3. For what purposes do we process personal data, what data is it, for how long do we keep it, and to whom can we disclose it?
A. Personal data processed for identity verification
Legislation in the field of anti-money laundering obliges us to verify the identity of persons requesting to open a current account (to establish a business relationship with the bank) and to contract products/services. We also have a legitimate interest in ensuring that we prevent attempts of identity theft fraud, especially in the online environment, and that we only allow the process to be completed by persons who meet the applicable conditions.
In BT units, we verify the identity of individuals based on the original identity document presented. In the online environment (including BT Pay), we use a remote identification process through video means, according to the applicable legislation in this field. The remote identification method uses, in addition to personal data from the identity document, contact data, including the so-called biometric data. We will not be able to use biometric data without your explicit consent. If you wish to express this agreement, please check the box next to the text “I agree with the processing of biometric data” from the dedicated BT Pay screen. If you do not agree with this processing, you can request to open your current account at a BT unit.
Before freely deciding if you wish to express your explicit consent for the processing of biometric data, here is how we will carry out remote identification in BT Pay:
1. photograph your identity card or electronic identity card ("bulletin"), front-back (requires access to the camera) - we extract your identity data from it through optical character recognition (a process that allows automatic extraction of letters and numbers from the photographed bulletin) and compare them with those from your bulletin issued by the General Directorate for Personal Records G.D.E.P. (see here details about the processing of data provided by D.G.E.P.). We also verify the date of birth and the type of identity document you photographed, to ensure that you meet the conditions to go through the process in BT Pay.
2. move in front of the camera (requires access to the camera) - we use your moving image to ensure that you are a real person. Additionally, we automatically compare facial features from your selfie with those from the photographed ID card and with your face data obtained from D.G.E.P. The comparison will be biometric, based on criteria such as: the color, size, and tilt of the eyes, the position and distance between the main facial features such as the eyes, eyebrows, lips, and nose. Following the comparison, the software solution will issue a result (accepted or rejected, as appropriate), indicating the probability that the face in the two images belongs to the same person. The data used for and resulting from the comparison are biometric data , care te identifică unic. Dacă scorul emis de instrumentul de recunoaștere facială este nesatisfăcător, vei putea să reiei procesul de aplicare într-o unitate BT.
3. If the result issued following the biometric comparison of the face is satisfactory, we will use the data from your ID card to complete the application for opening the business relationship with the bank and for contracting the transactional products.
4. We will also request contact information from you - phone number and email address - which we will verify to be sure they belong to you, as it is very important that they are correct and up to date. If you successfully complete the opening of the current account, this information will be used:
- and to send you messages of particular or general interest related to your status as a client of the bank (including as necessary for your use of some of the contracted transactional products), messages evaluating the quality of BT services or responses to various requests/complaints that you will send us.
- only if you express your consent for the processing of your data for advertising purposes, this contact information will also be used to send you such marketing messages.
The remote identification process through video means described above can only be carried out with your consent. By ticking the corresponding box next to the text “I agree with remote identification by video means” you explicitly express your consent to undergo the remote identification process in order to apply customer due diligence measures for opening the business relationship with Banca Transilvania, as well as your consent regarding taking photographs and/or image captures of you and your identity document.
Personal data indicated at points 1-4, used for identification, are also processed to allow you to set the initial security code (PIN) in the application.
Personal data collected will be kept for 30 days if you do not complete the current account opening request initiated in BT Pay by applying the qualified electronic signature. If you have signed the current account opening request through BT Pay and then gave up opening the account or the account opening was refused, as well as if you became a BT account holder client following this process, the data retention periods indicated in section I apply fromBT Privacy Policy.
For identification in BT Pay, BT uses the services of the service provider Onfido and its subcontractors. They process, only on behalf of and under the instructions of the bank, the data from your photographed ID card, your image (from selfies/videos taken in BT Pay), and respectively the biometric facial data used for identification in BT Pay.
Some of these service providers/ subcontractors of his are located in third countries for which the European Commission has recognized that there is an adequate level of personal data protection (UK), while others are located in third countries for which such an adequacy decision has not been issued.
To this latter category of recipients, we ensured that the data transfer is carried out based on adequate guarantees, in accordance with the mechanisms and provisions of the GDPR consisting of Standard Contractual Clauses approved by the European Commission, which you can find here: https://eur-lex.europa.eu/legal-content/RO/TXT/PDF/?uri=CELEX:32021D0915&from=EN.
