1. Who is the data controller and what is the purpose of processing?
Banca Transilvania S.A.( "The Bank", "BT") has the legal obligation to verify the identity of clients who request personalized information about the products/ services contracted from the bank, including the modification of some information related to them ("personalized banking information"), to ensure that these are provided only to authorized persons. The more sensitive the requested banking information is, the higher the level of identification we will have to apply.
When we receive such requests, we want to accommodate them as quickly as possible. Therefore, we provide customers with personalized banking information through the Ino chatbot (hereinafter "Ino") , after successfully completing the identification process.
The section of general questions and answers (FAQ) from Ino can be accessed by anyone, without the need to identify them.
2. What personal data is processed for identity verification in Ino and what happens if you refuse their processing
To be able to provide you with personalized banking information, you will need to enter in Ino your personal numeric code (CNP), the phone number declared in relation to the bank, and the unique identification code (SMS-OTP) that we will send you via SMS. We process this information both to verify if you meet the conditions to obtain personalized banking information through Ino (you are a BT client, of legal age, and resident), and to ensure that you are who you claim to be, so that we do not provide you with the requested information if you are not entitled to receive it.
Additionally, if you are a BT Pay user and meet the eligibility conditions (e.g. you have at least one card enrolled in this application and you have completed the identification process according to the payment services legislation, either directly in BT Pay or at a BT branch) during a live chat conversation with a BT employee, which you will access by entering the "talk to a colleague" sections from Ino, for certain types of banking information you will be able to complete the identification process in BT Pay by accessing a push notification that we will send you.
If you do not have BT Pay, do not meet the eligibility conditions, or do not wish to be identified through the application, for some types of personalized banking information requested through Ino, you will be able either to be identified by answering additional questions or by going through a remote identification process via video means, without a human operator, if you express your consent in this regard and explicit consent for the processing of your biometric data, according to the following steps:
- you present in front of the camera (requires access to the device's camera) the image of the identity card ("ID") - we retrieve data from the ID through optical character recognition, OCR-ization, (a process that allows automatic extraction of letters and numbers from the uploaded ID) and we compare them with those already in the bank's records, to ensure they match.
- you move in front of the camera – we record your moving image and use it to ensure that you are a real person.
- to confirm your unique identification, we want to apply to your image (face) a technology that uses so-called biometric data (comparing the characteristics of your face in two photographs).
We will not use biometric data without your explicit consent. Before freely deciding whether you want to express it, here is how we would use them:
- the IT solution we use identifies your face from the ID card and from the video we record when you move in front of the camera, selects it and compares it with the face from the ID card copy that is already recorded in the BT records
- the comparison is made biometrically, based on criteria such as: the color, size, and tilt of the eyes, the position and distance between the main elements of the face such as the eyes, eyebrows, lips, and nose.
Following the biometric comparison, the software solution indicates the probability that the face in the two images belongs to the same person. To give your consent for the processing of biometric data (facial recognition), you will need to select the button in Ino „I explicitly consent to my biometric data being processed” and if you refuse to have your biometric data processed, you will select the button „I do not wish my biometric data to be used”.
If you refuse to allow us to process your data by the means indicated above or we fail to identify you in Ino, we will not be able to provide you with personalized banking information within this chatbot, but you can obtain it at any BT unit, after identification based on your identity document.
3. How long do we keep the data from conversations held through Ino?
We will keep your processed data for identification in Ino, as appropriate, together with the conversation with the agent, for a period of 3 years.
This information note is supplemented with the provisions General information notes regarding the processing and protection of personal data belonging to BT Clients, which we recommend you consult. It is an integral part of BT Privacy Policies, which you can find on the bank's website www.bancatransilvania.ro, including in the section Privacy Hub from the site. Within the general information note, you will find including the definition of the BT Client, as well as details about the recipients of BT Clients' data, about the rights you benefit from in connection with the processing of your data, about the ways in which you can exercise them or about how you can contact the person responsible for data protection appointed by BT (BT DPO).
