1. General provisions
1. General provisions
Banca Transilvania, S.A., (hereinafter also referred to as “the bank”, “BT”, “we”), hereby informs you through this specific information note how it intends to process your data, with the main purpose of concluding and executing a credit agreement that you have concluded with the bank.
This is a specific information note, regarding the processing of personal data for the purpose of concluding and carrying out a credit agreement. The provisions of this note are supplemented by General information note regarding the processing and protection of personal data belonging to BT Clients, in which you can find detailed all the other purposes for which your data is processed. The general information note is an integral part of BT Privacy Policies, found on the website www.bancatransilvania.ro and can be obtained on request at any BT unit.
Banca Transilvania S.A with headquarters in Cluj-Napoca municipality, Calea Dorobanților street, no. 30-36, Cluj county processes as a data controller your personal data for concluding and carrying out the credit agreement concluded with the Bank and, where applicable, the guarantee agreement - accessory to the credit agreement.
2. The legal basis and the purpose of processing
2. The legal basis and the purpose of processing
For entering into and executing loan agreements and, as the case may be, the related guarantee agreements, the Bank processes the categories of personal data mentioned in this section at point (4), based on its legal obligations, the conclusion and performance of the contract, and on its legitimate interest.
The bank will use any of the contact details provided by the borrower for managing the contractual relationship with the bank for the purpose of informing about the due date of each installment, as well as, where applicable, for sending notifications regarding the expiration of insurance policies, for debt recovery on the contracted loan, and for other events related to it.
3. The obligation to provide data and the consequences of non-compliance with it
3. The obligation to provide data and the consequences of non-compliance with it
The provision of your personal data is necessary for the purpose mentioned in point (2). Refusal to process the personal data necessary to achieve the mentioned purpose will result in the Bank being unable to offer you the requested loan.
4. Categories of processed personal data
4. Categories of processed personal data
Personal data processed by the Bank for the purpose mentioned in point (2) are those you have been informed are processed during the pre-offer / credit application analysis phase, to which other such data added that have been completed and/or received from you on the occasion of / for the conclusion of the credit agreement, together with its accessories. Upon conclusion of the contract, an IBAN code corresponding to the contracted credit will be allocated to you, through which payments related to it will be made. Additionally, in the case of credit cards, these will contain, besides the holder's first and last name, the card number (PAN), as well as information related to the card expiry date and the CVV code.
5. Data recipients
5. Data recipients
Personal data processed for the purpose mentioned in point (2) are disclosed or transferred in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and data security, to the following categories of recipients - Credit Bureau S.A. and Participants in this system, insurance companies, appraisal companies, service providers used by the Bank in the credit process, debt collection companies, OCPI, the National Register of Movable Property Publicity (RNPM), authorities and public institutions, notaries public, lawyers, bailiffs, Credit Risk Central*, companies (funds) guaranteeing various types of credit products, the Bank's partners - Rotary and Flying Blue, for credit cards issued in collaboration with them.
*The bank has the legal obligation to report to the Credit Risk Center (CRC) the credit risk information for each debtor who meets the condition of being reported (including the identification data of a debtor, natural person or non-banking legal entity, and the operations in lei and foreign currency through which the Bank is exposed to risk towards that debtor), respectively to have recorded an individual risk towards this debtor, as well as information about detected card frauds.
** The bank has the legitimate interest to report to the Credit Bureau System, to which other Participants (mainly credit institutions and non-bank financial institutions) also have access, your personal data in the event that you register delays in loan payment of at least 30 days, after your prior notification in this regard at least 15 days before the reporting date.
6. Duration of personal data storage
6. Duration of personal data storage
Personal data processed for the purpose indicated at point (2) are stored in the Bank's records for legally established limited periods (e.g., according to financial-accounting legislation) or internally.
Those personal data that are processed in the Credit Bureau system and disclosed to Participants in this system are stored in the records of this institution for 4 years from the date of update. In the records of the Credit Risk Center, the data reported based on the legal obligation that the Bank has, namely credit risk information and information about card frauds, are maintained for a period of 7 years from the date of registration.
7. Rights of the data subjects regarding the processing of personal data
7. Rights of the data subjects regarding the processing of personal data
As a data subject, you can exercise the rights provided by EU Regulation 679/2016 - the General Data Protection Regulation: the right of access, the right to rectify data, the right to delete data, the right to restrict data processing, the right to object to processing.
These rights can be exercised as follows:
- at the Bank, by sending a written request to the bank's address in Cluj-Napoca city, Calea Dorobanților street, no. 30-36, Cluj County, with the mention – "to the attention of the data protection officer (DPO)" or by electronic means to the e-mail address dpo@btrl.ro.
- by securely accessing the Credit Bureau's website (www.birouldecredit.ro), in the case of data processed in the Credit Bureau System, as well as the right to address the National Authority for the Supervision of Personal Data Processing and the judiciary.