Policy for processing and protection of personal data -previous versions-15082019-30092019

Banks Transylvania S.A. Policy regarding the processing and protection of personal data within banking activity ("Policy" or "BT Privacy Policy")

Valid version in the period 15.08.2019 - 30.09.2019

At Transilvania Bank S.A. (hereinafter referred to as “BT”, “the Bank” or “we”) we are constantly concerned that the personal data of all individuals with whom we interact be processed in full accordance with the applicable legal provisions and with the highest standards of security and confidentiality.

To guide and support us in our activity in the field of processing and protection of personal data, we have appointed a data protection officer (DPO), who can be contacted by any person regarding any aspects related to how BT processes this data, by sending a notification to:

BT headquarters in Cluj-Napoca city, G. Barițiu St., no. 8, Cluj County, with the mention "to the attention of the person responsible for personal data protection" or a message at
email address dpo@btrl.ro

In the following, we present our policy in this very important area, which we commit to reviewing at certain intervals of time, with a view to its continuous improvement.

Through this Policy, we intend to fulfill our obligation to inform all categories of natural persons whose personal data we process within our banking activities (“data subjects”) in accordance with the provisions of Articles 13 -14 of EU Regulation no. 679/2016 or the General Data Protection Regulation (hereinafter referred to as “GDPR”).

Whenever we have the objective possibility to directly inform certain categories of targeted persons about the processing of their data, we commit to doing so.

In some cases, however, either we do not have the objective possibility, or it would involve a disproportionate effort for the bank to directly fulfill this obligation. For all these situations, we fulfill our information obligation through this Privacy Policy.

If you are a regular client of the bank - BT Client - and you want to consult only the section concerning the processing of the data of this category of data subjects, you can access: General information note on the processing and protection of personal data belonging to BT Clients, which is an integral part of this Policy.

The present Policy is not addressed to employees of Transilvania Bank, this category of targeted persons being informed regarding the personal data that BT processes as an employer through a separate document.

We will now present which categories of personal data we process within our banking activities, who are the data subjects of this processing, for what purposes we use personal data, to whom we disclose or transfer them, how long we keep them, how we ensure their security, as well as the rights that the data subjects can exercise in relation to this processing.

In case you are not familiar with the meaning of the various technical terms used within the GDPR or the applicable banking legislation, we recommend that you first study the section related to:

A. Specialized terms used in Politics

B. Who is Banca Transilvania?

C. What personal data does BT process, to whom do they belong, and for what purposes do we use them?

Q. What are the sources from which BT collects personal data?

E. What are the legal bases on which BT processes personal data and the consequences of refusing to have the data processed?

F. To whom does BT disclose/transfer the personal data it processes?

G. The regime of transfers of personal data made by BT to third countries/international organizations

H. Automated decision-making processes, including profiling

I. For how long does BT process personal data?

J. What are the rights of the data subjects, which can be exercised in connection with the processing of their data by BT?

K. How does BT protect the personal data it processes?

The terms defined in this section shall have the following meaning when used in this Policy:

"Personal data"means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity
„Processing of personal data” or "data processing", means any operation or set of operations performed on personal data or on personal data sets, with or without the use of automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, extraction, consultation, use, disclosure by transmission, dissemination or making available in any other way, alignment or combination, restriction, deletion or destruction
„GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
"BT Financial Group"- The bank together with entities controlled by it such as, BT Microfinancing IFN SA ( "BT Mic") , BT Asset Management S.A.I. S.A., ( "BTAM") , BT Leasing Transilvania IFN S.A. ("BTL") , BT Direct IFN S.A. ("BTD") , BT Capital Partners S.S.I.F. S.A. ("BTCP") , Foundation Romanian Entrepreneur Club, Foundation Clujul has Soul and other entities that can join this group in the future;
Operatormeans a legal person, who, alone or together with other persons, determines the purposes and means of processing personal data;
„Data subject” means the natural person whose personal data are processed;
"Recipient" means the natural or legal person, public authority, agency or other body to which the personal data are disclosed, regardless of whether it is or is not a third party;
“Third party” means a natural or legal person, public authority, agency or other body, other than the Data Subject, the Operator, the Authorized Person and who, under the direct authority of the Operator or the Authorized Person, are authorized to process Personal Data;
„Supervisory Authority" means an independent public authority established by a member state, responsible for monitoring the application of the GDPR. In Romania, the supervisory authority is the National Supervisory Authority for Personal Data Processing – “ANSPDCP”;
"Biometric data" means personal data resulting from specific processing techniques related to the physical, physiological or behavioral characteristics of a natural person that allow or confirm the unique identification of that person, such as facial images or fingerprint data;
"Health data " means personal data related to the physical or mental health of an individual, including the provision of medical assistance services, which reveal information about their health status;
“Signature specimen” represents the handwritten signature of the Client recorded on documents used in their relationship with the bank and/or the Client's signature captured through an Electronic Device (SignaturePad), made available to the Bank as a specimen signature;
„Real beneficiary” according to the provisions of art. 4 para. 1 of Law no. 129/2019 for the prevention and combating of money laundering and terrorist financing, as well as for the amendment and completion of certain normative acts, is any natural person who ultimately owns or controls the client and/or the natural person on whose behalf a transaction, operation, or activity is carried out and includes at least the categories of natural persons mentioned in art. 4 para. 2 of this normative act;
“Person exposed to the public ” according to the provisions of art. 3 para. 1 of Law no. 129/2019 for the prevention and combating of money laundering and terrorist financing, as well as for the amendment and completion of some normative acts, are the natural persons who exercise or have exercised important public functions and include at least the categories of natural persons mentioned in art. 3 para. 2 of this normative act.

