1. Who is the personal data controller and the data subjects?
1. Who is the personal data controller and the data subjects?
BANCA TRANSILVANIA S.A. (“the bank”, “BT” or “we”) credit institution, Romanian legal entity, with identification data and contact details from section III of General information note concerning the processing and protection of personal data belonging to BT Clients, („General information note”) offers to certain categories of legal entities1 possibility to open the business relationship with the bank („business relationship PJ”) through the internet/ mobile banking application for legal entities - BT Go.
If you legally represent the legal entity, you can apply for opening the business relationship PJ through BT Go. BT will process your personal data, as a sole operator or together with other operators, according to this information note. You are the data subject.
1 Legal entities that can open a business relationship PJ through BT Go must have a sole associate, who is also the sole legal representative of the company and the only beneficial owner. Both the company and the natural person must reside in Romania.
2. On what grounds do we process the data and what happens if you refuse their processing?
2. On what grounds do we process the data and what happens if you refuse their processing?
When you want to open the business relationship PJ through BT Go, we process your personal data on the following grounds:
- legal obligations of BT (e.g. customer knowledge for preventing money laundering and terrorist financing, remote identification through video means)
- conclusion/ execution of the contract – business relationship PJ
- the legitimate interest of BT and/or of some third parties, (e.g., for fraud prevention, to collect your option regarding data processing for advertising purposes, to provide you support if you interrupt the application process, to verify if you are eligible to open the business relationship PJ)
- your consent (e.g. for the processing of biometric data for remote identity verification by video means*, consent to receive advertising messages**)
* If you do not accept the processing of biometric data, you cannot open the business relationship PJ through BT GO. However, you can do this at any BT unit, without processing this data.
** If you do not want to give your consent to receive advertising messages, you can continue the process of opening the PJ business relationship through BT Go
On the other hand, if we have a legal obligation to process your data or if they are necessary for the conclusion of the contract, if you refuse their processing, BT will not be able to open the business relationship PJ.
3. For what purposes do we process your personal data, what data is collected and to whom do we disclose it?
3. For what purposes do we process your personal data, what data is collected and to whom do we disclose it?
A. for verifying the identity and the status of sole associate / legal representative / beneficial owner of the company
Legislation for client identification for the prevention of money laundering and terrorist financing obliges us to verify the identity of legal entities with whom we are about to establish a business relationship, including natural persons who are representatives, authorized persons, real beneficiaries of the entity. Also, we have a legitimate interest in ensuring that we prevent attempts of fraud through identity theft, especially in the online environment.
For your remote identification, we will take photos of you and your identity document and use your facial biometric data (facial recognition) — only with your consent, which will be requested separately in BT Go.
Here is how we should proceed:
- Photograph the ID card front and back (requires access to the camera). We automatically extract the data from it, including the photo, and compare them with those from the General Directorate for Persons Records - G.D.P.R. (see here details about the processing of data provided by D.G.E.P.). to check eligibility in BT GO.
- You move in front of the camera (requires access to the camera) and take a selfie, so we can confirm that you are a real person. We compare the facial features from your selfie, ID card, and the photo from D.G.E.P.. The analysis is based on criteria such as color, size, and tilt of the eyes, position and distance between eyes, eyebrows, lips, and nose. The data used for and resulting from the comparison are biometric data that uniquely identify you. If the score issued by the facial recognition tool is unsatisfactory, you will be able to restart the application process at a BT branch.
- We verify your data in the Trade Register to confirm that you are the sole associate, legal representative, and beneficial owner of the company and that you and the company have residency in Romania — necessary conditions for opening the business relationship PJ through BT Go.
- We collect your phone number and email, both personal and company ones, which we verify to ensure that you have access to them. We will use them for communications related to the contractual relationship with the bank and for the electronic signing of the documents necessary for opening the business relationship PJ through BT Go. If you are already a BT individual client – account holder or non-account holder – when you initiate this process through BT Go, it is necessary to declare the same personal contact details (phone number/ email address) that you already have registered with the bank. Otherwise, you will not be able to continue the process of opening the PJ business relationship through BT Go.
The personal data indicated at points 1-4, used for identification, are also processed to allow you to set the initial security code (PIN) in BT Go.
For remote identification in BT GO, we use the services of the service provider Onfido and some of its subcontracted partners. They process the data from your photographed ID card, your image (from selfies/videos taken in BT GO), and the facial biometric data only on behalf of and under the instructions of the bank.
