Information note regarding the processing of personal data for obtaining a BT personal needs loan 100% online

Printable version of this information note

Who is the personal data operator?

BANCA TRANSILVANIA S.A. (hereinafter "the bank" or "BT") credit institution, Romanian legal entity, with identification and contact details presented in section III of General information note concerning the processing and protection of personal data belonging to BT Clients, offers its individual customers who hold a current account the possibility to obtain a personal loan 100% online (hereinafter also referred to as "BT 100% online credit").

In the general note indicated above, which is an integral part of BT Privacy Policy from the website www.bancatransilvania.ro, found and distinct in the section Privacy Hub, you find the definition of BT Client, detailed information about your rights regarding the processing of personal data and the ways in which you can exercise them, and about the possibility of contacting the data protection officer appointed by BT (BT DPO).

When you apply to obtain a BT loan 100% online, we process your personal data for multiple purposes and legal grounds, either as the sole data controller or, as the case may be, together with other associated controllers, as we present to you below.

Also, if you choose a loan with attached insurance, the insurer Metropolitan Life is the operator of your personal data processed for issuing and managing the insurance policy, and the bank acts only as the authorized person of the insurer for this processing. Metropolitan Life Personal Data Processing Policy can be accessed from the website https://www.metropolitanlife.ro/ or directly at the following link: MetLife_Client_Data_Processing_Policy_Life_and_NonLife_aug2019.pdf (metropolitanlife.ro).

On what legal grounds do we process the data and what happens if you refuse their processing?

When you apply for obtaining and, as the case may be, conclude a contract related to a BT 100% online loan, we process your personal data based on the following legal grounds:

the legal obligations to which BT is subject through various normative acts,
the signing/execution of the credit contract or the completion of the necessary steps for its conclusion,
our legitimate interest and/or that of third parties, (e.g. the interest in preventing fraud or the legitimate interest to check your status in the records of the Credit Bureau SA for assessing your creditworthiness, the legitimate interest to contact you to provide support for completing the online application and to ask for your opinion about the application process),
your consent, such as for consulting your income in the ANAF database or for identity verification based on biometric data.

When the law requires us to process personal data or when they are necessary for concluding the credit contract, if you refuse their processing, we will not be able to analyze your application.

For processing based on the legitimate interest of BT or third parties, refusal to have your data processed may make it impossible to analyze your request or obtain the BT credit 100% online.

For data processing for which your consent is required, we will request this agreement at the appropriate time during the online application process. If you refuse to give this consent, you cannot obtain the credit 100% online, but you have the option to apply for it at a BT branch, where you will have to prove your income in another way (e.g. income certificate from your employer), and your identity will be verified without processing biometric data.

For what purposes do we process personal data, what data are they, for how long do we keep them, and to whom can we disclose them?

In the following lines, we present to you separately the purposes for which we will process personal data so that you can apply and, as the case may be, contract a BT loan 100% online. Depending on the purpose of the processing, we will present to you information about the data retention period, the categories of data recipients, the existence of automated decision-making processes, as well as the rights you benefit from..

A. Personal data processed for identity verification, in order to prevent fraud, money laundering, and terrorism financing, and to contact you for the purpose of providing support or evaluating the quality of this BT service

The applicable legislation obliges us to verify the identity of the persons with whom we are to conclude contracts. At the same time, we have a legitimate interest in preventing attempts of fraud through identity theft in the online environment.

In BT units, we verify the identity of credit applicants based on the original identity document. Online, we do not have this possibility, so we will do things a little differently. We have chosen a method that ensures who the BT client applying is, so that we can prevent possible fraud attempts. This method uses the latest technologies, processing so-called biometric data. We will use such data only based on your explicit consent. Before freely deciding whether you want to give it, here is what the use of your biometric data entails:

you make a selfie video (requires access to the device's camera);
the used IT solution compares biometrically your face from the selfie video with the face from the copy of your identity document already registered in BT's records.