BANCA TRANSILVANIA S.A. is a credit institution, Romanian legal entity, registered at the Cluj Trade Registry Office under number J12/4155/1993, having the unique registration code no. RO5022670 and the following contact information: registered office address Str. George Barițiu No. 8, postal code 400027, locality Cluj-Napoca, Cluj County, Romania Tel: 0801 01 0128 (BT) - callable from the Romtelecom network, 0264 30 8028 (BT) - callable from any network, including international, *8028 (BT) - callable from Vodafone and Orange networks, email address: contact@bancatransilvania.ro, website www.bancatransilvania.ro.

BT has over 500 units - branches, agencies, work points, that carry out their activity in Romania, as well as units through which they carry out banking activity in Italy.

Our official website is www.bancatransilvania.ro (hereinafter referred to as „the BT website”).

The bank also manages other websites, the updated list of which you can consult here: https://www.bancatransilvania.ro//site-uri-bt.pdf

Transilvania Bank S.A. is the parent company of the Transilvania Bank Financial Group (hereinafter also referred to as “BT Group”), which also includes the following subsidiary entities of the Bank: BT Microfinancing IFN SA ("BT Mic"), BT Asset Management S.A.I. S.A., ( "BTAM"), BT Leasing Transilvania IFN S.A. ("BTL"), BT Direct IFN S.A. ("BTD"), BT Capital Partners S.S.I.F. S.A.("BTCP")

C. What personal data does BT process, to whom do they belong, and for what purposes do we use them?

Within the banking activity it carries out, Banca Transilvania processes different categories of personal data, depending on the status that the data subjects have in relation to BT. The purposes for which we process the data are directly dependent on the way in which the different categories of data subjects enter into a relationship with us.

With regard to the relationship you have with the bank in a certain context, we distinctly present below how we will process your personal data:

a. Who is the BT Client?

„Client BT” or ”Client” is the natural person who belongs to any of the following categories of targeted persons:

residents or non-residents, holders of at least one account opened at the Bank (also called client individual account holder) or who fill out the dedicated forms to acquire this status;
legal or conventional representatives of Clients, natural or legal persons account holders, including Clients of the type of authorized natural persons;
authorized representatives with the right to operate on the accounts of individual or legal entity clients account holders;
the real beneficiaries of Clients natural or legal persons holders of accounts opened at BT;
persons authorized to submit banking documents, to collect account statements and/or to deposit cash amounts on behalf of and for the account of individual or legal entity Clients account holders (also known as "delegates");
any other individual users of a product/service of the bank, who do not have the status of Account holder Client, legal representative, authorized person, delegate or actual beneficiary, such as but not limited to: additional card users, internet/mobile banking service users, users of mobile payment applications offered by the bank, managers with guarantee management accounts opened at the bank, users of BT meal vouchers);
guarantors of any kind of the payment obligations assumed by individual or legal entity Clients account holders;
persons who request the bank to open a contractual relationship and/or contract a certain product/service of the bank, even if this request is rejected;
legal or conventional successors of those mentioned above.

