1. About the BT customer data provided by the General Directorate for Records of Persons
1. About the BT customer data provided by the General Directorate for Records of Persons
Based on the normative acts applicable in Romania in the field of client knowledge for the purpose of preventing money laundering and terrorist financing, between the Romanian Banking Association (R.B.A.) and the General Directorate for Personal Records (“D.G.E.P”) a framework cooperation agreement was concluded, which established the general conditions under which the member banks of A.R.B. – among which are also Transilvania Bank („bank”, “BT”) – will be able to conclude contracts with D.G.E.P. in order for banks to fulfill customer due diligence measures for the prevention of money laundering and terrorism financing, respectively for the validation of personal data related to bank clients, by comparing them with the information existing in the National Register of Persons Evidence (R.N.E.P.) and the additional provision of updated personal data.
According to the framework agreement concluded between A.R.B. and D.G.E.P., Banca Transilvania and D.G.E.P. have concluded the Contract regarding the validation and provision of data from the National Registry of Persons (R.N.E.P.), which was registered under no. 501615/04.05.2023 at BT and respectively under no. 3497232/08.05.2023 at D.G.E.P. (hereinafter referred to as the “Contract”), found in appendix this information note.
2. Operators of personal data and data subjects
2. Operators of personal data and data subjects
If you are a Romanian citizen, an individual BT client or you are going through the steps to become a BT client, the personal data mentioned in this notice will be processed according to the provisions of the Contract concluded between BT and D.G.E.P., for the purpose of BT applying customer due diligence measures to prevent money laundering and terrorist financing. Thus, you are a data subject of processing.
BT clients whose data will be processed are natural persons, Romanian citizens, both holders of products and services, as well as legal representatives (e.g., guardians, trustees) and conventional (authorized, delegated, attorneys, etc.), shareholders and ultimate beneficiaries of legal entities, including natural persons who have the status of users of the products or services owned by the legal entity, natural persons who have the status of third-party guarantors (signatories of chattel or real estate mortgage contracts) for loans granted to natural persons or legal entities.
BT and D.G.E.P. they will process the personal data of the data subjects as each as operator , but they have established through the Contract methods of collaboration for respecting your rights and freedoms in connection with the processing of data concerning you, as well as for ensuring the adequate security of these data.
We remind you that general information about the processing by Banca Transilvania of BT clients' data found in General information note concerning the processing and protection of personal data belonging to BT Clients.
3. Purpose and legal basis of data processing, categories of processed data
3. Purpose and legal basis of data processing, categories of processed data
BT, as a credit institution, has the legal obligation to collect from its clients/potential clients including personal data from the identity document, as well as a copy of the identity documents, for the purpose of applying customer due diligence measures to prevent money laundering and terrorist financing. Details about BT's processing of data for this purpose can be found on the BT website, in Information note regarding the processing of personal data belonging to BT Clients for the purpose of knowing the clientele to prevent money laundering and terrorist financing.
Also, BT must ensure that this data is always correct and, where appropriate, updated in its records. For this, BT will send to D.G.E.P. the name, surname, and Personal Numeric Code (CNP)-ul persoanelor vizate care sunt clienți sau fac pași pentru a deveni clienți BT.
D.G.E.P. will process and validate this data through automated procedures and wil provide additionally to BT about these persons: name, first name, type, series and number of the identity document, date of issue and expiration date of the identity document, place of birth, issuer of the identity document, home address, residence address, photograph and information regarding the date of death, as the case may be, as these data appear in the R.N.E.P.
BT will use the data received from D.G.E.P. for the purpose of applying customer due diligence measures. This means that if you are already a BT client and the data we receive from D.G.E.P. is different/more recent than the data we have about you, we will update the data received from D.G.E.P. without you needing to update this data at the bank.
4. Automated decision-making processes
4. Automated decision-making processes
BT will not take any measure likely to produce legal effects or similarly significantly affect you solely based on the automated processing of data provided by D.G.E.P., unless the provisions of art. 22 of the General Data Protection Regulation (GDPR) are complied with.
5. Data recipients
5. Data recipients
Recipients to whom we disclose/transfer BT customers' data, including those in this notice, are provided in the section VIII. To whom can we disclose/transfer the personal data of Clients from General information note concerning the processing and protection of personal data belonging to BT Clients. The data subject to exchange between BT and D.G.E.P. are not transmitted to third countries or international organizations.
6. The storage period of personal data by BT
6. The storage period of personal data by BT
The data processed for the purpose of applying customer due diligence measures are kept, according to the legislation applicable in this field, for 5 years after the termination of the customer's business relationship with the bank. This period may be extended under the conditions of the same legislation. Upon expiration of the retention period from this legislation, the bank will delete or anonymize this data, except in situations where other legal provisions require their further retention.
7. The rights that are guaranteed to you
7. The rights that are guaranteed to you
Regarding the processing of personal data, you are guaranteed the exercise of the rights provided by the GDPR. You can exercise these rights at BT or contact the BT Data Protection Officer (DPO BT) for questions about data processing by writing to the email address dpo@btrl.ro or, by mail to the headquarters of Transilvania Bank in Cluj-Napoca city, Dorobanților Road no. 30-36, Cluj county. As long as you are a BT customer, you can exercise these rights at the bank also through the online form available at this address: https://www.bancatransilvania.ro/dsar/verificare/
The rights guaranteed to you are: the right to information (we fulfill our obligation to inform you through this information note), the right to object, the right of access to processed data, the right to rectification of data, the right to erasure of data, the right to restriction of processing, the right to data portability, the right not to be subject to a decision based solely on automated data processing, the right to file a complaint with the National Authority for the Supervision of Personal Data Processing (ANSPDCP). The fact that the exercise of these rights is guaranteed to you does not, however, mean that all of them can be accommodated, taking into account the legal basis and the purpose for which the data from this notice are processed for you.
