Who is the personal data operator?
BANCA TRANSILVANIA S.A. (hereinafter "the bank" or "BT") credit institution, Romanian legal entity, with the identification and contact details presented in section III of General information note regarding the processing and protection of personal data belonging to BT Clients, offers its individual clients current account holders the possibility to obtain a personal loan 100% online (hereinafter also referred to as "BT 100% online loan").
In the general note indicated above, which is an integral part of BT Privacy Policy from the site www.bancatransilvania.ro, found also distinct in the section Privacy Hub, you will find the definition of the BT Client, detailed information about your rights regarding the processing of personal data and the ways in which you can exercise them, and about the possibility to contact the data protection officer appointed by BT (BT DPO).
When you apply to obtain a BT loan 100% online, we process your personal data for multiple purposes and legal grounds, either as the sole data controller or, as the case may be, together with other associated controllers, as we present to you below.
Also, if you choose a loan with attached insurance, the insurer Metropolitan Life is the operator of your personal data processed for the issuance and management of the insurance policy, and the bank acts only as the authorized person of the insurer for this processing. Metropolitan Life personal data processing policy can be accessed from the website https://www.metropolitanlife.ro/ or directly at the following link: MetLife_Client_Data_Processing_Policy_Life_and_NonLife_aug2019.pdf (metropolitanlife.ro).
On what grounds do we process the data and what happens if you refuse their processing?
When you apply for obtaining and, as the case may be, conclude a contract related to a BT credit 100% online, we process your personal data on the following legal grounds:
- the legal obligations to which BT is subject through various normative acts,
- conclusion/execution of the credit contract or completing the necessary steps to conclude it,
- our legitimate interest and/or that of third parties, (e.g. the interest in preventing fraud or the legitimate interest in consulting your situation in the records of Credit Bureau SA for assessing your creditworthiness, the legitimate interest in contacting you to provide support for completing the online application and to ask for your opinion about the application process),
- your consent, such as for consulting your income in the ANAF database or for identity verification based on biometric data.
When the law requires us to process personal data or when it is necessary for concluding the credit contract, if you refuse their processing, we will not be able to analyze your request.
For processing based on the legitimate interest of BT or third parties, refusing to have your data processed may make it impossible to analyze your request or obtain BT credit 100% online.
For data processing for which your consent is required, we will request this agreement at the appropriate time in the online application flow. If you refuse to give this consent, you cannot obtain the credit 100% online, but you have the possibility to apply for it at a BT unit, where you will have to prove your income in another way (e.g., income certificate from your employer), and your identity will be verified without processing biometric data.
For what purposes do we process personal data, what data is it, for how long do we keep it, and to whom can we disclose it?
In the following lines, we present to you separately the purposes for which we will process personal data so that you can apply and, if applicable, enter into a BT credit contract 100% online. Depending on the purpose of the processing, we will provide you with information about the data retention period, categories of data recipients, the existence of automated decision-making processes, as well as the rights you benefit from..
A. Personal data processed for identity verification, in order to prevent fraud, money laundering and terrorist financing, and to contact you for the purpose of providing support or evaluating the quality of this BT service
The applicable legislation obliges us to verify the identity of the persons with whom we are going to conclude contracts. At the same time, we have a legitimate interest in preventing attempts of fraud through identity theft in the online environment.
In BT units, we verify the identity of credit applicants based on the original identity document. Online, we do not have this possibility, so we will do things a little differently. We have chosen a method that ensures who the BT client applying is, so that we can prevent potential fraud attempts. This method uses the latest technologies, processing the so-called biometric data. We will use such data only based on your explicit consent. Before freely deciding whether you want to express it, here is what using your biometric data entails:
- you make a selfie video (requires access to the device's camera);
- the used IT solution compares biometrically your face from the selfie video with the face from the copy of your identity document already registered in BT's records.
Biometric comparison uses criteria such as: the color, size, and tilt of the eyes, the position and distance between the main facial features such as the eyes, eyebrows, lips, and nose. Following the comparison, the software solution issues a confidence score, indicating the probability that the face in the two images belongs to the same person. If the confidence score is satisfactory, we will further verify if the data from your identity document in our records are still valid. If they are not, you will need to update your data in the BT records and restart the application process. We will use the data taken from the identity document to complete the documentation related to the requested loan.
