1. Who is the personal data operator and the data subjects?
1. Who is the personal data operator and the data subjects?
BANCA TRANSILVANIA S.A. (“the bank”, “BT” or “we”) credit institution, Romanian legal entity, with identification and contact details in section III of General information note regarding the processing and protection of personal data belonging to BT Clients, („General information note”) offers to some categories of legal entities1 the possibility of opening the business relationship with the bank („business relationship PJ”) through the internet/ mobile banking application for legal entities - BT Go.
If you legally represent the legal entity, you can apply for opening the business relationship with the legal entity through BT Go. BT will process your personal data, as the sole operator or together with other operators, according to this information note. You are the data subject of the processing.
1 Legal entities that can open the business relationship PJ through BT Go must have a sole associate, who is also the sole legal representative of the company and the only beneficial owner. Both the company and the individual must have residency in Romania.
2. On what grounds do we process the data and what happens if you refuse their processing?
2. On what grounds do we process the data and what happens if you refuse their processing?
When you want to open the PJ business relationship through BT Go, we process your personal data on the following grounds:
- legal obligations of BT (e.g. customer due diligence for the prevention of money laundering and terrorist financing, remote identification by video means)
- the conclusion/ execution of the contract – business relationship PJ
- the legitimate interest of BT and/or of some third parties, (e.g. for fraud prevention, to collect your choice regarding data processing for advertising purposes, to offer you support if you interrupt the application process, to verify if you are eligible for opening the PJ business relationship)
- your consent (e.g. for processing biometric data for remote identity verification by video means*, the agreement to receive advertising messages**)
* If you do not accept the processing of biometric data, you cannot open the business relationship PJ through BT GO. However, you can do this at any BT unit, without processing this data.
** If you do not want to give your consent to receive advertising messages, you can continue the process of opening the business relationship PJ through BT Go
On the other hand, if we have a legal obligation to process your data or if they are necessary for the conclusion of the contract, if you refuse their processing, BT will not be able to open the business relationship PJ.
3. For what purposes do we process your personal data, what data is processed and to whom do we disclose it?
3. For what purposes do we process your personal data, what data is processed and to whom do we disclose it?
A. for the verification of identity and quality as sole associate/ legal representative/ ultimate beneficiary of the company
Legislation for customer due diligence to prevent money laundering and terrorist financing obliges us to verify the identity of legal entities with whom we are about to establish a business relationship, including the natural persons who are representatives, authorized agents, actual beneficiaries of these entities. Also, we have a legitimate interest to ensure that we prevent attempts of fraud by identity theft, especially in the online environment.
For your remote identification, we will take photos of you and your identity document and we will use your facial biometric data (facial recognition) — only with your consent, which will be requested separately in BT Go.
Here is how we should proceed:
- Photograph the ID card front and back (requires access to the camera). We automatically extract the data from it, including the photo, and compare it with those from the General Directorate for Person Records - G.D.P.R. (see here details about the processing of data provided by D.G.E.P.). to verify eligibility in BT GO.
- You move in front of the camera (requires access to the photo camera) and take a selfie, so that we can confirm you are a real person. We compare your facial features from the selfie, ID card, and the photo from D.G.E.P.. The analysis is based on criteria such as the color, size, and tilt of the eyes, the position and distance between the eyes, eyebrows, lips, and nose. The data used for and resulting from the comparison are biometric data, which uniquely identify you. If the score issued by the facial recognition tool is unsatisfactory, you will be able to retake the application process at a BT unit.
- We verify your data in the Trade Registry to confirm that you are the sole associate, legal representative, and beneficial owner of the company and that you and the company have residence in Romania — necessary conditions for opening the business relationship PJ through BT Go.
- We collect your phone number and email, both personal and company-related, which we verify to ensure you have access to them. We will use them for communications related to the contractual relationship with the bank and for the electronic signing of documents necessary for opening the PJ business relationship through BT Go. If you are already a BT individual client – account holder or non-account holder – when you initiate this process through BT Go, it is necessary to declare the same personal contact data (phone number/ email address) that you already have registered with the bank. Otherwise, you will not be able to continue the process of opening the PJ business relationship through BT Go.
Personal data indicated at points 1-4, used for identification, are also processed to allow you to initially set the security code (PIN) in BT Go.
For remote identification in BT GO, we use the services of the service provider Onfido and some of its subcontracted partners. They process the data from your photographed ID card, your image (from selfies/videos taken in BT GO), and facial biometric data only on behalf of and under the instructions of the bank.
