Who is the personal data operator?
Who is the personal data operator?
BANCA TRANSILVANIA S.A. (hereinafter "the bank" or "BT") credit institution, Romanian legal entity, with identification and contact details presented in section III of General information note concerning the processing and protection of personal data belonging to BT Clients, offers certain categories of BT corporate clients current account holders the possibility to obtain an online loan (hereinafter also referred to as "BT PJ online credit").
In this context, BT processes personal data ("personal data") of natural persons who represent the legal entity or are the real beneficiaries or associates/shareholders thereof, including from the perspective of these persons as guarantors and/or sureties. If you have any of these qualities, you are a data subject of this processing. In the general information note mentioned above, which is an integral part of BT Privacy Policy from the site www.bancatransilvania.ro, found and distinct in the section Privacy Hub, you find the definition of BT Client, detailed information about your rights regarding the processing of personal data and the ways in which you can exercise them, and about the possibility of contacting the data protection officer appointed by BT (BT DPO).
When you apply for obtaining and, as appropriate, conclude on behalf of the legal entity (hereinafter also referred to as "the credit applicant") an online BT PJ loan, we process your personal data for multiple purposes and legal grounds, either as the sole data controller or, as appropriate, together with other associated controllers, as we present to you below.
On what legal grounds do we process the data and what happens if you refuse their processing?
On what legal grounds do we process the data and what happens if you refuse their processing?
We process your personal data on the following legal grounds:
- the legal obligations to which BT is subject through various normative acts,
- the signing/execution of the credit contract or the completion of the necessary steps for its conclusion,
- our legitimate interest and/or that of third parties, (e.g. the interest of fraud prevention or the legitimate interest of consulting your situation in the records of the Credit Bureau SA for assessing your creditworthiness or consulting the situation of the legal entity you represent in the Credit Risk Center – “CRC”; the legitimate interest of contacting you to provide support for completing the online application and to ask for your opinion about the application process),
- your consent, if it is necessary for you to we verify identity based on biometric data (facial recognition).
When the law obliges us to process personal data or when they are necessary for concluding the credit contract, if you refuse their processing, we will not be able to analyze your request.
For processing based on the legitimate interest of BT or third parties, refusing to have your data processed may make it impossible to analyze your request or obtain BT PJ online credit.
For data processing for which your consent is required, we will request this agreement from you at the appropriate time in the online application flow. If you refuse to give this consent, you cannot obtain the BT PJ credit online, but you have the option to apply for it at a BT branch.
By continuing the application process, you express your consent for consulting the status of the legal entity you represent in the CRC records and you assume that you will sign the dedicated form with an electronic signature obtained according to the mentions from point D of this information note after the inquiry.
For what purposes do we process personal data, what data is it, for how long do we keep it, and to whom can we disclose it?
For what purposes do we process personal data, what data is it, for how long do we keep it, and to whom can we disclose it?
In the following lines, we present to you distinctly the purposes for which we will process personal data so that you can apply and, where appropriate, contract for the legal entity you represent an online BT PJ loan. Depending on the purpose of processing, we will present information about the data retention period, categories of data recipients, the existence of automated decision-making processes, as well as the rights you enjoy.
A. Personal data processed for identity verification, in order to prevent fraud, money laundering, and terrorism financing, to contact you for the purpose of providing support or assessing the quality of this BT service, as well as for the valid application/conclusion of the credit contract
The applicable legislation requires us to verify the identity of the persons with whom we are to conclude contracts/who represent the legal entity. At the same time, we have a legitimate interest in preventing attempts of fraud by identity theft in the online environment.
For verifying your identity, they will use the login data in BT Go and other personal data from BT records (e.g. quality, holdings, and powers of representation within the legal entity). To ensure that the information we have about you is correct and up to date, we will compare the data from your identity document in BT records with those from your identity document from the General Directorate for Personal Records - D.G.E.P. - (see here details about the processing of data provided by D.G.E.P.).