Based on BT's legitimate interest in ensuring the correct and efficient functioning of the application, BT GO has access to the device settings related to vibration, to confirm the successful completion of each step in the identity verification process. This functionality provides you with confirmation that you can proceed to the next step.
Onfido and its partners may be located in third countries, such as the UK (with adequate data protection recognized by the European Commission), or in other countries that do not have such a decision. In the latter cases, we have ensured that the data transfer is carried out based on appropriate guarantees provided by the GDPR, consisting of Standard Contractual Clauses approved by the European Commission which you can find here: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0915&from=RO
B. for knowing the clientele and for concluding/ conducting the business relationship with PJ
As the sole legal representative, beneficial owner, and partner of the company, as well as the authorized person with operating rights on the company's accounts, we are obliged to process your personal data for customer identification in order to prevent money laundering and terrorism financing. For this purpose, we are obligated to collect, update, and store at least the following categories of personal data about the account holder client (as applicable): name, first name, pseudonym, date and place of birth, personal numeric code or another unique similar identification element, citizenship, domicile, residence, the address where they live and its legal status, phone number, fax, email address, occupation, employer's name or nature of own activity, purpose and nature of the business relationship with the bank, source of funds to be used in the business relationship, estimated level of daily transactions, classification/non-classification as a politically exposed person (PEP), source of wealth, and important public function held (only in case of PEP), as well as details and a copy of the identity document. Some of these categories of data are processed, for the same purpose and legal basis, also for non-account holder clients (representatives, authorized persons with operating rights on the account, and the beneficial owner of the account holder client).
The data collected for customer knowledge, including verifications, documents, and transactions, contribute to establishing the risk profile and are kept for 5 years after the end of the relationship with the bank, with the possibility of extension, according to the law. At the end of the period, the data are deleted or anonymized, except when other legal provisions require their continued retention. According to the Tax Procedure Code, some data are reported daily to the National Agency for Fiscal Administration (ANAF) and are kept for 10 years from the termination of the business relationship.
At the same time, the bank allocates to clients identifiers, such as, but not limited to: client code (BT CIF), IBAN codes related to accounts opened at the bank, numbers related to bank cards, based on which they can be identified in the bank's systems.
When necessary, customers' personal data will be disclosed/ transferred to different categories of recipients (e.g., to ANAF - according to tax legislation, to other banks and their clients to whom/from whom BT clients transfer/collect amounts from/in BT accounts, to service providers used by the bank), including entities that are part of the BT Financial Group, for legitimate purposes and under conditions that ensure their security. All categories of recipients are found in the dedicated section of General information notes.
For setting up the current account package, we will check the date of your company's establishment and if it is less than 12 months old, we will offer you the package dedicated to newly established companies – The first year free account (which will be automatically changed when 12 months have passed since the company's establishment). Otherwise, you will be able to choose one of the Unlimited type packages.
It is necessary to process your personal data also for contracting the current account package and the banking products/services included therein (e.g., the IBAN of the current account from which the package price will be charged, for the BT Alert service included in the package the phone number of the legal representative is used, the unit chosen for card pickup or, as appropriate, the postal address for card delivery).
C. for collecting marketing options and for notifications in BT GO
Collecting marketing options
The bank has a legitimate interest in collecting your options regarding the processing of personal data for advertising purposes ("marketing options”). If you are about to become a BT non-account holder client in the process of opening the business relationship PJ through BT Go, you will be shown a screen where you can choose to allow us to process your data for advertising purposes or to refuse. Onlyif you express your agreement we will send you advertising messages.
Before you freely decide if you want to receive such messages, please keep the following in mind:
What personal data do we use from you – if you choose to receive advertising messages, we process: your first name, last name, phone number, declared email address and correspondence address to the bank. At the same time, to ensure that advertising messages are relevant, we will also use other information we find out when you use our services/products (e.g. transaction data, age, location, income range, etc.). We will analyze this data automatically (profiling) to form an opinion about the products/services/events that would suit you. It is also important for you to know that in advertising messages sent by email, we use tracking pixels and/or other similar technologies to better understand how you interact with the messages. Through these technologies, we collect information such as: when/if you opened the email, links or certain areas accessed within the email. This way, we can improve our marketing strategies and send you more relevant advertising messages. You can avoid email tracking through these technologies by adjusting your email inbox settings (according to the options offered by your email service provider). How long the consent is valid - if you choose to receive advertising messages, the expressed consent is valid until you withdraw/modify it or, otherwise, until the termination of the client status at BT - account holder or non-account holder (e.g., authorized person, client representative).
