Who is the personal data operator?
BANCA TRANSILVANIA S.A. (hereinafter "the bank" or "BT") credit institution, Romanian legal entity, with the identification and contact details presented in section III of General information note regarding the processing and protection of personal data belonging to BT Clients, offers its individual customers who hold debit cards the possibility to obtain/increase the credit line in the current account to which this debit card is attached, exclusively online. This type of credit is hereinafter referred to as overdraft.
In the general note indicated above, which is an integral part of BT Privacy Policy from the Transilvania Bank website, found and distinct in the section Privacy Hub from this site, you can find detailed information about the rights you benefit from in connection with the processing of your personal data, about the ways in which you can exercise them, or about how you can contact the data protection officer appointed by BT (DPO BT).
If you want to apply for obtaining or, as the case may be, for increasing an overdraft exclusively online, we will process your personal data for multiple purposes and legal bases; by ourselves, as the exclusive data controller or, as the case may be, together with other controllers associated with us.
In this information note, when we refer to the processing of personal data for applying for/obtaining/contracting an overdraft, the information is also valid for the processing of data carried out when you request an increase of an overdraft you obtained previously (regardless of whether you contracted it at a BT unit or online).
Also, when we refer to the processing of personal data for the conclusion and execution of the credit contract, the information also applies to the processing of personal data for the conclusion/execution of an additional act to the credit contract. This additional act will be concluded between you and the bank if your increase of the credit line related to a card you previously obtained is approved (regardless of whether you contracted it at a BT unit or online).
On what grounds do we process data and what happens if you refuse to have them processed?
Personal data processing carried out by BT in the context of applying for and, where applicable, contracting an overdraft exclusively online is based on the following grounds:
- the legal obligations to which BT is subject through various normative acts,
- the conclusion/execution of the overdraft contract or completing the necessary steps for its conclusion,
- our legitimate interest and/or that of third parties (e.g. the interest in preventing fraud or the legitimate interest in consulting your situation in the records of Credit Bureau SA for the assessment of your creditworthiness, the legitimate interest to contact you to resolve situations that may arise when applying for obtaining/increasing the credit line related to the overdraft),
- your consent, such as that for consulting your income in the ANAF database or for verifying your identity and your status as a BT client based on biometric data.
When the law requires us to carry out certain personal data processing or when they are necessary for concluding the overdraft contract, if you refuse their processing, BT will not be able to analyze your request or, as the case may be, you will not be able to contract the overdraft.
For the processing based on the legitimate interest of BT or third parties, the refusal to have your data processed may make it impossible for you to submit or for us to analyze your request or to obtain/increase the overdraft.
If the processing of personal data is based on your consent (e.g., querying income in ANAF, processing biometric data), we will request this agreement from you at the appropriate moment in the online flow, so that the entire process is as transparent as possible to you. If you refuse to grant us this consent, you cannot obtain the overdraft exclusively online, but you have the option to apply at a BT branch.
For what purposes do we process personal data, what data is it, for how long do we keep it, and to whom can we disclose it?
In the following lines we present to you separately the purposes for which we would process the personal data so that you can apply and, where applicable, contract an overdraft exclusively online.
Depending on the purpose of the processing, you will be presented with information about the storage period of your data, the categories of recipients of the data, the existence of automated decision-making processes, as well as the rights you have regarding the processing of your data.
A. Personal data processed for identity verification, in order to prevent fraud, money laundering and terrorism financing, for confirming the status of BT Client, as well as to contact you for the purpose of providing support or evaluating the quality of this BT service
The legislation applicable to us obliges us to verify the identity of the persons with whom we conclude various contracts. Also, we have a legitimate interest in ensuring that we prevent attempts of fraud through identity theft in the online environment.