B. Personal data processed for the analysis of the credit application submitted by the credit applicant (legal entity), including automated decision-making processes based on profilingi[1]
To analyze the request for application of the legal entity for a BT PJ online loan, we process your personal data in the internal BT records and in the Credit Bureau records, where we check your situation. All information related to this processing can be found below, in points I and II of this section B[2].
Being essential to provide you with a quick response to your online credit request, we will take the decision of approval/rejection of the request by processing personal data exclusively through automated means. Details about this decision can be found in point II (5) below.
[1] This information is valid throughout the entire duration of the business relationship of the credit applicant (legal entity) with Banca Transilvania, being applicable whenever this applicant submits a credit request/application to the bank (including in the case of supplementation/extension/restructuring of an existing credit), if you hold one of the mentioned roles within the applicant (legal representative/partner/shareholder, potentially: co-debtor/guarantor/endorser/surety/ultimate beneficiary). You will be provided with a new information of this type in case of substantial changes to the provisions of this information or upon your express request. This information is also publicly available on the bank's website www.bancatransilvania.ro, in the Privacy Hub section - the specific information notes subsection or, upon request, at any BT unit;
[2] Your personal data will be consulted in the Credit Bureau (respectively, the provisions from part I of this information apply to you) only if you qualify as: guarantor/co-debtor/endorser/avalist within a request/application for credit addressed to BT by the legal entity credit applicant
Identification data of the operators
Banca Transilvania S.A., with headquarters in Cluj-Napoca city, Calea Dorobanților street, no. 30-36, Cluj county and the company Biroul de Credit S.A., a Romanian legal entity with headquarters in Bucharest, Sfânta Vineri street, no. 29, 4th floor, sector 3, as associate operators, process your personal data, in good faith, in a fair and transparent manner, for specific and legitimate purposes, in accordance with the provisions of Regulation (EU) No 679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the Regulation).
The Credit Bureau SA is the private law entity that manages the Credit Bureau System, in which personal data related to the lending activity carried out by Participants are processed.
Participants in the Credit Bureau System are credit institutions, non-bank financial institutions, insurance companies, and debt collection companies, which have signed a Participation Agreement with the Credit Bureau.
2. Legal basis and purpose of processing
Banca Transilvania S.A. and the Credit Bureau processes your personal data based on the legitimate interest of the Participants and the Credit Bureau for conducting responsible credit activities, under the conditions of protecting, facilitating access to credit, and preventing the excessive indebtedness of the data subjects, complying with the legal framework regarding creditworthiness assessment and risk reduction, as well as preventing the use of the financial-banking system for carrying out activities contrary to the law.
Banca Transilvania S.A. are the obligation, according to the legal regulations in force, to assess your credit repayment capacity before concluding a credit agreement and during its term. For this purpose, Banca Transilvania S.A. processes the information indicated at point (4), registered in your name in its own records and transmits them to the Credit Bureau for processing by this institution and for consultation by any Participant, for the purpose of initiating or carrying out a credit relationship, as well as securing credit-type products.
3. The obligation to provide data and the consequences of non-compliance with it
Providing your personal data is necessary for the purpose mentioned in point (2). Refusal to provide your personal data, necessary to achieve the above-mentioned purpose, will result in the inability Transilvania Bank S.A. to fulfill its legal obligations in connection with granting the credit.