Biometric comparison uses criteria such as: the color, size, and tilt of the eyes, the position and distance between the main features of the face such as the eyes, eyebrows, lips, and nose. Following the comparison, the software issues a confidence score indicating the probability that the face in the two images belongs to the same person. If the confidence score is satisfactory, we will further verify if the data from your identity document in our records is still valid. If not, you will need to update your data in BT records and restart the application process. We will use the data taken from the identity document to complete the documentation related to the requested loan.

We will also verify your contact details - phone number and email address - to make sure they belong to you. We will also use them to communicate with you and remind you that you can electronically sign the documentation and to send you the credit documentation. Also, if you haven't completed the application flow, we will be able to contact you to provide support and to find out your opinion about the application flow.

B. Personal data processed for the analysis of the credit application, including automated decision-making processes based on profiling

To analyze the application for a BT 100% online loan, we process your data in BT's internal records and in the Credit Bureau records, where we check your situation. All information related to this processing can be found below, at points I and II in this section B.

Being essential to provide you a quick response to your online credit request, we will make the approval/rejection decision of the request by processing personal data exclusively by automatic means. Details about this decision can be found at point II (5) below.

1. Identification data of operators

Banca Transilvania S.A. and the Credit Bureau Society S.A., a Romanian legal entity headquartered in Bucharest, Sfânta Vineri St., no. 29, 4th floor, sector 3, as associated operators, process your personal data in good faith, fairly and transparently, for specific and legitimate purposes, in accordance with the provisions of Regulation (EU) No 679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("Regulation" or "GDPR").

Credit Bureau SA is the private law entity that manages the Credit Bureau System, in which personal data related to lending activities carried out by Participants is processed.

Participants in the Credit Bureau System are credit institutions, non-bank financial institutions, insurance companies, and debt collection companies, which have signed a Participation Agreement with the Credit Bureau.

2. The legal basis and purpose of processing

Banca Transilvania S.A. and the Credit Bureau processes your personal data based on the legitimate interest of the Participants and the Credit Bureau for conducting responsible credit activities, under conditions of protecting, facilitating access to credit, and preventing excessive indebtedness of the persons concerned, complying with the legal framework regarding creditworthiness assessment and the reduction of credit risk, as well as preventing the use of the financial-banking system for conducting activities contrary to the law.

Banca Transilvania S.A. are the obligation, according to the legal regulations in force, to assess your credit repayment capacity, before concluding a credit agreement and during its term. For this purpose, Banca Transilvania S.A. processes the information indicated at point (4), registered under your name in its own records and transmits them to the Credit Bureau for processing by this institution and for consultation by any Participant, for the purpose of initiating or conducting a credit relationship, as well as securing credit-type products.

3. The obligation to provide data and the consequences of non-compliance with it

Providing your personal data is necessary for the purpose mentioned in point (2). Refusal to provide your personal data, necessary for achieving the above-mentioned purpose, will lead to the impossibility Banca Transilvania S.A. to fulfill its legal obligations in connection with granting the credit.

4. Categories of personal data processed in the Credit Bureau System

identification data of the data subject: name, first name, personal numeric code or CUI for authorized natural persons or CIF for natural persons carrying out liberal professions or country code and series/number of passport for non-resident persons, home/residence address, phone number, date of birth;
information regarding the employer: employer's address, date of registration of this information, VAT number;
data related to requested/granted credit type products: the type and name of the Participant, type of product, the state of the product/account, granting date, account duration, amounts granted, amounts owed, update date, currency, payment frequency, amount paid, monthly rate, outstanding amounts, number of days of delay, date of first outstanding payment, delay category, date of last payment;
data related to events occurring during the term of the credit-type product, such as those related to restructuring/refinancing, payment in kind, assignment of the loan agreement, assignment of the debt;
data related to relationships with other accounts: information regarding credit-type products for which the data subject has the status of co-debtor and/or guarantor;
data related to insolvency: information regarding the data subjects against whom an insolvency procedure has been opened;
number of queries: indicates the number of Credit Reports issued by the Credit Bureau, at the request of one or more Participants;

In the process of analyzing your credit request, Transilvania Bank S.A. will request from the Credit Bureau the issuance of a Credit Report, without FICO® Score, to check if you qualify within the legally established debt-to-income ratio and if you have the capacity to repay the loan. To obtain the Credit Report, Transilvania Bank S.A. will send to the Credit Bureau your first name, last name, and personal numeric code.