When a person requests an overdraft at a BT unit, their identity is verified based on the original identity document presented. Online, we do not have this possibility, so we will do things a little differently. We have chosen a method that ensures who the BT client applying is, so that we can prevent potential fraud attempts. This method uses the latest technologies, processing so-called biometric data. However, we will not be able to use this data without your explicit consent. Before freely deciding whether you want to express it, here is what the use of your biometric data entails:
- you will need to photograph your identity card ("ID"), which also contains your image (requires access to the camera);
- the IT solution we use will identify in the photo of the ID card the section that includes your face, will select it and then compare it with the face from the copy of your identity document which is already registered in BT's records. The comparison is made biometrically, based on criteria such as: the color, size, and tilt of the eyes, the position and distance between the main elements of the face such as the eyes, eyebrows, lips, and nose. Following the comparison, the IT solution will issue a confidence score, indicating the probability that the face in the two images belongs to the same person.
If you do not wish your biometric data (facial identification) to be processed, you can apply for an overdraft at any BT branch, where your identity will be verified without the use of such data.
Also, in case the facial identification tool emits an unsatisfactory confidence score, you will be able to retake the application process at a BT unit.
We will automatically extract the data from the photographed ID card (through optical character recognition), which we will compare with the corresponding data from the copy of your identity document already registered in our records. If they match, you can proceed further in the process. Otherwise, you will first need to update your data in BT's records.
The data taken from the identity document will also be used for the overdraft request you make online.
We will also ask you for contact details - phone number and email address - which we will verify to make sure they belong to you, as they are very important in the electronic signing process of the documentation for obtaining/increasing the overdraft online. If we notice that you have not completed the application flow, we can use these contact details to see if you need support to complete the application, as well as to find out your opinion about the flow in BT Pay for obtaining an overdraft/increasing the credit line related to a previously obtained overdraft.
B. Personal data processed for the analysis of the credit application, including automated decision-making processes based on profiling
To analyze the application through which you apply for an online-only overdraft, we process information concerning you both in our internal records and in the Credit Bureau records, where we consult your situation. All information related to this processing can be found in points I and II below.
Because it is essential to be able to provide you with a quick response to your online overdraft request, we will make the decision to grant the credit or, as the case may be, to reject this request based solely on the automatic processing of data, a decision about which you can find details in the following, at point II (5).
1. Identification data of operators
Transylvania Bank and the Credit Bureau Company S.A., Romanian legal entity headquartered in Bucharest, Sfânta Vineri Street, no. 29, 4th floor, sector 3, as associated operators, process your personal data in good faith, fairly and transparently, for specific and legitimate purposes, in accordance with the provisions of Regulation (EU) no. 679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the Regulation).
Credit Bureau SA is the private law entity that manages the Credit Bureau System, where personal data related to lending activities carried out by Participants are processed.
Participants in the Credit Bureau System are credit institutions, non-banking financial institutions, insurance companies, and debt collection companies that have signed a Participation Contract with the Credit Bureau.
2. The legal basis and the purpose of processing
Banca Transilvania S.A. and the Credit Bureau process your personal data based on the legitimate interest of the Participants and the Credit Bureau for carrying out responsible lending activities, under the conditions of protecting, facilitating access to credit and preventing excessive indebtedness of the data subjects, complying with the legal framework regarding creditworthiness assessment and credit risk reduction, as well as preventing the use of the financial-banking system for carrying out activities contrary to the law.
Banca Transilvania S.A. are the obligation, according to the legal regulations in force, to assess your credit repayment capacity, before concluding a credit contract and during its execution. For this purpose, Banca Transilvania S.A. processes the information indicated at point (4), recorded in your name in its own records and transmits it to the Credit Bureau for processing by this institution and for consultation by any Participant, for the purpose of initiating or conducting a credit relationship, as well as securing credit-type products.
3. The obligation to provide data and the consequences of non-compliance with it
The provision of your personal data is necessary for the purpose stated in point (2). Refusal to provide your personal data, necessary to achieve the purpose mentioned above, will lead to the impossibility Transilvania Bank S.A. to fulfill its legal obligations in connection with granting the credit.
