Information note regarding the processing in BT Pay of personal data of minor users over 14 years old who have a BT account

Applicable version from April 15, 2024

1. About this information note

Please read this information note if:

you haveat least 14 years but under 18 years (continuing “minor” or “minor user”) and you want to use from the BT Pay mobile app (“BT Pay” or “Application”) the functionalities described in chapter V of Terms and Conditions BT Pay Kiddo for minors who have a BT account (continuing “BT Pay for minors who have a BT account”) with a personal card attached to the BT account opened in your name
you are a parent/ guardian/ legal representative of a minor over 14 years old (“parent”) and you intend to allow him to use BT Pay for minors who have a BT account with a card issued in the name of the minor and attached to his BT account

This information should be read before the minor starts the identification process in BT Pay.

Through this notification, Banca Transilvania (“BT”, “bank”) brings to the attention of the minor and his parent how the minor's personal data will be processed in BT Pay.

When we write in this information note “personal data” or “date”, we refer to any information that directly or indirectly identifies the minor (e.g. name, first name, identifiers, phone number, email address, data from the identity card, transactions you make through BT Pay etc) and when we write that we use, collect, verify, keep such data it means that we “we process”.

If you are a minor and do not understand some words used in this notice or have questions about how we process your data in BT Pay, ask your parent for help or write to us at the e-mail address dpo@btrl.ro. The person whom I appointed at BT as responsible for personal data protection (“BT DPO”) will help you with answers. We recommend that you do not use BT Pay for minors who have a BT account if you do not understand this information note.

If we modify this information note we will announce through messages in BT Pay. The current version of this information note and the date from which it applies are available in BT Pay or on our website – www.bancatransilvania.ro - in the section Privacy Hub.

2. Who processes the minor's personal data in BT Pay

The personal data of the minor in BT Pay are processed by Banca Transilvania S.A. Details about the identity and contact information of BT can be found in section III of General information note concerning the processing and protection of personal data belonging to BT Clients, in which we inform how we process, in general terms, BT Clients' data.

3. For what purposes do we use the minor's data in BT Pay and on what grounds

We use the minor's data in the Application for:

the application of measures regarding customer knowledge for the prevention of money laundering and terrorist financing (as a bank, we must collect and process some data from our customers, according to the law, including from a minor, who is also a BT client);
prevention of frauds (e.g. so that persons who do not have the right do not receive access to the minor's data and money);
conclusion and execution of the contract related to the BT Pay service for minors (so that the minor can use BT Pay for minors);
transmitting notifications in the Application (notifications about Application version updates or notifications via push notifications, if different types of notifications in the Application are activated);
financial education of the minor (by displaying grouped types of expenses according to the types of stores where minors make payments with cards);
internal analyzes (including statistical), to analyze if BT Pay functions properly;
archiving information and documents (keeping data and transactions made through BT Pay at the bank);
BT Pay security assurance (BT Pay is a banking application in which we must protect the data and money of BT Clients who use this Application).

The grounds on which we process these data are, depending on the situation, those from section VII of the General Information Note for BT Clients, indicated above.

4. What personal data do we process of the minor in BT Pay

identification data: name, first name, BT Pay username, date of birth, personal numerical code (C.N.P.), citizenship, home address, residence, other details from the minor's identity card ("bulletin");
biometric data:
- facial features of the minor (facial recognition – face ID) for identification in BT Pay, only with the explicit consent/agreement of the parent . Details about the conditions under which consent can be given for the processing of the minor's biometric data for identification in BT Pay, including the possibility of identification in BT units without the use of biometric data, can be found in Information note regarding the processing of personal data for the purpose of identification in BT Pay which we ask you to read
- related to the minor's phone security methods – e.g. facial recognition or fingerprint-based – if the minor uses such methods. In this case, BT does not have access to biometric data, but only relies on these to allow accessing/using BT Pay);
information about the family situation – the relationship between minor and parent;
the image: contained in the identity card and taken over in the identification process in BT Pay. Details in the information about identification in BT Pay;
voice: taken over in the identification process from BT Pay. Details in the information about identification in BT Pay;
age, to check if the minor can use BT Pay (must be at least 14 years old) as well as to stop using this service when they become an adult (turn 18 years old),
contact details: phone number (for sending unique codes to verify if the minor has access to this number and for using certain functionalities), the email address used in BT Pay (for sending unique codes to verify if the minor has access to this address and for sending certain documents, if the minor requests such transmissions from BT Pay);
financial data: data on transactions made with the minor's BT cards, data on the BT accounts to which the minor's BT cards are attached, registered in BT Pay;
identifiers: BT card data and IBAN codes of BT accounts to which the BT cards of the minor are attached, phone identifiers (e.g. device ID, security method, operating system type, phone model), unique codes (SMS-OTP) sent to the phone number registered at BT for the minor's card, payment method chosen for BT Pay, card PIN, which is verified if the minor withdraws cash contactless from the ATM;
information regarding the location carrying out certain transactions (e.g. when the minor pays with the card from BT Pay at certain stores, we will implicitly know that he/she was at the place where that store is located at the date and time when the payment was made or if he/she uses BT Pay for cash withdrawal from BT ATMs, we will know that he/she was at the location of that BT ATM at the respective date and time)
other personal data:
- list of phone applications on which the minor has BT Pay installed, to check if there is malware, including applications of the type that allow remote/remote connection. Depending on the situation, the bank may take the following measures as appropriate: blocking the application until the uninstallation of third-party applications that may compromise the confidentiality of the information in BT Pay or contacting the parent by the bank
- data about physical activity (e.g., number of steps, number of kilometers traveled and/or number of active minutes), if the minor connects an activity monitoring app to BT Pay to unlock offers from the Rewards in Motion section. We will process this data only to verify whether the conditions for unlocking those offers are met and only as necessary to verify these conditions;
- like any application, BT Pay will have some permissions. BT Pay:

a. will have access to read from the phone used by the minor the SMS messages sent by BT, for the pre-filling of SMS-OTP codes in the Application,

b. will be able to check if the phone has the NFC function and if it is activated when the minor tries to make payments with the phone in stores or if they want to withdraw cash contactless,

c. will check if the phone used has an Android or IOS operating system to facilitate the registration of cards in Apple Pay,

d. for online payments BT Pay will save on the phone used by the minor the transaction identifier, until the moment when the online payment is confirmed or rejected,

e. will ask for permission to automatically display the payment confirmation screen,

f. when the minor initiates transfers based on phone numbers, BT Pay will request access to the contact list if the phone number to which the transfer is made is desired to be chosen from the phone's agenda.

5. Where do we have the minor's data that we process in BT Pay

Depending on the case, we have the minor's data:

from the bank records (they were provided to us by the parent when opening the minor's account at the bank or when updating their data),
from the parent who initiates the process of registering the minor in BT Pay (we receive from the parent the phone number and the minor's personal identification number. Based on this data and the parent's data, we also verify the existence of the parent-child relationship in the bank's records);
directly from the minor, when they use BT Pay for minors

6. To whom can we disclose the processed minor's data in BT Pay

We never sell or rent personal data from BT Pay. However, we may disclose the minor's personal data:

to any of your parents/guardians/legal representatives, as long as you are a minor (under 18 years old);
some service providers who help us deliver the Application. Some of them are located in third countries. See details in Information note regarding the processing of personal data for the purpose of identification in BT Pay;
other users of BT Pay (e.g. all other BT Pay users will see the BT Pay icon next to the minor's phone number, if they initiate transfers to this number. In this case, those users will implicitly find out that the minor is a BT Client and uses BT Pay, the users to whom the minor makes transfers from BT Pay will find out the minor's first and last name and the amount he/she wants to transfer to them);
to Apple Pay, if the minor's phone has the IOS operating system and has chosen to enroll their BT card in Apple Pay from within BT Pay;
to public authorities/institutions (e.g. police) who may request such information about our Clients (including minors) in accordance with the law;

7. How long do we keep the minor's data processed through BT Pay

Pentru că, înainte de a fi utilizator BT Pay minorul este Client BT, legea ne obligă să păstrăm datele sale (inclusiv tranzacțiile derulate prin BT Pay) pe o perioadă de 5 sau 10 ani ani după ce nu mai este client BT. Termenul de 5/10 ani se aplică în funcție de legea care ne obligă să păstrăm datele.

8. What rights are guaranteed concerning the processing of the minor's data

Regarding the data processed about the minor, he/she and his/her parent have the following rights: the right to be informed (the information is in this information note), the right of access, rectification, objection, the right to withdraw consent (for processing based on consent), the right to data deletion, portability, the right not to be subject to a decision based on automated processing of data (we do not make such decisions in BT Pay regarding the minor's data), the right to file a complaint with ANSPDCP.

Details about these rights, including the ways in which they can be exercised, as well as the DPO BT contact details can be found within General information notes regarding the processing and protection of personal data belonging to BT Clients, with which this information note is completed.

General information note is an integral part of BT Privacy Policies, available on the website www.bancatransilvania.ro (including in the section Privacy Hub) or in BT units.

The minor and his parent should also know the following:

9. BT Pay Security

The bank guarantees that it has taken adequate measures to ensure the security of data in BT Pay. However, it does not depend solely on us who has access to the minor's data in the Application. Therefore, we cannot guarantee that persons who would not have the right do not gain access to this data, especially if they access it because the minor has not been careful enough.

As a minor user of BT Pay, you are responsible for the following:

to keep the confidentiality of your data from BT Pay, which depends on you (e.g. do not allow unauthorized persons to see your data from BT Pay);
to keep your phone safe (do not leave it unattended) and especially the phone unlock password (password, fingerprint, or another security method offered by the phone), as well as the data you use to log into other applications (third-party applications), for example: physical activity monitoring applications, if you connect such an application through BT Pay;
for what happens with your cards from the Application and with your accounts to which they are attached;
as soon as you find out that the phone or its security elements have reached people who should not have known them, you must notify the bank.

10. Links and third-party sites/applications

BT Pay contains links to partner websites and allows connecting third-party applications – e.g. for monitoring physical activity – by logging in with the account data from the respective application through the BT Pay application. Each website/third-party application accessed from BT Pay has its own rules regarding the processing of personal data, which should be read. The bank is not responsible for the processing of the minor's data carried out by these third-party websites/applications.