After granting the credit, Transilvania Bank S.A. will transmit your personal data provided at points a)-f) to the Credit Bureau. This information is shared with other Participants, within the Credit Bureau System, and is used for the purpose mentioned in point 2.

Your ability to repay debts at maturity can be periodically verified after the credit is granted, including by obtaining Credit Reports or by using the Alert Service*.

In the event that, during the term of the granted credit, you delay the payment of installments by more than 30 calendar days from the due date, Banca Transilvania S.A. will transmit to the Credit Bureau information regarding the outstanding amounts, the delay category, the date of the first overdue installment and/or, as the case may be, information regarding the initiation of the payment surrender procedure, only after notifying you at least 15 calendar days in advance, made in writing, by phone, SMS, e-mail or by another electronic communication means.

*The Alert Service is used by Participants to identify and/or reduce credit risk in a timely manner, by generating an alert to a Participant when an event (account opening/closing, entry/exit from delinquency, account correction, registration/deletion of surety/co-debtor status, account inquiry, change of employer name/phone number) is recorded for their own debtor at another Participant.

5. FICO® Score from the Credit Bureau

Personal data provided at point (4) may be processed by the Credit Bureau, including to calculate, at the request of Participants, the FICO® Score from the Credit Bureau.

Participants can use the FICO® Score from the Credit Bureau in order to reduce the credit risk associated with a debtor/potential debtor.

FICO® Score from the Credit Bureau is a number between 300 and 850, obtained following the statistical process that processes the information recorded by Participants in the Credit Bureau System and indicates the probability that the targeted person will pay their installments on time in the future. The main causes that led to the decrease of the FICO® Score from the Credit Bureau are displayed in the form of reason-codes.

FICO® Score from the Credit Bureau takes into account the following elements that provide predictability: payment history, current debt, account(s) duration (average number of months since the credits were granted), new credit requests (number of inquiries and credits granted in the last 6 months), credit mix (types of credits granted), age of the person concerned. The influence of these elements on the value of the FICO® Score from the Credit Bureau may vary depending on the information recorded at the Credit Bureau for each person concerned.

FICO® Score from the Credit Bureau represents a highly predictive analysis tool which, together with the data from the Credit Report and information obtained by Participants from other sources, contributes to the correct evaluation of the creditworthiness of the targeted person for the purpose of concluding/executing the credit agreement.

6. Recipients of the data

The personal data recorded in the Credit Bureau System are disclosed to Participants, upon request, for the purpose mentioned in point (2).

Personal data processed in the Credit Bureau System will not be disclosed to third parties, except authorities and public institutions, according to their competences and applicable legislation, such as the National Authority for the Supervision of Personal Data Processing, the National Bank of Romania, the National Integrity Authority, courts of law, public notaries, judicial executors, criminal investigation bodies.

7. Storage period

Personal data are stored at the Credit Bureau and disclosed to Participants for 4 years from the update date, except for the data of credit applicants who have withdrawn their credit application or to whom the credit was not granted, which are stored and disclosed to Participants for a period of 6 months.

8. Rights of the data subjects regarding the processing of personal data

As a data subject, you can exercise your rights provided by the Regulation as follows:

a) the right of access to data can be exercised:

by a written, signed request, sent by mail to the Credit Bureau, or
by securely accessing Credit Bureau website, or
personal or electronically, to the Participant who holds the status of creditor/potential creditor of yours.

At the same time, you have the right to obtain, upon request, at the time of communication of the credit decision, a copy of the Credit Report issued by the Credit Bureau, which was used by Banca Transilvania S.A. in analyzing the credit application.

b) the right to rectify data,

c) the right to erase data,

d) the right to data restriction ,

e) the right to object to processing, including the automated individual decision-making process,

can be exercised:

by securely accessing Credit Bureau website, or
personal or electronically, to the Participant who holds the status of creditor/potential creditor of the data subject.

f) the right to address the National Authority for the Supervision of Personal Data Processing and the judiciary.

