1. Who is the personal data operator?
1. Who is the personal data operator?
BANCA TRANSILVANIA S.A. (hereinafter “the bank” or “BT”) credit institution, Romanian legal entity, with the identification and contact details presented in section III of General information note regarding the processing and protection of personal data belonging to BT Clients, offers individuals the possibility to open exclusively online a business relationship with the bank (“current account”), to contract certain products/ services (debit card, internet/ mobile banking) with the help of which they will be able to perform transactions on this account (“transactional products”), as well as to express their choices regarding the processing of their personal data for advertising purposes during the course of the business relationship (marketing options). All persons who successfully complete the steps on the platform become BT account holders (if they did not already have this status before).
In the general note indicated above, which is an integral part of BT Privacy Policy from the site www.bancatransilvania.ro, you can also find information about the rights that bank customers benefit from in relation to the processing of your personal data, about the ways in which they can exercise these rights or about how they can contact the data protection officer appointed by BT (DPO BT).
2. Who are the targeted persons?
2. Who are the targeted persons?
If you initiate the application process for the exclusively online opening of the business relationship and/or contracting of certain transactional products/services, BT will process certain personal data concerning you. Therefore, you are a “targeted person” of this processing. We will process your data for multiple purposes and legal bases, as we inform you through this information note.
This online process is dedicated to adult resident individuals who: either already have a relationship with BT but do not have an account opened in their name (e.g. BT clients who are non-account holders, such as: authorized representatives, representatives on other accounts), or do not have any relationship with BT (are non-BT clients). Also, individuals who are already BT account holder clients can go through the flow steps to exclusively contract transactional products online (e.g. internet/mobile banking).
3. On what grounds do we process the data and what happens if you refuse their processing?
3. On what grounds do we process the data and what happens if you refuse their processing?
Personal data processing carried out by BT when you go through the steps for exclusively online opening of the business relationship with the bank and/or contracting some transactional BT products/services is based on the following grounds:
- the legal obligations to which BT is subject through various normative acts (e.g. legislation in the field of customer due diligence for the prevention of money laundering and terrorist financing);
- closing/ execution of the contract for the current account and transactional products or following the necessary steps for concluding these contracts;
- our legitimate interest and/or that of third parties, (e.g. the interest in preventing fraud, the interest in requesting clients' expression of options regarding the processing of their data for advertising purposes);
- the consent of the data subjects, to the extent that they wish to express it (e.g. your explicit consent for the processing of biometric data for verifying your identity online, consent for recording image and voice during the audio-video interview that you will need to complete in order to open the account/contract the transactional products, agreement to receive advertising messages or to be contacted to be offered support if you interrupt the online flow);
If you do not agree with the processing of biometric data or with recording your voice and image, you will not be able to complete the online process, and if you refuse to express your marketing options or to be contacted for the purpose of providing support, there are no consequences and you can continue the application process.
On the other hand, when the law requires us to carry out certain processing of personal data or when they are necessary for concluding contracts, if you refuse their processing, BT will not be able to open an account for you or allow you to obtain the transactional products available on this platform.
4. For what purposes do we process personal data, what are the data, for how long do we keep them, and to whom can we disclose them?
4. For what purposes do we process personal data, what are the data, for how long do we keep them, and to whom can we disclose them?
A. Personal data processed for identity verification, as well as, if applicable, for confirming the status of a BT Client
Legislation in the field of preventing money laundering, which is applicable to us, obliges us to verify the identity of the persons with whom we are about to conclude various contracts/ transactions. Also, we have a legitimate interest in ensuring that we prevent attempts of fraud through identity theft, especially in the online environment.
When a person requests to open an account at the bank or to contract certain banking products at a BT unit, their identity and possible BT client status are verified based on the original identity document presented.
In the online environment we do not have this possibility, so we will do things a little differently. We have chosen a method that ensures who is the person wishing to go through the process (including if they are already a BT client), so that we can prevent potential fraud attempts and fulfill our legal obligations to verify their identity. This method uses the latest technologies, processing the so-called biometric data. However, we will not be able to use this data without your explicit consent. If you choose to express this agreement, please check the box next to the text “I agree with the processing of my biometric data” from the platform. In case you do not agree, you can apply at a BT unit.
