Data controller and data subjects
Banca Transilvania S.A. (“the bank”, “BT”) processes personal data of natural persons who carry out occasional transactions in the bank's units or through BT equipment (e.g. cash deposits into BT accounts in which they have no capacity, currency exchanges, money transfers via Western Union, payments to utility providers, withdrawals of amounts representing dividends), also called occasional clients, as well as, where appropriate, data of the beneficial owners of the occasional clients (together "data subjects").
The purposes of processing personal data
Personal data is processed in the context of occasional transactions for the following main purposes:
- application of measures regarding customer due diligence for the prevention of money laundering and terrorist financing (including identity verification and identification).
- conclusion and execution of the contract for occasional transactions (including processing/settlement of this transaction);
Categories of processed personal data and their source
In the context of occasional transactions, BT processes, as appropriate, the following categories of personal data:
- identification data: data found in the identity card or passport with which you identify yourself, including a copy of this document, when we are required by law, signature, country of tax residence;
- financial data about the occasional transaction (e.g. amount, currency, payment beneficiary, explanations/ details regarding the transaction, reference/ transaction identifier) and the history of occasional transactions carried out at BT;
- contact details: phone number, e-mail address;
- other personal data required by law, depending on the specifics of the transaction;
We collect the occasional customers' data directly from them. In the case of their real beneficiaries, we collect the personal data from the occasional customers who provide them to us.
What are the legal grounds for the processing of personal data and what happens if you refuse the processing
The bank processes personal data based on the legal obligations applicable to it (e.g., legislation regarding customer due diligence for the prevention of money laundering and terrorist financing, legislation regarding payment services), as well as for the conclusion and execution of the contract related to the requested occasional transaction. If you refuse the processing of this personal data, we will not be able to process the occasional transaction.
Also, to reduce waiting times at the bank counters, we have the legitimate interest to use the processed data in the context of an occasional transaction or, as the case may be, personal data we hold about you from the perspective of an ordinary bank customer and for possible future occasional transactions.
For what period do we keep personal data
Personal data is kept for 5 years from the date of the occasional transaction, a period which can be extended under specific legislation conditions. Upon the expiration of the legal retention period, the bank will delete/ anonymize the data, if there are no other legal provisions requiring their continued retention (e.g., the Fiscal Procedure Code requires data retention for 10 years from the date of the occasional transaction).
To whom do we disclose personal data
The categories of recipients to whom we disclose personal data, as appropriate, are:
- other Clients (the BT client beneficiary of the amounts subject to the occasional transaction)
- contractual partners (service providers) used in BT's activity
- authorities and public institutions to which we have a legal obligation (e.g. ANAF and ONPCSB) or, as the case may be, a legitimate interest (e.g. courts of law) to disclose the personal data processed in the context of occasional transactions.
This information note is completed with Transilvania Bank S.A. Policy regarding the processing and protection of personal data within banking activities ("Privacy Policy"), especially with provisions from section C point 2 of this. The privacy policy can be found on the website www.bancatransilvania.ro or, upon request, at any branch of the bank. The Privacy Policy also mentions the rights that can be exercised by the data subjects and the ways to exercise them, as well as the contact details of the data protection officer (DPO BT).
