Operators of personal data

Under Art. 13-14 of EU Regulation 679/2016 - General Data Protection Regulation (“GDPR”), Alfatrust Certification S.A. (“Alfatrust”) and Banca Transilvania S.A. (“BT” or “the Bank”), having the identification and contact details indicated within the Terms and Conditions for the provision of certification services for qualified digital certificates, informs you about the processing of the User's personal data ("data subject") carried out as associated operators for the purpose mentioned in letter b of this notice.

The purpose and legal basis of personal data processing

The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate ("Certificate").

BT is the operator that identifies the User, respectively collects from them the personal data necessary for issuing the Qualified Digital Certificate, and sends it to Alfatrust so that this operator can issue the certificate.

The data that BT collects from Users are those processed by the Bank in its own records, in the context of the business relationship that is initiated or that is ongoing between the User and the Bank at the time of transmitting the data to Alfatrust.

During the validity period of the certificate, personal data are processed by the associated operators, as appropriate, as well as in situations where Users request the suspension or revocation of the certificate in the manners detailed in the Terms and Conditions of service provision.

The legal grounds for processing personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit. c GDPR), the conclusion/performance of the Contract (Art. 6 para. 1 lit. b GDPR), and the legitimate interest of the associated operators (Art. 6 para. 1 lit. f GDPR).

Regarding the legal obligation, both BT - as a credit institution with which the User initiates or has an ongoing business relationship, and Alfatrust - as an accredited certification service provider from which the User wishes to obtain a certificate, are subject to the legal provisions applicable in the field of money laundering and terrorist financing prevention according to which they must collect from clients a series of personal data. These data are also necessary for concluding/executing the Contract under which the User is allowed to use the certificate to sign documents in relation to the Bank.

In order to assist users who wish to submit a request for suspension or withdrawal of the certificate, the associated operators justify a legitimate interest in offering them (who are also clients of the Bank) the possibility to send these requests not only directly to Alfatrust, but also through the BT Call Center. The resolution of these requests involves the exchange of personal data of the Users between the two associated operators.

Contact details - phone number and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.

Categories of personal data and of persons whose personal data are processed

Personal data processed for the purpose of fulfilling the mentioned objective are those provided by law as mandatory to be collected by a credit institution, respectively by a certification service provider for the prevention of money laundering and the sanctioning of terrorism, namely: name, first name, personal numerical code (CNP), home/residence address, identity document validity date, phone number, and a copy of the identity document. All these data, as they are recorded in the Bank's records, will be made available to Alfatrust for the issuance and management of the Qualified Digital Certificate.

Processing of this personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate.

The persons concerned by this processing are only the Users, as defined in the Terms and Conditions of use.

Recipients of personal data

Except for the associated operators among whom a transfer of personal data processed for the fulfillment of the processing purpose will take place, the data is disclosed, as the case may be, to the employees of the associated operators who need to know it, IT service providers, auditors, authorities, and institutions entitled to know it.

Period of personal data processing

Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiration, in accordance with legally established terms.

At the level of Banca Transilvania, the remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship between the User and BT is ongoing, to which are added the terms established in the applicable banking legislation, respectively at least 5 years from the termination of the business relationship with the credit institution.

Rights of data subjects whose personal data are processed for the indicated purpose

To any User, in his capacity as a data subject, the exercise of the following rights is guaranteed regarding the processing of his personal data, with any of the associated operators: the right of access, the right to rectification, the right to restriction of processing, the right to data erasure, the right to object to data processing, the right to data portability.

Users can exercise these rights or contact the data protection officers for any questions/requests regarding the processing of your personal data, as follows:

- at Banca Transilvania S.A.- by message sent to the email address dpo@btrl.ro or by a request sent to the BT headquarters, with the mention "to the attention of the person responsible for data protection (DPO)"

- to Alfatrust Certification S.A.- by message sent to the e-mail address dataprotection@alfasign.ro or by a request sent to the Alfatrust headquarters, mentioning "to the attention of the data protection officer (DPO)".

Users also have the right to file a complaint with the supervisory authority - the National Supervisory Authority for Personal Data Processing (ANSPDCP), with headquarters in Bucharest, sector 1, G-ral Gh. Magheru Blvd. no. 28-30.

Information regarding the processing of personal data for the purpose of issuing and managing the Qualified Digital Certificate issued to the User by Alfatrust Certification S.A. for signing documentation related to Banca Transilvania.