We will also verify your contact details - phone number and email address - to make sure they belong to you. We will also use them to communicate with you and remind you that you can electronically sign the documentation and to send you the credit documentation. Also, if you have not completed the application flow, we will be able to contact you to provide support and to find out your opinion about the application flow.
B. Personal data processed for the analysis of the credit application, including automated decision-making processes based on profiling
To analyze the application for a BT 100% online loan, we process your data in BT's internal records and in the Credit Bureau's records, where we check your situation. All information related to this processing can be found below, in points I and II of this section B.
Being essential to provide you a quick response to your online credit application, we will make the approval/rejection decision by processing personal data exclusively through automated means. Details about this decision can be found at point II (5) below.
1. Identification data of operators
Banca Transilvania S.A. and Credit Bureau Company S.A., Romanian legal entity headquartered in Bucharest, Sfânta Vineri street, no. 29, 4th floor, sector 3, as associated operators, processes your personal data in good faith, fairly and transparently, for specific and legitimate purposes, in accordance with the provisions of Regulation (EU) No 679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC ("the Regulation" or "GDPR").
Credit Bureau SA is the private law entity that manages the Credit Bureau System, where personal data related to lending activities carried out by Participants are processed.
Participants in the Credit Bureau System are credit institutions, non-banking financial institutions, insurance companies, and debt collection companies that have signed a Participation Contract with the Credit Bureau.
2. The legal basis and the purpose of processing
Banca Transilvania S.A. and the Credit Bureau processes your personal data based on the legitimate interest of the Participants and the Credit Bureau for conducting responsible credit activities, under the conditions of protecting, facilitating access to credit, and preventing excessive indebtedness of the persons concerned, complying with the legal framework regarding creditworthiness assessment and risk reduction, as well as preventing the use of the financial-banking system for carrying out activities contrary to the law.
Banca Transilvania S.A. are the obligation, according to the legal regulations in force, to assess your credit repayment capacity, before concluding a credit contract and during its execution. For this purpose, Banca Transilvania S.A. processes the information indicated at point (4), recorded in your name in its own records and transmits it to the Credit Bureau for processing by this institution and for consultation by any Participant, for the purpose of initiating or conducting a credit relationship, as well as securing credit-type products.
3. The obligation to provide data and the consequences of non-compliance with it
The provision of your personal data is necessary for the purpose stated in point (2). Refusal to provide your personal data, necessary to achieve the purpose mentioned above, will lead to the impossibility Transilvania Bank S.A. to fulfill its legal obligations in connection with granting the credit.
4. Categories of personal data processed in the Credit Bureau System
- identification data of the data subject: the last name, first name, personal numeric code or CUI for authorized natural persons or CIF for natural persons who carry out liberal professions or country code and passport series/number for non-resident persons, home/residence address, telephone number, date of birth;
- data relating to the employer: employer's address, date of registration of this information, VAT number;
- data related to the requested/granted credit-type products: the type and name of the Participant, type of product, product/account status, date of granting, account duration, granted amounts, amounts owed, date of update, currency, payment frequency, amount paid, monthly rate, outstanding amounts, number of days of delay, date of first outstanding, delay category, date of last payment;
- data relating to events occurring during the term of the credit-type product, such as those relating to restructuring/refinancing, handing over in payment, assignment of the credit contract, assignment of the claim;
- data regarding relationships with other accounts: information regarding credit-type products for which the data subject has the status of co-debtor and/or guarantor;
- data regarding insolvency: information regarding the targeted persons against whom an insolvency procedure has been initiated;
- number of queries: indicates the number of Credit Reports issued by the Credit Bureau, at the request of one or more Participants;
In the process of analyzing your credit application, Banca Transilvania S.A. will request from the Credit Bureau the issuance of a Credit Report, without FICO® Score, in order to verify if you fit within the legally established indebtedness level and if you have the capacity to repay the credit. For obtaining the Credit Report, Banca Transilvania S.A. will send to the Credit Bureau your first name, last name, and personal numerical code.
