3. For what purposes do we process personal data, what data is involved, how long do we keep it, and to whom can we disclose it?
A. Personal data processed for identity verification
Legislation in the field of anti-money laundering requires us to verify the identity of persons who request to open a current account (to establish a business relationship with the bank) and to contract products/services. We also have a legitimate interest in ensuring that we prevent attempts of fraud through identity theft, especially in the online environment, and that we do not allow the process to be completed except by persons who meet the application conditions.
In BT units, we verify the identity of persons based on the original identity document presented. In the online environment (including in BT Pay), we use a remote identification process through video means, according to the applicable legislation in this field. The remote identification method uses, in addition to personal data from the identity document, contact data, including so-called biometric data. We will not be able to use biometric data without your explicit consent. If you wish to express this agreement, please check the box next to the text “I agree with the processing of biometric data” from the dedicated BT Pay screen. If you do not agree with this processing, you can request at a BT unit to open your current account.
Before freely deciding whether you wish to explicitly express your consent for the processing of biometric data, here is how we will carry out remote identification in BT Pay:
1.photograph your identity card or electronic identity card (“bulletin”), front-back (requires access to the camera) - we extract your identity data from it through optical character recognition (process that allows the automatic extraction of letters and numbers from the photographed bulletin) and compare them with those from your bulletin issued by the General Directorate for Persons Evidence D.G.E.P. (see here details about the processing of data provided by D.G.E.P.). We check including the date of birth and the type of identity document you photographed, to make sure you meet the conditions to go through the process in BT Pay.
2. move in front of the camera (camera access required) - we use your moving image to ensure that you are a real person. Additionally, we automatically compare facial features from your selfie with facial features from the photographed ID card and with your face data obtained from D.G.E.P. The comparison is to be carried out biometrically, based on criteria such as: color, size and tilt of the eyes, position and distance between the main facial elements such as the eyes, eyebrows, lips, and nose. Following the comparison, the software solution will issue a result (accepted or rejected, as the case may be), indicating the probability that the face in the two images belongs to the same person. Data used for and results from the comparison are biometric data, which uniquely identifies you. If the score issued by the facial recognition tool is unsatisfactory, you will be able to resume the application process at a BT unit.
3. If the result issued following the biometric facial comparison is satisfactory, we will use the data from your ID to complete the application for opening the business relationship with the bank and contracting the transactional products.
4. We will also request contact details from you - phone number and email address - which we will verify, to ensure that they belong to you, as it is very important that they are correct and up to date. If you successfully complete the opening of the current account, this data will be used:
- and to send you messages of particular or general interest related to your status as a client of the bank (including as necessary for your use of some of the contracted transactional products), messages evaluating the quality of BT services or responses to various requests/ complaints that you will send us.
- only if you express your consent to the processing of your data for advertising purposes, these contact details will also be used to send you such marketing messages.
The remote identification process through video means described above can only be carried out with your consent. By ticking the corresponding box next to the text “I agree with remote identification by video means ” you express your explicit consent for undergoing the remote identification process for the purpose of applying customer due diligence measures in order to open a business relationship with Banca Transilvania, as well as your consent regarding the taking of photographs and/or image captures of yourself and your identity document.
Personal data indicated at points 1-4, used for identification, are also processed to allow you the initial setting of the security code (PIN) in the application.
Personal data collected will be kept for 30 days if you do not complete the current account opening request initiated in BT Pay by applying the qualified electronic signature. If you have signed the current account opening request through BT Pay and then gave up opening the account or your account opening was refused, as well as if you became a BT account holder client following this process, the data retention periods indicated in section I apply from BT Privacy Policy.
For identification in BT Pay, BT uses the services of the service provider Onfido and some of its subcontractors. They process, only on behalf of and under the instructions of the bank, the data from your photographed ID card, your image (from selfies/videos taken in BT Pay), and the biometric facial data used for identification in BT Pay.
Some of these service providers/subcontractors are located in third countries for which the European Commission has recognized an adequate level of personal data protection (UK), while others are located in third countries for which no such adequacy decision has been issued.
To this latter category of recipients, we have ensured that the data transfer is carried out based on appropriate safeguards, in accordance with the mechanisms and provisions of the GDPR consisting of Standard Contractual Clauses approved by the European Commission which you can find here: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0915&from=RO.