To whom do we disclose your data – if you choose to be contacted for advertising purposes, depending on your option, BT will communicate your data to:
(1) BT subsidiaries – entities from the Banca Transilvania Financial Group (BT Microfinanțare IFN SA, BT Asset Management S.A.I. S.A., BT Leasing Transilvania I.F.N. S.A., BT Direct I.F.N. S.A., BT Capital Partners S.S.I.F. S.A., BT Pensii Societate de Administrare a Fondurilor de Pensii Facultative S.A., BT Broker S.R.L., The Romanian Entrepreneur Club Foundation, Clujul Are Suflet Foundation and other entities that may join this group in the future), unless you have expressed communication preferences directly to the subsidiaries;
(2) current or future partners of BT and/ or BT subsidiaries, whose products/ services/ events are related to BT services/ products – the list of current partners is available at this link or, on request, at any BT or BT subsidiary unit.
Also, for sending advertising messages, your data will be disclosed to service providers, who will process them as authorized persons by BT, by BT subsidiaries, or by their partners.
Which communications are not influenced by marketing options - the options expressed regarding the processing of personal data for advertising purposes, whatever they may be: (a) do not refer to messages of general interest or of particular interest for clients, which are transmitted by BT based on its legitimate interests in carrying out the business relationship under good conditions or based on its legal obligations; (b) do not influence the subscription/unsubscription of the e-mail address entered in forms available on BT websites to receive information from various areas of interest. Subscription to the newsletters available on the site it is done through the respective online forms, and the unsubscription is managed by following the unsubscribe link in the newsletters received after subscribing.
If you express your consent to receive advertising messages, you can withdraw/modify it at any time and/or object to profiling for advertising purposes, as follows:
- by accessing the section „Options regarding the processing of personal data in advertising purpose” from the bank's website www.bancatransilvania.ro;
- by accessing the dedicated section from internet or mobile banking;
- through BT units, where you can request our employees to update the options regarding the processing of your personal data for advertising purposes;
- sending a request in this regard to the BT headquarters, with the mention "attention DPO";
Based on the information above, in the process of opening the business relationship PJ in BT Go, you will be shown both the option not to receive advertising messages (refusal) and the option to receive such messages (consent). The consent option will be divided into several categories from which you can choose: products and services of BT and/or BT subsidiaries, events organized by BT and/or BT subsidiaries, products/services of partners that are related to products/services of BT or BT subsidiaries, as well as events organized by BT partners.
If you are already a BT individual client (account holder or non-account holder) when you start the process of opening a business relationship for PJ through BT Go, the screen for expressing marketing options will not be displayed, so the previously expressed marketing options will remain valid, whatever they may be.
Collecting the option for and sending notifications in BT GO
During the process, you will be asked if you allow receiving notifications in BT GO. If you accept such notifications and do not complete the application process within the set deadline after you have set your PIN, we will send you notifications to remind you to resume the process. In this case, you will resume the process from where you left off. If you do not set a PIN or if you do not complete the process within the set deadline, you will have to start the process over if you want to open your current account through BT GO.
D. For the issuance and management of the Qualified Digital Certificate issued by Alfatrust Certification S.A. for signing the documentation for opening the business relationship PJ
To finalize the process of opening the business relationship for PJ through BT GO, it will be necessary to sign with a qualified electronic signature the application for opening the contractual/business relationship and for contracting the transactional products included in the current account package and, where applicable, the enrollment form as a non-account holder client and the form with options regarding the processing of your data for advertising purposes.
Issuance and use for signing of the digital certificate do not entail costs for you, but it is necessary for BT and Alfatrust to jointly process, as associated operators, personal data concerning you for the issuance of this electronic signature, as we inform you below:
- Operators of personal data
Under Articles 13-14 of EU Regulation 679/2016 - General Data Protection Regulation (“GDPR”), Alfatrust Certification S.A. (“Alfatrust”) and Banca Transilvania S.A. (“BT” or “the Bank”), having the identification and contact data indicated within the Terms and Conditions for providing certification services for qualified digital certificates, informs you about the processing of your personal data, as a User (“data subject”), carried out by associated operators for the purpose mentioned in point b below.
b. The purpose and the legal basis of processing personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate ("Certificate").
BT is the operator that identifies the User, respectively collects from them the personal data necessary for issuing the Qualified Digital Certificate, and transmits it to Alfatrust so that this operator can issue the certificate.