Based on BT's legitimate interest in ensuring the correct and efficient operation of the application, BT GO has access to the device settings related to vibration, to confirm the successful completion of each step in the identity verification process. This functionality provides you with confirmation that you can proceed to the next step.
Onfido and its partners may be located in third countries, such as the UK (with adequate data protection recognized by the European Commission), or in other countries that do not have such a decision. In the latter cases, we have ensured that the data transfer is carried out on the basis of appropriate safeguards provided by the GDPR, consisting of Standard Contractual Clauses approved by the European Commission which you can find here: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0915&from=RO
B. for knowing the clientele and for concluding/ conducting the business relationship PJ
As the sole legal representative, beneficial owner, and partner of the company, as well as the authorized person with operating rights on the company's accounts, we are obliged to process your personal data for customer identification in order to prevent money laundering and terrorist financing. For this, we are required to collect, update, and store at least the following categories of personal data about the account holder client (as applicable): name, first name, alias, date and place of birth, personal numerical code or another similar unique identification element, citizenship, domicile, residence, address of residence and its legal status, phone number, fax, email address, occupation, employer's name or the nature of own activity, the purpose and nature of the business relationship with the bank, the source of funds to be used in the business relationship, the estimated level of daily transactions, classification/non-classification as politically exposed persons (PEP), source of wealth and important public function held (only in the case of PEP), as well as the details and a copy of the identity document. Some of these categories of data are processed, for the same purpose and legal basis, also for non-account holder clients (representatives, authorized persons with operating rights on the account, and the beneficial owner of the account holder client).
The data collected for customer knowledge, including checks, documents and transactions, contribute to establishing the risk profile and are kept for 5 years after the end of the relationship with the bank, with the possibility of extension, according to the law. At the end of the period, the data are deleted or anonymized, except when other legal provisions require their continued retention. According to the Tax Procedure Code, some data are reported daily to ANAF and are kept for 10 years from the termination of the business relationship.
At the same time, the bank allocates identifiers to clients, such as, but not limited to: client code (BT CIF), IBAN codes corresponding to the accounts opened at the bank, numbers corresponding to bank cards, based on which they can be identified in the bank's systems.
When necessary, clients' personal data will be disclosed/transferred to different categories of recipients (e.g., to ANAF - according to tax legislation, to other banks and their clients to whom/from whom BT clients transfer/collect amounts from/in BT accounts, to service providers used by the bank), including entities that are part of the BT Financial Group, for legitimate purposes and under conditions that ensure their security. All categories of recipients can be found in the dedicated section of General information notes.
For setting up the current account package, we will check the establishment date of your company and if it is less than 12 months old, we will offer you the package dedicated to newly established companies – The free first year account (which will be automatically changed when 12 months have passed since the company's establishment). Otherwise, you will be able to choose one of the Unlimited type packages.
It is necessary to process your personal data also for contracting the current account package and the banking products/services included in it (e.g. the IBAN of the current account from which the package price will be charged, for the BT Alert service included in the package the phone number of the legal representative is used, the unit chosen for card pickupor, as appropriate, the postal address for card delivery).
C. for collecting marketing options and for notifications in BT GO
Collecting marketing options
The Bank has a legitimate interest in collecting your choices regarding the processing of personal data for advertising purposes („marketing options”). If you are about to become a BT non-account-holder client in the process of opening the business relationship PJ through BT Go, a screen will be displayed in which you can choose to allow us to process your data for advertising purposes or to refuse.Onlyif you give your consent we will send you advertising messages.
Before you freely decide if you want to receive such messages, please consider the following:
What personal data do we use from you – if you choose to receive advertising messages, we process: your first name, last name, phone number, email address and correspondence address declared to the bank. Also, to ensure that the advertising messages are relevant, we will use other information we learn when you use our services/products (e.g. transaction data, age, location, income range, etc.). We will analyze this data automatically (profiling) to form an opinion about the products/services/events that would suit you. It is important to know that, in advertising messages sent by email, we use tracking pixels and/or other similar technologies to better understand how you interact with the messages. Through these technologies, we collect information such as: when/if you opened the email, links or certain areas accessed within the email. Thus, we can improve our marketing strategies and send you more relevant advertising messages. You can avoid tracking of emails through these technologies by adjusting your email inbox settings (according to the options offered by your email service provider). Duration of consent - if you choose to receive advertising messages, the expressed consent is valid until you withdraw/modify it or, otherwise, until the termination of the BT customer status - account holder or non-account holder (e.g. authorized person, representative of a client).
