Who is the personal data operator?
Who is the personal data operator?
BANCA TRANSILVANIA S.A. (hereinafter "the bank" or "BT") credit institution, Romanian legal entity, with the identification and contact details presented in section III of General information note regarding the processing and protection of personal data belonging to BT Clients, offers certain categories of BT legal entity clients holding current accounts the possibility to obtain an online loan (hereinafter also referred to as "BT PJ online loan").
In this context, BT processes personal data (“personal data”) of natural persons who represent the legal entity or are real beneficiaries or associates/shareholders thereof, including from the perspective of these as guarantors and/or sureties. If you have any of these qualities, you are a data subject of this processing. In the general information note indicated above, which is an integral part ofBT Privacy Policy from the site www.bancatransilvania.ro, found also distinct in the section Privacy Hub, you will find the definition of the BT Client, detailed information about your rights regarding the processing of personal data and the ways in which you can exercise them, and about the possibility to contact the data protection officer appointed by BT (BT DPO).
When you apply for obtaining and, as the case may be, conclude on behalf of the legal entity (hereinafter also referred to as the "credit applicant") an online BT PJ loan, we process your personal data for several purposes and legal grounds, either as the sole data controller or, as the case may be, together with other associated controllers, as we present to you below.
On what grounds do we process the data and what happens if you refuse their processing?
On what grounds do we process the data and what happens if you refuse their processing?
We process your personal data on the following legal grounds:
- the legal obligations to which BT is subject through various normative acts,
- conclusion/execution of the credit contract or completing the necessary steps to conclude it,
- our legitimate interest and/or that of third parties, (e.g. the interest in preventing fraud or the legitimate interest of consulting your situation in the records of Credit Bureau SA for assessing your creditworthiness or consulting the situation of the legal entity you represent in the Credit Risk Center – "CRC"; the legitimate interest to contact you to provide support for completing the online application and to ask for your opinion about the application process),
- your consent, if it is necessary to verify your identity based on biometric data (facial recognition).
When the law requires us to process personal data or when they are necessary for concluding the credit contract, if you refuse to process them, we will not be able to analyze your request.
For processing based on the legitimate interest of BT or third parties, refusing to have your data processed may make it impossible to analyze your request or obtain the BT PJ online credit.
For data processing for which your consent is required, we will request this agreement from you at the appropriate time in the online application flow. If you refuse to give this consent, you cannot obtain the BT PJ credit online, but you have the possibility to apply for it at a BT unit.
By continuing the application process, you express your consent to consult the status of the legal entity you represent in the CRC records and you assume that you will subsequently sign the dedicated form after the inquiry, with an electronic signature obtained according to the mentions at point D of this information note.
For what purposes do we process personal data, what are the data, for what period do we keep them, and to whom can we disclose them?
For what purposes do we process personal data, what are the data, for what period do we keep them, and to whom can we disclose them?
In the following lines, we present to you separately the purposes for which we will process personal data so that you can apply and, if applicable, so that you can contract for the legal entity you represent a BT PJ online loan. Depending on the purpose of the processing, we will present information about the data storage period, categories of data recipients, the existence of automated decision-making processes, as well as the rights you benefit from.
A. Personal data processed for identity verification, in order to prevent fraud, money laundering and terrorist financing, to contact you for the purpose of providing support or evaluating the quality of this BT service, as well as for the valid application/conclusion of the credit contract
The applicable legislation obliges us to verify the identity of the persons with whom we are to conclude contracts/who represent the legal entity. At the same time, we have a legitimate interest in preventing attempts at fraud through identity theft in the online environment.
For verifying your identity, they will use the login data in BT Go and other personal data from BT records (e.g. status, holdings, and powers of representation within the legal entity). To ensure that the information we hold about you is correct and up to date, we will compare the data from your identity document in the BT records with those from your identity document at the General Directorate for Persons Records - G.D.P.R. - (see here details about the processing of the data provided by D.G.E.P.).