Data that BT collects from Users are those processed by the Bank in its own records, in the context of the business relationship initiated between the User and the Bank at the time of transmitting data to Alfatrust.
During the validity period of the certificate, personal data is processed by the associated operators, as appropriate, including in situations where Users request the suspension or revocation of the certificate in the manners detailed in the Terms and Conditions of service provision.
The legal grounds for processing personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit. c GDPR), the conclusion/ execution of the Contract (Art. 6 para. 1 lit. b GDPR), and the legitimate interest of the associated operators (Art.6 para. 1 lit. f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User initiates a business relationship, and Alfatrust - as an accredited certification service provider from which the User wishes to obtain a certificate, are subject to the applicable legal provisions in the field of preventing money laundering and terrorist financing, according to which they must collect a series of personal data. These data are also necessary for concluding/performing the Contract under which the User is allowed to use the certificate for signing the documentation in relation to BT.
To assist Users who wish to submit a request for suspension or withdrawal of the certificate, the associated operators justify a legitimate interest in offering them the possibility to send these requests not only directly to Alfatrust but also through BT. Resolving these requests involves the exchange of personal data of the Users between the two associated operators.
Contact details - phone number and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.
c. Categories of personal data and of persons whose personal data areprocessed.
Personal data processed for the purpose of fulfilling the mentioned objective are those provided by law as mandatory to be collected by a credit institution, respectively by a certification service provider for the prevention of money laundering and the sanctioning of terrorism, namely: last name, first name, personal numerical code (CNP), home/residence address, identity document expiry date, phone number, and a copy of the identity document. All these data, as collected by the Bank, will be made available to Alfatrust for the issuance and management of the Qualified Digital Certificate.
Processing of this personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate.
The persons targeted by this processing are only the Users, as defined in the Terms and Conditions of use.
d. Recipients of personal data
Except for the associated operators among whom a transfer of personal data processed for the fulfillment of the processing purpose will take place, the data is disclosed, as the case may be, to the employees of the associated operators who need to know it, IT service providers, auditors, authorities, and institutions entitled to know it.
e. Personal data processing period
Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiration, in accordance with the legally established terms.
At the level of Transilvania Bank, the remote electronic signature, applied on the basis of the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship is conducted between the client User and BT, to which are added the terms established by the applicable banking legislation, respectively at least 5 years from the termination of the business relationship with the credit institution.
p.Rights of data subjects whose personal data are processed for the indicated purpose
To any User, in his capacity as a data subject, the exercise of the following rights regarding the processing of his personal data by any of the associated operators is guaranteed: the right of access, the right to rectification, the right to restriction of processing, the right to data deletion, the right to object to the data processing, the right to data portability.
Users can exercise these rights or contact the data protection officers for any questions/ requests regarding the processing of personal data, as follows:
- to Banca Transilvania S.A.- by message sent to the e-mail address dpo@btrl.ro or by a request sent to the BT headquarters, with the mention "to the attention of the person responsible for data protection (DPO)"
- to Alfatrust Certification S.A.- through message sent to the e-mail address dataprotection@alfasign.ro or by a request sent to the Alfatrust headquarters, mentioning "to the attention of the data protection officer (DPO)".
Users also have the right to file a complaint with the supervisory authority - the National Supervisory Authority for Personal Data Processing (ANSPDCP), with headquarters in Bucharest, sector 1, G-ral Gh. Magheru Blvd. no. 28-30.
4. Period of retention of personal data
4. Period of retention of personal data
Personal data collected will be kept for 30 days if you do not complete the current account opening request initiated in BT GO by applying the qualified electronic signature.
In case you have signed the necessary forms for the PJ business relationship and then gave up on establishing it or it was refused, as well as in case you have become a BT account holder client following this process, the data retention periods from the dedicated section of the General Information Note apply.
5. Your rights, the contact details of the DPO and details about the processing of personal data
5. Your rights, the contact details of the DPO and details about the processing of personal data
Generally, the bank processes the personal data of BT clients according to General information notes, iar atunci când acestia utilizeaza BT Go, conform BT Go Privacy Policies. You find these notifications on the site www.bancatransilvania.ro, in sectiunea Privacy Hub, unde ai detalii despre drepturile tale si cum poti sa ti le exerciti si datele de contact ale responsabilul BT cu protecția datelor (DPO BT). Aceasta nota de informare se completeaza cu mentiunile din Nota de informare generala si din Politica de confidentialitate BT Go.