9. The contact details of the data protection officers are:

For Banca Transilvania S.A.– e-mail address dpo@btrl.ro
For the Credit Bureau - e-mail address: rpd@birouldecredit.ro

This is a specific information note concerning the processing of personal data for the purpose of analyzing the credit application addressed to Transilvania Bank S.A. The provisions of this note are supplemented by General information note concerning the processing and protection of personal data belonging to BT Clients.

1. Operator's identity

Banca Transilvania S.A. processes your personal data as an operator for the purpose of pre-offering and, where appropriate, for analyzing the formulated credit application.

2. The legal basis and purpose of processing

In order to pre-offer and, as the case may be, to analyze the credit application submitted, in accordance with the need to conduct responsible lending activities, in addition to processing your personal data in the system of Credit Bureau S.A. - about which you were informed at point I. of this notice - BT processes such data in its own records, based on its legal obligations, the conclusion of the credit contract, and its legitimate interest.

3. The obligation to provide data and the consequences of non-compliance with it

The provision of personal data is necessary for the purpose mentioned in point II (2). Refusal to provide the personal data necessary for achieving this purpose would prevent the bank from fulfilling its legal obligations regarding the granting of credit, so the credit application will not be able to be analyzed.

4. Categories of personal data processed within Banca Transilvania S.A.

The categories of personal data mentioned in this notice at point I. (4) and II. (5), as well as other data collected in the credit application, are processed by BT for pre-offering, respectively for the analysis of the application.

5. Automated decision-making, including profiling, carried out through the bank's own system and inquiries of external records

To objectively verify if you meet the eligibility conditions for the requested loan, we process your personal data in our own automated system, for carrying out the necessary steps to conclude the loan agreement at your request, as well as under the legitimate interest of efficiently managing the credit risk. The bank does not use the FICO® Score from the Credit Bureau for loan application analysis.

In the bank's own system used for analyzing the credit application, personal data collected from you during the application process are automatically processed, along with information resulting from verifications carried out in the bank's own records or those of Credit Bureau SA. We process data such as, but not limited to: identification data, professional data, family-related data, data regarding economic and financial situation, data about any BT products and services you already use. Following the analysis of all information and the result of consulting the records of Credit Bureau S.A., our analysis system establishes a profile of you as a debtor/potential debtor to help us determine whether you meet the lending conditions set by BT.

Based on the agreement requested through a separate form, we will query your data and the ANAF records to obtain the income situation you realize, in order to verify the legally established indebtedness level. By exception, we will no longer ask for your consent for this consultation if you have already expressed it on the same day. If you refuse to allow us to query your data at ANAF, you cannot obtain the 100% online personal loan.

To the information obtained through automatic processing of data in our own analysis system, we will add the information obtained by querying the Credit Bureau and ANAF and the result of checking your situation in public databases such as the websites of the court portal, ONRC, etc.

We will make the approval/rejection decision of the credit application by 100% automated means because the application is submitted online and it is essential to provide you with a response within a very short time frame. In such situations, making the decision through such means is necessary to quickly analyze the application and, if applicable, to conclude the credit contract. However, you are guaranteed the right to request human intervention, that is, for the credit application to be reviewed by a bank employee, to express your point of view, and to contest the decision.

6. Recipients of the data

In addition to the recipients mentioned in point I. (6) of this notice, the personal data processed for the purpose indicated in point II (2) are disclosed, as appropriate, to the following recipients: ANAF (for consulting the database of the Ministry of Public Finance, if you have given your consent in this regard), Credit Office S.A. (to consult your situation in the records of this institution), insurance companies (if you choose to conclude insurance related to the loan), service providers used by the bank in the process of analyzing the loan application.

7. Storage period

Personal data filled in the credit application are kept in the records of Banca Transilvania for legally established limited periods (e.g. according to the financial accounting legislation) or internally.

8. Rights of the data subjects regarding the processing of personal data

For the exercise of rights (the right of access to data, the right to rectification of data, the right to erasure of data, the right to restriction of data, the right to object to processing) provided by the Regulation in connection with the processing of personal data in the system of Biroul de Credit S.A. in relation to Banca Transilvania S.A., you may use any of the methods indicated at point I.(8).

