permission to automatically display the payment confirmation screen,

f. when the minor initiates transfers based on phone numbers, BT Pay will request access to the contact list, if the phone number to which the transfer is made is intended to be chosen from the phone's address book.

5. Where do we have the minor's data that we process in BT Pay

Depending on the case, we have the minor's data:

from the bank records (they were provided to us by the parent when the minor's account was opened at the bank or when the data was updated),
from the parent who initiates the process of registering the minor in BT Pay (we receive from the parent the phone number and the minor's personal identification number. Based on this data and the parent's data, we also verify the existence of the parent-child relationship in the bank's records);
directly from the minor, when they use BT Pay for minors

6. To whom can the minor's data processed in BT Pay be disclosed

We never sell or rent personal data from BT Pay. However, we may disclose the minor's personal data:

to any of your parents/guardians/legal representatives, as long as you are a minor (under 18 years old);
some service providers who help us deliver the Application. Some of them are located in third countries. See details in Information note on personal data processing for identification purposes in BT Pay;
other BT Pay users (e.g. all other BT Pay users will see the BT Pay icon next to the minor's phone number if they initiate transfers to this number. In this case, those users will implicitly find out that the minor is a BT Client and uses BT Pay, the users to whom the minor makes transfers from BT Pay will find out the minor's first and last name and the amount they want to transfer to them);
towards Apple Pay, if the minor's phone has IOS operating system and they chose to enroll their BT card in Apple Pay within BT Pay;
to authorities/public institutions (e.g. police) that may request such information about our Clients (including minors) according to the law;

7. How long do we keep the minor's data processed through BT Pay

Because, before being a BT Pay user, the minor is a BT Client, the law obliges us to keep their data (including transactions carried out through BT Pay) for a period of 5 or 10 years after they are no longer a BT client. The term of 5/10 years applies depending on the law that obliges us to keep the data.

8. What rights are guaranteed regarding the processing of minor's data

Regarding the data processed about the minor, the minor and their parent have the following rights: the right to be informed (the information is in this information note), the right of access, rectification, opposition, the right to withdraw consent (for processing based on consent), the right to data deletion, portability, the right not to be subject to a decision based on automated data processing (we do not make such decisions in BT Pay regarding the minor's data), the right to file a complaint with ANSPDCP.

Details about these rights, including the ways in which they can be exercised, as well as the DPO BT contact details can be found within General information notes regarding the processing and protection of personal data belonging to BT Clients, with which this information note is supplemented.

General information note is an integral part of BT Privacy Policies, available on the website www.bancatransilvania.ro (including in the section Privacy Hub) or in BT units.

The minor and his parent should also know the following:

9. Security of BT Pay

The bank guarantees that it has taken adequate measures to ensure data security in BT Pay. However, it does not depend solely on us who has access to the minor’s data in the Application. Therefore, we cannot guarantee that persons who would not have the right do not gain access to this data, especially if they access it because the minor did not take sufficient care.

As a minor user of BT Pay, you are responsible for the following:

to keep the confidentiality of your data from BT Pay which depends on you (e.g. do not allow unauthorized persons to see your data from BT Pay);
to keep your phone safe (do not leave it unattended) and especially the phone unlocking password (password, fingerprint or another security method provided by the phone), as well as the data you use to log into other applications (third-party applications), for example: physical activity monitoring apps, if you connect such an app through BT Pay;
for what happens with your cards from the Application and with your accounts to which they are attached;
as soon as you find out that the phone or its security elements have reached people who should not have known them, you must notify the bank.

10. Links and third-party sites/applications

BT Pay contains links to partner websites and allows the connection of third-party applications – e.g. physical activity monitoring – by logging in with the account data from the respective application through the BT Pay application. Each website/third-party application accessed from BT Pay has its own rules regarding the processing of personal data, which should be read. The bank is not responsible for the processing of the minor's data carried out by these websites/third-party applications.