What does the RoPay payment scheme represent?
Banca Transilvania S.A.(“BT”, “bank”) and Society of Fund Transfer and Settlements – TRANSFOND S.A. (in continuation „TRANSFOND”), together with other banks from Romania (hereinafter “participating banks”) processes your personal data, as a data subject, in accordance with the provisions of the General Data Protection Regulation (hereinafter "GDPR"), for the purpose and through the processing means established by Set of Rules regarding the RoPay Scheme (hereinafter „RoPay”).
RoPay is offered by Transilvania Bank under the conditions mentioned in BT Terms of use RoPay. The BT client who uses RoPay through Banca Transilvania is a „utilizator RoPay”.
If you are a natural person, it is important to know how your personal data will be processed in the context of using this service, as you would be the data subject of this processing.
RoPay offers users two services:
- SPL RoPay Service - facilitates the process of initiating payments/payment requests based on a proxy (alias - phone number) associated with an account (IBAN), registered in SPL RoPay, on the basis of which a consumer initiates a payment/payment request.
- The service of initiating payment requests based on a QR code generated by the payment beneficiary, which the payer scans and can make the payment.
To avoid any doubt, all information in this specific information note refers to the personal data processed for the provision of the RoPay service. The processing of BT clients' personal data, carried out by Banca Transilvania, as an independent operator, is subject to the provisions of General information notes regarding the processing and protection of personal data belonging to BT Customers
Operators of personal data
RoPay payment initiation scheme can only work if participating banks exchange the personal data necessary for payment initiation, according to Set of Rules regarding the RoPay Scheme. The information exchange will be carried out through a common database, which will be managed by TRANSFOND.
Participating banks and TRANSFOND will process the data of the data subjects as joint controllers, as this term is defined in the GDPR, and have established their responsibilities through an agreement concerning the fulfillment of the obligations imposed by the GDPR, especially those related to the confidentiality and security of personal data, as well as those regarding their role and relationship with the data subjects.
The list of banks participating in this scheme may undergo changes, by joining or, as the case may be, withdrawing from the RoPay scheme of some of them. The updated daily list of all participating banks can be foundhere.
Purpose of personal data processing
Personal data is processed jointly by the associated operators exclusively for the purpose of providing services facilitating instant payment/payment request initiation, in accordance with Set of Rules regarding the RoPay Scheme, for customers of banks participating in RoPay, in the use cases mentioned in the Rule Set regarding the RoPay Scheme.
Categories of personal data processed
The categories of personal data that the associated operators process in the context of RoPay are:
• name, first name and phone number (proxy) of the RoPay paying user or beneficiary, individual client of a participating bank;
• the IBAN code of the individual customer's account of the RoPay User beneficiary or payer, who transmits payments/payment requests to clients of the participating banks.
These data belong to the following categories of data subjects: BT clients, with current accounts in lei opened at BT who are users of BT's mobile banking service dedicated to individual clients. The data subjects may be payers and/or beneficiaries of payments through the RoPay service.
Legal grounds for processing
The legal bases for the processing of personal data carried out by the banks participating in the RoPay scheme are:
• performance of a contract to which the data subject is a party (legal basis provided by art. 6 para. 1 lit. b of the GDPR);
• the legitimate interest of the paying bank to execute the RoPay service and to present the RoPay paying user with the pre-filled payment order (legal basis provided by art. 6 para. 1 lit. f of the GDPR).
The legal basis for the processing of personal data carried out by TRANSFOND is its legitimate interest to execute the RoPay service under the conditions of the RoPay Scheme Ruleset (basis provided by art. 6 para. 1 letter f of the GDPR).
Recipients of personal data
Personal data processed by associated operators are disclosed, as the case may be, to institutions and state authorities with supervisory and control prerogatives.
The storage period of personal data in the context of using RoPay
Your personal data related to the RoPay service offered through BT will be stored in the Transfond database, and will thus be available to other participating banks and their customers who are RoPay users, as long as you use the RoPay service. Personal data will no longer be used for the provision of the RoPay service if you request the deletion of the data or object to the processing of your data, as well as in the event that you are no longer a client of the Bank.