B. Personal data processed for the purpose of client knowledge in order to prevent money laundering and terrorist financing, as well as for concluding and executing current account contracts and for transactional products
For the prevention of money laundering and terrorist financing, the bank applies customer due diligence measures for all persons who wish to open a current account. For the purpose of applying these measures, the bank has the legal obligation to collect, update and store at least the following categories of personal data about the person requesting the opening of the current account: name, first name, pseudonym, date and place of birth, personal numeric code or another similar unique identification element, citizenship, domicile, residence, the address where the person lives and its legal status, telephone number, fax, email address, occupation, employer's name or nature of own activity, purpose and nature of the business relationship with the bank, source of funds to be used in the business relationship, estimated level of daily transactions, classification/non-classification as a politically exposed person (PEP), source of wealth and important public function held (only in the case of PEP), as well as details and a copy of the identity document. The data in your identity document can be verified and updated (if applicable, if you become a client) also based on information provided to the bank by the General Directorate for Persons' Records (D.G.E.P). Also, based on information from D.G.E.P., the address where you live / the mailing address registered with the bank will be updated, if you declare to the bank that the address where you live is the same as your domicile.
The indicated data, together with all records obtained by applying the customer knowledge measures imposed by law - such as monitoring and verifications carried out by the bank, supporting documents and transaction records, including the results of any analysis carried out in connection with you, as a client, determine your risk profile and will be kept for a period of 5 years after the termination of the business relationship with the bank. This legal retention period may be extended, under the conditions of the same legislation. Upon expiration of the retention period under this legislation, the bank will delete or anonymize these data, except in situations where other legal provisions require their continued retention. According to the legal obligation imposed on the bank by the Tax Procedure Code, some of the aforementioned data is also processed for the reporting that BT must submit daily to ANAF regarding account holders, their representatives, persons with signature rights on accounts and the real beneficiaries. The legal retention period for these data is 10 years from the termination of the business relationship.
At the same time, the bank will allocate identifiers to you, such as, but not limited to: client code (BT CIF), IBAN codes related to the accounts opened at the Bank, numbers related to bank cards, based on which you can be identified in the bank's systems.
In situations where it is mandatory or necessary, your personal data, as a client, will be disclosed/transferred to various categories of recipients (e.g., to ANAF - according to fiscal legislation, to other banks and their clients to whom/from BT clients transfer/receive amounts from/to BT accounts, to service providers used by the bank), including to entities that are part of the BT Financial Group, for legitimate purposes and under conditions that ensure their security. For all details related to the processing of BT clients' data, please read in full General information note concerning the processing and protection of personal data belonging to BT Clients, with which this specific information note is completed.
C. For collecting options regarding the processing of personal data for advertising purposes, with regard to telephone contact for providing support and for sending push notifications in BT Pay
Collecting marketing options
The Bank has a legitimate interest in collecting the options of individuals who wish to open a current account regarding the processing of their personal data for advertising purposes. You are not obligated to express this option. However, if you decide to express it, you can choose to allow us to process your data for advertising purposes or to refuse.Only if you give your consent will we send you advertising messages.
Before freely deciding if you want to receive such messages, please take into account the following: expressing consent for the processing of your data for the purpose of receiving advertising messages is optional. Refusal to give this consent does not affect your right to become a BT client.
The personal data usually processed to send advertising messages to customers are: name, first name, phone number, e-mail address and correspondence address declared to the bank for the business relationship.
If you choose to receive advertising messages, to ensure that they are relevant, we will also use other information we learn about you when you use our services/products (e.g. transaction data, age, location, income range, etc.). We will study this data automatically (profiling) to get an opinion about the products/ services/ events that would suit you.
In case you express your consent to receive advertising messages, it will be valid until you withdraw/modify it or, otherwise, until the termination of the business relationship with the bank or, as the case may be, of the status of representative/authorized person on other accounts, if you have established such a relationship with BT.
If you wish to be contacted for advertising purposes, depending on the categories from which you choose to receive advertising messages, your option/data will be communicated by BT for the purpose of sending advertising messages to:
- entities within the Financial Group Banca Transilvania BT Microfinancing IFN SA, BT Asset Management S.A.I. S.A., BT Leasing Transilvania IFN S.A., BT Direct IFN S.A., BT Capital Partners S.S.I.F. S.A., BT Pensions Voluntary Pension Fund Management Company SA, The Romanian Entrepreneur Club Foundation, The Cluj has Soul Foundation and other entities that may join this group in the future- („the BT subsidiaries”), except in cases where you have expressed other options, on separate forms used by subsidiaries for collecting marketing consent.