4. Categories of personal data processed in the Credit Bureau system
a. identification data of the data subject: name, first name, personal numerical code, or CUI for authorized natural persons or CIF for natural persons practicing liberal professions or country code and passport series/number for non-resident persons, domicile/residence address, telephone number, date of birth;
b. data relating to the employer: the employer's name and address, the date of recording this information, VAT number;
c. data related to the requested/granted credit-type products : the type and name of the Participant, product type, product/account status, grant date, account duration, amounts granted, amounts owed, update date, currency, payment frequency, amount paid, monthly rate, outstanding amounts, number of days overdue, date of first delinquency, delinquency category, date of last payment;
d. data related to events occurring during the term of the credit-type product , such as those related to restructuring/refinancing, payment in kind, assignment of the loan agreement, assignment of the debt;
e. data regarding relationships with other accounts: information relating to credit-type products for which the data subject has the status of co-debtor and/or guarantor;
f. data related to insolvency: information regarding the persons concerned against whom insolvency proceedings have been opened;
g. number of inquiries: indicates the number of Credit Reports issued by the Credit Bureau, at the request of one or more Participants;
In the process of pre-analysis of the request/applicant's credit application analysis, Banca Transilvania SA will request from the Credit Bureau the issuance of a Credit Report issued in your name, without FICO® Score, to verify if you fit into the indebtedness degree established by law, as your situation in the Credit Bureau could impact the credit applicant's (legal entity) ability to repay the loan. To obtain the Credit Report, Banca Transilvania SA will transmit your name, surname, and personal numerical code to the Credit Bureau.
5. FICO® Score from the Credit Bureau
Personal data provided at point (4) may be processed by the Credit Bureau, including to calculate, at the request of the Participants, the FICO® Score from the Credit Bureau.
Participants can use the FICO® Score from the Credit Bureau for the purpose of reducing the credit risk associated with a debtor/potential debtor.
FICO® Score from the Credit Bureau is a number between 300 and 850, obtained following the statistical process that processes the information recorded by Participants in the Credit Bureau System and indicates the probability that the targeted person will pay their installments on time in the future. The main causes that led to the decrease of the FICO® Score from the Credit Bureau are displayed in the form of reason-codes.
FICO® Score from the Credit Bureau takes into account the following elements that provide predictability: payment history, current debt, the duration of the credit account/accounts (average number of months since the credits were granted), the request for new credits (the number of inquiries and credits granted in the last 6 months), the credit mix (types of credits granted), the age of the person concerned. The influence of these elements on the value of the FICO® Score from the Credit Bureau may vary depending on the information recorded at the Credit Bureau for each person concerned.
FICO® Score from the Credit Bureau represents a highly predictive analysis tool that, alongside data from the Credit Report and information obtained by Participants from other sources, contributes to the accurate assessment of the creditworthiness of the targeted person for the purpose of concluding/executing the credit agreement.
6. Recipients of the data
Personal data registered in the Credit Bureau System are disclosed to Participants, upon request, for the purpose mentioned in point (2).
Personal data processed in the Credit Bureau System will not be disclosed to third parties, except for authorities and public institutions, according to their competences and applicable legislation, such as the National Authority for the Supervision of Personal Data Processing, the National Bank of Romania, the National Integrity Authority, courts of law, notaries public, judicial executors, criminal investigation bodies.
7. Storage period
Personal data is stored at the Credit Bureau and disclosed to the Participants for 4 years from the date of update, except for the data of credit applicants who have withdrawn the credit application or were not granted the credit, which are stored and disclosed to Participants for a period of 6 months.
8. Rights of the data subjects regarding the processing of personal data
As a data subject, you can exercise your rights provided by the Regulation, as follows:
a. the right of access to data can be exercised:
- by a written, signed request, sent by mail to the Credit Bureau, or
- by securely accessing the Credit Bureau website (www.birouldecredit.ro), or
- personal or electronically, to the Participant who holds the status of creditor/potential creditor of yours
You also have the right to obtain, upon request, at the time of communicating the credit decision, a copy of the Credit Report issued by the Credit Bureau, which was used by Banca Transilvania S.A. in the analysis of the credit application;
b. the right to data rectification,
c. the right to erasure of data,
d. the right to restriction of data ,
e. the right to object to processing, including automated individual decision-making,
can be exercised:
- by securely accessing the Credit Bureau website (www.birouldecredit.ro), or
- personal or electronically, at the Participant who holds the status of creditor/potential creditor of the data subject.
f. the right to address the National Authority for the Supervision of Personal Data Processing and the judiciary.
