Who is the personal data operator?
BANCA TRANSILVANIA S.A. (hereinafter "the bank" or "BT") credit institution, Romanian legal entity, with identification and contact details presented in section III of General information note concerning the processing and protection of personal data belonging to BT Clients, offers its individual customers who hold debit cards the possibility to obtain/increase the credit line in the current account to which this debit card is attached, exclusively online. This type of credit is hereinafter called „overdraft”.
In the general note indicated above, which is an integral part of BT Privacy Policy from Transilvania Bank's website, found and distinct in the section Privacy Hub from this site, you can find detailed information about the rights you benefit from regarding the processing of your personal data, about the ways you can exercise them or about how you can contact the person responsible for data protection appointed by BT (DPO BT).
If you want to apply for obtaining or, as the case may be, for increasing an overdraft exclusively online, we will process your personal data for multiple purposes and legal bases; we alone, as the exclusive data controller, or, as the case may be, together with other operators affiliated with us.
In this information note, when we refer to the processing of personal data for applying for/obtaining/contracting an overdraft, the notice also applies to the processing of data carried out when you request an increase of an overdraft you previously obtained (regardless of whether you contracted it at a BT unit or online).
Also, when referring to the processing of personal data for the conclusion and execution of the credit agreement, the information is also valid for the processing of personal data for the conclusion/execution of an addendum to the credit agreement. This addendum will be concluded between you and the bank if your increase of the credit line related to a card you previously obtained is approved (regardless of whether you contracted it at a BT unit or online).
On what grounds do we process the data and what happens if you refuse to have it processed?
Personal data processing carried out by BT in the context of applying for and, where appropriate, contracting an overdraft exclusively online is based on the following grounds:
- the legal obligations to which BT is subject through various normative acts,
- the conclusion/execution of the overdraft contract or completing the necessary steps for its conclusion,
- our legitimate interest and/or that of some third parties (e.g. the interest in fraud prevention or the legitimate interest in consulting your situation in the records of the Credit Bureau SA for the assessment of your creditworthiness, the legitimate interest in contacting you to resolve situations that may arise when you apply for obtaining/increasing the credit line related to the overdraft),
- your consent, such as for consulting your income in the ANAF database or for verifying your identity and your status as a BT client based on biometric data.
When the law obliges us to carry out certain personal data processing or when they are necessary for concluding the overdraft contract, if you refuse their processing, BT will not be able to analyze your request or, as the case may be, you will not be able to contract the overdraft.
For processing based on the legitimate interest of BT or third parties, refusal to have your data processed may make it impossible for you to submit or for us to analyze your request or to obtain/increase the overdraft.
If the processing of personal data is based on your consent (e.g. income inquiry at ANAF, processing of biometric data), we will request this agreement at the appropriate time in the online flow, so that the whole process is as transparent as possible for you. If you refuse to grant us this consent, you cannot obtain the overdraft exclusively online, but you have the option to apply at a BT unit.
For what purposes do we process personal data, what data are they, for how long do we keep them, and to whom can we disclose them?
In the following lines, we present to you separately the purposes for which we will process personal data so that you can apply and, where applicable, contract an overdraft exclusively online.
Depending on the purpose of the processing, you will be presented with information about the storage period of your data, the categories of data recipients, the existence of automated decision-making processes, as well as the rights you have regarding the processing of your data.
A. Personal data processed for identity verification, in order to prevent fraud, money laundering, and terrorism financing, to confirm the status of BT Client, as well as to contact you for the purpose of providing support or evaluating the quality of this BT service
Legislation applicable to us obliges us to verify the identity of persons with whom we conclude various contracts. Also, we have a legitimate interest in ensuring that we prevent attempts at fraud through identity theft in the online environment.