After granting the credit, Banca Transilvania S.A. will send your personal data specified in points a)-f) to the Credit Bureau. This information is shared with other Participants, within the Credit Bureau System, and is used for the purpose mentioned in point 2.
Your ability to repay debts on time can be periodically checked after the credit is granted, including by obtaining Credit Reports or by using the Alert Service*.
If, during the term of the granted loan, you delay the payment of installments for more than 30 calendar days from the due date, Banca Transilvania S.A. will transmit to the Credit Bureau information regarding the outstanding amounts, the delay category, the date of the first outstanding installment and/or, as the case may be, information related to the initiation of the transfer of ownership procedure, only after notifying you at least 15 calendar days in advance, made in writing, by phone, SMS, e-mail, or by other electronic means of communication.
*The Alert Service is used by Participants to identify and/or reduce credit risk in a timely manner, by generating an alert to a Participant when an event is recorded for their own debtor (account opening/closing, entry/exit from delinquency, account correction, registration/deletion of guarantor/co-debtor status, account inquiry, employer name/phone number change) at another Participant.
5. FICO® Score from the Credit Bureau
Personal data provided in point (4) may be processed by the Credit Bureau, including to calculate, at the request of the Participants, the FICO® Score from the Credit Bureau.
Participants can use the FICO® Score from the Credit Bureau for the purpose of reducing the credit risk associated with a debtor/potential debtor.
FICO® Score from the Credit Bureau is a number between 300 and 850, obtained through the statistical process that processes the information recorded by Participants in the Credit Bureau System and indicates the probability that the targeted person will pay their installments on time in the future. The main causes that led to the decrease of the FICO® Score from the Credit Bureau are displayed in the form of reason-codes.
FICO® Score from the Credit Bureau takes into account the following elements that provide predictability: payment history, current debt, account/accounts duration (average number of months since the credits were granted), new credit inquiries (number of inquiries and credits granted in the last 6 months), credit mix (types of credits granted), age of the concerned person. The influence of these elements on the value of the FICO® Score from the Credit Bureau may vary depending on the information recorded at the Credit Bureau for each concerned person.
FICO® Score from the Credit Bureau represents a highly predictive analytical tool which, combined with data from the Credit Report and information obtained by Participants from other sources, contributes to the accurate assessment of the creditworthiness of the targeted person in order to conclude/execute the credit agreement.
6. Data recipients
Personal data recorded in the Credit Bureau System are disclosed to Participants, upon request, for the purpose mentioned in point (2).
Personal data processed in the Credit Bureau System will not be disclosed to third parties, except for authorities and public institutions, according to their competences and applicable legislation, such as the National Authority for the Supervision of Personal Data Processing, the National Bank of Romania, the National Integrity Authority, judicial courts, notaries public, judicial executors, criminal investigation bodies.
7. Storage period
Personal data are stored at the Credit Bureau and disclosed to Participants for 4 years from the update date, except for the data of credit applicants who have withdrawn their credit application or to whom the credit was not granted, which are stored and disclosed to Participants for a period of 6 months.
8. The rights of the data subjects regarding the processing of personal data
As a data subject, you can exercise your rights under the Regulation as follows:
a) the right of access to data can be exercised:
- by a written, signed request, sent by mail to the Credit Bureau, or
- by securely accessing the Credit Bureau website, or
- personal or electronically, to the Participant who holds the status of creditor/potential creditor of yours.
At the same time, you have the right to obtain, upon request, at the time of communication of the credit decision, a copy of the Credit Report issued by the Credit Bureau, which was used by Banca Transilvania S.A. in the analysis of the credit application.
b) the right to rectification of data,
c) the right to erasure of data,
d) the right to restrict data,
e) the right to object to processing, including the automated individual decision-making process,
can be exercised:
- by securely accessing the Credit Bureau website, or
- personal or electronically, to the Participant who holds the status of creditor/potential creditor of the data subject.
f) the right to address the National Supervisory Authority for Personal Data Processing and the judiciary.