4. Categories of personal data processed in the Credit Bureau System
- identification data of the data subject: name, first name, personal numeric code or CUI for authorized natural persons or CIF for natural persons practicing liberal professions or country code and passport series/number for non-resident persons, home/residence address, phone number, date of birth;
- data relating to the employer: employer's address, the date of registration of this information, VAT number;
- data related to the requested/granted credit-type products: type and name of the Participant, type of product, product/account status, date of granting, account duration, amounts granted, amounts owed, date of updating, currency, payment frequency, amount paid, monthly rate, outstanding amounts, number of days of delay, date of first overdue, delay category, date of last payment;
- data related to events occurring during the term of the credit-type product, such as those relating to restructuring/refinancing, handing over in payment, assignment of the credit contract, assignment of the claim;
- data related to relationships with other accounts: information regarding credit-type products for which the data subject has the status of co-debtor and/or guarantor;
- data related to insolvency: information regarding the targeted persons against whom an insolvency procedure has been initiated;
- number of queries: indicates the number of Credit Reports issued by the Credit Bureau, at the request of one or more Participants.
In the process of analyzing your credit application, Banca Transilvania S.A. will request from the Credit Bureau the issuance of a Credit Report, with or without a FICO® Score, to verify if you fit within the legally established debt ratio and if you have the capacity to repay the credit. For obtaining the Credit Report, Banca Transilvania S.A. will send to the Credit Bureau the name, surname, and personal numeric code.
After granting the credit, Banca Transilvania S.A. will send your personal data specified in points a)-f) to the Credit Bureau. This information is shared with other Participants, within the Credit Bureau System, and is used for the purpose mentioned in point 2.
Your ability to repay debts at maturity can be periodically verified, after the credit is granted, including by obtaining Credit Reports or by using *Alert Service.
In case, during the term of the granted loan, you delay the payment of installments for more than 30 calendar days from the due date, Banca Transilvania S.A. will send to the Credit Bureau information regarding the outstanding amounts, the delay category, the date of the first outstanding installment and/or, as the case may be, information regarding the initiation of the payment surrender procedure, only after notifying you, at least 15 calendar days in advance, made in writing, by phone, SMS, e-mail or by other means of electronic communication.
*The Alert Service is used by Participants to identify and/or reduce credit risk in a timely manner, by generating an alert to a Participant when an event is recorded for one of their own debtors (account opening/closing, entry/exit from arrears, account correction, registration/deletion of guarantor/co-debtor status, account inquiry, employer name/phone number change) at another Participant.
5. FICO® Score from the Credit Bureau
Personal data provided in point (4) may be processed by the Credit Bureau, including to calculate, at the request of the Participants, the FICO® Score from the Credit Bureau.
Participants can use the FICO® Score from the Credit Bureau for the purpose of reducing the credit risk associated with a debtor/potential debtor.
FICO® Score from the Credit Bureau is a number between 300 and 850, obtained through the statistical process that processes the information recorded by Participants in the Credit Bureau System and indicates the probability that the targeted person will pay their installments on time in the future. The main causes that have led to the decrease of the FICO® Score from the Credit Bureau are displayed in the form of reason codes.
FICO® Score from the Credit Bureau takes into account the following elements that provide predictability: payment history, current debt, the duration of the credit account(s) (the average number of months since the credits were granted), the request for new credits (the number of inquiries and credits granted in the last 6 months), the credit mix (types of credits granted), the age of the person concerned. The influence of these elements on the value of the FICO® Score from the Credit Bureau may vary depending on the information recorded at the Credit Bureau for each person concerned.
FICO® Score from the Credit Bureau represents a high predictability analysis tool which, alongside data from the Credit Report and information obtained by Participants from other sources, contributes to the correct assessment of the creditworthiness of the person concerned for the purpose of concluding/performing the credit agreement.
6. Data recipients
Personal data recorded in the Credit Bureau System are disclosed to Participants, upon request, for the purpose mentioned in point (2).
