Personal data operators
Personal data operators
Based on Art. 13-14 of EU Regulation 679/2016 - General Data Protection Regulation (“GDPR”), Alfatrust Certification S.A. (“Alfatrust”) and Banca Transilvania S.A. (“BT” or “the Bank”), having the identification and contact data indicated within the Terms and Conditions for providing certification services for qualified digital certificates, informs you about the processing of the User's personal data ("data subject") which it performs as associated operators for the purpose mentioned in point b of this notice.
The purpose and the legal basis of processing personal data
The purpose and the legal basis of processing personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate (“Certificate”).
BT is the operator that identifies the User, respectively collects from him the personal data necessary for issuing the Qualified Digital Certificate, and transmits them to Alfatrust so that this operator can issue the certificate.
Data that BT collects from Users are those processed by the Bank in its own records, within the context of the business relationship that is initiated or is ongoing between the User and the Bank at the time of transmitting the data to Alfatrust.
During the validity period of the certificate, personal data are processed by the associated operators, as appropriate, as well as in situations where Users request the suspension or revocation of the certificate in the ways detailed in the Terms and Conditions of service provision.
The legal grounds for processing personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit. c GDPR), the conclusion/performance of the Contract (Art. 6 para. 1 lit. b GDPR) and the legitimate interest of the associated operators (Art.6 para. 1 lit. f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User initiates or has an ongoing business relationship, and Alfatrust - as an accredited certification service provider from whom the User wishes to obtain a certificate, are subject to the legal provisions applicable in the field of anti-money laundering and counter-terrorism financing according to which they must collect from clients a series of personal data. These data are also necessary for concluding/performing the Contract based on which the User is allowed to use the certificate to sign the documentation in relation to the Bank.
To support users who wish to submit a request to suspend or withdraw the certificate, the associated operators justify a legitimate interest in offering them (who also have the status of Bank clients) the possibility to send these requests not only directly to Alfatrust, but also through the BT Call Center. Resolving these requests involves the exchange of personal data of the Users between the two associated operators.
Contact details - phone number and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.
Categories of personal data and of persons whose personal data are processed
Categories of personal data and of persons whose personal data are processed
Personal data processed for the purpose of fulfilling the mentioned objective are those provided by law as mandatory to be collected by a credit institution, respectively by a certification service provider for the prevention of money laundering and the sanctioning of terrorism, namely: name, first name, personal numerical code (CNP), home/residence address, validity date of the identity document, phone number, and a copy of the identity document. All these data, as they are recorded in the Bank's records, will be made available to Alfatrust for the issuance and management of the Qualified Digital Certificate.
Processing of this personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have this data processed results in the impossibility of issuing the Qualified Digital Certificate.
The persons targeted by this processing are only the Users, as they are defined in the Terms and Conditions of use.
Recipients of personal data
Recipients of personal data
With the exception of associated operators between whom a transfer of personal data processed for the purpose of processing will be carried out, the data are disclosed, as appropriate, to employees of the associated operators who need to know them, IT service providers, auditors, authorities and institutions entitled to know them.
Period of processing of personal data
Period of processing of personal data
Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of expiration of its validity, in accordance with the legally established terms.
At the level of Transilvania Bank, the remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship is conducted between the User and BT, to which the terms established by the applicable banking legislation are added, namely at least 5 years from the termination of the business relationship with the credit institution.
Rights of data subjects whose personal data are processed for the indicated purpose
Rights of data subjects whose personal data are processed for the indicated purpose
To any User, in their capacity as a data subject, the exercise of the following rights regarding the processing of their personal data by any of the associated operators is guaranteed: the right of access, the right to rectification, the right to restrict processing, the right to erasure of data, the right to object to data processing, the right to data portability.
Users can exercise these rights or contact the data protection officers for any questions/requests regarding the processing of your personal data, as follows:
- to Banca Transilvania S.A.- via message sent to the e-mail address dpo@btrl.ro or by a request sent to the BT headquarters, with the mention "to the attention of the data protection officer (DPO)"
- to Alfatrust Certification S.A.- through a message sent to the e-mail address dataprotection@alfasign.ro or by a request sent to Alfatrust headquarters, with the mention "to the attention of the data protection officer (DPO)".
Users also have the right to file a complaint with the supervisory authority - the National Authority for the Supervision of Personal Data Processing (ANSPDCP), with headquarters in Bucharest, sector 1, General Gh. Magheru Blvd. no. 28-30.