We remind you that complete details, in printable format, about BT's processing of the data of its regular customers – BT Customers – can also be found in General information note regarding the processing and protection of personal data belonging to BT Clients

b. The purposes for which we process BT Clients' data

Depending on the case, if you have the status of BT Client, we will process your data as follows:

identity verification, for the purpose of preventing money laundering and terrorist financing, as well as for confirming the status of BT Client;

Identity verification is carried out at the establishment and throughout the duration of a business relationship, when ordering any transaction, or when requesting information or performing operations such as, but not limited to: account information, submission/transmission of any applications/complaints, handing over cards, tokens, expressing options, contracting bank products/services, accessing bank services already contracted, as well as during phone calls initiated by the Clients or by the bank.

In the bank units, identity is verified based on identity documents that are within the validity period, which must be presented in original, and in the online environment and during phone calls initiated by the Client or the bank, by requesting the provision and validation of information already held in the bank's records regarding the Client;

knowing the Client for the prevention of money laundering and terrorism financing, including risk-based verification, through the application of Customer Due Diligence measures which involve both identity verification and the processing of certain personal data required by law, both at the time of acquiring the status of Client by a particular natural person (data collection), throughout the entire period this status is held (data updating), as well as after this moment, for the legally established period after the termination of the Client status (data storage and processing for purposes permitted by law);
- For details about the processing of personal data for the purpose of knowledge of the Clientele access the following link: https://www.bancatransilvania.ro//Nota-de-informare-privind-prelucrarea-datelor-cu-caracter-personal-in-scop-KYC.pdf
solvency assessment, credit risk reduction, determination of the indebtedness level of Clients interested in personalized offers related to the bank's credit products or contracting these types of products (credit risk analysis);
- For details about the processing of personal data for the purpose of analysis of a credit application submitted to Banca Transilvania S.A. access the following link: https://www.bancatransilvania.ro//Informare-privind-prelucrarea-datelor-cu-caracter-personal-in-scopul-analizarii-unei-cereri-de-creditare-1.10.2019.pdf
the conclusion and execution of contracts concluded between the bank and Clients, related to products and services offered by it on its own behalf (such as, but not limited to: cards, deposits, loans, internet and mobile banking, SMS Alert);
- For details about the processing of personal data on the occasion of concluding and during the execution of a credit contract (card or non-card) concluded with Banca Transilvania S.A. access the following link: https://www.bancatransilvania.ro//Information-note-regarding-the-processing-of-personal-data-in-the-context-of-concluding-the-performance-of-a-BT-credit-agreement.pdf
- For details regarding the processing of personal data within the mobile application BT Pay, access the following link: https://www.bancatransilvania.ro/wallet-bt-pay/privacy-policy-en/
For details related to the processing of personal data within the service Self Service Livia from BT, access the following link: https://www.bancatransilvania.ro/files/self-service-livia-de-la-bt/nota_informare_prelucrare_date_caracter_personal_serviciu_livia_de_la_bt.pdf
For details regarding the processing of personal data within the service BT Visual Help access the following link: https://www.bancatransilvania.ro//Nota-de-informare-privind-prelucrarea-datelor-cu-caracter-personal-in-cadrul-BT-VISUAL-HELP.pdf
the conclusion and execution of contracts related to occasional transactions, such as but not limited to: cash deposits made by Clients at counters or with the help of the bank's devices, in cases where the amounts are deposited into bank accounts over which those Clients do not have operating rights (are not account holders, authorized persons, or delegates on those accounts), money transfer services, currency exchanges;
- For details about the processing of personal data for the purpose of the deposit of some sums in cash access the following link: https://www.bancatransilvania.ro//Information-note-regarding-the-processing-of-personal-data-cash-deposit-occasional-customers-BT.pdf
settlement of bank transactions;
establishment of garnishments, recording the garnished amounts at the disposal of creditors and providing responses regarding these to the enforcement bodies and/or competent authorities, according to the bank's legal obligations;
monitoring the security of individuals, spaces and/or the bank's assets or those of the visitors to its units;
- Details about data processing through video surveillance can be found here: https://www.bancatransilvania.ro/supraveghere-video/
- Details about the processing of visitor data for access to some BT units can be found here www.bancatransilvania.ro/monitorizare.pdf
preparation and submission of reports to the competent institutions to receive them, in accordance with the legal provisions applicable to the bank (such as, but not limited to: reports on payment incidents to the Payment Incident Center within the National Bank of Romania, declaration of transactions exceeding the amount established by law to the National Office for Prevention and Control of Money Laundering);
carrying out analyses and keeping records of economic, financial and/or administrative management of the bank;
administration within the internal departments of the services and products offered by the bank;
evaluation and monitoring of the financial-commercial behavior of Clients during the course of the business relationship with the bank, in order to detect unusual transactions and suspicious transactions, according to the legal obligations of knowing the Clientele imposed on the bank for the prevention of money laundering and terrorist financing;
the collection of receivables and the recovery of debts recorded from Clients;
prevention of acquiring or reacquiring the status of Client by persons exhibiting inappropriate behavior, which is likely to hinder the conduct of prudent banking activities, in accordance with the legal obligations the bank has;
appearance in court of the bank's rights and interests, resolution of disputes, investigations or any other petitions/complaints/requests in which the bank is involved;
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
taking measures/providing information or responses to requests/notifications/complaints of any nature addressed to the bank by any person and/or by authorities or institutions, through any channel, including through electronic communications and internet services;
the proof of requests/agreements/options regarding certain requested/discussed/agreed aspects within the telephone calls initiated by Clients or by the bank, by recording the discussed aspects and, as the case may be, the audio recording of telephone conversations or, as the case may be, audio-video;
informing Clients about the products/services they hold at the bank, for the purpose of proper execution of contracts (such as, but not limited to account or card statements, information regarding the operating hours of bank units, information related to the insertion of garnishments on accounts, notifications about the existence of unauthorized debts or about arrears in paying installments, information about the approaching termination date of a certain product/service held, information about improvements or new facilities offered in connection with the product/service held);
the transmission of advertising messages, according to the consent expressed by Clients on forms available in the bank's units, on its website or within some online services offered;
collecting Customers' opinions regarding the quality of BT services/products/employees (service quality evaluation);
financial education of Clients;
carrying out internal analyses (including statistical), both regarding products/services and regarding the portfolio and Customer profile, for the improvement and development of products/services, as well as carrying out studies, market analyses, analyses of Customer opinions regarding the products/services/employees of the bank;
archiving- both in physical and electronic format- of documents, making backup copies;
performance of registry and secretarial services regarding correspondence addressed to and/or sent by the bank, as well as for carrying out courier activities;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention;
calculation of commissions to which certain categories of bank employees are entitled;