9. The contact details of the data protection officers are:
- For Banca Transilvania S.A.– e-mail address dpo@btrl.ro
- For the Credit Bureau - email address rpd@birouldecredit.ro
This is a specific information note, regarding the processing of your personal data for the preliminary analysis of a credit request/analysis of a credit application addressed to BT by the credit applicant. The provisions of this note are supplemented by General information note concerning the processing and protection of personal data belonging to BT Clients, in which you will find presented the other purposes for which your data is processed, as a BT client. The general information note is an integral part of the BT Privacy Policy, found on the website www.bancatransilvania.ro, including in the Privacy Hub section of the website, and can be obtained on request at any BT unit.
1. Operator's identity
The Transilvania Bank S.A., headquartered in Cluj-Napoca city, Calea Dorobanților street, no. 30-36, Cluj county processes your personal data as a data controller for the purpose of pre-analyzing a request/analyzing a credit application addressed to the bank by the credit applicant.
2. The legal basis and purpose of processing
For the purpose of pre-analyzing a request/analyzing a credit application addressed to BT by the credit applicant, according to the need to conduct a responsible lending activity, besides processing your personal data in the system of Credit Bureau S.A. (if applicable, see footnote no. 2) - about which you were informed at point I. of this notice - BT processes these data in its own records and in other external records, based on the legal obligations it must comply with, the conclusion of the credit contract and on the basis of its legitimate interest.
3. The obligation to provide data and the consequences of non-compliance with it
The provision of personal data is necessary for the purpose mentioned in point II. (2). Refusal to provide the personal data necessary for achieving this purpose would prevent the bank from fulfilling its legal obligations in connection with granting the credit, so the applicant's request, the legal entity, will not be able to be analyzed.
4. Categories of personal data processed in BT records and, where applicable, in other external records
Categories of personal data from point I. (4), as applicable (see footnote no. 2) and II. (5) of this information, as well as other personal data belonging to you, collected in the credit request/application addressed to BT by the credit applicant, are processed by BT for the pre-analysis/analysis of the credit request/application of the applicant. These data (usually the name, first name, and/or personal numerical code) may be verified, as applicable, in public databases such as the websites - portal of courts, ONRC etc. or private (e.g. related to the International Sanctions Regime).
5. The existence of an automated decision-making process, including profiling created through the BT scoring application[3]
In order to objectively verify the fulfillment of the eligibility conditions for the pre-analysis of a request/analyzing some of the credit applications addressed by legal entities of certain types (see footnote 3 of part I of the information note), BT processes based on its legitimate interest the data of some of the targeted persons[4] in a proprietary automatic system ("the BT scoring application").
In the BT scoring application, data and information about the credit applicant are entered and analyzed, as well as the following categories of personal data of the data subject: personal identification number (CNP), date of birth, country of residence, existence of entries in sanction regime databases, the status and, if applicable, the length of the status as a BT client, as well as, in the case of clients from the medical sector, specialty, grade, and held position. These data are automatically analyzed within the scoring application, which issues a score based on a profile of the debtor/potential debtor, thus determining the credit risk and the likelihood of timely future payment of installments.
Based on this issued score, to which information resulting from checks carried out in the Bank's own records is added - such as those regarding the level of monthly incomes - and in public databases such as the websites - the courts' portal, ONRC, etc. - BT determines whether the eligibility conditions provided in its internal regulations are met and will make the decision to accept or reject the loan applicant's request, a decision that is based on the analysis carried out by the bank's employees (human intervention).
By exception, we will make the decision to approve/reject the credit application exclusively through automated means only in specific cases, namely when the application is made online and it is essential to provide the credit applicant with a response within a very short time frame, in which case making the decision through exclusively automated means is necessary to be able to quickly analyze the application and, as the case may be, to conclude the credit agreement.