B. Personal data processed for the purpose of customer knowledge to prevent money laundering and terrorist financing, as well as for concluding and executing current account contracts and for transactional products
For the prevention of money laundering and terrorism financing, the bank applies customer due diligence measures to all individuals who wish to open a current account. For the purpose of applying these measures, the bank has the legal obligation to collect, update, and store at least the following categories of personal data about the person requesting the opening of the current account: name, first name, pseudonym, date and place of birth, personal numeric code or another similar unique identification element, citizenship, domicile, residence, the address where they live and its legal status, phone number, fax, email address, occupation, employer's name or nature of own activity, purpose and nature of the business relationship with the bank, source of funds to be used in the business relationship, estimated level of daily transactions, classification / non-classification as politically exposed persons (PEP), source of wealth and important public function held (only in the case of PEP), as well as details and a copy of the identity document. The data from your identity document can be verified and updated (where applicable, if you become a client) also based on the information provided to the bank by the General Directorate for Personal Records (D.G.E.P). Also based on information from D.G.E.P, the address where you live / the correspondence address registered at the bank will be updated, if you declare to the bank that the address where you live is the same as the domicile address.
The indicated data, together with all records obtained by applying customer knowledge measures imposed by legislation - such as monitoring and checks carried out by the bank, supporting documents and transaction records, including the results of any analysis conducted in relation to you, as a client, determine your risk profile and will be kept for a period of 5 years after the termination of the business relationship with the bank. This legal retention period may be extended, under the conditions of the same legislation. Upon expiration of the retention period provided by this legislation, the bank will delete or anonymize this data, except in situations where other legal provisions require their continued retention. According to the legal obligation established for the bank by the Fiscal Procedure Code, some of the data mentioned above are also processed for the reporting that BT must submit daily to ANAF regarding account holders, their representatives, persons with signature rights on accounts, and beneficial owners. The legal retention period for these data is 10 years from the termination of the business relationship.
At the same time, the bank will allocate identifiers to you, such as, but not limited to: client code (BT CIF), IBAN codes related to accounts opened at the Bank, numbers related to bank cards, based on which you can be identified in the bank's systems.
In situations where it is mandatory or necessary, your personal data, as a client, will be disclosed/transferred to different categories of recipients (e.g. to ANAF - according to tax legislation, to other banks and their clients to whom/from whom BT clients transfer/collect amounts from/to BT accounts, to service providers used by the bank), including entities that are part of the BT Financial Group, for legitimate purposes and under conditions that ensure their security. For all details related to the processing of BT clients' data, please read in full General information note regarding the processing and protection of personal data belonging to BT Clients, with which this specific information note is completed.
C. For collecting options regarding the processing of personal data for advertising purposes, concerning telephone contact for providing support and for sending push notifications in BT Pay
Collecting marketing options
The bank has the legitimate interest of collecting the options of persons who wish to open a current account regarding the processing of their personal data for advertising purposes. You are not obliged to express this option. However, if you decide to express it, you can choose to have your data processed for advertising purposes or to refuse.Only if you express your consent will we send you advertising messages.
Before freely deciding if you want to receive such messages, please consider the following: expressing consent for the processing of your data for the purpose of receiving advertising messages is optional. Refusing to give this consent does not affect your right to become a BT client.
Personal data usually processed to send advertising messages to customers are: name, first name, phone number, e-mail address and correspondence address declared to the bank for the business relationship.
If you choose to receive advertising messages, to ensure that they are relevant, we will also use other information we learn about you when you use our services/products (e.g. transaction data, age, location, income range, etc.). We will study this data automatically (profiling) to get an opinion about the products/ services/ events that would suit you.
In case you express your consent to receive advertising messages, it will be valid until you withdraw/modify it or, otherwise, until the termination of the business relationship with the bank or, as the case may be, the status of representative/authorized person on other accounts, if you have such a relationship with BT established.
If you wish to be contacted for advertising purposes, depending on the categories from which you will choose to receive advertising messages, your option/data will be communicated by BT, for the purpose of sending advertising messages, to:
- entities within the Financial Group Banca Transilvania BT Microfinancing IFN SA, BT Asset Management S.A.I. S.A., BT Leasing Transilvania IFN S.A., BT Direct IFN S.A., BT Capital Partners S.S.I.F. S.A., BT Pensions Voluntary Pension Fund Management Company SA, Romanian Entrepreneur Club Foundation, Cluj has Soul Foundation and other entities that may join this group in the future- („the BT subsidiaries”), except if you have expressed other options, on own forms used by subsidiaries to collect marketing consent.
