1. About the BT customers' data provided by the General Directorate for Persons' Records
1. About the BT customers' data provided by the General Directorate for Persons' Records
Based on the normative acts applicable in Romania in the field of customer knowledge for the purpose of preventing money laundering and terrorist financing, between the Romanian Banking Association (R.B.A.) and the General Directorate for Personal Records (“D.G.E.P”) a framework collaboration agreement was concluded, establishing the general conditions under which the member banks of A.R.B. – among which is also Transylvania Bank („bank”, “BT”) – will be able to conclude contracts with D.G.E.P. for the purpose of banks fulfilling the customer due diligence measures to prevent money laundering and terrorist financing, respectively for validating the personal data related to the bank's clients, by comparing them with the information existing in the National Register of Personal Records (N.R.P.R.) and providing additional updated personal data.
According to the framework agreement concluded between A.R.B. and D.G.E.P., Banca Transilvania and D.G.E.P. have concluded inițial The contract regarding the validation and provision of data from the National Register of Persons Records (N.R.P.R.) which was registered under no. 501615/04.05.2023 at BT and respectively under no. 3497232/08.05.2023 at D.G.E.P., which was subsequently replaced by the contract with the same name, registered under no. 597554/12.03.2026 at BT and respectively under no. 4937601/12.03.2026 at D.G.E.P (hereinafter referred to as "the Contract"). The current contract is found in annexthis information note.
2. Operators of personal data and data subjects
2. Operators of personal data and data subjects
If you are a Romanian citizen, an individual BT client or you are going through the steps to become a BT client, the personal data mentioned in this information will be processed according to the provisions of the Contract concluded between BT and D.G.E.P., for the purpose of applying by BT of the customer due diligence measures for the prevention of money laundering and terrorist financing. Thus, you are a targeted person processing.
BT clients whose data will be processed are natural persons, Romanian citizens, both holders of products and services, as well as legal representatives (e.g. guardians, curators) and conventional representatives (authorized persons, delegates, attorneys, etc.), shareholders and the real beneficiaries of legal entities, including natural persons who have the status of users of the products or services owned by the legal entity, natural persons who have the status of third-party guarantors (signatories of movable or immovable mortgage contracts) for loans granted to natural persons or legal entities.
BT and D.G.E.P. will process the data of the data subjects as each as operator , but they established through the Contract methods of collaboration for respecting your rights and freedoms in connection with the processing of data concerning you, as well as for ensuring the adequate security of these data.
We remind you that general information about the processing by Banca Transilvania of BT clients' data found in General information note regarding the processing and protection of personal data belonging to BT Clients.
3. The purpose and legal basis of data processing, categories of processed data
3. The purpose and legal basis of data processing, categories of processed data
BT, as a credit institution, has the legal obligation to collect from its clients/potential clients including personal data from the identity document, as well as a copy of the identity documents, for the purpose of applying customer due diligence measures to prevent money laundering and terrorist financing. Details about BT's processing of data for this purpose can be found on the BT website, in Information note concerning the processing of personal data belonging to BT Clients for the purpose of customer knowledge for the prevention of money laundering and terrorism financing.
Also, BT must ensure that this data is always correct and, where appropriate, updated in its records. For this, BT will transmit to D.G.E.P. the name, surname, and CNP-ul persoanelor vizate care sunt clienți sau fac pași pentru a deveni clienți BT.
D.G.E.P. will process and validate this data through automated procedures and will return to BT about these persons, as appropriate: name, first name, the code personal numeric code (CNP),marital statusă, sex, date and place of birth or thedeath, other data from the identity document: type, series and number, issue date and expiration date, issuer, residential address, address of residence, photograph, as these data appear in R.N.E.P.
BT will use the data received from D.G.E.P. for the application of customer knowledge measures. If you are already a BT client and the information received from D.G.E.P. differs from the data existing in our records, we will automatically update your data registered at the bank, without the need for you to personally request this update.
Also, if you request the opening of a business relationship with BT, we can verify the information you provide to us by comparing it with the data obtained from D.G.E.P., to ensure that we correctly identify you.
4. Automated decision-making processes
4. Automated decision-making processes
BT will not take any measures likely to produce legal effects or similarly significantly affect you solely on the basis of the automated processing of data provided by D.G.E.P., unless the provisions of art. 22 of the General Data Protection Regulation (GDPR) are respected.
5. Data recipients
5. Data recipients
Recipients to whom we disclose/transfer the BT clients' data, including those in this notice, are provided in the section VIII. To whom can we disclose/transfer Clients' personal data from General information note regarding the processing and protection of personal data belonging to BT Clients. The data subject to exchange between BT and D.G.E.P. are not transmitted to third countries or international organizations.
6. The retention period of personal data by BT
6. The retention period of personal data by BT
The data processed for the purpose of applying customer knowledge measures are kept, according to the applicable legislation in this field, for 5 years after the termination of the business relationship of the client with the bank. This period can be extended, under the conditions of the same legislation. Upon expiration of the retention period from this legislation, the bank will delete or anonymize these data, except in situations where other legal provisions require their further retention.
7. The rights guaranteed to you
7. The rights guaranteed to you
In connection with the processing of personal data, you are guaranteed the exercise of the rights provided by the GDPR. You can exercise these rights at BT or contact the BT Data Protection Officer (BT DPO) for questions about data processing, by writing to the e-mail address dpo@btrl.ro or, by postal mail to the headquarters of Transilvania Bank in Cluj-Napoca city, Dorobanților Road no. 30-36, Cluj county. As long as you are a BT client, you can exercise these rights at the bank also through the online form available at this address: https://www.bancatransilvania.ro/dsar/verificare/
The rights guaranteed to you are: the right to information (we fulfill our obligation to inform you through this information note), the right to object, the right to access the processed data, the right to rectify the data, the right to erase the data, the right to restrict processing, the right to data portability, the right not to be subject to a decision based solely on automated data processing, the right to file a complaint with the National Authority for the Supervision of Personal Data Processing (ANSPDCP). The fact that the exercise of these rights is guaranteed to you does not, however, mean that all of them can be accommodated, considering the legal basis and the purpose for which the data in this information are processed for you.