B. Personal data processed for the analysis of the credit application submitted by the credit applicant (legal entity), including automated decision-making processes based on profile creationi [1]
To analyze the application of the legal entity for a BT PJ online loan, we process your personal data in BT's internal records and in the Credit Bureau's records, where we check your situation. All information related to this processing can be found below, in points I and II of this section B [2].
Being essential to provide you with a quick response to your online loan request, we will make the decision to approve/reject the application by processing the personal data exclusively by automated means. Details about this decision can be found in point II (5) below.
[1] This information is valid for the entire duration of the business relationship of the credit applicant (legal entity) with Banca Transilvania, being applicable whenever this applicant addresses the bank with a credit request/application (including in case of supplementation / extension / restructuring of an existing credit), if you hold within the applicant one of the mentioned capacities (legal representative/partner/shareholder, potentially: co-debtor/guarantor/endorser/surety/real beneficiary). You will be provided with a new information of this type in the event of substantial changes to the provisions of this information or at your express request. This information is also publicly available on the bank’s website www.bancatransilvania.ro, în secțiunea Privacy Hub - subsecțiunea note de informare specifice sau, la cerere, în orice unitate BT;
[2] Your personal data will be consulted in the Credit Bureau (respectively, the mentions from part I of this information apply to you) only if you have the status of: guarantor/codebtor/surety/endorser within a credit request/application addressed to BT by the legal entity credit applicant
Identification data of operators
Banca Transilvania S.A., with headquarters in Cluj-Napoca city, Calea Dorobanților street, no. 30-36, Cluj county and the company Credit Bureau S.A., Romanian legal entity with headquarters in Bucharest, Sfânta Vineri street, no. 29, 4th floor, sector 3, as associated operators, process your personal data, in good faith, fairly and transparently, for specific and legitimate purposes, in accordance with the provisions of Regulation (EU) No 679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the Regulation).
The Credit Bureau SA is the private law entity that administers the Credit Bureau System, in which are processed personal data related to the lending activity carried out by Participants.
Participants in the Credit Bureau System are credit institutions, non-banking financial institutions, insurance companies, and debt collection companies that have signed a Participation Contract with the Credit Bureau.
2. Legal basis and purpose of processing
Banca Transilvania S.A. and the Credit Bureau processes your personal data based on the legitimate interest of the Participants and the Credit Bureau for conducting responsible credit activities, under conditions of protection, facilitating access to credit, and preventing excessive indebtedness of the persons concerned, compliance with the legal framework regarding creditworthiness assessment and risk reduction, as well as preventing the use of the financial-banking system for conducting activities contrary to the law.
Banca Transilvania S.A. are the obligation, according to the legal regulations in force, to assess your credit repayment capacity, before concluding a credit agreement and throughout its duration. For this purpose, Banca Transilvania S.A. processes the information indicated at point (4), registered in your name in its own records and transmits them to the Credit Bureau for processing by this institution and for consultation by any Participant, for the purpose of initiating or carrying out a credit relationship, as well as securing credit-type products.
3. The obligation to provide data and the consequences of non-compliance with it
The provision of your personal data is necessary for the purpose mentioned in point (2). Refusal to provide your personal data, necessary to achieve the purpose mentioned above, will result in the impossibility Transilvania Bank S.A. to fulfill their legal obligations in connection with granting the credit.