When a person requests an overdraft at a BT unit, their identity is verified based on the original identity document presented. Online, we do not have this possibility, so we will do things a little differently. We have chosen a method that ensures who the BT client applying is, so that we can prevent potential fraud attempts. This method uses the latest technologies, processing the so-called biometric data. However, we will not be able to use this data without your explicit consent. Before you freely decide whether you want to express it, here is what the use of your biometric data involves:
- you will need to photograph your identity card ("ID"), which also contains your image (requires access to the camera);
- The IT solution we use will identify in the ID photo the section that contains your face, select it, and then compare it with the face in the copy of your identity document that is already registered in BT's records. The comparison is made biometrically, based on criteria such as: the color, size, and tilt of the eyes, the position and distance between the main facial features such as the eyes, eyebrows, lips, and nose. Following the comparison, the IT solution will issue a confidence score, indicating the probability that the face in the two images belongs to the same person.
If you do not wish to have your biometric data (facial identification) processed, you can apply for an overdraft at any BT unit, where your identity will be verified without the use of such data.
Also, in case the facial identification tool issues an unsatisfactory confidence score, you will be able to resume the application process at a BT unit.
We will automatically extract the data from the photographed ID card (through optical character recognition), which we will compare with the corresponding data from your identity document copy already registered in our records. If they match, you can proceed further in the process. Otherwise, you will first need to update your data in the BT records.
The data taken from the identity document will also be used for the overdraft request that you submit online.
We will also ask you for contact details - phone number and email address - which we will verify to make sure they belong to you, as they are very important in the process of electronic signing of the documentation for obtaining/increasing the online overdraft. If we notice that you have not completed the application flow, we will be able to use these contact details to see if you need support to complete the application, as well as to hear your opinion about the flow in BT Pay for obtaining an overdraft/increasing the credit line related to a previously obtained overdraft.
B. Personal data processed for credit application analysis, including automated decision-making processes based on profiling
In order to analyze the request through which you apply for an overdraft exclusively online, we process information concerning you both in our internal records and in the Credit Bureau records, where we check your situation. All information related to this processing can be found in points I and II below.
Because it is essential to be able to provide you with a quick response to your online overdraft request, we will make the decision to grant the credit or, as the case may be, to reject this request based solely on the automated processing of data, a decision about which you will find details below, in section II (5).
1. Identification data of operators
Transilvania Bank and the Credit Bureau Society S.A., Romanian legal entity headquartered in Bucharest, Sfânta Vineri Street, no. 29, 4th floor, sector 3, as associated operators, process your personal data in good faith, fairly and transparently, for specific and legitimate purposes, in accordance with the provisions of Regulation (EU) No. 679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the Regulation).
Credit Bureau SA is the private law entity that manages the Credit Bureau System, in which personal data related to lending activities carried out by Participants is processed.
Participants in the Credit Bureau System are credit institutions, non-bank financial institutions, insurance companies, and debt collection companies, which have signed a Participation Agreement with the Credit Bureau.
2. The legal basis and purpose of processing
Banca Transilvania S.A. and the Credit Bureau processes your personal data based on the legitimate interest of the Participants and the Credit Bureau for carrying out responsible credit activities, under the conditions of protecting, facilitating access to credit and preventing excessive indebtedness of the persons concerned, complying with the legal framework regarding creditworthiness assessment and risk reduction, as well as preventing the use of the financial-banking system for carrying out activities contrary to the law.
Banca Transilvania S.A. are the obligation, according to the legal regulations in force, to assess your credit repayment capacity, before concluding a credit agreement and during its term. For this purpose, Banca Transilvania S.A. processes the information indicated at point (4), registered under your name in its own records and transmits them to the Credit Bureau for processing by this institution and for consultation by any Participant, for the purpose of initiating or conducting a credit relationship, as well as securing credit-type products.
3. The obligation to provide data and the consequences of non-compliance with it
Providing your personal data is necessary for the purpose mentioned in point (2). Refusal to provide your personal data, necessary for achieving the above-mentioned purpose, will lead to the impossibility Banca Transilvania S.A. to fulfill its legal obligations in connection with granting the credit.