Personal data processed in the Credit Bureau System will not be disclosed to third parties, except for authorities and public institutions, according to their competences and applicable legislation, such as the National Authority for the Supervision of Personal Data Processing, the National Bank of Romania, the National Integrity Authority, judicial courts, notaries public, judicial executors, criminal investigation bodies.
7. Storage period
Personal data are stored at the Credit Bureau and disclosed to Participants for 4 years from the date of update, except for the data of credit applicants who have withdrawn their credit application or who were not granted credit, which are stored and disclosed to Participants for a period of 6 months.
8. The rights of the data subjects regarding the processing of personal data
As a data subject, you can exercise your rights under the Regulation as follows:
a) the right of access to data can be exercised:
- by a written, signed request, sent by mail to the Credit Bureau, or
- by securely accessing the Credit Bureau's website (www.birouldecredit.ro), or
- personal or electronically, to the Participant who holds the status of creditor/potential creditor of yours.
At the same time, you have the right to obtain, upon request, at the time of communication of the credit decision, a copy of the Credit Report issued by the Credit Bureau, which was used by Banca Transilvania S.A. in the analysis of the credit application.
b) the right to rectification of data,
c) the right to erasure of data,
d) the right to restrict data,
e) the right to object to processing, including the automated individual decision-making process,
can be exercised:
- by securely accessing the Credit Bureau's website (www.birouldecredit.ro), or
- personal or electronically, to the Participant who holds the status of creditor/potential creditor of the data subject.
f) the right to address the National Authority for the Supervision of Personal Data Processing and the judiciary.
9. The contact details of the data protection officers are:
- For Banca Transilvania S.A. – e-mail address dpo@btrl.ro
- For the Credit Bureau - e-mail address: rpd@birouldecredit.ro
This is a specific informative note regarding the processing of personal data for the purpose of analyzing the credit application addressed to BT. The provisions of this note are supplemented by General information note regarding the processing and protection of personal data belonging to BT Clients, in which you find presented in detail all the other purposes for which your data is processed. The general information note is an integral part of the BT Privacy Policy, found on website of Transilvania Bank and can be obtained on request at any BT unit.
1. The identity of the operator
Banca Transilvania S.A. processes your personal data as an operator for the purpose of pre-offering and, if applicable, for analyzing the credit application submitted.
2. The legal basis and the purpose of processing
For the purpose of pre-offering and, as the case may be, analyzing the credit application submitted, in accordance with the need to conduct responsible lending activity, in addition to processing your personal data in the system of Credit Bureau S.A. - about which you were informed at point I. of this notice - Transilvania Bank S.A. processes such data in its own records, based on the legal obligations it must comply with, the conclusion of the credit contract and based on its legitimate interest.
The bank will process any of the contact details provided within the credit application submitted, for the purpose of notifying the credit applicant in writing regarding the approval/rejection decision thereof, in accordance with the applicable legal provisions. In case the applicant wishes to use another form for communicating the decision, they may address the bank with an explicit request in this regard.
3. The obligation to provide data and the consequences of non-compliance with it
Providing your personal data is necessary for the purpose mentioned in point II.(2). Refusal to provide your personal data, necessary to achieve the purpose mentioned above, will lead to the impossibility for Banca Transilvania S.A. to fulfill its legal obligations related to granting the loan, and the loan application will not be able to be analyzed.
4. Categories of personal data processed within Transilvania Bank S.A.
The personal data mentioned in this information at point I. (4), II.(5), as well as other categories of such data collected in the credit application fields are processed by Banca Transilvania S.A. within the process of analyzing the submitted credit application, both in the system of Credit Bureau S.A. and in its own records, being also verified (name, first name and/or Personal Numeric Code) - as applicable - in public databases such as websites - court portal, National Trade Register Office etc.
5. The existence of an automated decision-making process, including profiling created through the BT scoring application
In order to objectively verify the fulfillment of eligibility conditions for pre-offering and, where applicable, for analyzing the credit application, BT processes your personal data in its own automated system ("BT scoring application"), for carrying out the necessary steps to conclude the credit contract at your request, as well as on the basis of our legitimate interest to efficiently manage the credit risk.