- partners current or future of BT and/or BT subsidiaries, whose products/ services/ events are related to BT services/ products (“partners”). List of current BT partners' categories and/or BT subsidiaries is available at the link https://www.bancatransilvania.ro/partners or, upon request, at any BT unit or BT subsidiaries.
For the actual transmission of advertising messages, your data will be disclosed to providers - having the status of persons authorized by BT, by BT subsidiaries or by their partners.
Please keep in mind that the options you will choose, whichever they may be:
- does not refer to messages of general interest or particular interest for clients, which are sent by BT based on its legitimate interests in carrying out the business relationship in good conditions or based on its legal obligations;
- are not applicable for commercial notifications/ messages sent within BT mobile applications (including BT Pay), which have their own marketing options management system, available in the dedicated sections for settings (notifications) or privacy;
- does not affect subscribing/unsubscribing any e-mail address entered by you in forms available on BT websites to receive information from various areas of interest. Subscription to the respective newsletters is done through the respective online forms, and you can manage the unsubscription by following the unsubscribe link in the content of the messages received after subscribing.
Given the information presented above, in the process you will go through in BT Pay to open the current account, you will have the possibility to express your options regarding the processing of your personal data for advertising purposes. You will be shown both the option not to receive advertising messages (refusal) and the option to receive such messages (consent). The consent option will be divided into several categories from which you can choose: products and services of BT and/or BT subsidiaries, events organized by BT and/or BT subsidiaries, products/services of partners related to BT or BT subsidiaries products/services, and events organized by BT partners.
If you are already a BT non-account holder client, who previously expressed marketing consent and now select options that modify or withdraw the consent expressed in the past, we will mark the new options in our records and respect them, but we inform you that it can take up to 5 business days for us to ensure the removal of your data from ongoing campaigns. In this interval it is possible to receive advertising messages according to previous options.
Also, if you have previously expressed your refusal to have your data processed for advertising purposes and you express your consent during the process of opening a current account in BT Pay, the newly expressed option will be the valid one.
With regard to the processing of your personal data for advertising purposes, your rights under the General Data Protection Regulation (GDPR) are guaranteed.
If you choose to express your consent to receive advertising messages, you can always withdraw/ modify it and/ or object to profiling for advertising purposes, as follows:
- by accessing the section "Options regarding the processing of personal data for advertising purposes" from the bank's website- www.bancatransilvania.ro;
- by accessing the dedicated section from the NeoBT internet/ mobile banking platform;
- through BT units, where you can request our employees to update your options regarding the processing of your personal data for advertising purposes;
- sending a request in this regard to the BT headquarters, with the mention "attention to DPO";
Collecting the option for and telephone contacting in order to provide support
If you interrupt the online application flow at some point, we want to offer you the necessary support to be able to resume it. We will ask you at the beginning of the process of opening the current account through BT Pay if you consent to be contacted for support purposes, and we will call you for this only if you grant it to us.
Collecting the option for and sending push notifications in BT Pay
Also at the beginning of the process, you will be asked if you allow receiving push notifications in BT Pay. If you accept such notifications and do not complete the application process within the deadline established after setting your PIN, we will send you notifications to remind you to resume the process. In this case, you will resume the process from where you left off. If you do not set a PIN or do not complete the process within the established deadline, you will have to restart the process from the beginning if you wish to open your current account through BT Pay.
D. For concluding the contracts related to transactional products from the subscription you will choose
Depending on the type of subscription you choose, we process your personal data about the chosen subscription type, as well as about the transactional products included in it (e.g., cards, internet banking), including for setting the applicable fees for the products included in the subscription.
Please be aware that, for insurance products included in some types of subscriptions, the operator of your personal data necessary for concluding and executing the insurance contract/policy is the insurer providing those services. BT processes insurance data as an operator only for the collection of the insurance premium payment (included in the subscription).
E. For the issuance and management of the Qualified Digital Certificate issued by Alfatrust Certification S.A. for signing documentation in relation to BT
To complete the process of opening the BT current account through BT Pay, it will be necessary to sign with a qualified electronic signature the application for opening the contractual/business relationship and for contracting the transactional products included in the subscription and, if applicable, the form with options regarding the processing of your data for advertising purposes.
