1. General provisions
1. General provisions
Banca Transilvania, S.A., (hereinafter also referred to as “the bank”, “BT”, “we”), hereby informs you through this specific information note how it intends to process your data, with the main purpose of concluding and executing a credit agreement that you have concluded with the bank.
This is a specific information note regarding the processing of personal data for the purpose of concluding and executing a credit contract. The provisions of this note are supplemented by General information note concerning the processing and protection of personal data belonging to BT Clients, in which you will find all the other purposes for which your data is processed presented in detail. The general information note is an integral part of BT Privacy Policies, found on the website www.bancatransilvania.ro and can be obtained on request at any BT unit.
Transilvania Bank S.A located in Cluj-Napoca city, Calea Dorobanților street, no. 30-36, Cluj county processes your personal data as a data controller for the conclusion and execution of the credit agreement concluded with the Bank and, if applicable, the guarantee agreement - accessory to the credit agreement.
2. The legal basis and purpose of processing
2. The legal basis and purpose of processing
For the conclusion and execution of credit agreements and, where appropriate, of the related guarantee agreements, the Bank processes the categories of personal data mentioned in this section at point (4), based on its legal obligations, on the conclusion and execution of the contract, and on its legitimate interest.
The bank will use any of the contact details provided by the borrower for conducting the contractual relationship with the bank for the purpose of informing about the due date of each installment, as well as, if applicable, for sending notifications regarding the expiration of insurance policies, for the recovery of debts on the contracted loan, and for other events related to it.
3. The obligation to provide data and the consequences of non-compliance with it
3. The obligation to provide data and the consequences of non-compliance with it
Your provision of your personal data is necessary for the purpose mentioned in point (2). Refusal to have your personal data processed as necessary for the achievement of the mentioned purpose will result in the Bank being unable to offer you the requested credit.
4. Categories of personal data processed
4. Categories of personal data processed
Personal data processed by the Bank for the purpose mentioned in point (2) are those about which you have been informed that they are processed within the pre-offer/credit application analysis stage, to which other such data added that have been completed and/or received from you on the occasion of/for concluding the credit contract, together with its accessories. On the occasion of concluding the contract, you will be assigned an IBAN code related to the contracted credit, through which the payments related to it will be carried out. In addition, in the case of credit cards, they will contain, besides the holder's first and last name, the card number (PAN), as well as information related to the card's expiration date and the CVV code.
5. Data recipients
5. Data recipients
Personal data processed for the purpose mentioned in point (2) are disclosed or transferred in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and security of the data, to the following categories of recipients - Credit Bureau S.A. and the Participants in this system, insurance companies, appraisal companies, service providers used by the Bank within the credit process, debt collection companies, OCPI, the National Register of Movable Property Publicity (RNPM), public authorities and institutions, notaries public, lawyers, bailiffs, the Credit Risk Center*, companies (funds) guaranteeing various types of credit products, the Bank's partners - Rotary and Flying Blue, for credit cards issued in collaboration with them.
*The bank has the legal obligation to report to the Credit Risk Center (CRC) credit risk information for each debtor who meets the condition to be reported (it includes the identification data of a debtor, natural person or non-banking legal entity, and operations in lei and foreign currency through which the bank is exposed to risk towards that debtor), as well as to have recorded towards them an individual risk, as well as information about detected card frauds.
** The bank has a legitimate interest in reporting to the Credit Bureau System, which is also accessible to other Participants (mainly credit institutions and non-banking financial institutions) your personal data in case you register delays in credit payments of at least 30 days, after prior notification to you at least 15 days before the reporting date.
6. The duration of personal data storage
6. The duration of personal data storage
Personal data processed for the purpose indicated at point (2) are stored in the Bank's records for limited periods established by law (e.g. according to financial accounting legislation) or internally.
Those personal data processed in the Credit Bureau system and disclosed to the Participants in this system are stored in the records of this institution for 4 years from the date of updating. In the records of the Credit Risk Center, data reported under the legal obligation of the Bank, namely credit risk information and information about card frauds, are maintained for a period of 7 years from the date of registration.
7. The rights of data subjects regarding the processing of personal data
7. The rights of data subjects regarding the processing of personal data
As a data subject, you can exercise the rights provided by EU Regulation 679/2016 – the General Data Protection Regulation: the right of access, the right to data rectification, the right to data erasure, the right to restrict processing, the right to object to processing.
These rights may be exercised as follows:
- at the Bank, by sending a written request to the address of the bank in Cluj-Napoca city, Calea Dorobanților street, no. 30-36, Cluj county, with the mention – "to the attention of the data protection officer (DPO)" or electronically to the e-mail address dpo@btrl.ro.
- by securely accessing the Credit Bureau website (www.birouldecredit.ro), in the case of data processed in the Credit Bureau System, as well as the right to address the National Authority for the Supervision of Personal Data Processing and the judiciary.