4. Categories of personal data processed in the Credit Bureau system
a. identification data of the data subject : name, first name, personal numeric code, or VAT number for authorized natural persons or VAT identification code for natural persons carrying out liberal professions or country code and passport series/number for non-resident persons, home address/residence, phone number, date of birth;
b. data regarding the employer: the employer's name and address, the date of registration of this information, VAT number;
c. data related to requested/granted credit-type products : type and name of the Participant, type of product, product/account status, grant date, account duration, amounts granted, amounts owed, update date, currency, payment frequency, amount paid, monthly rate, outstanding amounts, number of days overdue, first overdue date, delay category, last payment date;
d. data related to events occurring during the credit product period, such as those relating to restructuring/refinancing, handing over in payment, assignment of the credit contract, assignment of the claim;
e. information related to relationships with other accounts: information regarding credit-type products for which the data subject is a co-debtor and/or guarantor;
f. data related to insolvency: information regarding the persons concerned against whom an insolvency procedure has been opened;
g. number of inquiries: indicates the number of Credit Reports issued by the Credit Bureau, at the request of one or more Participants;
In the pre-analysis process of the request/applicant's credit application analysis, Banca Transilvania SA will request from the Credit Bureau the issuance of a Credit Report issued in your name, without FICO® Score, to check if you fit within the legally established debt ratio, as your situation in the Credit Bureau could impact the credit applicant's (legal entity) ability to repay the loan. To obtain the Credit Report, Banca Transilvania SA will send to the Credit Bureau your name, surname, and personal numeric code.
5. FICO® Score from the Credit Bureau
Personal data provided at point (4) may be processed by the Credit Bureau, including to calculate, at the request of Participants, the FICO® Score from the Credit Bureau.
Participants can use the FICO® Score from the Credit Bureau for the purpose of reducing the credit risk associated with a debtor/potential debtor.
FICO® Score from the Credit Bureau is a number ranging from 300 to 850, obtained following the statistical process that processes the information recorded by Participants in the Credit Bureau System and indicates the probability that the person in question will pay their installments on time in the future. The main causes that led to the decrease of the FICO® Score from the Credit Bureau are displayed in the form of reason codes.
FICO® Score from the Credit Bureau takes into account the following elements that provide predictability: payment history, current debt, duration of the credit account/accounts (the average number of months since the credits were granted), demand for new credits (the number of inquiries and credits granted in the last 6 months), credit mix (types of credits granted), age of the person concerned. The influence of these elements on the value of the FICO® Score from the Credit Bureau may vary depending on the information recorded at the Credit Bureau for each person concerned.
FICO® Score from the Credit Bureau represents a highly predictive analysis tool which, combined with the data from the Credit Report and information obtained by Participants from other sources, contributes to the accurate assessment of the creditworthiness of the person concerned in order to conclude/execute the credit agreement.
6. Data recipients
Personal data recorded in the Credit Bureau System are disclosed to Participants, upon request, for the purpose mentioned in point (2).
Personal data processed in the Credit Bureau System will not be disclosed to third parties, except for authorities and public institutions, according to their competencies and applicable legislation, such as the National Supervisory Authority for Personal Data Processing, the National Bank of Romania, the National Integrity Authority, judicial courts, public notaries, judicial executors, criminal investigation bodies.
7. Storage period
Personal data are stored at the Credit Bureau and disclosed to Participants for 4 years from the date of update, except for the data of credit applicants who have withdrawn the credit application or who were not granted credit, which are stored and disclosed to the Participants for a period of 6 months.
8. The rights of the data subjects regarding the processing of personal data
As a data subject, you can exercise your rights provided by the Regulation as follows:
a. the right of access to data can be exercised:
- by a written, signed request, sent by mail to the Credit Bureau, or
- by securely accessing the Credit Bureau website (www.birouldecredit.ro), or
- personal or electronically, to the Participant who holds the status of your creditor/potential creditor
At the same time, you have the right to obtain, upon request, at the time of communication of the credit decision, a copy of the Credit Report issued by the Credit Bureau, which was used by Banca Transilvania S.A. in the analysis of the credit application;
b. the right to data rectification ,
c. the right to data deletion ,
d. the right to data restriction ,
e. the right to object to processing, including automated individual decision-making,
can be exercised:
- by securely accessing the Credit Bureau website (www.birouldecredit.ro), or
- personal or electronically, to the Participant who holds the status of creditor/potential creditor of the data subject.
f. the right to address the National Authority for the Supervision of Personal Data Processing and the judiciary.