4. Categories of personal data processed in the Credit Bureau System
- identification data of the data subject: name, first name, personal numeric code or CUI for authorized natural persons or CIF for natural persons carrying out liberal professions or country code and passport series/number for non-resident persons, home/residence address, phone number, date of birth;
- information regarding the employer: employer's address, date of this information's registration, VAT number;
- data related to requested/granted credit type products: the type and name of the Participant, product type, product/account status, grant date, account duration, amounts granted, amounts owed, update date, currency, payment frequency, amount paid, monthly rate, outstanding amounts, number of days late, date of first overdue, delay category, date of last payment;
- date relating to events occurring during the term of the credit product , such as those related to restructuring/refinancing, payment in kind, assignment of the loan agreement, assignment of the debt;
- data related to relationships with other accounts: information regarding credit-type products for which the data subject has the status of co-debtor and/or guarantor;
- data regarding insolvency: information regarding the data subjects against whom an insolvency procedure has been opened;
- number of queries: indicates the number of Credit Reports issued by the Credit Bureau, at the request of one or more Participants.
In the process of analyzing your credit application, Banca Transilvania S.A. will request from the Credit Bureau the issuance of a Credit Report, with or without a FICO® Score, to verify whether you meet the legally established debt-to-income ratio and if you have the ability to repay the loan. To obtain the Credit Report, Banca Transilvania S.A. will send to the Credit Bureau your first name, last name, and personal numeric code.
After granting the credit, Transilvania Bank S.A. will transmit your personal data provided at points a)-f) to the Credit Bureau. This information is shared with other Participants, within the Credit Bureau System, and is used for the purpose mentioned in point 2.
Your ability to repay debts on maturity can be periodically verified, after granting the loan, including through obtaining Credit Reports or through the use of *Alert Service.
In case, during the term of the granted loan, you delay the payment of installments for more than 30 calendar days from the due date, Banca Transilvania S.A. will send to the Credit Bureau information regarding the outstanding amounts, delay category, date of first delinquency and/or, where applicable, information regarding the initiation of the payment surrender procedure, only after notifying you at least 15 calendar days in advance, in writing, by phone, SMS, e-mail, or by other electronic means of communication.
*The Alert Service is used by Participants to identify and/or reduce credit risk in a timely manner, by generating an alert to a Participant when an event is recorded for their own debtor (account opening/closing, entry/exit from arrears, account correction, registration/deletion of guarantor/co-debtor status, account inquiry, employer name/phone number change) at another Participant.
5. FICO® Score from the Credit Bureau
Personal data provided at point (4) may be processed by the Credit Bureau, including to calculate, at the request of Participants, the FICO® Score from the Credit Bureau.
Participants can use the FICO® Score from the Credit Bureau in order to reduce the credit risk associated with a debtor/potential debtor.
FICO® Score from the Credit Bureau is a number between 300 and 850, obtained following the statistical process that processes the information recorded by Participants in the Credit Bureau System and indicates the probability that the targeted person will pay their installments on time in the future. The main causes that led to the decrease of the FICO® Score from the Credit Bureau are displayed in the form of reason codes.
FICO® Score from the Credit Bureau takes into account the following elements that provide predictability: payment history, current debt, account/account duration (average number of months since credit was granted), new credit requests (number of inquiries and credits granted in the last 6 months), credit mix (types of credits granted), age of the targeted person. The influence of these elements on the value of the FICO® Score from the Credit Bureau may vary depending on the information recorded at the Credit Bureau for each targeted person.
FICO® Score from the Credit Bureau represents a highly predictive analytical tool which, together with the data from the Credit Report and the information obtained by Participants from other sources, contributes to the accurate assessment of the creditworthiness of the person concerned for the purpose of concluding/executing the credit agreement.
6. Recipients of the data
The personal data recorded in the Credit Bureau System are disclosed to Participants, upon request, for the purpose mentioned in point (2).
Personal data processed in the Credit Bureau System will not be disclosed to third parties, except authorities and public institutions, according to their competences and applicable legislation, such as the National Authority for the Supervision of Personal Data Processing, the National Bank of Romania, the National Integrity Authority, courts of law, public notaries, judicial executors, criminal investigation bodies.