- partners current or future of BT and/or BT subsidiaries, whose products/ services/ events are related to BT services/ products („partners”). The list of current BT partners and/or BT subsidiaries is available at the link https://www.bancatransilvania.ro/partners or, upon request, in any BT unit or BT subsidiaries.
For the actual transmission of advertising messages, your data will be disclosed to providers - having the status of authorized persons by BT, subsidiaries of BT, or their partners.
Please keep in mind that the options you will choose, whatever they may be:
- does not refer to messages of general interest or of particular interest to customers, which are sent by BT based on its legitimate interests in conducting the business relationship under good conditions or based on its legal obligations;
- are not applicable for commercial notifications/messages sent within BT's mobile applications (including BT Pay), which have their own marketing options management system, available in the dedicated sections for settings (notifications) or privacy;
- does not affect the subscription/ unsubscription of any e-mail address entered by you in forms available on BT websites to receive information from various areas of interest. Subscription to these newsletters is done through the respective online forms, and unsubscription can be managed by following the unsubscribe link within the content of the messages received after subscription.
Considering the information presented above, in the process you will go through in BT Pay for opening the current account, you will have the possibility to express your options regarding the processing of your personal data for advertising purposes. You will be shown both the option not to receive advertising messages (refusal) and the option to receive such messages (consent). The consent option will be divided into several categories from which you can choose: products and services of BT and/or BT subsidiaries, events organized by BT and/or BT subsidiaries, products/services of partners related to products/services of BT or BT subsidiaries, as well as events organized by BT partners.
If you are already a BT non-account holder client, who has previously expressed marketing consent and you now select options that modify or withdraw the consent previously given, we will mark the new options in our records and respect them, but we inform you that it may take up to 5 working days for us to ensure the removal of your data from ongoing campaigns. In this interval, it is possible to receive advertising messages according to previous options.
Also, if you have previously expressed your refusal to have your data processed for advertising purposes and in the process of opening a current account in BT Pay you express your consent, the newly expressed option will be the valid one.
Regarding the processing of your personal data for advertising purposes, you are guaranteed the rights provided by the General Data Protection Regulation (GDPR).
If you choose to express your consent to receive advertising messages, you can always withdraw/modify it and/or object to profiling for advertising purposes, as follows:
- by accessing the section „Options regarding the processing of personal data for advertising purposes” from the bank's website- www.bancatransilvania.ro;
- by accessing the dedicated section on the NeoBT internet/ mobile banking platform;
- through BT units, where you can request our employees to update your options regarding the processing of your personal data for advertising purposes;
- sending a request in this regard to the BT headquarters, with the mention "to the attention of DPO";
Collecting the option for and telephone contact for the purpose of providing support
If at some point you interrupt the online application flow, we want to provide you with the necessary support to resume it. We will ask you at the beginning of the current account opening process through BT Pay if you give your consent to be contacted for support purposes, and we will call you for this only if you grant it to us.
Collecting the option for and sending push notifications in BT Pay
Also at the beginning of the process, you will be asked if you allow receiving push notifications in BT Pay. If you accept such notifications and do not complete the application process within the deadline set after you have set your PIN, we will send you notifications to remind you to resume the process. In this case, you will resume the process from where you left off. If you do not set a PIN or if you do not complete the process within the set deadline, you will have to start the process over if you want to open your current account through BT Pay.
D. For the conclusion of contracts related to transactional products from the subscription you will choose
Depending on the type of subscription you choose, we process your personal data about the selected subscription type, as well as about the transactional products included in it (e.g. cards, internet banking), including for setting the applicable fees for the products included in the subscription.
Please note that, for insurance products included in some types of subscriptions, the operator of your personal data necessary for the conclusion and execution of the insurance contract/policy is the insurer providing those services. BT processes insurance data as an operator only for the collection of the insurance premium payment (included in the subscription).
E. For the issuance and management of the Qualified Digital Certificate issued by Alfatrust Certification S.A. for signing documentation in relation to BT
To complete the process of opening the BT current account through BT Pay, it will be necessary to sign with a qualified electronic signature the application for opening the contractual/ business relationship and for contracting the transactional products included in the subscription and, as appropriate, the form with options regarding the processing of your data for advertising purposes.