9. The contact details of the data protection officers are:
- For Banca Transilvania S.A.– e-mail address dpo@btrl.ro
- For the Credit Bureau - email address rpd@birouldecredit.ro
This is a specific information note regarding the processing of your personal data for the preliminary analysis of a credit request/analysis of a credit application addressed to BT by the credit applicant. The provisions of this note are supplemented by General information note regarding the processing and protection of personal data belonging to BT Clients, in which you also find presented the other purposes for which your data is processed, as a BT client. The general information note is an integral part of the BT Privacy Policy, found on the website www.bancatransilvania.ro, including in the Privacy Hub section of the website, and can be obtained upon request at any BT unit.
1. The identity of the operator
Transilvania Bank S.A., headquartered in Cluj-Napoca city, Calea Dorobanților street, no. 30-36, Cluj county processes your personal data as a data controller for the purpose of pre-analyzing a request/analyzing a credit application addressed to the bank by the credit applicant.
2. Legal basis and purpose of processing
For the purpose of pre-analyzing a request / analyzing a credit application addressed to BT by the credit applicant, according to the need to conduct responsible lending activity, in addition to processing your personal data in the Credit Bureau S.A. system (as applicable, see footnote no. 2) - about which you were informed at point I. of this information - BT also processes these data in its own records and in other external records, based on the legal obligations it must comply with, the conclusion of the credit agreement, and on the basis of its legitimate interest.
3. The obligation to provide data and the consequences of non-compliance with it
Providing personal data is necessary for the purpose mentioned in point II. (2). Refusal to provide the personal data necessary to achieve this purpose would prevent the bank from fulfilling its legal obligations in connection with granting the credit, so the credit applicant's request, the legal entity, cannot be analyzed.
4. Categories of personal data processed in BT records and, where appropriate, in other external records
The categories of personal data from point I. (4), as applicable (see footnote no. 2) and II. (5) in this information, as well as other personal data belonging to you, collected in the credit application/request addressed to BT by the credit applicant, are processed by BT for the pre-analysis/analysis of the applicant’s credit application/request. These data (usually the name, first name and/or Personal Numerical Code) may be verified, as applicable, - in public databases such as websites - the courts portal, ONRC etc. or private (e.g. related to the International Sanctions Regime).
5. The existence of an automated decision-making process, including profiling created through the BT scoring application [3]
For the purpose of objectively verifying the fulfillment of eligibility conditions for the preliminary review of a request / analyzing some of the credit applications submitted by legal entities of certain types (see footnote 3 of part I of the information note), BT processes the data of some of the data subjects based on its legitimate interest [4] in own automatic system ("BT scoring application").
In the BT scoring application, data and information about the credit applicant are entered and analyzed, as well as the following categories of personal data of the data subject: Personal Numeric Code (CNP), date of birth, country of residence, existence of entries in Sanctions Regimes databases, the status and, if applicable, the seniority of the status as a BT client, as well as, in the case of clients in the medical sector, specialty, grade, held position. These data are automatically analyzed within the scoring application, which issues a score based on a profile of the debtor/potential debtor, thus determining the credit risk and the likelihood of timely repayment of installments in the future.
Based on this issued score, to which information resulting from checks carried out in the Bank's own records is added, -such as those regarding the level of monthly income- and in public databases such as websites - the courts' portal, ONRC, etc. - BT determines whether the eligibility conditions provided in its internal regulations are met and will make the decision to approve or reject the credit applicant's request, a decision that is based on the analysis carried out by the bank employees (human intervention).
By exception, we will make the credit application approval/rejection decision through exclusively automated means only in specific cases, namely when the application is submitted online and it is essential to provide the credit applicant with a response within a very short time frame; in this case, making the decision through exclusively automated means is necessary to be able to quickly analyze the application and, if applicable, to conclude the credit agreement.