In the BT scoring application, some of the personal data that we request from you in the credit application/pre-application are entered and processed automatically, along with information resulting from checks carried out in the bank's own records or those of Credit Bureau S.A., such as (for informational purposes but not limited to them) as applicable - information related to BT client status, income level, professional and personal information, the level of monthly payment obligations, payment history on other credits. Following the analysis of all the information and the result of consulting the records of Credit Bureau S.A., the BT scoring application issues a score that establishes a profile of the debtor/potential debtor based on the information presented in the previous lines, which will be taken into consideration in the analysis process and which considers the probability of paying the monthly payment obligations.
Based on the score issued by the BT scoring application, which is supplemented by the result of verifying the applicant's situation in public databases such as websites - the courts' portal, ONRC, etc. - Banca Transilvania S.A. determines whether the eligibility conditions established by its internal regulations are met and will make the decision to approve or reject the credit application.
We will make the decision to approve/reject the credit application exclusively through automated means because the application is made online and it is essential to provide you with a response within a very short time frame. In such situations, making the decision through such means is necessary in order to quickly analyze the application and, if applicable, to conclude the credit agreement. However, you are guaranteed the right to request human intervention, that is, the credit application to be reviewed by a bank employee, to express your point of view, and to contest the decision.
6. Data recipients
In addition to the recipients mentioned in point I.(6) of this notification, the personal data processed for the purpose indicated in point II.(2) are disclosed, as appropriate, to the following recipients: ANAF (for consulting the database of the Ministry of Public Finance, in case you have given your consent in this regard on the dedicated form), Credit Bureau S.A. (to consult your situation in the records of this institution), insurance companies, appraisers (in the case of loans for which an evaluation of the collateral goods is carried out), FNGCIMM (in the case of First House, New House or First Car loans), suppliers of the BT scoring application or other services used by Banca Transilvania S.A. in the credit application analysis process and/or within other processes specific to its object or activity.
7. Storage period
The personal data filled in the credit application are kept in the records of Transilvania Bank for legally established limited periods (e.g. according to financial accounting legislation) or internal periods.
8. The rights of the data subjects regarding the processing of personal data
For exercising the rights (the right to access data, the right to rectify data, the right to erase data, the right to restrict data, the right to object to processing) provided by the Regulation in connection with the processing of your personal data in the system of Credit Bureau S.A. in relation to Transilvania Bank S.A., you can use any of the methods indicated at point I.(8).
In case you understand to exercise these rights at Banca Transilvania S.A. (both for the processing of personal data in the Credit Bureau S.A. system, as well as within Banca Transilvania S.A.), you will be able to address your written request to the address in Cluj-Napoca City, Calea Dorobanților Street, no. 30-36, Cluj county, with the mention – "attention to the data protection officer (DPO)" or electronically at the e-mail address dpo@btrl.ro. Ai, de asemenea, dreptul de a vă adresa Autorității Naționale pentru Supravegherea Prelucrării Datelor cu Caracter Personal și justiției.
You must know that BT, in its capacity as a credit institution, is subject to legal obligations to establish and analyze its exposure to connected customer groups, as part of the credit risk analysis. For this purpose, it is necessary to collect from you, as a credit applicant and, if applicable, from other public or internal sources, information about persons with whom you form the same connected customer group.
Your husband/wife is always a person connected to you. If you are married, you will need to provide us with his/her name, first name, and personal identification number.
As a declarant, BT will report these exposures and the component of debtor client groups in connection to BNR, Credit Risk Center (only where applicable).
Persons in your group can find information about the processing of their data in section C point 3 of the BT Privacy Policies, found on the Transilvania Bank website.
These data are necessary for BT in order to proceed with the analysis of your credit application, and your refusal to provide them may result in BT being unable to analyze the application and/or approve the credit.