To whom do we disclose your data – if you choose to be contacted for advertising purposes, depending on your option, BT will communicate your data to:
(1) BT subsidiaries – entities from the Banca Transilvania Financial Group (BT Microfinancing IFN SA, BT Asset Management S.A.I. S.A., BT Leasing Transilvania I.F.N. S.A., BT Direct I.F.N. S.A., BT Capital Partners S.S.I.F. S.A., BT Pensions Voluntary Pension Funds Management Company S.A., BT Broker S.R.L., The Romanian Entrepreneur Club Foundation, Cluj has Soul Foundation and other entities that may join this group in the future), except in cases where you have expressed communication preferences directly to the subsidiaries;
(2) current or future partners of BT and/or BT's subsidiaries, whose products/services/events are related to BT's services/products – the list of current partners is accessible at this link or, upon request, at any BT unit or BT subsidiary.
At the same time, for the transmission of advertising messages, your data will be disclosed to service providers, who will process them as persons authorized by BT, by BT's subsidiaries or by their partners.
Which communications are not influenced by marketing options - the options expressed regarding the processing of personal data for advertising purposes, whatever they may be: (a) do not relate to messages of general interest or of particular interest for clients, which are transmitted by BT based on its legitimate interests in properly conducting the business relationship or based on its legal obligations; (b) do not affect the subscription/unsubscription of the e-mail address entered in forms available on BT websites to receive information from various areas of interest. Subscribing to the newsletters available on the site it is done through the respective online forms, and unsubscription is managed by following the unsubscribe link in the newsletters received after subscribing.
If you express your consent to receive advertising messages, you can withdraw/ modify it at any time and/ or object to profiling for advertising purposes, as follows:
- by accessing the " sectionOptions regarding the processing of personal data in advertising purpose” from the bank's website www.bancatransilvania.ro;
- by accessing the dedicated section from internet or mobile banking;
- through BT units, where you can request our employees to update the options regarding the processing of your personal data for advertising purposes;
- sending a request in this regard to the BT headquarters, with the mention "to the attention of DPO";
Based on the information above, in the process for opening the PJ business relationship in BT Go, you will be shown both the option not to receive advertising messages (refusal), and the option to receive such messages (agreement). The agreement option will be divided into several categories from which you can choose: products and services of BT and/or BT subsidiaries, events organized by BT and/or BT subsidiaries, products/services of partners related to products/services of BT or BT subsidiaries, and events organized by BT partners.
If you are already a BT individual client (account holder or non-account holder) when you initiate the process of opening a business relationship PJ through BT Go, the screen for expressing marketing options will not be displayed to you, so the previously expressed marketing options, whatever they may be, will remain valid.
Collection of the option for and sending notifications in BT GO
During the process, you will be asked if you allow receiving notifications in BT GO. If you accept such notifications and do not complete the application process within the set deadline after setting your PIN, we will send you notifications to remind you to resume the process. In this case, you will resume the process from where you left off. If you do not set a PIN or if you do not complete the process within the set deadline, you will have to start the process from the beginning if you want to open your current account through BT GO.
D. For issuing and managing the Qualified Digital Certificate issued by Alfatrust Certification S.A. for signing the documentation for opening the business relationship PJ
To complete the process of opening the business relationship PJ through BT GO, it will be necessary to sign with a qualified electronic signature the application for opening the contractual/business relationship and for contracting the transactional products included in the current account package and, as the case may be, the enrollment form as a non-account holder client and the form with options regarding the processing of your data for advertising purposes.
Issuing and using the digital certificate for signing does not incur any costs for you, but it is necessary for BT and Alfatrust to jointly process, as joint operators, personal data concerning you for the issuance of this electronic signature, as we inform you in the following:
- Personal data operators
Based on Art. 13-14 of EU Regulation 679/2016 - General Data Protection Regulation (“GDPR”), Alfatrust Certification S.A. (“Alfatrust”) and Banca Transilvania S.A. (“BT” or “Bank”), having the identification and contact data indicated within the Terms and Conditions for providing certification services for qualified digital certificates , informs you about the processing of your personal data, as a User ("data subject"), carried out as joint controllers for the purpose mentioned in point b below.
b. Purpose and legal basis for processing personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate (“the Certificate”).
BT is the operator that identifies the User, respectively collects from them the personal data necessary for issuing the Qualified Digital Certificate, and forwards it to Alfatrust so that this operator can issue the certificate.
