Information note regarding the processing in BT Pay of the personal data of minor users attached to the parent's account
Applicable version from June 14, 2024
1. About this information note
Please read this information note if:
or
- you are a parent/guardian/legal representative ("parent") of a minor who is at least 8 years old but has not yet turned 18 and you intend to allow them to use BT Pay functionalities with a card issued in their name but linked to the account opened in your name
This information should be read before a child starts installing BT Pay.
By this notice, Banca Transilvania (“BT”, “bank”) brings to the knowledge of the child and his/her parent how the child's personal data will be used in BT Pay.
When we write in this notice “personal data” or “date”, we refer to any information that identifies the child, directly or indirectly (e.g. name, first name, phone number, the transactions that the child makes through BT Pay, the child's card number etc) and when we write that we use, collect, verify, keep such data it means that we “we process”.
If you do not understand some words used in this information or have questions about how BT uses the child's data in BT Pay, you can write to us at the e-mail address dpo@btrl.ro. The person appointed at BT as responsible for personal data protection (hereinafter referred to as “BT DPO”) will assist you with answers. We recommend that the minor does not use the BT Pay services available to users in their age category if you do not understand this information.
If we modify this notification, we will announce it through messages in BT Pay. The version of this notification that applies and the date from which this version is applicable are available in BT Pay or on our website – www.bancatransilvania.ro - in the section Privacy Hub.
2. Who processes the child's personal data in BT Pay
The personal data of the minor in BT Pay are collected and used by Banca Transilvania S.A. Details about who BT is and how it can be contacted can be found in section III of General information note regarding the processing and protection of personal data belonging to BT Clients, in which BT informs its clients about how it generally uses their personal data.
3. What do we use the child's data for in BT Pay and on what grounds
We use the child's data in BT Pay for:
- fraud prevention (e.g. so that persons who do not have the right do not receive access to the child's data and money and the amounts that are in the account associated with his card);
- conclusion and execution of the contract related to the BT Pay service for minors aged 8 - 14 years;
- transmission of notifications in BT Pay (notifications of BT Pay version updates or notifications via push notifications, if the different types of notifications in BT Pay are activated);
- internal analyzes (including statistics), to analyze whether BT Pay works properly;
- archiving information and documents (keeping the data and transactions made from BT Pay at the bank);
- ensuring the security of BT Pay (BT Pay is a banking application in which we must protect the data and money of users who use this Application).
The grounds on which we process this data are, depending on the situation, those in section VII of the general information note for BT Clients, indicated above.
4. What personal data of the child do we use in BT Pay
- identification data: name, first name, personal numerical code (C.N.P.), date of birth (extracted from CNP), citizenship;
- information about the family situation – the relationship between the child and the parent who granted the right/access to use BT Pay for minors;
- age, pentru a verifica dacă minorul poate folosi BT Pay disponibil pentru categoria de vârstă 8 ani – 18 ani neîmpliniți, precum și pentru a stopa folosirea acestui serviciu când împlinește 18 ani;
- contact details: phone number (for sending unique codes to verify if the minor has access to this number and for using some services from BT Pay available to them);
- financial data: data about transactions made with the BT card issued in the child's name, data about the BT accounts to which the child's BT card registered in BT Pay is attached (although the account is opened in the parent's name, the child's card being associated with it, the transactions made through this account indirectly identify the child);
- identifiers: BT card data and IBAN codes of BT accounts (of the parent) to which the child's BT cards are linked, phone identifiers (e.g. device ID, security method, operating system type, phone model), unique codes (SMS-OTP) sent to the phone number declared at BT by the parent for the child's card, payment method chosen for BT Pay;
- information regarding the location carrying out certain transactions (e.g. when the child pays with BT Pay at certain stores, we will indirectly know that they were at the place where that store is located at the date and time when the payment was made or if they use BT Pay for cash withdrawal from BT ATMs, we will know that they were at the location of that BT ATM at the respective date and time)
- other personal data :
- like any application, BT Pay will request some permissions. Thus, BT Pay:
a. will have access to read from the phone used by the child the SMS messages sent by BT, for pre-filling the SMS-OTP codes in the Application;
b. will be able to check if the phone has NFC functionality and if it is activated when the child tries to make payments with the phone in stores;
c. will check if the phone used has an Android or IOS operating system to facilitate the registration of cards in Apple Pay,
d. when the child initiates transfers based on phone numbers (the child can only initiate requests for amounts from the parent who granted the right), BT Pay will have access to the number of the parent who granted access in BT Pay, this being the only person from whom the child can receive money amounts.