If you exercise these rights at BT (both for the processing of personal data in the system of Credit Bureau S.A. and within the bank) or if you wish to withdraw your consent (for the processing of personal data based on this legal ground), you can submit a written request to the address in Cluj-Napoca city, Calea Dorobanților, no. 30-36, Cluj county, with the mention – "attention to the data protection officer (DPO)" or electronically to the e-mail address dpo@btrl.ro.

You also have the right to address the National Authority for the Supervision of Personal Data Processing.

Banca Transilvania S.A., as a credit institution, is subject to legal obligations to establish and analyze its exposure to groups of connected clients, as part of the credit risk analysis. For this purpose, it is necessary to collect from you, as a credit applicant and, where applicable, from other public or internal sources, information about persons with whom you form the same debtor group, as you are connected clients. Your spouse is always a person connected with you. If you are married, it will be necessary to provide us with their name, surname, and Personal Numeric Code (CNP).

To check if and with whom you are in such connection relationships, we will query your data in our internal records and in public ones (e.g. ONRC). To understand what categories of persons are considered to be connected to you, we recommend that you study the details available within BT Privacy Policies, from our website www.bancatransilvania.ro, at section C point 3 or at the following link: https://www.bancatransilvania.ro/Informare-Apartenenta-la-Grupuri-Credit-Online.pdf. And the persons who are in contact with you can find out information about how we process their data for this purpose, from the same section of the BT Privacy Policy.

As a declarant, BT has the legal obligation to report these exposures and the composition of borrower client groups in connection to BNR, the Credit Risk Central (only where applicable), and, based on its legitimate interest, may disclose this data also to entities within the Banca Transilvania Financial Group and service providers used by BT within the credit application analysis process. Your refusal to have this data processed may result in BT being unable to analyze the application and/or approve the credit.

The data retention period for these persons in BT's records is equal to that of the existence of a group/groups of clients connected to which they belong, plus non-excessive storage periods.

When we analyze your credit application, we have the legal obligation and legitimate interest to determine your debt level and your ability to repay the requested loan. For this, it is necessary to know the exact situation of your income. To make everything go quickly, when you apply for a BT loan 100% online, we want to find out your income from ANAF records.

If you express this agreement, we will be able to carry out the consultation for a maximum duration of 5 working days from the date of the agreement. The form through which you express your agreement or refusal will generally be kept for 8 years, in order to prove that we have fulfilled our obligation to inform you properly and to request your consent.

The personal data indicated below, recorded under your name in the records of the Ministry of Finance, the National Agency for Fiscal Administration (ANAF) will be consulted for the purpose of (i) initiating or carrying out contractual relationships in accordance with the prudential requirements applicable to BT as a credit institution and (ii) streamlining the credit operational process, as a result of simplifying the documentation we request from you:

identification data of the natural person/natural person exercising an authorized activity: last name and first name, domicile/residence address, personal numerical code/unique identification code, identity document series and number, in the case of non-resident persons;
the name of the form of exercising the profession/of earning income, the tax identification code of the form of exercising the profession/of earning income, the address/seat of the form of exercising the profession/of earning income;
identification data of the natural person, legal representative of the legal entity: name and surname, personal numeric code/unique identification code;
nature, source and amount of income, for the period corresponding to the last two completed fiscal years, including, where possible, for the period between the last completed fiscal year and the date of their request;
other financial information (in the case of a legal entity client);

You have the right to withdraw your consent regarding the processing of personal data at any time, as indicated in the General Information Note mentioned above. In this case, we will cease the processing of your data carried out based on consent, except where there is another legal basis for this. However, the withdrawal of consent does not affect the legality of processing carried out before the withdrawal of consent.

C. Information regarding the processing of personal data on the occasion of concluding and during the execution of a credit agreement concluded with BT

If the BT loan application is approved, we inform you below how we will process your data on the occasion of concluding (signing with electronic signature) and during the term of the loan agreement.

This is a specific information note regarding the processing of personal data for the purpose of concluding and executing a credit contract. The provisions of this note are supplemented by the General Information Note on the processing and protection of personal data belonging to BT Clients, in which you will find detailed presentation of all other purposes for which your data is processed, as a BT client.