7. Storage period
Personal data are stored at the Credit Bureau and disclosed to Participants for 4 years from the date of update, except for credit applicants data who have withdrawn the credit application or to whom the credit was not granted, which are stored and disclosed to Participants for a period of 6 months.
8. Rights of the data subjects regarding the processing of personal data
As a data subject, you can exercise your rights provided by the Regulation as follows:
a) the right of access to data can be exercised:
- by a written, signed request, sent by mail to the Credit Bureau, or
- by securely accessing the Credit Bureau website (www.birouldecredit.ro), or
- personal or electronically, to the Participant who holds the status of creditor/potential creditor of yours.
At the same time, you have the right to obtain, upon request, at the time of communication of the credit decision, a copy of the Credit Report issued by the Credit Bureau, which was used by Banca Transilvania S.A. in analyzing the credit application.
b) the right to rectify data,
c) the right to erase data,
d) the right to data restriction ,
e) the right to object to processing, including the automated individual decision-making process,
can be exercised:
- by securely accessing the Credit Bureau website (www.birouldecredit.ro), or
- personal or electronically, to the Participant who holds the status of creditor/potential creditor of the data subject.
f) the right to address the National Authority for the Supervision of Personal Data Processing and the judiciary.
9. The contact details of the data protection officers are:
- For Banca Transilvania S.A. – e-mail address dpo@btrl.ro
- For the Credit Bureau - e-mail address: rpd@birouldecredit.ro
This is a specific information note, regarding the processing of personal data for the purpose of analyzing the credit request addressed to BT. The provisions of this note are supplemented by General information note concerning the processing and protection of personal data belonging to BT Clients, in which you find detailed all the other purposes for which your data is processed. The general information note is an integral part of the BT Privacy Policy, found on website of Transilvania Bank and can be obtained on request at any BT unit.
1. Operator's identity
Banca Transilvania S.A. processes your personal data as an operator for the purpose of pre-offering and, where appropriate, for analyzing the submitted credit request.
2. The legal basis and purpose of processing
In order to pre-offer and, as the case may be, to analyze the credit application submitted, in accordance with the need to conduct responsible lending activities, in addition to processing your personal data in the system of the Credit Bureau S.A. - about which you were informed at point I. of this information - Transilvania Bank S.A. processes such data in its own records, based on the legal obligations it must comply with, the conclusion of the credit contract and on its legitimate interest.
The bank will process any of the contact details provided within the credit application, for the purpose of notifying the credit applicant in writing regarding the approval/rejection decision, in accordance with the applicable legal provisions. In case the applicant wishes to use another form for communicating the decision, they may submit an express request to the bank in this regard.
3. The obligation to provide data and the consequences of non-compliance with it
Providing your personal data is necessary for the purpose mentioned in point II.(2). Refusal to provide your personal data, necessary for achieving the purpose mentioned above, will lead to the impossibility for Banca Transilvania S.A. to fulfill its legal obligations related to granting the loan, and the loan application will not be analyzed.
4. Categories of personal data processed within Banca Transilvania S.A.
The personal data mentioned within this information at point I. (4), II.(5), as well as other categories of such data collected in the credit application fields are processed by Banca Transilvania S.A. within the process of analyzing the submitted credit application, both in the system of Credit Bureau S.A. and in own records, including being verified (name, first name and/or personal numerical code) - as applicable - in public databases such as websites - courts portal, Trade Register Office etc.
5. The existence of an automated decision-making process, including profiling created through the BT scoring application
In order to objectively verify the fulfillment of eligibility conditions for pre-offering and, as the case may be, for analyzing the credit application, BT processes your personal data in its own automatic system ("BT scoring application"), to carry out the necessary steps for concluding the credit contract at your request, as well as on the basis of our legitimate interest in efficiently managing the credit risk.
