Who is the personal data operator and the data subjects?
Who is the personal data operator and the data subjects?
BANCA TRANSILVANIA S.A. ("the bank", "BT" or "we") credit institution, Romanian legal entity, with the identification and contact details from section III of the General information notes regarding the processing and protection of personal data belonging to BT Clients, („General information note”) offers its clients the possibility to sign documents in relation to the bank with digital certificates issued by the trusted service provider Alfatrust Certification S.A. (“Alfatrust”), in collaboration with BT.
If you are an authorized natural person to sign documents in the relationship with the bank on behalf of a client (legal or natural person) or a natural person account holder and choose to sign the documentation with a digital certificate that Alfatrust will issue to you based on the collaboration with BT, your personal data will be processed as we inform you below. In this context, you are the data subject of this processing.
On what grounds do we process the data and what happens if you refuse their processing?
On what grounds do we process the data and what happens if you refuse their processing?
We process your personal data, as appropriate, on the following grounds:
- legal obligations of BT (e.g. customer due diligence for the prevention of money laundering and terrorist financing, remote identification by video means)
- conclusion/performance of the contract that you sign with BT (if you are the individual account holder client)
- the legitimate interest of BT and/or some third parties, (e.g. for fraud prevention)
- your consent (e.g. for processing biometric data)
If you refuse the processing of biometric data or other types of personal data, we cannot identify you beyond any doubt. Thus, Alfatrust cannot issue you a digital certificate within this online flow. In this case, you can sign the documentation with another digital certificate you own or by hand (only if other potential signatories of the document also opt for this signing variant).
For what purposes do we process your personal data, what data is it, to whom do we disclose it, and how long do we keep it?
For what purposes do we process your personal data, what data is it, to whom do we disclose it, and how long do we keep it?
- for the verification of identity and the status of signatory of a document in relation to BT
We use a process of remote identification by video means, to make sure you are who you say you are. In this process, we will take photos of your face and your identity document, only if you give your consent.
In this case, for identification, we would process the following types of personal data for you, depending on the situation: (i) the data from the identity document (including passport, if you are not a Romanian citizen resident), which you will need to photograph in certain situations (this implies access to the camera). If you are a Romanian resident, we will compare this information with that from the General Directorate for Personal Records - G.D.P.R. (see here details about the processing of data provided by D.G.E.P.); (ii) the image little faces in motion, from the selfie video that we will ask you to make (requires access to the camera), (iii) the biometric data of the face, obtained by biometric comparison of the selfie image with that from the photographed identity document and/or, as the case may be, with the image from the D.G.E.P.. We will process your biometric data only if you give your explicit consent, which we will request from you before we carry out such processing . Biometric comparison is performed by analyzing relevant facial features, using specific computer methods, to uniquely confirm that the same person appears in the images. Following the biometric comparison, the computer solution indicates the probability that the face in the two images belongs to the same person. If you refuse to allow us to process your biometric data or if the result issued by the computer solution does not assure us of your identity, the same consequences we informed you about in the previous section will apply.
For remote identification, we use the services of the service provider Onfido and some of its partners (subprocessors). They process the data from your photographed ID card, your image (from the selfie/video taken), and the facial biometric data only on behalf of and under the instructions of the bank.
Onfido and its partners may be located in third countries, such as the UK (with adequate data protection recognized by the European Commission), or in other countries that do not have such a decision. In the latter cases, we have ensured that the data transfer takes place based on appropriate guarantees provided by the GDPR, consisting of Standard Contractual Clauses approved by the European Commission which you can find here: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32021D0914
- for the issuance and management of the Qualified Digital Certificate issued by Alfatrust Certification S.A. for signing the documentation in relation to BT
If your identification was successful, in order to sign the documentation related to BT with a qualified electronic signature, it is necessary to have a qualified digital certificate.
Issuing and using the digital certificate for signing does not involve costs for you, but it is necessary for BT and Alfatrust to jointly process, as associated operators, personal data concerning you, as follows:
a. Operators of personal data
Based on Art. 13-14 of EU Regulation 679/2016 - General Data Protection Regulation (“GDPR”), Alfatrust Certification S.A. (“Alfatrust”) and Banca Transilvania S.A. (“BT” or “Bank”), having the identification and contact data indicated within the Terms and Conditions for providing certification services for qualified digital certificates, informs you about the processing of your personal data, as User (“data subject”), which is carried out by it as associated operators for the purpose mentioned in point b below.
b. The purpose and legal basis for processing personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate ("the Certificate").