Personal data belonging to these categories of individuals are transmitted to the Credit Risk Center within the BNR, as well as, if applicable, in compliance with the need-to-know principle, to entities within the Banca Transilvania Financial Group and service providers used by BT in the credit application analysis process.
The retention period of these persons' data in the BT records is equal to the existence of a group/some groups of clients in connection of which they are part.
Information on group membership DownloadWhen we analyze your credit request we have the legal obligation and legitimate interest to establish your debt level and your ability to repay the requested credit. For this, it is necessary to know the exact situation of your income. To make everything go quickly, when you apply for an overdraft exclusively online, we want to find out your income from the ANAF records. However, we will not consult them without you giving your express consent. We inform you that the tax-related information consulted by BT in the ANAF records can also be made available to you directly through the private virtual space managed by ANAF.
If you express your agreement for us to consult your income in the ANAF records, we will be able to perform the consultation for a maximum duration of 5 working days from the date you express your agreement. The form through which you express your agreement or refusal will generally be kept for 8 years, in order to prove that we have fulfilled our obligation to properly inform you and to request your consent.
In case you wish to express your disagreement (the NO response), you will not be able to continue the online application process, but you can apply for an overdraft at any BT unit, where you will be presented with other ways to prove your income.
We would consult, in the records of the Ministry of Public Finance, the National Agency for Fiscal Administration (ANAF), the personal data registered in your name indicated below* (*please note that the query consent form that will be displayed for signature during the online application process is a standard one, used both for querying data of individuals and legal entities. However, the process you are undergoing is dedicated only to individuals, so we show you in this information note only the categories of data processed in the case of querying individuals' incomes).
- identification data: name and surname, personal numeric code/tax identification number, IP and signature;
- the name of the form of practicing the profession/of earning income, the fiscal identification code of the form of practicing the profession/of earning income, the address/seat of the form of practicing the profession/of earning income;
- incomes obtained from any kind of activities (salaried, authorized/independent, pensions, social insurance, rentals etc.);
The purpose/purposes of processing these data is, as the case may be, that of (i) initiating or carrying out contractual relations specific to BT's activity (ii) fulfilling BT's legitimate interests and/or (iii) fulfilling BT's legal obligations, including those regarding risk management or those arising from administrative acts issued by the competent authorities in the application of the law:
If you express your consent, you have the right to withdraw it at any time within the 5-day period. In this case, once the notification is received, BT will no longer process your personal data for the above-mentioned purpose(s), unless there is another legal basis for this. However, please note that the legality of the personal data processing carried out before the withdrawal of consent will not be affected. To exercise the right to withdraw consent, you will need to address BT with a written, dated and signed request, sent to the bank's headquarters address - marked "to the attention of DPO" - or to the email address dpo@btrl.ro, in which you must state that you withdraw the consent expressed by agreement.
You are also guaranteed the exercise of the other rights provided by the GDPR, which you can find presented in detail in the BT Privacy Policy on the website www.bancatransilvania.ro/. You will have to exercise them in the ways explicitly indicated in the ANAF query agreement that you will sign during the online application process.
C. Information regarding the processing of personal data on the occasion of concluding and during the execution of a credit agreement concluded with BT
Presence is a specific information note regarding the processing of personal data for the purpose of concluding and performing a credit agreement. The provisions of this note are supplemented by the General information note on the processing and protection of personal data belonging to BT Clients, in which all the other purposes for which your data is processed are presented in detail. The General information note is an integral part of the BT Privacy Policy, found on website of Transilvania Bank and can be obtained on request at any BT unit.
1. The identity of the operator
Banca Transilvania S.A processes your personal data as a controller for the conclusion and execution of the credit agreement concluded with the bank and, where applicable, the guarantee contract - accessory to the credit agreement.
2. The legal basis and the purpose of processing
For the conclusion and execution of lending contracts and, where appropriate, of the related guarantee contracts, the bank processes the categories of personal data mentioned in this section at point (4), based on its legal obligations, the conclusion and execution of the contract, and based on legitimate interest.