9. The contact details of the data protection officers are:
- For Banca Transilvania S.A.– e-mail address dpo@btrl.ro
- For the Credit Bureau - e-mail address: rpd@birouldecredit.ro
This is a specific information note regarding the processing of personal data for the purpose of analyzing the credit application addressed to Transilvania Bank S.A. The provisions of this note are supplemented by General information note regarding the processing and protection of personal data belonging to BT Clients.
1. The identity of the operator
Banca Transilvania S.A. processes your personal data as an operator for the purpose of pre-offering and, where applicable, for analyzing the submitted credit application.
2. The legal basis and the purpose of processing
In order to pre-offer and, as the case may be, to analyze the submitted credit application, in accordance with the need to conduct a responsible lending activity, besides processing your personal data in the Credit Bureau S.A. system - about which you were informed at point I. of this information - BT processes such data in its own records, based on its legal obligations, the conclusion of the credit contract, and on the basis of its legitimate interest.
3. The obligation to provide data and the consequences of non-compliance with it
Providing personal data is necessary for the purpose mentioned in point II (2). Refusal to provide the personal data necessary for achieving this purpose would prevent the bank from fulfilling its legal obligations in connection with granting the credit, so the credit application cannot be analyzed.
4. Categories of personal data processed within Transilvania Bank S.A.
Categories of personal data mentioned in this information at point I. (4) and II. (5), as well as other data collected in the credit application, are processed by BT for pre-offering, respectively for the analysis of the application.
5. Automated decision-making, including profiling, carried out through the bank's own system and inquiries of external records
To objectively verify if you meet the eligibility conditions for the requested loan, we process your personal data in our own automated system, to carry out the necessary steps to conclude the loan agreement at your request, as well as based on the legitimate interest of efficiently managing credit risk. The bank does not use the FICO® Score from the Credit Bureau for credit application analysis.
In the bank's own system used for the analysis of the credit application, personal data collected from you during the application process are automatically processed, together with information resulting from checks carried out in the bank's own records or those of the Credit Bureau SA. We process data such as, but not limited to: identification data, professional data, family-related data, regarding economic and financial situation, data about any BT products and services you already use. After analyzing all the information and the result of consulting the records of Credit Bureau S.A., our analysis system establishes a profile of you as a debtor/potential debtor to help us determine if you meet the credit conditions established by BT.
Based on the agreement requested through a separate form, we will query your data and in the ANAF records, to obtain the situation of the income you earn, in order to verify the classification within the legally established debt level. By exception, we will no longer ask for your consent for this consultation if you have already expressed it on the same day. If you refuse to have your data queried at ANAF, you cannot obtain the 100% online personal loan.
To the information obtained through the automatic processing of data in our own analysis system, we will add the information obtained through querying the Credit Bureau and ANAF and the result of verifying your situation in public databases such as the websites of the court portal, ONRC, etc.
We will take the decision to approve/reject the credit application by 100% automated means because the application is submitted online and it is essential to provide you with an answer within a very short time frame. In such situations, making the decision by such means is necessary in order to quickly analyze the application and, if applicable, to conclude the credit contract. However, you are guaranteed the right to request human intervention, that is, the analysis of the credit application by a bank employee, to express your point of view, and to contest the decision.
6. Data recipients
In addition to the recipients mentioned in point I. (6) of this notice, the personal data processed for the purpose indicated in point II (2) is disclosed, as appropriate, to the following recipients: ANAF (for consulting the database of the Ministry of Public Finance, if you have given your consent for this purpose), Credit Bureau S.A. (to consult your situation in the records of this institution), insurance companies (if you choose to take out insurance in connection with the loan), service providers used by the bank in the process of analyzing the loan application.
7. Storage period
The personal data filled in the credit application are kept in the records of Transilvania Bank for legally established limited periods (e.g. according to financial accounting legislation) or internal periods.
8. The rights of the data subjects regarding the processing of personal data
For exercising the rights (the right to data access, the right to data rectification, the right to data deletion, the right to data restriction, the right to object to processing) provided by the Regulation in connection with the processing of personal data in the Credit Bureau S.A. system in relation to Banca Transilvania S.A., you can use any of the methods indicated in point I.(8).