c. Categories of personal data processed from BT Clients

identification data: last name, first name, pseudonym (if applicable), date and place of birth, personal numeric code (CNP) or another similar unique identification element, such as CUI for authorized individuals or CIF for individuals practicing liberal professions (e.g., another unique identification element is assigned by the bank to Clients classified as "non-residents" and this is represented by a code consisting of a sequence of digits referring to the year, month, day of birth and the identity document number, complete or truncated), series and number of the national or international identity document/passport, as well as its copy, domicile and residence address;
contact details: mailing address (if applicable), telephone number, fax number, e-mail address;
citizenship;
information about the purpose and nature of the business relationship;
financial data (such as, but not limited to, data about transactions, including the amount of the projected transactions);
tax dates (country of tax residence);
profession, occupation, employer's name or nature of own activity (if applicable),
information about the important public function held - if applicable - and political opinions (excluding in the context of obtaining information related to the status of a politically exposed person - PEP);
quality, holdings and, where applicable, powers of representation held within legal entities;
information about family situation (including marital status, number of children, children in care, etc.);
information about the economic and financial situation (including data on income, data on bank transactions and their history, data on owned/possessed assets, as well as data related to payment behavior);
the image (contained in identity documents or captured by video surveillance cameras installed in the bank units, at the BT equipment, as well as in some audio and/or video recordings, as applicable);
voice, within telephone or audio/video conversations and recordings of conversations (initiated by Clients or by the bank);
age, for verifying the eligibility to contract certain products/services/offers of the bank (e.g. credit products, products dedicated to minors, etc.);
opinions, expressed within notifications/complaints/conversations, including telephone ones, regarding products/services/employees of the bank;
signature (including within signature specimens);
biometric data (such as, but not limited to, the situation of illiterate persons or persons with visual impairments, whose fingerprint can be processed);
identifiers, including identifiers allocated by Banca Transilvania or by other financial-banking or non-banking institutions, necessary for the provision of certain services, such as, but not limited to: BT Client code (BT CIF), transaction identifiers, IBAN codes attached to bank accounts, debit/credit card numbers, card expiration dates, contract numbers, codes and the operating system type of mobile phones or other devices used to access mobile banking services/mobile payment applications, as well as the IP address of the device used to access these services. Mobile phone codes, the operating system type, and IP addresses are processed exclusively to ensure security measures for transactions carried out through these services, in order to prevent fraud;
data regarding health status, exclusively in cases where the processing of such data is necessary for Clients to prove the difficult situation they or their family members are in, especially for granting certain facilities or in the context of providing/carrying out insurance products/services intermediated by the bank;
for credit products: product type, granting term, granting date, due date, amounts and credits granted, amounts owed, account status, account closing date, credit currency, payment frequency, amount paid, monthly rate, name and address of the employer, amounts owed, overdue amounts, number of overdue installments, due date of the overdue amount, number of days of delay in credit repayment. These data are processed both in the bank's own records and - where appropriate - in the Credit Bureau system and/or other records/systems of this type;
information regarding fraudulent/potentially fraudulent activity, consisting of data related to accusations and convictions related to crimes such as fraud, money laundering, and financing of terrorist acts;
information related to the commission of crimes or contraventions in the financial-banking field, in direct relation with Banca Transilvania S.A., established by final or irrevocable court decisions, as the case may be, or by uncontested administrative acts;
information regarding the location of certain transactions (implicitly, in the case of operations carried out on BT equipment belonging to Banca Transilvania);
date and information related to the products and services offered by the bank or its collaborators, which the data subjects use (such as, but not limited to, credit, deposit, insurance products);
any other personal data belonging to Clients, which are brought to our attention in various contexts by other Clients or by any other persons.