[3] The scoring application is used only in the case of legal entities of the SME type, as this category is defined according to the internal regulations of the Bank
[4] If you have the status of, as the case may be: partner/ shareholder with the largest share, legal representative, the real beneficiary of the credit applicant
6. Data recipients
In addition to the recipients mentioned in point I.(6) of this notice, the personal data processed for the purpose indicated in point II.(2) are disclosed, as appropriate, to the following recipients: Credit Bureau S.A. (for checking your situation in the records of this institution), insurance companies, appraisers (in the case of loans for which an evaluation of the goods brought as collateral is carried out), providers of certain services used by Banca Transilvania S.A. within the process of analyzing the credit application, companies (funds) guaranteeing certain types of loans, such as: FNGCIMM, FGCR, or APIA, to whom - when acting on the personal data for purposes and by means established jointly with the bank, as associated operators - we disclose certain personal data under the conditions of agreements concluded according to the law, by which we have mutually committed to ensure adequate protection of personal data and respect your rights regarding the processing of these data, rights that you can exercise both at the bank and at the bank's associated operator.
7. Storage period
The personal data filled in the credit application are kept in the records of Transilvania Bank for legally established limited periods (e.g. according to financial accounting legislation) or internal periods.
8. The rights of the data subjects regarding the processing of personal data
For exercising the rights (the right of access to data, the right to rectification of data, the right to data erasure, the right to restriction of data, the right to object to processing) provided by the Regulation regarding the processing of personal data in the Credit Bureau S.A. system in relation to Banca Transilvania S.A. you may use any of the methods indicated in section I point (8) of this information.
If you exercise these rights at Banca Transilvania S.A. (both for the processing of personal data in the Credit Bureau S.A. system and within Banca Transilvania S.A.), you can send your written request to the address in Cluj-Napoca Municipality, Calea Dorobanților Street, no. 30-36, Cluj County, with the mention - "to the attention of the Data Protection Officer (DPO)" or electronically to the e-mail address dpo@btrl.ro.
You also have the right to address the National Authority for the Supervision of Personal Data Processing.
Banca Transilvania S.A., as a credit institution, is subject to legal obligations to establish and analyze its exposure to groups of connected clients, as part of the credit risk analysis.
For this purpose, it is necessary to use information about persons with whom you form the same debtor group, as you are clients connected to each other. Your husband/wife is always a person connected to you.
Besides spouse, there may be other natural or legal persons together with whom you are part of the same group of debtors. To check if and with whom you have such linked relationships, we will query your data in our internal records and in public ones (e.g. ONRC).
To understand what categories of people are considered to be connected with you, we recommend that you study the details available within BT Privacy Policies, from our website www.bancatransilvania.ro, at section C point 3 or at the following link: https://www.bancatransilvania.ro/Informare-Apartenenta-la-Grupuri-Credit-Online.pdf. And the people who are in contact with you can find out information about how we process their data for this purpose, from the same section of the BT Privacy Policy.
As the reporting person, BT has the legal obligation to report these exposures and the composition of the debtor client groups connected to BNR, CRC (only where applicable) and, based on its legitimate interest, may disclose this data also to entities within the Banca Transilvania Financial Group and service providers used by BT within the credit application analysis process.
Your refusal to have these data processed may make it impossible for BT to analyze the request and/or approve the loan for the loan applicant.
The retention period of data of these persons in the BT records is equal to that of the existence of a group/groups of clients connected of which they are part, plus reasonable storage periods.
C. Information regarding the processing of personal data on the occasion of concluding and during the execution of a credit contract contracted by legal entity clients from Banca Transilvania S.A.
If the credit application addressed to the bank by the credit applicant is approved, we inform you further how we will process your data on the occasion of concluding (signing with electronic signature) and during the execution of the credit agreement.