[3] The scoring application is used only in the case of legal entities of the SME type, as this category is defined according to the internal regulations of the Bank
[4] If you have the status of, as applicable: associate/ shareholder with the largest participation, legal representative, the real beneficiary of the credit applicant
6. Recipients of the data
In addition to the recipients mentioned in point I.(6) of this notice, the personal data processed for the purpose indicated in point II.(2) are disclosed, as appropriate, to the following recipients: Biroul de Credit S.A. (for consulting your situation in the records of this institution), insurance companies, appraisers (in the case of loans for which an evaluation of the collateral goods is carried out), suppliers of certain services used by Banca Transilvania S.A. in the loan application analysis process, companies (funds) guaranteeing certain types of loans, such as: FNGCIMM, FGCR or APIA, to whom - when acting on personal data for purposes and by means jointly established with the bank, as associated operators - we disclose certain personal data under the conditions of agreements concluded according to the law, through which we have mutually committed to ensuring adequate protection of personal data and respecting your rights regarding the processing of these data, rights that you can exercise both at the bank and at the operator associated with the bank.
7. Storage period
Personal data filled in the credit application are kept in the records of Banca Transilvania for legally established limited periods (e.g. according to the financial accounting legislation) or internally.
8. Rights of the data subjects regarding the processing of personal data
For exercising rights (the right of access to data, the right to rectification of data, the right to erasure of data, the right to restriction of data, the right to object to processing) provided by the Regulation regarding the processing of personal data in the Credit Bureau S.A. system in relation to Banca Transilvania S.A. you may use any of the methods indicated in section. I point (8) of this notice.
If you exercise these rights at Banca Transilvania S.A. (both for the processing of personal data in the Credit Bureau S.A. system and within Banca Transilvania S.A.), you may send your written request to the address in Cluj-Napoca City, Calea Dorobanților Street, no. 30-36, Cluj County, with the note – "to the attention of the data protection officer (DPO)" or electronically to the e-mail address dpo@btrl.ro.
You also have the right to address the National Authority for the Supervision of Personal Data Processing.
Banca Transilvania S.A., as a credit institution, is subject to legal obligations to establish and analyze its exposure to connected client groups, as part of the credit risk analysis.
For this purpose, it is necessary to use information about persons with whom you form the same debtor group, as you are clients connected. Your spouse is always a person connected with you.
In addition to spouse, there may also be other individuals or legal entities together with whom you are part of the same group of debtors. To verify if and with whom you have such connected relationships, we will query your data in our internal records and in public ones (e.g. ONRC).
To understand which categories of people are considered to be connected to you, we recommend that you study the details available within BT Privacy Policies, from our website www.bancatransilvania.ro, at section C point 3 or at the following link: https://www.bancatransilvania.ro/Informare-Apartenenta-la-Grupuri-Credit-Online.pdf. And the persons who are in contact with you can find out information about how we process their data for this purpose, from the same section of the BT Privacy Policy.
As the reporting person, BT has the legal obligation to report these exposures and the composition of debtor client groups in connection to BNR, CRC (only where applicable), and, based on its legitimate interest, may disclose this data also to entities within the Banca Transilvania Financial Group and service providers used by BT during the credit application analysis process.
Your refusal to have this data processed may result in BT being unable to analyze the request and/or approve the loan for the loan applicant.
The data retention period for these persons in BT's records is equal to that of the existence of a group/groups of clients connected to which they belong, plus non-excessive storage periods.
C. Information regarding the processing of personal data on the occasion of concluding and during the course of a credit contract contracted by legal entity clients from Banca Transilvania S.A.
If the credit application addressed to the bank by the credit applicant is approved, we inform you further how we will process your data on the occasion of concluding (signing with electronic signature) and during the term of the credit agreement.
This is a specific information note regarding the processing of personal data for the purpose of concluding and executing a credit contract. The provisions of this note are supplemented by the General Information Note on the processing and protection of personal data belonging to BT Clients, in which you will find detailed presentation of all other purposes for which your data is processed, as a BT client.