The bank will use any of the contact details provided by the borrower for conducting the contractual relationship with the bank for the purpose of informing about the due date of each installment, as well as, where applicable, for sending notifications regarding the expiration of insurance policies, for debt collection on the contracted loan, and for other events related to it.
3. The obligation to provide data and the consequences of non-compliance with it
Your personal data provision is necessary for the purpose mentioned in point (2). Refusal to process your personal data necessary for the achievement of the mentioned purpose will result in the bank being unable to grant you the requested credit.
4. Categories of processed personal data
The personal data processed by the bank for the purpose mentioned in point (2) are those about which you have been informed that they are processed during the pre-offer/credit application analysis stage (detailed in letter B points I, II, and III of this information note) to which other such data received from you on the occasion of/for the conclusion of the credit agreement, together with its accessories, are added. On the occasion of concluding the contract, including the IBAN of the current account into which the amount related to the overdraft will be made available to you will be processed.
In order to send you the credit contract, we will also use the e-mail address we requested from you and verified that you use.
5. Data recipients
Personal data processed for the purpose mentioned in point (2) are disclosed or transferred in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and data security, to the following categories of recipients - Credit Bureau S.A. and the Participants in this system, insurance companies, appraisal companies, service providers used by the Bank within the credit process, debt collection companies, OCPI, National Register of Movable Property Publicity (RNPM), public authorities and institutions, notaries public, lawyers, bailiffs, Credit Risk Center*, societies (funds) for guaranteeing various types of credit products.
*The Bank has the legal obligation to report to the Credit Risk Center (CRC) the credit risk information for each debtor who meets the condition to be reported (includes the identification data of a debtor, natural person or non-banking legal entity, and transactions in lei and foreign currency through which the Bank is exposed to risk against that debtor), as well as to have registered an individual risk against them, along with information about detected card frauds.
**The bank has a legitimate interest in reporting to the Credit Bureau System, to which other Participants have access (mainly credit institutions and non-banking financial institutions), your personal data in case you register delays in credit payment of at least 30 days, after prior notification to you in this regard at least 15 days before the reporting date.
6. Duration of personal data storage
The personal data processed for the purpose indicated at point (2) are stored in the bank's records for legally established limited periods (e.g., according to financial accounting legislation) or internal periods. Those personal data that are processed in the Credit Bureau system and disclosed to Participants in this system are stored in the records of this institution for 4 years from the date of the update. In the records of the Credit Risk Center, the data reported under the legal obligation that the Bank has, respectively credit risk information and information about card frauds are maintained for a period of 7 years from the date of registration.
7. Rights of the data subjects regarding the processing of personal data
As a data subject, you can exercise your rights provided by EU Regulation 679/2016 - the General Data Protection Regulation: the right of access, the right to rectification of data, the right to erasure of data, the right to restriction of data, the right to object to processing.
These rights can be exercised as follows:
- at the Bank, by sending a written request to the bank's address in Cluj-Napoca Municipality, Calea Dorobanților street, no. 30-36, Cluj county, with the mention – "to the attention of the data protection officer (DPO)" or electronically to the email address dpo@btrl.ro.
- by securely accessing the Credit Bureau website, in the case of data processed in the Credit Bureau System as well as the right to address the National Authority for the Supervision of Personal Data Processing and justice.
D. Information regarding the processing of personal data for the purpose of issuing and managing the Qualified Digital Certificate issued to the User by Alfatrust Certification S.A. for signing documentation in relation to BT
If you want to obtain an overdraft exclusively online, it will be necessary to sign the credit documentation with a qualified electronic signature. Issuing and using the digital certificate for signing does not involve costs for you, but it is necessary for BT and Alfatrust to jointly process, as associated operators, personal data concerning you for issuing this electronic signature.