1. Operator's identity

Banca Transilvania S.A processes your personal data as a data controller for the conclusion and execution of the credit contract concluded with the bank and, where applicable, the guarantee contract - accessory to the credit contract.

2. The legal basis and purpose of processing

For the conclusion and execution of credit contracts and, as appropriate, the related guarantee contracts, the bank processes the categories of personal data mentioned in this section at point (4), based on its legal obligations, the conclusion and execution of the contract, and based on legitimate interest.

The bank will use any of the contact details provided by the borrower for conducting the contractual relationship with the bank for the purpose of informing about the due date of each installment, as well as, if applicable, for sending notifications regarding the expiration of insurance policies, for the recovery of debts on the contracted loan, and for other events related to it.

3. The obligation to provide data and the consequences of non-compliance with it

Providing your personal data is necessary for the purpose mentioned in point (2). Refusal to process your personal data necessary to achieve the mentioned purpose will lead to the bank being unable to offer you the requested loan.

4. Categories of personal data processed

Personal data processed by the bank for the purpose mentioned in point (2) are those about which you have been informed that they are processed within the pre-offer/loan application analysis stage (detailed in letter B points I, II, and III of this section of this information note) to which are added other such data received from you on the occasion/of concluding the loan agreement, together with its accessories. On the occasion of concluding the contract, an IBAN code related to the contracted loan will be allocated to you, through which the payments related to it will be carried out.

In order to send you the credit contract, we will also use the e-mail address that we requested from you and which we have verified during the application process that you use.

5. Data recipients

Personal data processed for the purpose mentioned in point (2) are disclosed or transferred in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and security of the data, to the following categories of recipients - Credit Bureau S.A. and Participants in this system, insurance companies, appraisal companies, service providers used by the Bank within the credit process, debt collection companies, the Office of Cadastre and Real Estate Advertising (OCPI), the National Register of Movable Property Advertising (RNPM), public authorities and institutions, notaries public, lawyers, bailiffs, Credit Risk Center*, companies (funds) guaranteeing various types of credit products.

*The bank has the legal obligation to report to the Credit Risk Central (CRC) the credit risk information for each debtor who meets the reporting condition (includes the identification data of a debtor, natural person or non-bank legal entity, and the operations in local currency and foreign currency through which the bank is exposed to risk in relation to that debtor), respectively to have recorded an individual risk regarding this debtor, as well as information about detected card frauds.

**The bank has the legitimate interest to report to the Credit Bureau System, to which other Participants (mainly credit institutions and non-banking financial institutions) also have access, your personal data in case you register delays in loan repayment of at least 30 days, after your prior notice in this regard at least 15 days before the reporting date.

6. The duration of personal data storage

Personal data processed for the purpose indicated in point (2) are stored in the bank's records for the longest of the legally established periods or, in the absence of legal terms, for the internally established periods. Those personal data processed in the Credit Bureau system and disclosed to the Participants in this system are stored in the records of this institution for 4 years from the date of each update. In the records of the Credit Risk Center, the data reported under the legal obligation that the Bank has, namely credit risk information and information about card frauds, are maintained for a period of 7 years from the date of registration.

7. The rights of data subjects regarding the processing of personal data

As a data subject, you can exercise your rights under EU Regulation 679/2016 - the General Data Protection Regulation: the right of access, the right to rectify data, the right to erase data, the right to restrict data processing, the right to object to processing.

These rights may be exercised as follows:

at the Bank, by sending a written request to the bank's address in Cluj-Napoca Municipality, Calea Dorobanților Street, no. 30-36, Cluj County, with the mention - “to the attention of the data protection officer (DPO)” or electronically to the email address dpo@btrl.ro.
by securely accessing Credit Bureau website, in the case of data processed in the Credit Bureau System as well as the right to address the National Authority for the Supervision of Personal Data Processing and the judiciary.

D. Information regarding the processing of personal data for the purpose of issuing and managing the Qualified Digital Certificate issued to the User by Alfatrust Certification S.A. for signing documentation in relation to BT

You can find detailed information below about the processing of your data for this purpose.