BT is the operator that identifies the User, respectively collects from them the personal data necessary for issuing the Qualified Digital Certificate, and transmits it to Alfatrust so that this operator can issue the certificate.
The data that BT collects from Users are those processed by the Bank in its own records, in the context of the business relationship that is initiated between the User and the Bank at the time of data transmission to Alfatrust.
In the validity period of the certificate, personal data is processed by the associated operators, as appropriate, including in situations where Users request the suspension or revocation of the certificate in the manners detailed in the Terms and Conditions of service provision.
The legal grounds for processing personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit. c GDPR), the conclusion/performance of the Contract (Art. 6 para. 1 lit. b GDPR), and the legitimate interest of the associated operators (Art. 6 para. 1 lit. f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User initiates a business relationship, and Alfatrust - as an accredited certification services provider from whom the User wishes to obtain a certificate, are subject to the legal provisions applicable in the field of money laundering prevention and terrorism financing, according to which they must collect a series of personal data. These data are also necessary for concluding/executing the Contract under which the User is allowed to use the certificate for signing documentation in relation to BT.
To assist Users who wish to submit a request for suspension or withdrawal of the certificate, the associated operators justify a legitimate interest in offering them the possibility to send these requests not only directly to Alfatrust, but also through BT. The resolution of these requests involves the exchange of personal data of the Users between the two associated operators.
Contact details - phone number and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.
c, Categories of personal data and of persons whose personal data areprocessed.
Personal data processed in order to fulfill the mentioned purpose are those provided by law as mandatory to be collected by a credit institution, respectively by a certification services provider for the prevention of money laundering and the sanctioning of terrorism, namely: name, surname, personal numeric code (CNP), home/residence address, identity document validity date, phone number and copy of the identity document. All these data, as collected by the Bank, will be made available to Alfatrust for the issuance and management of the Qualified Digital Certificate.
Processing of these personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have these data processed leads to the impossibility of issuing the Qualified Digital Certificate.
The individuals targeted by this processing are only the Users, as they are defined in the Terms and Conditions of use.
d. Recipients of personal data.
With the exception of associated operators between whom a transfer of personal data processed for the purpose of processing will be carried out, the data are disclosed, as appropriate, to employees of the associated operators who need to know them, IT service providers, auditors, authorities and institutions entitled to know them.
e. The period of processing of personal data.
The information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiration, in accordance with the legally established deadlines.
At the level of Transilvania Bank, the remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship is conducted between the Client User and BT, to which are added the terms established in the applicable banking legislation, namely at least 5 years from the termination of the business relationship with the credit institution.
f. Rights of the data subjects regarding the processing of their personal data for the indicated purpose.
To any User, in their capacity as a data subject, the exercise of the following rights regarding the processing of their personal data is guaranteed with any of the associated operators: the right of access, the right to rectification, the right to restriction of processing, the right to data deletion, the right to object to data processing, the right to data portability.
Users can exercise these rights or contact the data protection officers for any questions/requests regarding the processing of personal data, as follows:
- at Banca Transilvania S.A. - by message sent to the e-mail address dpo@btrl.ro or by a request
sent to the BT headquarters, with the mention "to the attention of the data protection officer (DPO)"
- to Alfatrust Certification S.A.- by message sent to the email address dataprotection@alfasign.ro or by a request sent to Alfatrust headquarters, with the mention "to the attention of the data protection officer (DPO)".
Users also have the right to file a complaint with the supervisory authority - the National Supervisory Authority for Personal Data Processing (ANSPDCP), with headquarters in Bucharest, sector 1, General Gh. Magheru Blvd. no. 28-30.
- For communication with you
If the electronic signing of the document in relation to BT is successfully completed, we will send it to the e-mail address from which you initiated the signing flow. We have this contact data, as well as your phone number, from you (e.g., if you declared them to the bank when you became a client) or, as the case may be, we received them from the account holder client who authorized you to sign the documentation in relation to the bank.
If your identification was successful, in order to sign the documentation related to BT with a qualified electronic signature, it is necessary to have a qualified digital certificate.
Issuing and using the digital certificate for signing does not involve costs for you, but it is necessary for BT and Alfatrust to jointly process, as associated operators, personal data concerning you, as follows:
- Personal data operators
Based on Art. 13-14 of EU Regulation 679/2016 - General Data Protection Regulation (“GDPR”), Alfatrust Certification S.A. (“Alfatrust”) and Banca Transilvania S.A. (“BT” or “Bank”), having the identification and contact data indicated within the Terms and Conditions for providing certification services for qualified digital certificates, informs you about the processing of your personal data, as User (“data subject”), which is carried out by it as associated operators for the purpose mentioned in point b below.