Issuing and using the digital certificate for signing does not incur any costs for you, but it is necessary for BT and Alfatrust to jointly process, as joint operators, personal data concerning you for the issuance of this electronic signature, as we inform you in the following:
a.Personal data operators
Based on Art. 13-14 of EU Regulation 679/2016 - General Data Protection Regulation (“GDPR”), Alfatrust Certification S.A. (“Alfatrust”) and Banca Transilvania S.A. (“BT” or “the Bank”), having the identification and contact details indicated within the Terms and Conditions for the provision of certification services for qualified digital certificates, inform you regarding the processing of your personal data, as User (“data subject”), carried out in their capacity as joint controllers for the purpose mentioned in point b below.
b.Purpose and legal basis for processing personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate (“Certificate”). BT is the operator that identifies the User, respectively collects from them the personal data necessary for the issuance of the Qualified Digital Certificate, and transmits it to Alfatrust so that this operator can issue the certificate. The data that BT collects from Users are those processed by the Bank in its own records, in the context of the business relationship initiated between the User and the Bank at the time of transmitting the data to Alfatrust.
During the validity period of the certificate, personal data is processed by associated operators, as the case may be, including in situations where Users request the suspension or revocation of the certificate in the manner detailed in the Terms and Conditions of service provision.
The legal grounds for processing personal data for the defined purpose are the legal obligation (Art. 6 para. 1 letter c GDPR), the conclusion/ performance of the Contract (Art. 6 para. 1 letter b GDPR) and the legitimate interest of the associated operators (Art.6 para. 1 letter f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User initiates a business relationship, and Alfatrust - as an accredited certification service provider from which the User wishes to obtain a certificate, are subject to the applicable legal provisions in the field of preventing money laundering and terrorist financing, according to which they must collect a series of personal data. These data are also necessary for the conclusion/ execution of the Contract on the basis of which the User is allowed to use the certificate for signing documentation in relation to BT.
In order to support Users who wish to submit a request for suspension or withdrawal of the certificate, the associated operators justify a legitimate interest in offering them the possibility to transmit these requests not only directly to Alfatrust but also through BT. The processing of these requests involves the exchange of Users' personal data between the two associated operators. Contact details - phone number and home address will be processed by either of the associated operators whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.
c.Categories of personal data and of persons whose personal data are processed.
Personal data processed in order to fulfill the mentioned purpose are those provided by law as mandatory to be collected by a credit institution, respectively by a certification service provider for the prevention of money laundering and the sanctioning of terrorism, namely: name, first name, personal numeric code, home/residence address, identity document expiration date, phone number, and a copy of the identity document. All these data, as collected by the Bank, will be made available to Alfatrust for the issuance and management of the Qualified Digital Certificate.
The processing of these personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have these data processed leads to the impossibility of issuing the Qualified Digital Certificate. The persons concerned by this processing are only the Users, as defined in the Terms and Conditions of use.
d.Recipients of personal data.
Except for the associated operators between whom a transfer of personal data processed for the fulfillment of the processing purpose will be made, the data are disclosed, as appropriate, to the associated operators' employees who need to know them, to IT service providers, auditors, authorities, and institutions entitled to know them.
e.Period of processing of personal data.
Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiration, in accordance with the legally established terms.
At the level of Banca Transilvania, the remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is retained for the entire period during which a business relationship is conducted between the client User and BT, to which the terms established in the applicable banking legislation are added, namely at least 5 years from the termination of the business relationship with the credit institution.
f.Rights of data subjects whose personal data are processed for the indicated purpose.
Any User, in their capacity as a data subject, is guaranteed the exercise of the following rights regarding the processing of their personal data, with any of the associated operators: the right of access, the right to rectification, the right to restriction of processing, the right to erasure of data, the right to object to the processing of data, the right to data portability.
Users can exercise these rights or contact the data protection officers for any questions/ requests regarding the processing of personal data, as follows:
- at Banca Transilvania S.A. - by message sent to the e-mail address dpo@btrl.ro or by a request submitted at the BT headquarters, mentioning "attn: Data Protection Officer (DPO)"
- to Alfatrust Certification S.A.- by message sent to the email address dataprotection@alfasign.ro or by a request sent to the Alfatrust headquarters, with the mention "to the attention of the data protection officer (DPO)".
Users also have the right to file a complaint with the supervisory authority - the National Authority for the Supervision of Personal Data Processing (ANSPDCP), with headquarters in Bucharest, sector 1, Bd. Gen. Gh. Magheru no. 28-30.
- opens in a new tab