e. list of applications on the device on which the minor has installed/uses BT Pay, to check if there is malware, including applications of the type that allow remote connection/ access. Depending on the situation, the bank may take, as applicable, the following measures: blocking the application until third-party applications that may compromise the confidentiality of information from BT Pay are uninstalled or the bank contacting the parent.
5. Where do we get the child's data that we use in BT Pay
Depending on the case, we have the child's data:
- from the parent who initiates the process of registering the child in BT Pay (we receive from the parent the child's last name and first name, phone number, and personal numeric code);
- directly from the child, when using BT Pay for minors attached to the parent's account.
6. To whom can we disclose the child's data used in BT Pay
We never sell or rent personal data from BT Pay. However, we may disclose the child's personal data:
- to any of your parents/legal guardians/legal representatives, as long as he/she is a minor;
- some service providers who help us deliver BT Pay;
- other BT Pay users (e.g. all other BT Pay users will see the icon with BT Pay next to the child's phone number if they try to initiate transfers to that phone number. In this case, those users will implicitly find out that the respective child uses BT Pay (however, transfers to the child made based on the phone number will only be successful from the phone number of the parent who granted access to BT Pay));
- to Apple Pay, if the child's phone has the IOS operating system and they chose to enroll their BT card in Apple Pay within BT Pay;
- to authorities/public institutions (e.g. police) that may request such information about our Clients (including minors) according to the law;
7. How long do we keep the child's data used in BT Pay
Because any child card is linked to the account opened in the name of the parent, who is a BT Client account holder, the law requires us to keep their data (including transactions made through BT Pay) for a period of 5 or 10 years after they are no longer a BT client. The 5/10 year term applies depending on the law that requires us to retain the data.
8. What rights are guaranteed regarding the processing of the child's data
Regarding the processed child's data, the following rights are guaranteed: the right to be informed (the information is in this information note), the right of access, rectification, opposition, the right to data deletion, portability, the right not to be subject to a decision based on automated data processing (we do not make such decisions in BT Pay regarding the child's data), the right to file a complaint with the ANSPDCP. The rights can be exercised on behalf of the child by the parent.
Details about these rights, including the ways in which they can be exercised, as well as the DPO BT contact details can be found within General information notes regarding the processing and protection of personal data belonging to BT Clients, with which this information note is supplemented.
General information note is an integral part of BT Privacy Policies, available on the website www.bancatransilvania.ro (including in the section Privacy Hub) or in BT units.
The child and his parent should also know the following:
9. Security of BT Pay
The bank guarantees that it has taken adequate measures to ensure the security of data in BT Pay. However, it does not depend solely on BT who has access to the child's data in BT Pay. Therefore, we cannot guarantee that persons who would not have the right do not gain access to this data, especially if the minor has not been careful enough.
Even if you are a child, when you use BT Pay, you are responsible for the following:
- do not allow people who do not have the right to see your data in BT Pay (e.g., do not show it to friends, colleagues. We recommend that you only show it to your parents);
- to keep your phone safe (do not leave it unattended);
- take care of the phone unlock password (password, fingerprint or another security method offered by the phone), so that other persons who do not have the right cannot see or know it (e.g., make sure friends, colleagues, people on the bus or at stops etc. do not see it);
- for what happens with your cards in BT Pay (do not let people who are not allowed to use the phone where you have installed BT Pay);
- immediately upon learning that the phone or the phone unlock password have reached people who should not have known them, you must inform your parent to contact the bank.
- opens in a new tab