In the BT scoring application, some of the personal data that we request from you within the loan application/pre-application are entered and processed automatically, together with information resulting from checks carried out in the bank's own records or those of the Credit Bureau S.A., such as (for informational purposes but not limited to them) as appropriate - information related to the status of being a BT client, income level, professional and personal information, the level of monthly payment obligations, payment history on other loans. Following the analysis of all the information and the result of consulting the records of the Credit Bureau S.A., the BT scoring application issues a score that establishes a profile of the debtor/potential debtor based on the information presented in the previous lines, which will be taken into account in the analysis process and which considers the probability of repayment of the monthly payment obligations.
Based on the score issued by the BT scoring application, to which is added the result of checking the applicant's situation in public databases such as the websites - court portal, ONRC, etc - Banca Transilvania S.A. determines whether the eligibility conditions established by its internal regulations are met and will make the decision to approve or reject the credit application.
We will make the decision to approve/reject the credit application exclusively through automated means because the application is submitted online and it is essential to provide you with a response within a very short time frame. In such situations, making the decision through such means is necessary in order to quickly analyze the application and, if applicable, to conclude the credit contract. However, you are guaranteed the right to request human intervention, meaning the credit application will be reviewed by a bank employee, to express your point of view and to contest the decision.
6. Recipients of the data
In addition to the recipients mentioned in point I.(6) of this notice, the personal data processed for the purpose indicated in point II.(2) are disclosed, as the case may be, to the following recipients: ANAF (for consulting the database of the Ministry of Public Finance, in case you have expressed your consent in this regard on the dedicated form), Credit Bureau S.A. (to check your situation in the records of this institution), insurance companies, evaluators (in the case of loans for which an evaluation of the assets brought as collateral is carried out), FNGCIMM (in the case of First House, New House or First Car loans), providers of the BT scoring application or other services used by Transilvania Bank S.A. within the credit application analysis process and/or within other processes specific to its object of activity.
7. Storage period
Personal data filled in the credit application are kept in the records of Banca Transilvania for legally established limited periods (e.g. according to the financial accounting legislation) or internally.
8. Rights of the data subjects regarding the processing of personal data
For exercising the rights (the right to access data, the right to rectify data, the right to delete data, the right to restrict data, the right to object to processing) provided by the Regulation in connection with the processing of your personal data in the system of Credit Bureau S.A. in relation to Transilvania Bank S.A. you can use any of the methods indicated at point I.(8).
In case you understand to exercise these rights at Banca Transilvania S.A. (both for the processing of personal data in the Credit Bureau S.A. system, as well as within Banca Transilvania S.A.), you can address your written request to the address in Cluj-Napoca Municipality, Calea Dorobanților Street, no. 30-36, Cluj County, with the mention – "to the attention of the data protection officer (DPO)" or electronically to the e-mail address dpo@btrl.ro. Ai, de asemenea, dreptul de a vă adresa Autorității Naționale pentru Supravegherea Prelucrării Datelor cu Caracter Personal și justiției.
You must know that BT, in its capacity as a credit institution, is subject to legal obligations to establish and analyze its exposure to groups of connected clients, as part of the credit risk analysis. For this purpose, it is necessary to collect from you, as a credit applicant, and, if applicable, from other public or internal sources, information about persons with whom you form the same group of connected clients.
Your husband/wife is always a person connected to you. If you are married, you will need to provide their name, surname, and personal identification number.
As the declarant, BT will report these exposures and the component of debtor customer groups in connection to BNR, the Credit Risk Central (only where applicable).
Persons in your group can find information about the processing of their data in section C point 3 of BT Privacy Policies, found on Transilvania Bank's website.
These data are required by BT in order to proceed with the analysis of your credit application, and your refusal to provide them may result in BT being unable to analyze the application and/or approve the credit.
Personal data belonging to these categories of natural persons are transmitted to the Credit Risk Center within the National Bank of Romania, as well as, where applicable, respecting the need-to-know principle, to entities within the Banca Transilvania Financial Group and service providers used by BT in the credit application analysis process.