If you exercise these rights at BT (both for the processing of personal data in the Credit Bureau system S.A., and within the bank) or if you wish to withdraw your consent (for the processing of personal data based on this basis), you can send a written request to the address in Cluj-Napoca city, Calea Dorobanților, no. 30-36, Cluj county, with the mention – "attention to the data protection officer (DPO)" or electronically to the email address dpo@btrl.ro.
You also have the right to address the National Authority for the Supervision of Personal Data Processing.
Banca Transilvania S.A., as a credit institution, is subject to legal obligations to establish and analyze its exposure to groups of connected clients, as part of the credit risk analysis. For this purpose, it is necessary to collect from you, as a credit applicant and, where applicable, from other public or internal sources, information about persons with whom you form the same debtor group, as you are connected clients. Your spouse is always a person connected to you. If you are married, you will need to provide us with their name, surname, and personal identification number (CNP).
To check if and with whom you are in such connection relationships, we will query your data in our internal records and those public (e.g. ONRC). To understand what categories of people are considered to be connected to you, we recommend that you study the details available within BT Privacy Policies, from our website www.bancatransilvania.ro, at section C point 3 or at the following link: https://www.bancatransilvania.ro/Informare-Apartenenta-la-Grupuri-Credit-Online.pdf. And the people who are in contact with you can find out information about how we process their data for this purpose, from the same section of the BT Privacy Policy.
As the declaring person, BT has the legal obligation to report these exposures and the composition of the client debtor groups in connection to BNR, the Credit Risk Central (only where applicable), and, based on its legitimate interest, may disclose this data also to entities within the Banca Transilvania Financial Group and service providers used by BT during the credit application analysis process. Your refusal to have these data processed may result in BT's inability to analyze the application and/or approve the credit.
The retention period of data of these persons in the BT records is equal to that of the existence of a group/groups of clients connected of which they are part, plus reasonable storage periods.
When we analyze your loan application we have the legal obligation and the legitimate interest to determine your level of indebtedness and your capacity to repay the requested loan. For this, it is necessary to know the exact situation of your income. To make everything go quickly, when you apply for a BT loan 100% online we want to find out your income from ANAF records.
If you express this agreement, we will be able to carry out the consultation for a maximum period of 5 working days from the date of agreement. The form by which you express your agreement or refusal will generally be kept for 8 years, in order to prove that we have fulfilled our obligation to inform you properly and to request your consent.
The personal data indicated below, registered in your name in the records of the Ministry of Finance, the National Agency for Fiscal Administration (ANAF) will be consulted for the purpose of (i) initiating or carrying out contractual relations in accordance with the prudential requirements applicable to BT as a credit institution and (ii) streamlining the credit operational process, as a result of the simplification of the documentation we request from you:
- identification data of the natural person/natural person carrying out an authorized activity: last name and first name, home/residence address, personal numeric code/unique identification code, series and number of identity document, in the case of non-resident persons;
- the name of the form of practicing the profession/of earning income, the fiscal identification code of the form of practicing the profession/of earning income, the address/seat of the form of practicing the profession/of earning income;
- identification data of the natural person, legal representative of the legal entity: last name and first name, personal numerical code/unique identification code;
- nature, source and amount of the income, for the period corresponding to the last two completed fiscal years, including, where possible, for the period between the last completed fiscal year and the date of their request;
- other financial information (in the case of a legal entity client);
You have the right to withdraw your consent regarding the processing of personal data at any time, as indicated in the General Information Note mentioned above. In this case, we will stop processing your data carried out based on consent, except where there is another legal basis for this. However, the withdrawal of consent does not affect the legality of the data processing carried out before the withdrawal of consent.
C. Information regarding the processing of personal data on the occasion of concluding and during the execution of a credit agreement concluded with BT
If the BT loan application is approved, we inform you below how we will process your data on the occasion of concluding (signing with electronic signature) and during the term of the loan contract.
This is a specific information note regarding the processing of personal data for the purpose of concluding and carrying out a credit contract. The provisions of this note are complemented by the General information note on the processing and protection of personal data belonging to BT Clients, in which all the other purposes for which your data is processed, as a BT client, are detailed.