1. Operator's identity
Transilvania Bank S.A headquartered in Cluj-Napoca, Dorobanţilor Road no. 30 – 36, Cluj county, processes your personal data as data controller for the conclusion and execution of the loan agreement concluded with the Bank and, where appropriate, of the guarantee contracts - accessories to the loan agreement.
2.Legal basis and purpose of processing
For the conclusion and execution of credit contracts and, if applicable, of the related guarantee contracts, the Bank processes the categories of personal data mentioned in this section at point (4), based on its legal obligations, the conclusion and execution of the contract, and on its legitimate interest.
3. The obligation to provide data and the consequences of non-compliance with it
Providing your personal data is necessary for the purpose mentioned in point (2). Refusal to have your personal data processed which is necessary to achieve the mentioned purpose will result in the Bank being unable to offer the requested credit.
4. Categories of personal data processed
Personal data processed by the Bank for the purpose mentioned in point (2) are those about which you have been informed that they are processed during the pre-offering/credit application analysis stage, to which other such data that were completed and/or received on the occasion of/for the conclusion of the credit agreement, together with its accessories, are added.
5. Data recipients
The personal data processed for the purpose mentioned in point (2) are disclosed or transferred in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and data security, to the following categories of recipients - insurance companies, evaluation companies, service providers used by the Bank within the lending process, debt collection companies, OCPI, RNPM, public authorities and institutions, notaries public, lawyers, bailiffs, Credit Risk Center*, companies (funds) guaranteeing various types of credit products, such as: FNGCIMM, FGCR or APIA, to whom - when acting on personal data for purposes and by means established jointly with the bank, as associated operators - we disclose certain personal data under the conditions of agreements concluded according to the law, by which we have mutually committed to ensure the proper protection of personal data and respect your rights regarding the processing of these data, rights which you can exercise both at the bank and at the operator associated with the bank.
*The bank has the legal obligation to report to the Credit Risk Central (CRC) the credit risk information for each debtor who meets the condition to be reported (includes the identification data of a debtor, natural person or non-banking legal entity, and the transactions in lei and foreign currency through which the Bank is exposed to risk with respect to that debtor), as well as to have recorded an individual risk towards that debtor, as well as information about detected card frauds.
6. The duration of personal data storage
The personal data processed for the purpose indicated in point (2) are stored in the Bank's records for a period of 5 years from the termination of the business relationship.
In the records of the Credit Risk Central, the data reported based on the legal obligation that the Bank has, namely credit risk information and information about card frauds are kept for a period of 7 years from the date of registration.
7. The rights of data subjects regarding the processing of personal data
As a data subject, you can exercise the rights provided by EU Regulation 679/2016 - the General Data Protection Regulation: the right of access, the right to rectification of data, the right to data erasure, the right to data restriction, the right to object to processing, as well as the right to address the National Authority for the Supervision of Personal Data Processing and the judiciary.
These rights may be exercised by submitting a written request to the address in Cluj-Napoca City, Calea Dorobanților Street, no. 30-36, Cluj County, with the mention – "attention to the data protection officer (DPO)" or electronically to the e-mail address dpo@btrl.ro.
D. Information regarding the processing of personal data for the purpose of issuing and managing the Qualified Digital Certificate issued to the User by Alfatrust Certification S.A. for signing documentation in relation to BT
If you want to obtain a BT PJ loan online, you will need to sign the loan documentation with a qualified electronic signature. The issuance and use of the digital certificate for signing does not entail any costs for you, but it is necessary for BT and Alfatrust to jointly process, as associated operators, personal data concerning you for the issuance of this electronic signature.
You can find detailed information below about the processing of your data for this purpose.
