1. Who is the data controller and what is the purpose of the processing?
Banca Transilvania S.A.(„The Bank", „BT") has the legal obligation to verify the identity of clients who request personalized information about the products/services contracted from the bank, including the modification of some related information ("personalized banking information"), to ensure that these are provided only to authorized persons. The more sensitive the requested banking information is, the higher the level of identification we will have to apply.
When we receive such requests, we want to accommodate them as quickly as possible. Therefore, we provide customers with personalized banking information through the Ino chatbot (hereinafter "Ino"), after successfully completing the identification process.
The general Questions and Answers (FAQ) section in Ino can be accessed by any person, without the need to identify them.
2. What personal data is processed for identity verification in Ino and what happens if you refuse their processing
In order to provide you with personalized banking information, you will need to enter your Personal Numeric Code (CNP), the phone number declared in your relationship with the bank, and the unique identification code (SMS-OTP) that we will send to you via SMS. We process this information both to verify if you meet the conditions to obtain personalized banking information through Ino (you are a BT client, of legal age, and a resident), and to ensure that you are who you claim to be, so that we do not provide the requested information if you are not entitled to receive it.
Additionally, if you are a BT Pay user and meet the eligibility conditions (e.g. you have at least one card enrolled in this application and have completed the identification process according to the payment services legislation, either directly in BT Pay or at a BT unit) during a live chat conversation with a BT employee, which you will enter by accessing the "talk to a colleague" sections in Ino, for some types of banking information you will be able to complete the identification process in BT Pay by accessing a push notification that we will send you.
If you do not have BT Pay, do not meet the eligibility conditions, or do not wish to be identified through the application, for some types of personalized banking information that you request through Ino, you will be able either to be identified by answering additional questions, or by going through a remote identification process via video means, without a human operator, if you express your consent in this regard and explicit consent for the processing of your biometric data, according to the following steps:
- you present in front of the camera (requires access to the device's camera) the image of the identity card ("ID") - we capture the data from the ID through optical character recognition, OCR-ization, (a process that allows the automatic extraction of letters and numbers from the uploaded ID) and we compare them with those already in the bank's records, to ensure that they match.
- you move in front of the camera – we record your moving image and use it to make sure you are a real person.
- to confirm your unique identification, we want to apply to your image (face) a technology that uses the so-called biometric data (comparing the characteristics of your face from two photographs).
We will not use biometric data without your explicit consent. Before freely deciding whether you wish to give it, here is how we would use them:
- The computer solution we use identifies your face from the ID and from the video we record when you move in front of the camera, selects it and compares it with the face from the ID copy that is already registered in the BT records
- the comparison is made biometric, based on criteria such as: the color, size and slope of the eyes, the position and distance between the main elements of the face such as the eyes, eyebrows, lips and nose.
Following the biometric comparison, the IT solution indicates the probability that the face in the two images belongs to the same person. To express your consent for the processing of biometric data (facial recognition), you will need to select the button in Ino „I explicitly consent to have my biometric data processed” and if you refuse to have your biometric data processed, you will select the button „I do not want my biometric data to be used”.
If you refuse to let us process your data by the means indicated above or we fail to identify you in Ino, we will not be able to provide you with personalized banking information within this chatbot, but you can obtain them at any BT branch, after identification based on your identity document.
3. How long do we keep the data from conversations held through Ino?
We will keep your processed data for identification in Ino, if applicable together with the conversation with the agent, for a period of 3 years.
This information note is completed with the provisions General information notes regarding the processing and protection of personal data belonging to BT Customers, which we recommend you consult. It is an integral part of BT Privacy Policies, which you can find on the bank's website www.bancatransilvania.ro, including in the section Privacy Hub from the site. Within the general information note, you will also find the definition of the BT Client, as well as details about the recipients of BT Clients' data, about the rights you benefit from regarding the processing of your data, about the ways you can exercise them, or about how you can contact the data protection officer appointed by BT (BT DPO).
