What does the RoPay payment scheme represent?
Banca Transilvania S.A.(“BT”, “bank”) and Society for Funds Transfer and Settlements – TRANSFOND S.A. (hereinafter „TRANSFOND”), together with other banks from Romania (hereinafter “participating banks”) processes your personal data, as a data subject, in accordance with the provisions of the General Data Protection Regulation (hereinafter "GDPR"), for the purpose and by means of processing established by RoPay Scheme Rule Set (hereinafter „RoPay”).
RoPay is offered by Transilvania Bank under the conditions mentioned in BT Terms of Use RoPay. The BT client who uses RoPay through Banca Transilvania is a „user RoPay”.
If you are a natural person, it is important to know how your personal data will be processed in the context of using this service, as you would be a data subject of this processing.
RoPay offers users two services:
- The SPL RoPay service - facilitates the process of initiating payments/payment requests based on a proxy (alias - phone number) associated with an account (IBAN), registered in SPL RoPay, on the basis of which a consumer initiates a payment/request for payment.
- The service of initiating payment requests based on a QR code generated by the payment beneficiary, which the payer scans and can make the payment.
For the avoidance of any doubt, all information in this specific information note refers to the personal data processed for the provision of the RoPay service. The processing of the personal data of BT clients, carried out by Banca Transilvania, as an independent operator, is subject to the provisionsGeneral information notes regarding the processing and protection of personal data belonging to BT Clients
Personal data operators
RoPay payment initiation scheme can only work if the participating banks perform an exchange of personal data necessary for payment initiation, according to Set of Rules regarding the RoPay Scheme. The information exchange will be carried out through a common database, which will be managed by TRANSFOND.
Participating banks and TRANSFOND will process the data of the data subjects as joint controllers, as this term is defined in the GDPR, and have established through an agreement their responsibilities regarding the fulfillment of the obligations imposed by the GDPR, especially those related to the confidentiality and security of personal data, as well as those concerning their role and relationship towards the data subjects.
The list of banks participating in this scheme may undergo changes, by joining or, as the case may be, withdrawing from the RoPay scheme of some of them. The updated list to date of all participating banks can be found here.
The purpose of processing personal data
Personal data is processed jointly by the associated operators exclusively for the purpose of providing instant payment initiation/payment request facilitation services, in accordance with Set of Rules regarding the RoPay Scheme, for customers of banks participating in RoPay, in the use cases mentioned in the RoPay Scheme Rule Set.
Categories of personal data processed
The categories of personal data that the associated operators process in the context of RoPay are:
• name, surname and phone number (proxy) of the payer or beneficiary RoPay user, individual client of a participating bank;
• the IBAN code of the individual client's account of the RoPay User beneficiary or payer, who sends payments/payment requests to clients of the participating banks.
These data belong to the following categories of data subjects: BT clients, with current accounts in lei opened at BT who are users of BT's mobile banking service dedicated to individual clients. The data subjects may be payers and/or beneficiaries of payments through the RoPay service.
Legal grounds for processing
The legal grounds for the processing of personal data carried out by banks participating in the RoPay scheme are:
• the performance of a contract to which the data subject is party (legal basis provided by art. 6 para. 1 lit. b of GDPR);
• the legitimate interest of the paying bank to execute the RoPay service and to present the RoPay user the pre-filled payment order (legal basis provided by art. 6 para. 1 lit. f of the GDPR).
The legal basis for the processing of personal data carried out by TRANSFOND is its legitimate interest in performing the RoPay service under the conditions of the RoPay Scheme Rulebook (basis provided by art. 6 para. 1 letter f of the GDPR).
Recipients of personal data
Personal data processed by associated operators are disclosed, as appropriate, to institutions and state authorities with supervisory and control prerogatives.
Period of storage of personal data in the context of using RoPay
Your personal data related to the RoPay service offered through BT will be stored in the Transfond database and will thus be available to the other participating banks and their customers who use RoPay, as long as you use the RoPay service. Personal data will no longer be used for providing the RoPay service if you request data deletion or oppose the processing of your data, as well as in the case that you are no longer a client of the Bank.