1. Operators of personal data

Based on art. 13-14 of EU Regulation 679/2016- General Data Protection Regulation („GDPR), Alfatrust Certification S.A. („Alfatrust”) and Banca Transilvania S.A. („BT”), inform you regarding the processing of your personal data, as a User („data subject”) which they carry out as joint controllers for the purpose mentioned in section b of this notice.

2. The purpose and legal basis of processing personal data

The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate ("Certificate").

BT is the operator that identifies the User, respectively collects from them the personal data necessary for issuing the Qualified Digital Certificate, and transmits it to Alfatrust so that this operator can issue the certificate.

The data that BT collects from Users are those processed by BT in its own records, in the context of the business relationship that is already established between the User and BT at the time of transmitting the data to Alfatrust.

During the validity period of the certificate, personal data is processed by the associated operators, as appropriate, as well as in situations where Users request the suspension or revocation of the certificate in the ways detailed in the Terms and conditions of service provision.

The legal bases for processing personal data for the defined purpose are the legal obligation (art. 6 para. 1 lit. c GDPR), the conclusion/performance of the contract (art. 6 para. 1 lit. b GDPR), and the legitimate interest of the associated operators (art. 6 para. 1 lit. f GDPR).

Regarding the legal obligation, both BT - as a credit institution with which the User has established a business relationship, and Alfatrust - as an accredited certification service provider from which the User wishes to obtain a certificate, are subject to the applicable legal provisions in the field of preventing money laundering and terrorist financing, according to which they must collect from clients a series of personal data. These data are also necessary for the conclusion/performance of the contract under which the User is allowed to use the certificate for signing documentation in relation to BT.

To support users who wish to submit a request to suspend or withdraw the certificate, the associated operators justify a legitimate interest in offering them (who also have the status of BT clients) the possibility to send these requests not only directly to Alfatrust but also through BT. The resolution of these requests involves the exchange of personal data of the Users between the two associated operators.

Contact data - phone number, and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.

3. Categories of personal data and of persons whose personal data are processed

The personal data processed for the purpose of fulfilling the mentioned objective are those required by law to be collected by a credit institution, respectively by a certification service provider for the prevention of money laundering and the sanctioning of terrorism, namely: name, surname, personal numerical code (CNP), home/residence address, expiration date of the identity document, and phone number, a copy of the identity document. All these data, as provided by the user to BT, will be transmitted to Alfatrust for the issuance and management of the Qualified Digital Certificate.

Processing of this personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate.

The persons targeted by this processing are only the Users, as they are defined in the Terms and Conditions of Use of Alfatrust.

4. Recipients of personal data

Except for the associated operators between whom there will be an exchange of personal data processed for the fulfillment of the processing purpose, the data is disclosed, as the case may be, to IT service providers, audit providers, authorities, and institutions entitled to know them.

5. Period of processing of personal data

Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its validity termination, in accordance with legally established deadlines.

At the BT level, remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship between the User and BT is ongoing, plus the terms established in the applicable legislation.

6. Rights of the data subjects whose personal data are processed

To any User, in their capacity as a data subject, the exercise of the following rights regarding the processing of their personal data is guaranteed, with any of the associated operators: the right of access, the right to rectification, the right to restriction of processing, the right to erasure of data, the right to object to data processing, the right to data portability.

Users can exercise these rights or contact the data protection officers for any questions/requests regarding the processing of your personal data, as follows:

to Banca Transilvania S.A.- by message sent to the e-mail address dpo@btrl.ro or by a request sent to the bank's address in Cluj-Napoca City, Cale Dorobanților Street no. 30-36, Cluj county, with the mention "attention to the data protection officer (DPO)"
to Alfatrust Certification S.A. - by message sent to the e-mail address suport@alfasign.ro or by a request sent to the Alfatrust headquarters, with the mention "attention to the data protection officer (DPO)"

Users also have the right to file a complaint with the supervisory authority - the National Authority for the Supervision of Personal Data Processing (ANSPDCP), with headquarters in Bucharest, sector 1, Bd. Gen. Gh. Magheru no. 28-30.