Issuance and use for signing of the digital certificate do not entail costs for you, but it is necessary for BT and Alfatrust to jointly process, as associated operators, personal data concerning you for the issuance of this electronic signature, as we inform you below:
a.Operators of personal data
Based on Art. 13-14 of EU Regulation 679/2016 - General Data Protection Regulation (“GDPR”), Alfatrust Certification S.A. (“Alfatrust”) and Banca Transilvania S.A. (“BT” or “the Bank”), having the identification and contact data indicated within the Terms and Conditions for the provision of certification services for qualified digital certificates, inform you regarding the processing of your personal data, as User (“data subject”), carried out as joint controllers for the purpose mentioned in point b below.
b.The purpose and the legal basis of processing personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate ("Certificate"). BT is the operator that identifies the User, collects from them the personal data necessary for issuing the Qualified Digital Certificate, and transmits it to Alfatrust so that this operator can issue the certificate. The data that BT collects from Users are those processed by the Bank in its own records, in the context of the business relationship initiated between the User and the Bank at the time the data is transmitted to Alfatrust.
During the validity period of the certificate, personal data are processed by associated operators, as appropriate, including in situations where Users request the suspension or revocation of the certificate in the manners detailed in the Terms and Conditions of service provision.
The legal grounds for processing personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit. c GDPR), the conclusion/ execution of the Contract (Art. 6 para. 1 lit. b GDPR), and the legitimate interest of the associated operators (Art.6 para. 1 lit. f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User initiates a business relationship, and Alfatrust - as an accredited certification service provider from whom the User wishes to obtain a certificate, are subject to the applicable legal provisions in the field of money laundering and terrorist financing prevention, according to which they must collect a series of personal data. This data is also necessary for the conclusion/execution of the Contract under which the User is allowed to use the certificate for signing documentation in relation to BT.
To assist Users who wish to submit a request to suspend or revoke the certificate, the associated operators justify a legitimate interest in offering them the possibility to send these requests not only directly to Alfatrust but also through BT. The resolution of these requests involves the exchange of Users' personal data between the two associated operators. Contact details - phone number and home address will be processed by either of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.
c.Categories of personal data and of persons whose personal data are processed.
Personal data processed for the fulfillment of the mentioned purpose are those provided by law as mandatory to be collected by a credit institution, namely by a certification services provider for the prevention of money laundering and the sanctioning of terrorism, namely: name, surname, personal numerical code (CNP), home/residence address, validity date of the identity document, phone number, and copy of the identity document. All these data, as collected by the Bank, will be made available to Alfatrust for the issuance and management of the Qualified Digital Certificate.
Processing of this personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate. The individuals concerned by this processing are only the Users, as they are defined in the Terms and Conditions of use.
d.Recipients of personal data.
Except for the associated operators between whom an exchange of personal data processed for the fulfillment of the processing purpose will be made, the data is disclosed, as the case may be, to the employees of the associated operators who need to know them, IT service providers, auditors, authorities, and institutions entitled to know them.
e.Period of personal data processing.
Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiration, in accordance with the legally established terms.
At the level of Banca Transilvania, the remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship between the client User and BT is ongoing, plus the terms established in the applicable banking legislation, namely at least 5 years from the termination of the business relationship with the credit institution.
p.Rights of data subjects whose personal data are processed for the indicated purpose.
To any User, in their capacity as a data subject, the exercise of the following rights is guaranteed regarding the processing of their personal data, with any of the associated operators: the right of access, the right to rectification, the right to restriction of processing, the right to data deletion, the right to object to data processing, the right to data portability.
Users can exercise these rights or contact the data protection officers for any questions/ requests regarding the processing of personal data, as follows:
- to Banca Transilvania S.A.- by message sent to the e-mail address dpo@btrl.ro or by a request sent to the BT headquarters, with the mention "attention to the person responsible for data protection (DPO)"
- to Alfatrust Certification S.A.- through message sent to the e-mail address dataprotection@alfasign.ro or by a request sent to the Alfatrust headquarters, with the mention "to the attention of the data protection officer (DPO)".
Users also have the right to file a complaint with the supervisory authority - the National Supervisory Authority for the Processing of Personal Data (ANSPDCP), with headquarters in Bucharest, sector 1, Bd. Gen. Gh. Magheru no. 28-30.
- opens in a new tab
