Data controller and data subjects
Banca Transilvania S.A. (“the bank”, “BT”) processes the personal data of natural persons who carry out occasional transactions at the bank's units or through BT equipment (e.g. cash deposits into BT accounts in which they have no capacity, currency exchanges, money transfers via Western Union, payments to utility providers, withdrawals of amounts representing dividends), also called occasional clients, as well as, where applicable, the data of the actual beneficiaries of the occasional clients (together "data subjects").
Purposes of personal data processing
Personal data are processed in the context of occasional transactions for the following main purposes:
- application of measures regarding customer due diligence for the prevention of money laundering and terrorist financing (including identity verification and identification).
- the conclusion and execution of the contract for occasional transactions (including the processing/ settlement of this transaction);
Categories of processed personal data and their source
In the context of occasional transactions, BT processes, as appropriate, the following categories of personal data:
- identification data: data found in the identity card or the passport with which you identify yourself, including the copy of this document, when we are obliged by law, the signature, the country of tax residence;
- financial data about the occasional transaction (e.g. amount, currency, payment beneficiary, explanations/ details regarding the transaction, reference/ transaction identifier) and the history of occasional transactions made at BT;
- contact details: phone number, e-mail address;
- other personal data required by law, depending on the specifics of the transaction;
We collect occasional customers' data directly from them. In the case of their beneficial owners, we collect the personal data from the occasional customers who provide it to us.
What legal grounds underlie the processing of personal data and what happens if you refuse processing
The Bank processes personal data based on the legal obligations that apply to it (e.g., legislation regarding customer due diligence for the prevention of money laundering and terrorist financing, legislation regarding payment services), as well as for the conclusion and execution of the contract related to the requested occasional transaction. If you refuse the processing of this personal data, we will not be able to process the occasional transaction.
Also, to reduce waiting times at the bank counters, we have the legitimate interest to use the processed data in the context of an occasional transaction or, as the case may be, personal data that we hold about you from the perspective of a regular bank customer and for possible future occasional transactions.
For what period do we keep personal data
Personal data is kept for 5 years from the date of the occasional transaction, a period that can be extended under the conditions of specific legislation. Upon the expiration of the legal retention period, the bank will delete/anonymize the data, if there are no other legal provisions requiring their continued retention (e.g.: The Fiscal Procedure Code requires keeping the data for 10 years from the date of the occasional transaction).
To whom do we disclose personal data
The categories of recipients to whom we disclose personal data, as applicable, are:
- other Clients (BT client beneficiary of the amounts which are the object of the occasional transaction)
- contractual partners (service providers) used in BT activity
- authorities and public institutions to which we have the legal obligation (e.g. ANAF and ONPCSB) or, as the case may be, the legitimate interest (e.g. courts of law) to disclose the personal data processed in the context of occasional transactions.
This information note is completed with Transilvania Bank S.A. Policy regarding the processing and protection of personal data within banking activities ("Privacy Policy"), especially with provisions from section C point 2 of this. The privacy policy can be found on the website www.bancatransilvania.ro or, upon request, at any unit of the bank. The Privacy Policy also mentions the rights that can be exercised by the data subjects and the ways of exercising them, as well as the contact details of the data protection officer (DPO BT).