The retention period of these individuals' data in BT records is equal to that of the existence of a group/some groups of customers connected of which they are part.
Information on group membershipWhen we analyze your credit application, we have the legal obligation and legitimate interest to determine your debt level and your capacity to repay the requested credit. For this, it is necessary to know the exact situation of your income. To make everything go quickly, when you apply for an overdraft exclusively online, we want to find out your income from ANAF records. However, we will not consult them without your express consent. We inform you that the tax information consulted by BT in the ANAF records can also be made available to you directly through the private virtual space managed by ANAF.
If you express your consent to us consulting your income records in the ANAF registers, we will be able to carry out the consultation for a maximum period of 5 working days from the date you express your consent. The form through which you express your consent or refusal will generally be kept for 8 years, in order to prove that we have fulfilled our obligation to inform you properly and to request your consent.
If you wish to express your disagreement (the NO response), you will not be able to continue the application process online, but you can apply for an overdraft at any BT branch, where other ways to prove your income will be presented to you.
We will consult in the records of the Ministry of Public Finance, the National Agency for Fiscal Administration (ANAF) the personal data registered in your name indicated below* (*please note that the inquiry consent form that will be displayed to you for signing during the online application process is a standard one, used both for the inquiry of data of individuals and of legal entities. However, the process you are going through is dedicated only to individuals, so we present in this information note only the categories of data processed in the case of individual income inquiries).
- identification data: name and surname, personal numeric code/tax identification number, IP and signature;
- the name of the form of exercising the profession/of earning income, the tax identification code of the form of exercising the profession/of earning income, the address/seat of the form of exercising the profession/of earning income;
- revenues earned from any kind of activities (salaried, authorized/independent, pensions, social insurance, rentals, etc.);
The purpose/purposes of processing these data is, as appropriate, that of (i) initiating or carrying out the contractual relationships specific to BT's activity (ii) realizing BT's legitimate interests and/or (iii) fulfilling the legal obligations incumbent upon BT, including those concerning risk management or those deriving from administrative acts issued by the competent authorities in the application of the law:
If you express your consent, you have the right to withdraw it at any time within the 5-day period. In this case, once the notification is received, BT will no longer process your personal data for the purpose(s) mentioned above, except if there is another legal basis for this. However, please note that the legality of personal data processing carried out before the withdrawal of consent will not be affected. To exercise the right to withdraw consent, you must send a request to BT in written form, dated and signed, to the bank's headquarters address - with the mention "attention DPO" - or to the email address dpo@btrl.ro, in which you must state that you are withdrawing the consent given by agreement.
Your exercise of the other rights provided by the GDPR is also guaranteed, which you can find detailed in the BT Privacy Policy on the website www.bancatransilvania.ro/. You will have to exercise them in the ways explicitly indicated in the ANAF query agreement that you will sign during the online application process.
C. Information regarding the processing of personal data on the occasion of concluding and during the execution of a credit agreement concluded with BT
Presence is a specific information note concerning the processing of personal data for the purpose of concluding and executing a credit contract. The provisions of this note are supplemented by the General Information Note regarding the processing and protection of personal data belonging to BT Clients, where you will find detailed presentation of all other purposes for which your data is processed. The General Information Note is an integral part of the BT Privacy Policy, found on website of Transilvania Bank and can be obtained on request at any BT unit.
1. Operator's identity
Banca Transilvania S.A processes your personal data as a data controller for the conclusion and execution of the credit contract concluded with the bank and, where applicable, the guarantee contract - accessory to the credit contract.
2. The legal basis and purpose of processing
For the conclusion and execution of credit contracts and, as appropriate, the related guarantee contracts, the bank processes the categories of personal data mentioned in this section at point (4), based on its legal obligations, the conclusion and execution of the contract, and based on legitimate interest.
The bank will use any of the borrower's provided contact details to carry out the contractual relationship with the bank for the purpose of informing about the due date of each installment, as well as, if applicable, for sending notifications regarding the expiration of insurance policies, for the recovery of debts on the contracted loan, and for other events related to it.