1. The identity of the operator
Banca Transilvania S.A processes your personal data as a controller for the conclusion and execution of the credit agreement concluded with the bank and, where applicable, the guarantee contract - accessory to the credit agreement.
2. The legal basis and the purpose of processing
For the conclusion and execution of lending contracts and, where appropriate, of the related guarantee contracts, the bank processes the categories of personal data mentioned in this section at point (4), based on its legal obligations, the conclusion and execution of the contract, and based on legitimate interest.
The bank will use any of the contact details provided by the borrower for managing the contractual relationship with the bank for the purpose of informing about the due date of each installment, as well as, where applicable, for sending notifications regarding the expiration of insurance policies, for debt recovery on the contracted loan, and for other events related to it.
3. The obligation to provide data and the consequences of non-compliance with it
Your personal data provision is necessary for the purpose mentioned in point (2). Refusal to process your personal data necessary for the achievement of the mentioned purpose will result in the bank being unable to grant you the requested credit.
4. Categories of processed personal data
Personal data processed by the bank for the purpose mentioned in point (2) are those that you have acknowledged being processed during the pre-offering/credit application analysis stage (detailed in letter B points I, II, and III of this section of the present information note), to which other such data received from you on the occasion/for the conclusion of the credit contract, together with its accessories, are added. Upon conclusion of the contract, an IBAN code related to the contracted credit will be allocated to you, through which the payments related to it will be processed.
In order to send you the credit contract, we will also use the e-mail address that we requested from you and that we have verified during the application process that you use.
5. Data recipients
Personal data processed for the purpose mentioned in point (2) are disclosed or transferred in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure the full confidentiality and security of the data, to the following categories of recipients - Credit Bureau S.A. and Participants in this system, insurance companies, appraisal companies, service providers used by the Bank within the lending process, debt recovery companies, the Office of Cadastre and Real Estate Advertising (OCPI), the National Register for Movable Property Advertising (RNPM), authorities and public institutions, notaries public, lawyers, judicial executors, Credit Risk Center*, societies (funds) for guaranteeing various types of credit products.
*The Bank has the legal obligation to report to the Credit Risk Center (CRC) the credit risk information for each debtor who meets the condition to be reported (includes the identification data of a debtor, natural person or non-banking legal entity, and transactions in lei and foreign currency through which the Bank is exposed to risk against that debtor), as well as to have registered an individual risk against them, along with information about detected card frauds.
**The bank has the legitimate interest to report in the Credit Bureau System, to which other Participants also have access (mainly credit institutions and non-banking financial institutions) your personal data in case you record delays in loan repayment of at least 30 days, after your prior notification in this regard at least 15 days before the reporting date.
6. Duration of personal data storage
Personal data processed for the purpose indicated in point (2) are stored in the bank's records for the longest of the legally established periods or, in the absence of legal terms, for the internally established periods. Those personal data that are processed in the Credit Bureau system and disclosed to the Participants in this system are stored in the records of this institution for 4 years from the date of each update. In the records of the Credit Risk Center, the data reported under the legal obligation that the Bank has, namely credit risk information and information about card frauds, are maintained for a period of 7 years from the date of registration.
7. Rights of the data subjects regarding the processing of personal data
As a data subject, you can exercise your rights provided by EU Regulation 679/2016 - the General Data Protection Regulation: the right of access, the right to data rectification, the right to data erasure, the right to restriction of data, the right to object to processing.
These rights can be exercised as follows:
- at the Bank, by sending a written request to the bank's address in Cluj-Napoca City, Calea Dorobanților Street, no. 30-36, Cluj County, with the mention – "attention to the person responsible for data protection (DPO)" or electronically to the e-mail address dpo@btrl.ro.
- by securely accessing the Credit Bureau website, in the case of data processed in the Credit Bureau System as well as the right to address the National Authority for the Supervision of Personal Data Processing and justice.
D. Information regarding the processing of personal data for the purpose of issuing and managing the Qualified Digital Certificate issued to the User by Alfatrust Certification S.A. for signing documentation in relation to BT
You can find detailed information below about the processing of your data for this purpose.