- The purpose and basis of processing personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Certificate
Digital Certificate (“The Certificate”).
BT is the operator that identifies the User, respectively collects from them the personal data necessary for issuing the Qualified Digital Certificate, and transmits it to Alfatrust so that this operator can issue the certificate.
The data that BT collects from Users are those processed by the Bank in its own records, in the context of the business relationship that is initiated between the User and the Bank at the time of data transmission to Alfatrust.
In the validity period of the certificate, personal data is processed by the associated operators, as appropriate, including in situations where Users request the suspension or revocation of the certificate in the manners detailed in the Terms and Conditions of service provision.
The legal grounds for processing personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit. c GDPR), the conclusion/performance of the Contract (Art. 6 para. 1 lit. b GDPR), and the legitimate interest of the associated operators (Art. 6 para. 1 lit. f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User initiates a business relationship, and Alfatrust - as an accredited certification services provider from whom the User wishes to obtain a certificate, are subject to the legal provisions applicable in the field of money laundering prevention and terrorism financing, according to which they must collect a series of personal data. These data are also necessary for concluding/executing the Contract under which the User is allowed to use the certificate for signing documentation in relation to BT.
To assist Users who wish to submit a request for suspension or withdrawal of the certificate, the associated operators justify a legitimate interest in offering them the possibility to send these requests not only directly to Alfatrust, but also through BT. The resolution of these requests involves the exchange of personal data of the Users between the two associated operators.
Contact details - phone number and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.
- Categories of personal data and persons whose personal data areprocessed.
Personal data processed in order to fulfill the mentioned purpose are those provided by law as mandatory to be collected by a credit institution, respectively by a certification services provider for the prevention of money laundering and the sanctioning of terrorism, namely: name, surname, personal numeric code (CNP), home/residence address, identity document validity date, phone number and copy of the identity document. All these data, as collected by the Bank, will be made available to Alfatrust for the issuance and management of the Qualified Digital Certificate.
Processing of these personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have these data processed leads to the impossibility of issuing the Qualified Digital Certificate.
The individuals targeted by this processing are only the Users, as they are defined in the Terms and Conditions of use.
- Recipients of personal data.
With the exception of associated operators between whom a transfer of personal data processed for the purpose of processing will be carried out, the data are disclosed, as appropriate, to employees of the associated operators who need to know them, IT service providers, auditors, authorities and institutions entitled to know them.
- Period of processing of personal data.
The information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiration, in accordance with the legally established deadlines.
At the level of Transilvania Bank, the remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship is conducted between the Client User and BT, to which are added the terms established in the applicable banking legislation, namely at least 5 years from the termination of the business relationship with the credit institution.
- The rights of the data subjects whose personal data is processed for the indicated purpose.
To any User, in their capacity as a data subject, the exercise of the following rights regarding the processing of their personal data is guaranteed with any of the associated operators: the right of access, the right to rectification, the right to restriction of processing, the right to data deletion, the right to object to data processing, the right to data portability.
Users can exercise these rights or contact the data protection officers for any questions/requests regarding the processing of personal data, as follows:
- at Banca Transilvania S.A. - by message sent to the e-mail address dpo@btrl.ro or by a request sent to the BT headquarters, with the mention "to the attention of the data protection officer (DPO)"
- to Alfatrust Certification S.A.- by message sent to the email address dataprotection@alfasign.ro or by a request sent to Alfatrust headquarters, with the mention "to the attention of the data protection officer (DPO)".
Users also have the right to file a complaint with the supervisory authority - the National Supervisory Authority for Personal Data Processing (ANSPDCP), with headquarters in Bucharest, sector 1, General Gh. Magheru Blvd. no. 28-30.
- For communication with you
If the electronic signing of the document in relation to BT is successfully completed, we will send it to the e-mail address from which you initiated the signing flow. We have this contact data, as well as your phone number, from you (e.g., if you declared them to the bank when you became a client) or, as the case may be, we received them from the account holder client who authorized you to sign the documentation in relation to the bank.
Your rights, contact details of the DPO and details about the processing of personal data
Your rights, contact details of the DPO and details about the processing of personal data
Other details about how BT processes, in general terms, the personal data of BT clients, including information about your rights, how you can exercise them, and the contact details of BT's data protection officer (BT DPO), are provided to you in General information note, with which this information is completed. You can find it on the website www.bancatransilvania.ro, in the section Privacy Hub