This is a specific information note regarding the processing of personal data for the purpose of concluding and carrying out a credit contract. The provisions of this note are complemented by the General information note on the processing and protection of personal data belonging to BT Clients, in which all the other purposes for which your data is processed, as a BT client, are detailed.
1. The identity of the operator
Banca Transilvania S.A headquartered in Cluj-Napoca city, Calea Dorobanţilor no. 30 – 36, Cluj county, processes as the data controller your personal data for the conclusion and execution of the credit contract concluded with the Bank and, where appropriate, of the guarantee contracts - accessories to the credit contract.
2.Legal basis and purpose of processing
For the conclusion and execution of credit contracts and, where applicable, of the guarantee contracts related thereto, the Bank processes the categories of personal data mentioned in this section at point (4), based on its legal obligations, the conclusion and execution of the contract, and on its legitimate interest.
3. The obligation to provide data and the consequences of non-compliance with it
Providing your personal data is necessary for the purpose mentioned at point (2). Refusal to have your personal data processed, necessary to achieve the mentioned purpose, will lead to the Bank's inability to offer the requested loan.
4. Categories of processed personal data
Personal data processed by the Bank for the purpose mentioned in point (2) are those of which you have been informed that they are processed within the pre-offer/request analysis stage of the credit application, to which other such data that have been completed and/or received on the occasion/for the conclusion of the credit agreement, together with its accessories, are added.
5. Data recipients
The personal data processed for the purpose mentioned in point (2) are disclosed or transferred in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and data security, to the following categories of recipients - insurance companies, appraisal companies, service providers used by the Bank within the lending process, debt collection companies, OCPI, RNPM, public authorities and institutions, public notaries, lawyers, judicial executors, Credit Risk Central*, companies (funds) guaranteeing various types of credit products, such as: FNGCIMM, FGCR or APIA, to whom - when they act on personal data for purposes and by means established jointly with the bank, as joint controllers - we disclose certain personal data under the conditions of agreements concluded in accordance with the law, through which we have mutually committed to ensure the adequate protection of personal data and respect of your rights regarding the processing of these data, rights which you can exercise both at the bank and at the operator associated with the bank.
*The bank has the legal obligation to report to the Credit Risk Central (CRC) the credit risk information for each debtor who meets the condition to be reported (includes the identification data of a debtor, either a natural person or a non-banking legal entity, and the operations in local currency and foreign currency through which the bank is exposed to risk against that debtor), as well as to have recorded an individual risk towards that debtor, as well as information about detected card frauds.
6. Duration of personal data storage
The personal data processed for the purpose indicated in point (2) are stored in the Bank's records for a period of 5 years from the termination of the business relationship.
In the records of the Credit Risk Central, the data reported under the legal obligation of the Bank, namely credit risk information and information about card frauds, are maintained for a period of 7 years from the date of registration.
7. Rights of the data subjects regarding the processing of personal data
As a data subject, you can exercise the rights provided by EU Regulation 679/2016 - the General Data Protection Regulation: the right of access, the right to rectification of data, the right to erasure of data, the right to restriction of data, the right to object to processing, as well as the right to address the National Authority for the Supervision of Personal Data Processing and the judiciary.
These rights can be exercised by submitting a written request to the address in Cluj-Napoca City, Calea Dorobanților Street, no. 30-36, Cluj County, with the mention – "attn: Data Protection Officer (DPO)" or electronically at the email address dpo@btrl.ro.
D. Information regarding the processing of personal data for the purpose of issuing and managing the Qualified Digital Certificate issued to the User by Alfatrust Certification S.A. for signing documentation in relation to BT
If you want to obtain a BT PJ online loan, it will be necessary to sign the loan documentation with a qualified electronic signature. Issuing and using the digital certificate for signing involves no costs for you, but it is necessary for BT and Alfatrust to jointly process, as associated operators, personal data concerning you for the issuance of this electronic signature.
You can find detailed information below about the processing of your data for this purpose.