Before freely deciding whether you want to explicitly give this consent, here is what the use of your biometric data involves:
1. you will have to upload a copy of the identity card ("ID") or take a photo of it on the spot, which also contains your photo/image. The image will be automatically taken from the ID (requires access to the camera);
2. then you take a selfie in the platform (requires access to the camera);
3. a facial recognition tool will first ensure that you are a real person and then, it will detect your face in the ID photo and in the taken selfie, it will identify in the two images - by automated means - characteristics such as: estimated age, emotions, gender, attitude, smile, and other facial landmarks, which it will compare and verify the likelihood that the two faces belong to the same person. Following the automatic comparison process, the facial recognition tool will issue a "confidence" score. The higher this score, the greater the probability that the face in the two images belongs to the same person;
4. We do not make the decision to open your business relationship or to allow you to contract a transactional product exclusively based on this automatic processing of your data, but you will enter into an audio-video call with a BT employee, who will verify this data and collect other necessary information to ensure that there are no impediments to concluding the contracts. The video call will be recorded, and for its execution it will be necessary to access the camera and the microphone of your device to record and play the image and voice
If the score issued by the facial recognition tool is unsatisfactory, you will be able to restart the application process at a BT unit. If the confidence score is satisfactory, we will continue verifying the identity and, where applicable, your status as a client as follows:
We will automatically retrieve the data from the photographed ID card (through optical character recognition) and based on it we will verify whether you are already a BT client and if you meet the conditions to apply (adult and resident). The data taken from the ID card will also be used to complete the business relationship opening application with the bank and to contract the transactional products, as the case may be.
We will also request contact details from you - phone number and email address - which we will verify to ensure that they belong to you, as it is very important that they are correct and up to date. They will be used to send you messages of particular or general interest related to your status as a bank client or responses to various requests/complaints that you will send us. Also, only if you choose to express your consent for the processing of your data for advertising purposes, these contact details will be used to send you such marketing messages.
B. Personal data processed for the purpose of customer knowledge to prevent money laundering and terrorism financing, as well as for the conclusion and execution of current account contracts and for transactional products
For the prevention of money laundering and terrorist financing, the bank applies customer due diligence measures to all persons who wish to become its clients, as well as to those who are already clients, account holders or non-account holders (persons representing the account holders, who have operating rights on their accounts or are their real beneficiaries). For the purpose of applying these measures, the bank has the legal obligation to collect, update and store at least the following categories of personal data about the account holder client (as appropriate): name, surname, pseudonym, date and place of birth, personal numerical code or another similar unique identification element, citizenship, domicile, residence, the address where the person lives and its legal status, telephone number, fax, e-mail address, occupation, employer's name or nature of own activity, the purpose and nature of the business relationship with the bank, the source of the funds to be used in the business relationship, the estimated level of daily transactions, classification/non-classification as a politically exposed person (PEP), the source of wealth and important public office held (only in the case of PEP), as well as the details and a copy of the identity document. Some of these categories of data are processed for the same purpose and legal basis also for non-account holder clients (representatives, authorized persons with operating rights on the account and the real beneficiary of the account holder client).
These data, together with all records obtained through the application of customer knowledge measures imposed by law - such as monitoring and checks carried out by the bank, supporting documents and transaction records, including the results of any analysis carried out in relation to the client - determine the client's risk profile and will be kept for a period of 5 years after the termination of the business relationship between the account holder client and the bank. This legal retention period may be extended under the same legislation. Upon expiration of the retention period under this legislation, the bank will delete or anonymize these data, except in cases where other legal provisions require their continued retention. According to the legal obligation established on the bank through the Tax Procedure Code, some of the aforementioned data are also processed for the preparation of the report that BT must submit daily to ANAF regarding account holders, their representatives, persons authorized to sign on accounts, and ultimate beneficiaries. The legal retention period for these data is 10 years from the termination of the business relationship.
At the same time, the bank assigns the client identifiers, such as, but not limited to: client code (CIF BT), IBAN codes related to accounts opened at the Bank, numbers related to bank cards, on the basis of which the client can be identified in the bank's systems.
In situations where it is mandatory or necessary, the personal data of clients will be disclosed/transferred to different categories of recipients (e.g., to ANAF - according to fiscal legislation, to other banks and their clients to whom/from BT clients BT transfers/collects amounts from/in BT accounts, to service providers used by the bank), including entities that are part of the BT Financial Group, for legitimate purposes and under conditions that ensure their security. For all details related to the processing of BT clients' data, please read in full General information note regarding the processing and protection of personal data belonging to BT Clients.
C. For collecting the options of the data subjects regarding the processing of their personal data (as appropriate, consent, refusal, unexpressed option) for advertising purposes and regarding contact for offering support
Collecting marketing options
The bank has the legitimate interest to collect the options of clients/persons who wish to become clients regarding the processing of their personal data for advertising purposes. You are not obliged to express this option. However, if you decide to express it, you can choose to have your data processed for advertising purposes or to refuse.Only if you express your consent will we send you advertising messages.
Before you freely decide whether you want to receive such messages, please consider the following: Expressing consent for the processing of your data for the purpose of receiving advertising messages is optional. Refusal to give this consent does not affect your right to become/remain a BT client.
Personal data usually processed to send advertising messages to customers are: name, first name, phone number, email address and correspondence address declared to the bank for the established business relationship with it or, as the case may be, for the status of representative/ authorized person at BT.
If you choose to receive advertising messages, to ensure that they are relevant, we will also use other information we learn about you when you use our services/products (e.g. transaction data, age, location, income range, etc.). We will study these data automatically (profiling) to form an opinion about the products/ services/ events that would suit you.