1. Operators of personal data
Under Articles 13-14 of EU Regulation 679/2016 - General Data Protection Regulation ("GDPR"), Alfatrust Certification S.A. ("Alfatrust") and Transilvania Bank S.A. ("BT") inform you regarding the processing of your personal data as a User ("data subject") which they carry out as joint controllers for the purpose mentioned in point b of this notice.
2. The purpose and basis of processing personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate ("the Certificate").
BT is the operator that identifies the User, and collects from them the personal data necessary for issuing the Qualified Digital Certificate, and transmits it to Alfatrust so that this operator can issue the certificate.
The data that BT collects from Users are those processed by BT in its own records, in the context of the business relationship that is already established between the User and BT at the time of transmitting the data to Alfatrust.
During the validity period of the certificate, the personal data are processed by the associated operators, as appropriate, as well as in situations where Users request the suspension or revocation of the certificate in the manners detailed in the Terms and Conditions of service provision.
The legal grounds for processing personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit. c GDPR), conclusion/performance of the contract (Art. 6 para. 1 lit. b GDPR), and the legitimate interest of the associated operators (Art. 6 para. 1 lit. f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User has established a business relationship, and Alfatrust - as an accredited certification service provider from whom the User wishes to obtain a certificate, are subject to the applicable legal provisions in the field of money laundering and terrorist financing prevention according to which they must collect from clients a series of personal data. These data are also necessary for the conclusion/execution of the contract based on which the User is allowed to use the certificate for signing documentation in relation to BT.
To assist users who wish to submit a request for suspension or withdrawal of the certificate, the associated operators justify a legitimate interest in offering them (who also have the status of BT clients) the possibility to send these requests not only directly to Alfatrust, but also through BT. The processing of these requests involves the exchange of personal data of the Users between the two associated operators.
Contact details - phone number, and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.
3. Categories of personal data and of persons whose personal data are processed
Personal data processed for the purpose of fulfilling the mentioned goal are those provided by law as mandatory to be collected by a credit institution, respectively by a certification service provider for the prevention of money laundering and the sanctioning of terrorism, namely: name, first name, Personal Numeric Code (CNP), home/residence address, validity date of the identity document, and phone number, a copy of the identity document. All these data, as made available by the user to BT, will be transmitted to Alfatrust for the issuance and management of the Qualified Digital Certificate.
Processing this personal data is necessary for generating the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate.
The persons targeted by this processing are only the Users, as they are defined in the Terms and Conditions of Use.
4. Recipients of personal data
Except for the associated operators between whom there will be an exchange of personal data processed for the fulfillment of the processing purpose, the data are disclosed, as the case may be, to IT service providers, auditors, authorities and institutions entitled to know them.
5. The period of processing personal data
Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiration, in accordance with the legally established terms.
At the BT level, the remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is retained for the entire period during which a business relationship between the User and BT is ongoing, plus the terms established by the applicable legislation.
6. Rights of the data subjects concerning the processing of their personal data
To Any User, in their capacity as a data subject, the exercise of the following rights regarding the processing of their personal data, with any of the associated operators, is guaranteed: the right of access, the right to rectification, the right to restriction of processing, the right to data deletion, the right to object to data processing, the right to data portability.
Users can exercise these rights or address the data protection officers for any questions/requests regarding the processing of your personal data, as follows:
- to Banca Transilvania S.A. - by message sent to the e-mail address dpo@btrl.ro or by a request sent to the bank's address in Cluj-Napoca City, Calea Dorobanților Street no. 30-36, Cluj County, with the mention "to the attention of the data protection officer (DPO)"
- to Alfatrust Certification S.A. - by message sent to the e-mail address suport@alfasign.ro or by a request sent to the Alfatrust headquarters, with the mention "attention to the person responsible for data protection (DPO)"
Users also have the right to file a complaint with the supervisory authority - the National Supervisory Authority for Personal Data Processing (ANSPDCP), headquartered in Bucharest, Sector 1, G-ral Gh. Magheru Blvd. no. 28-30.