1. Operators of personal data
Based on art. 13-14 of EU Regulation 679/2016 - General Data Protection Regulation ("GDPR"), Alfatrust Certification S.A. ("Alfatrust") and Banca Transilvania S.A. ("BT") inform you regarding the processing of your personal data, as a User ("data subject") carried out by them as joint controllers for the purpose mentioned in letter b of this notice.
2. Purpose and legal basis of the processing of personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate ("the Certificate").
BT is the operator that identifies the User, and collects from them the personal data necessary for issuing the Qualified Digital Certificate, and transmits it to Alfatrust so that this operator can issue the certificate.
The data that BT collects from Users are those processed by BT in its own records, in the context of the business relationship that is already established between the User and BT at the time of transmitting the data to Alfatrust.
During the validity period of the certificate, the personal data are processed by the associated operators, as appropriate, as well as in situations where Users request the suspension or revocation of the certificate in the manners detailed in the Terms and Conditions of service provision.
The legal grounds for processing personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit. c GDPR), conclusion/performance of the contract (Art. 6 para. 1 lit. b GDPR), and the legitimate interest of the associated operators (Art. 6 para. 1 lit. f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User has established a business relationship, and Alfatrust - as an accredited certification service provider from whom the User wishes to obtain a certificate, are subject to the legal provisions applicable in the field of preventing money laundering and terrorist financing according to which they must collect from clients a series of personal data. This data is also necessary for the conclusion/performance of the contract under which the User is granted the use of the certificate for signing documentation in relation to BT.
To assist users who wish to submit a request for suspension or withdrawal of the certificate, the associated operators justify a legitimate interest in offering them (who also have the status of BT clients) the possibility to send these requests not only directly to Alfatrust, but also through BT. The processing of these requests involves the exchange of personal data of the Users between the two associated operators.
Contact details - phone number, and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the smooth running of the contractual relationship related to the qualified digital certificate.
3. Categories of personal data and of persons whose personal data are processed
Personal data processed for the purpose of fulfilling the mentioned objective are those prescribed by law as mandatory to be collected by a credit institution, respectively by a certification service provider for the prevention of money laundering and the sanctioning of terrorism, namely: name, first name, personal identification number (CNP), home/residence address, validity date of the identity document, and phone number, a copy of the identity document. All these data, as made available by the user to BT, will be transmitted to Alfatrust for the issuance and management of the Qualified Digital Certificate.
Processing this personal data is necessary for generating the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate.
The persons targeted by this processing are only the Users, as they are defined in the Terms and Conditions of Use of Alfatrust.
4. Recipients of personal data
Except for the associated operators between whom there will be an exchange of personal data processed for the fulfillment of the processing purpose, the data are disclosed, as the case may be, to IT service providers, auditors, authorities and institutions entitled to know them.
5. The period of processing personal data
Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiry, in accordance with legally established terms.
At the BT level, remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is retained for the entire period during which a business relationship between the User and BT is carried out, to which the terms established in the applicable legislation are added.
6. Rights of the data subjects concerning the processing of their personal data
To Any User, in their capacity as a data subject, the exercise of the following rights regarding the processing of their personal data, with any of the associated operators, is guaranteed: the right of access, the right to rectification, the right to restriction of processing, the right to data deletion, the right to object to data processing, the right to data portability.
Users can exercise these rights or address the data protection officers for any questions/requests regarding the processing of your personal data, as follows:
- at Banca Transilvania S.A. - by message sent to the e-mail address dpo@btrl.ro or by a request sent to the bank's address in Cluj-Napoca City, 30-36 Dorobanților Road, Cluj County, with the note "to the attention of the person responsible for data protection (DPO)"
- to Alfatrust Certification S.A. - by message sent to the e-mail address suport@alfasign.ro or by a request sent to the Alfatrust headquarters, with the mention "attention to the person responsible for data protection (DPO)"
Users also have the right to file a complaint with the supervisory authority - the National Supervisory Authority for Personal Data Processing (ANSPDCP), with headquarters in Bucharest, sector 1, Bd. Gen. Gh. Magheru no. 28-30.