In case you express your consent to receive advertising messages, it will be valid until you withdraw/modify it or, otherwise, until the termination of the business relationship/representative/authorized person status you have established with/at BT. If you wish to be contacted for advertising purposes, depending on the categories from which you will choose to receive advertising messages, your option/data will be communicated by BT for the purpose of sending advertising messages to:
- entities within the Financial Group Banca Transilvania – BT Microfinancing IFN SA, BT Asset Management S.A.I. S.A., BT Leasing Transilvania IFN S.A., BT Direct IFN S.A., BT Capital Partners S.S.I.F. S.A., BT Pensions Voluntary Pension Fund Management Company SA, Romanian Entrepreneur Club Foundation, Cluj has Soul Foundation and other entities that may join this group in the future- („the BT subsidiaries”), except in the case where you have expressed preferences on proprietary forms used by subsidiaries for collecting marketing consent.
- current or future partners of BT and/or BT subsidiaries, whose products/services/events are related to BT services/products ("partners"). The list of categories of current partners of BT and/or BT subsidiaries is accessible at the link https://www.bancatransilvania.ro/partners or, upon request, at any BT unit or BT subsidiaries.
For the effective transmission of advertising messages, your data will be disclosed to suppliers - having the status of authorized persons by BT, BT subsidiaries, or their partners.
Please note that the options you will choose, whichever they may be:
- does not refer to messages of general interest or particular interest for clients, which are sent by BT based on its legitimate interests in carrying out the business relationship in good conditions or based on its legal obligations;
- are not applicable to commercial notifications/messages sent within BT's mobile applications, which have their own marketing options management system, available in the dedicated sections for settings or privacy;
- does not affect the subscription/unsubscription of any email address entered by you in forms available on BT websites to receive information from various fields of interest. Subscription to the respective newsletters is done through the respective online forms, and you can manage the unsubscription by following the unsubscribe link included in the messages received after subscribing
Given the information presented above, in the online process you will go through next you will have the possibility to express your options regarding the processing of your personal data for advertising purposes. You will be shown both the option not to receive advertising messages (refusal), as well as the option to receive such messages (consent). The consent option will be divided into several categories from which you can choose: products and services of BT and/or BT subsidiaries, events organized by BT and/or BT subsidiaries, products/services of partners related to products/services of BT or BT subsidiaries, and events organized by BT partners.
If you are already a BT client who previously expressed marketing consent and now select options that modify or withdraw the consent given in the past, we will mark the new options in our records and respect them, but we inform you that it may take up to 5 working days for us to ensure the removal of your data from ongoing campaigns. In this interval you may still receive advertising messages according to previous options.
With regard to the processing of your personal data for advertising purposes, your rights under the General Data Protection Regulation (GDPR) are guaranteed.
If you choose to express your consent to receive advertising messages, you can always withdraw/ modify it and/ or object to profiling for advertising purposes, as follows:
- by accessing the section Marketing options from the bank's website- www.bancatransilvania.ro;
- by accessing the dedicated section of the internet/ mobile banking platform; through BT units, where you can request our employees to update the options regarding the processing of your personal data for advertising purposes;
- sending a request in this regard to the BT headquarters, with the mention "attention to DPO";
Collecting the option regarding contacting for the purpose of offering support
If you interrupt the online application flow at any point, we want to provide you with the necessary support to be able to resume it, in case you interrupted it due to some technical difficulties encountered. We will ask you during the online application process if you give your consent for us to contact you for support purposes and we will only call you if you grant it to us.
D. For proving your claims/ agreements/ options regarding, as the case may be: opening the business relationship, contracting transactional products, expressing marketing options.
In order to prove that we have fulfilled our legal obligation to apply customer due diligence measures, as well as the fact that you have requested the account opening, the contracting of transactional products, or have expressed certain marketing options, we need to record and keep the audio-video interview you will have with one of our employees. The recording of your voice and image during the interview can only be done with your consent. By accessing the link that takes you to the interview space, you express this consent. If you do not wish to give your consent for recording, you can visit a BT branch to request account opening and/or product contracting.
E. For the issuance and management of the Qualified Digital Certificate issued by Namirial S.p.a for signing documentation in relation to BT
To complete this online application process, it will be necessary to sign the relevant documentation with a qualified electronic signature. The issuance and use of the digital certificate for signing entail no costs for you; however, it is necessary that BT and Namirial S.p.a. – the qualified services provider – process personal data concerning you, as associated operators, which are necessary for the issuance of this electronic signature. For this purpose, your name, surname, personal numeric code (CNP), ID card data (series and number, type of document, issuing authority, issue and expiration date), country of residence, and your phone number will be transmitted by BT to Namirial S.p.a. This operator will process these mainly to fulfill its purposes related to customer knowledge and for issuing and managing the digital certificate, as well as for other purposes detailed in the personal data processing information note, which will be displayed to you during the online process by Namirial S.p.a.