1. Operators of personal data
Based on articles 13-14 of EU Regulation 679/2016 - General Data Protection Regulation (“GDPR”), Alfatrust Certification S.A. (“Alfatrust”) and Banca Transilvania S.A. (“BT”), inform you regarding the processing of your personal data, as User (“data subject”), carried out by them as joint controllers for the purpose mentioned within letter b of this information.
2. The purpose and legal basis of processing personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate ("Certificate").
BT is the operator that identifies the User, respectively collects from them the personal data necessary for issuing the Qualified Digital Certificate, and transmits it to Alfatrust for this operator to issue the certificate.
The data that BT collects from Users are those processed by BT in its own records, in the context of the business relationship that is already established between the User and BT at the time of transmitting the data to Alfatrust.
During the validity period of the certificate, personal data is processed by the associated operators, as appropriate, as well as in situations where Users request the suspension or revocation of the certificate in the ways detailed in the Terms and conditions of service provision.
The legal bases for processing personal data for the defined purpose are the legal obligation (art. 6 para. 1 lit. c GDPR), the conclusion/performance of the contract (art. 6 para. 1 lit. b GDPR), and the legitimate interest of the associated operators (art. 6 para. 1 lit. f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User has established a business relationship, and Alfatrust - as an accredited certification service provider from which the User wishes to obtain a certificate, are subject to the applicable legal provisions in the field of prevention of money laundering and terrorism financing, according to which they must collect a series of personal data from clients. These data are also necessary for the conclusion/performance of the contract based on which the User is allowed to use the certificate for signing documentation in relation to BT.
To support Users who wish to submit a request for suspension or withdrawal of the certificate, the associated operators justify a legitimate interest in offering them (who also have the status of BT clients) the possibility to submit these requests not only directly to Alfatrust, but also through BT. The resolution of these requests involves the exchange of personal data of the Users between the two associated operators.
Contact details - phone number and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.
3. Categories of personal data and of persons whose personal data are processed
Personal data processed for the purpose of fulfilling the mentioned objective are those provided by law as mandatory to be collected by a credit institution, or by a certification services provider for the prevention of money laundering and the sanctioning of terrorism, namely: name, surname, personal numerical code (CNP), home/residence address, validity date of the identity document, phone number, copy of the identity document. All these data, as provided by the User to BT, will be transmitted to Alfatrust for the issuance and management of the Qualified Digital Certificate.
Processing of this personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate.
The persons targeted by this processing are only the Users, as they are defined in the Terms and Conditions of Use of Alfatrust.
4. Recipients of personal data
Except for the associated operators between whom there will be an exchange of personal data processed for the fulfillment of the processing purpose, the data is disclosed, as the case may be, to IT service providers, audit providers, authorities, and institutions entitled to know them.
5. Period of processing of personal data
Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of termination of its validity, in accordance with the legally established deadlines.
At the BT level, the remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship between the User and BT is ongoing, to which the terms established in the applicable legislation are added.
6. Rights of the data subjects whose personal data are processed
To any User, in their capacity as a data subject, the exercise of the following rights regarding the processing of their personal data is guaranteed, with any of the associated operators: the right of access, the right to rectification, the right to restriction of processing, the right to erasure of data, the right to object to data processing, the right to data portability.
Users can exercise these rights or contact the data protection officers for any questions/requests regarding the processing of your personal data, as follows:
- to Banca Transilvania S.A.- by message sent to the e-mail address dpo@btrl.ro or by a request sent to the bank's address in Cluj-Napoca city, 30-36 Dorobanților Road, Cluj county, with the mention "to the attention of the data protection officer (DPO)"
- to Alfatrust Certification S.A.- through message sent to the e-mail address suport@alfasign.ro or by a request sent to the Alfatrust headquarters, with the mention "attention to the data protection officer (DPO)"
Users also have the right to file a complaint with the supervisory authority - the National Authority for the Supervision of Personal Data Processing (ANSPDCP), with headquarters in Bucharest, sector 1, General Gh. Magheru Blvd. no. 28-30.