The data that BT collects from Users are those processed by the Bank in its own records, in the context of the business relationship initiated between the User and the Bank at the time of transmitting the data to Alfatrust.
During the validity period of the certificate, personal data are processed by the associated operators, as appropriate, including in situations where Users request the suspension or revocation of the certificate in the ways detailed in the Terms and Conditions of service provision.
The legal grounds for processing personal data for the defined purpose are the legal obligation (Art. 6 para. 1 letter c GDPR), the conclusion/ performance of the Contract (Art. 6 para. 1 letter b GDPR) and the legitimate interest of the associated operators (Art.6 para. 1 letter f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User initiates a business relationship, and Alfatrust - as an accredited certification service provider from which the User wishes to obtain a certificate, are subject to the applicable legal provisions in the field of preventing money laundering and terrorist financing, according to which they must collect a series of personal data. This data is also necessary for the conclusion/execution of the Contract under which the User is allowed to use the certificate for signing documentation related to BT.
To support Users who wish to submit a request for suspension or withdrawal of the certificate, the associated operators justify a legitimate interest in offering them the possibility to send these requests not only directly to Alfatrust, but also through BT. The processing of these requests involves the exchange of Users' personal data between the two associated operators.
Contact details - phone number and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.
c. Categories of personal data and of persons whose personal data areprocessed.
The personal data processed for the purpose of fulfilling the mentioned objective are those provided by law as mandatory to be collected by a credit institution, respectively by a certification service provider for the prevention of money laundering and terrorism financing, namely: name, first name, personal numerical code (CNP), home/residence address, identity document expiry date, phone number, and a copy of the identity document. All these data, as collected by the Bank, will be made available to Alfatrust for the issuance and management of the Qualified Digital Certificate.
Processing of this personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have this data processed results in the impossibility of issuing the Qualified Digital Certificate.
The individuals targeted by this processing are only the Users, as they are defined in the Terms and Conditions of use.
d. Recipients of personal data
With the exception of associated operators between whom a transfer of personal data processed for the purpose of processing will be carried out, the data are disclosed, as appropriate, to employees of the associated operators who need to know them, IT service providers, auditors, authorities and institutions entitled to know them.
e. Period of processing of personal data
Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiration, in accordance with the legally established terms.
At the level of Banca Transilvania, the remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which there is a business relationship between the client User and BT, to which are added the terms established in the applicable banking legislation, namely at least 5 years from the termination of the business relationship with the credit institution.
f. Rights of data subjects whose personal data are processed for the indicated purpose
To any User, in their capacity as a data subject, the exercise of the following rights regarding the processing of their personal data is guaranteed at any of the associated operators: the right of access, the right to rectification, the right to restriction of processing, the right to erasure of data, the right to object to data processing, the right to data portability.
Users can exercise these rights or contact the data protection officers for any questions/requests regarding the processing of personal data, as follows:
- at Banca Transilvania S.A. - by message sent to the e-mail address dpo@btrl.ro or by a request sent to the BT headquarters, with the mention "to the attention of the data protection officer (DPO)"
- to Alfatrust Certification S.A.- by message sent to the email address dataprotection@alfasign.ro or by a request sent to Alfatrust headquarters, with the mention "to the attention of the data protection officer (DPO)".
Users also have the right to file a complaint with the supervisory authority - the National Supervisory Authority for Personal Data Processing (ANSPDCP), with headquarters in Bucharest, sector 1, General Gh. Magheru Blvd. no. 28-30.
4. Retention period of personal data
4. Retention period of personal data
Personal data collected will be kept for 30 days, if you do not complete the current account opening request initiated in BT GO by applying the qualified electronic signature.
In case you have signed the necessary forms for the PJ business relationship and then gave up establishing it or it was refused to you, as well as in case you became a BT account holder client after going through this process, the data retention periods from the dedicated section of the General Information Note apply.
5. Your rights, the contact details of the DPO and details about the processing of personal data
5. Your rights, the contact details of the DPO and details about the processing of personal data
In general, the bank processes the personal data of BT clients according to General information notes, iar atunci când acestia utilizeaza BT Go, conform BT Go Privacy Policies. You can find this information on the website www.bancatransilvania.ro, in sectiunea Privacy Hub, where you have details about your rights and how you can exercise them and the contact details of the BT person responsible for data protection (BT DPO). This information note is completed with the mentions from the General information note and the Privacy Policy BT Go.