3. The obligation to provide data and the consequences of non-compliance with it
Providing your personal data is necessary for the purpose mentioned in point (2). Refusal to process your personal data necessary to achieve the mentioned purpose will lead to the bank being unable to offer you the requested loan.
4. Categories of personal data processed
Personal data processed by the bank for the purpose mentioned in point (2) are those about which you have been informed that they are processed during the pre-offer/analysis stage of the credit application (detailed in letter B points I, II, and III of this information note) to which other such data received from you on the occasion/for the conclusion of the credit contract, along with its accessories, are added. On the occasion of concluding the contract, the IBAN of the current account into which the amount related to the overdraft will be made available to you will also be processed.
In order to send you the credit contract we will also use the email address we requested from you and have verified that you use it.
5. Data recipients
Personal data processed for the purpose mentioned in point (2) are disclosed or transferred in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and data security, to the following categories of recipients - Credit Bureau S.A. and the Participants in this system, insurance companies, evaluation companies, service providers used by the Bank within the lending process, debt collection companies, OCPI, the National Register of Movable Property Publicity (RNPM), authorities and public institutions, notaries public, lawyers, judicial executors, the Credit Risk Center*, companies (funds) guaranteeing various types of credit products.
*The bank has the legal obligation to report to the Credit Risk Central (CRC) the credit risk information for each debtor who meets the reporting condition (includes the identification data of a debtor, natural person or non-bank legal entity, and the operations in local currency and foreign currency through which the bank is exposed to risk in relation to that debtor), respectively to have recorded an individual risk regarding this debtor, as well as information about detected card frauds.
**The bank has the legitimate interest to report in the Credit Bureau System, to which the other Participants (mainly credit institutions and non-banking financial institutions) also have access, your personal data in case you register delays in loan payment of at least 30 days, after your prior notification in this regard at least 15 days before the reporting date.
6. The duration of personal data storage
Personal data processed for the purpose indicated in point (2) are stored in the bank's records for legally established limited periods (e.g., according to financial accounting legislation) or internally. Those personal data that are processed in the Credit Bureau system and disclosed to the Participants in this system are stored in the records of this institution for 4 years from the date of update. In the records of the Credit Risk Center, data reported under the legal obligation of the Bank, namely credit risk information and information about card frauds, are maintained for a period of 7 years from the date of registration.
7. The rights of data subjects regarding the processing of personal data
As a data subject, you can exercise your rights under EU Regulation 679/2016 - the General Data Protection Regulation: the right of access, the right to rectification of data, the right to erasure of data, the right to restrict data processing, the right to object to processing.
These rights may be exercised as follows:
- at the Bank, by submitting a written request to the bank's address in Cluj-Napoca City, Calea Dorobanților street, no. 30-36, Cluj county, with the mention - "attention to the person responsible for data protection (DPO)" or electronically to the e-mail address dpo@btrl.ro.
- by securely accessing Credit Bureau website, in the case of data processed in the Credit Bureau System as well as the right to address the National Authority for the Supervision of Personal Data Processing and the judiciary.
D. Information regarding the processing of personal data for the purpose of issuing and managing the Qualified Digital Certificate issued to the User by Alfatrust Certification S.A. for signing documentation in relation to BT
If you want to obtain an overdraft exclusively online, it will be necessary to sign the credit documentation with a qualified electronic signature. The issuance and use of the digital certificate for signing does not entail costs for you, however, it is necessary that BT and Alfatrust jointly process, as associated operators, personal data concerning you for the issuance of this electronic signature.
1. Operators of personal data
Under Articles 13-14 of EU Regulation 679/2016 - General Data Protection Regulation ("GDPR"), Alfatrust Certification S.A. ("Alfatrust") and Banca Transilvania S.A. ("BT") inform you regarding the processing of your personal data as a User ("data subject") carried out by them as joint controllers for the purpose mentioned under letter b of this notice.