1. Operators of personal data
Under art. 13-14 of EU Regulation 679/2016 - General Data Protection Regulation ("GDPR"), Alfatrust Certification S.A. ("Alfatrust") and Banca Transilvania S.A. ("BT") inform you regarding the processing of your personal data, as a User ("data subject"), which they carry out as joint controllers for the purpose mentioned in point b of this notice.
2. Purpose and legal basis of the processing of personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate ("the Certificate").
BT is the operator that identifies the User, respectively collects from them the personal data necessary for issuing the Qualified Digital Certificate, and transmits them to Alfatrust for this operator to issue the certificate.
The data that BT collects from Users are those processed by BT in its own records, in the context of the business relationship that is already established between the User and BT at the time of transmitting the data to Alfatrust.
During the validity period of the certificate, the personal data are processed by the associated operators, as appropriate, as well as in situations where Users request the suspension or revocation of the certificate in the manners detailed in the Terms and Conditions of service provision.
The legal grounds for processing personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit. c GDPR), conclusion/performance of the contract (Art. 6 para. 1 lit. b GDPR), and the legitimate interest of the associated operators (Art. 6 para. 1 lit. f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User has established a business relationship, and Alfatrust - as an accredited certification service provider from whom the User wishes to obtain a certificate, are subject to legal provisions applicable in the field of preventing money laundering and financing terrorism according to which they must collect from clients a series of personal data. These data are also necessary for the conclusion/execution of the contract under which the User is allowed to use the certificate for signing documentation related to BT.
To support Users who wish to submit a request for suspension or withdrawal of the certificate, the associated operators justify a legitimate interest in offering them (who are also BT clients) the possibility to send these requests not only directly to Alfatrust, but also through BT. The resolution of these requests involves the exchange of Users' personal data between the two associated operators.
Contact details - phone number and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.
3. Categories of personal data and of persons whose personal data are processed
Personal data processed for the purpose of fulfilling the mentioned objective are those provided by law as mandatory to be collected by a credit institution, respectively by a certification services provider for the prevention of money laundering and terrorism financing, namely: name, first name, personal numerical code (CNP), home/residence address, identity document validity date, phone number, copy of the identity document. All these data, as provided by the User to BT, will be transmitted to Alfatrust for the issuance and management of the Qualified Digital Certificate.
Processing this personal data is necessary for generating the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate.
The persons targeted by this processing are only the Users, as they are defined in the Terms and Conditions of Use of Alfatrust.
4. Recipients of personal data
Except for the associated operators between whom there will be an exchange of personal data processed for the fulfillment of the processing purpose, the data are disclosed, as the case may be, to IT service providers, auditors, authorities and institutions entitled to know them.
5. The period of processing personal data
Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiry, in accordance with the legally established terms.
At BT level, the remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship runs between the User and BT, to which the terms established in the applicable legislation are added.
6. Rights of the data subjects concerning the processing of their personal data
To any User, in their capacity as a data subject, the exercise of the following rights regarding the processing of their personal data by any of the associated operators is guaranteed: the right of access, the right to rectification, the right to restriction of processing, the right to erasure of data, the right to object to data processing, the right to data portability.
Users can exercise these rights or address the data protection officers for any questions/requests regarding the processing of your personal data, as follows:
- at Banca Transilvania S.A. - by message sent to the e-mail address dpo@btrl.ro or by a request sent to the bank's address in Cluj-Napoca city, Cale Dorobanților Street no. 30-36, Cluj county, with the mention "to the attention of the data protection officer (DPO)"
- to Alfatrust Certification S.A.- by message sent to the email address suport@alfasign.ro or by a request sent to the Alfatrust headquarters, with the mention "attention to the person responsible for data protection (DPO)"
Users also have the right to lodge a complaint with the supervisory authority - the National Supervisory Authority for Personal Data Processing (ANSPDCP), with headquarters in Bucharest, sector 1, Gen. Gh. Magheru Blvd. no. 28-30.