2. The purpose and legal basis of processing personal data
The purpose for which the associated operators process the User's data is the issuance and management of the Qualified Digital Certificate ("Certificate").
BT is the operator that identifies the User, respectively collects from them the personal data necessary for issuing the Qualified Digital Certificate, and transmits it to Alfatrust so that this operator can issue the certificate.
The data that BT collects from Users are those processed by BT in its own records, in the context of the business relationship that is already established between the User and BT at the time of transmitting the data to Alfatrust.
During the validity period of the certificate, personal data is processed by the associated operators, as appropriate, as well as in situations where Users request the suspension or revocation of the certificate in the ways detailed in the Terms and conditions of service provision.
The legal bases for processing personal data for the defined purpose are the legal obligation (art. 6 para. 1 lit. c GDPR), the conclusion/performance of the contract (art. 6 para. 1 lit. b GDPR), and the legitimate interest of the associated operators (art. 6 para. 1 lit. f GDPR).
Regarding the legal obligation, both BT - as a credit institution with which the User has established a business relationship, and Alfatrust - as an accredited certification service provider from which the User wishes to obtain a certificate, are subject to the applicable legal provisions in the field of preventing money laundering and terrorism financing, according to which they must collect from clients a series of personal data. These data are also necessary for the conclusion/performance of the contract under which the User is allowed to use the certificate for signing documentation in relation to BT.
To support users who wish to submit a request to suspend or withdraw the certificate, the associated operators justify a legitimate interest in offering them (who also have the status of BT clients) the possibility to send these requests not only directly to Alfatrust but also through BT. The resolution of these requests involves the exchange of personal data of the Users between the two associated operators.
Contact data - phone number, and home address will be processed by any of the associated operators, whenever it is necessary to contact the end user for the proper conduct of the contractual relationship related to the qualified digital certificate.
3. Categories of personal data and persons whose personal data are processed
Personal data processed for the purpose of fulfilling the mentioned objective are those stipulated by law as mandatory to be collected by a credit institution, respectively by a certification service provider for the prevention of money laundering and the sanctioning of terrorism, namely: name, surname, personal numerical code (CNP), home/residence address, identity document validity date, and phone number, a copy of the identity document. All these data, as provided by the user to BT, will be transmitted to Alfatrust for the issuance and management of the Qualified Digital Certificate.
Processing of this personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate.
The data subjects of this processing are only the Users, as defined in the Terms and Conditions of Use.
4. Recipients of personal data
Except for the associated operators between whom there will be an exchange of personal data processed for the fulfillment of the processing purpose, the data is disclosed, as the case may be, to IT service providers, audit providers, authorities, and institutions entitled to know them.
5. The period of processing personal data
Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiration, in accordance with the legally established terms.
At the BT level, the remote electronic signature, applied based on the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship is conducted between the User and BT, plus the terms established by the applicable legislation.
6. Rights of the data subjects whose personal data are processed
To any User, in their capacity as a data subject, the exercise of the following rights regarding the processing of their personal data is guaranteed, with any of the associated operators: the right of access, the right to rectification, the right to restriction of processing, the right to erasure of data, the right to object to data processing, the right to data portability.
Users can exercise these rights or contact the data protection officers for any questions/requests regarding the processing of your personal data, as follows:
- at Banca Transilvania S.A. - through message sent to the e-mail address dpo@btrl.ro or by a request sent to the bank's address in Cluj-Napoca City, Calea Dorobanților Street no. 30-36, Cluj County, with the mention "to the attention of the data protection officer (DPO)"
- to Alfatrust Certification S.A. - by message sent to the e-mail address suport@alfasign.ro or by a request sent to the Alfatrust headquarters, with the mention "attention to the data protection officer (DPO)"
Users also have the right to file a complaint with the supervisory authority - the National Authority for the Supervision of Personal Data Processing (ANSPDCP), headquartered in Bucharest, sector 1, General Gh. Magheru Blvd. no. 28-30.