a. Who are/ in which situations do we process your data as an occasional BT Client?

“Occasional BT client” is the natural person who places at BT counters or through BT equipment transactions of the following types:

cash deposits in BT accounts for which they have no quality (including BT Clients who deposit amounts into bank accounts for which they have no quality will act in this capacity);
currency exchanges;
money transfers via Western Union (WU);
payment of utility bills;
payment of various installments or insurance premiums;
dividend withdrawal or other types of amounts;
cash withdrawals from BT equipment with cards issued by other banking or payment institutions etc).

Specific information note regarding the processing of personal data for the purpose of depositing cash amounts can be found here https://www.bancatransilvania.ro//Policy-on-the-processing-and-protection-of-personal-data-valid-version-in-the-period-15-08-2019-30-09-2019.pdf

We process your data as an occasional BT client whenever you carry out transactions of the type listed above, even if you also have the status of a regular client of the bank.

b. The purposes for which we process the data of occasional BT Clients

When you act in relation to BT as an occasional client, your data is processed, as applicable, for the following purposes:

identity verification, in order to prevent money laundering and terrorist financing; In the case of occasional transactions carried out through the bank's units, identity is verified based on valid identity documents, which must be presented in original, and in the case of using BT equipment through other information about the payer held in the bank's records;
client knowledge for the prevention of money laundering and terrorist financing, including risk-based verification, through the application of customer knowledge measures;
evaluation and monitoring of financial-commercial behavior in order to detect unusual transactions and suspicious transactions, in accordance with the legal obligations of customer due diligence imposed on the bank for the prevention of money laundering and terrorist financing;
conclusion and execution of the contract related to the occasional transaction;
settlement of bank transactions;
preparation and transmission of reports to the competent institutions authorized to receive them, in accordance with the legal provisions applicable to the bank (such as, but not limited to: reports on payment incidents to the Payment Incidents Center within the National Bank of Romania, declaration of transactions exceeding the amount established by law to the National Office for the Prevention and Control of Money Laundering);
carrying out analyses and keeping records of the bank's economic, financial and/or administrative management;
administration within the internal departments of the services and products offered by the bank;
the legal defense of the bank's rights and interests, the resolution of disputes, investigations or any other petitions/complaints/requests in which the bank is involved;
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
monitoring/security of persons, spaces and/or assets of the bank or its unit visitors;
taking measures/providing information or responses to requests/notifications/complaints of any nature addressed to the bank by any person and/or by authorities or institutions, through any channel, including via electronic communication services and the internet;
carrying out internal analyses (including statistical);
archiving - both in physical and electronic format - of documents, making backup copies;
performance of registry and secretarial services regarding correspondence addressed to and/or sent by the bank, as well as for carrying out courier activities;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention.

c. Categories of personal data processed Occasional BT Clients

Occasional BT clients we process, as appropriate, the following categories of personal data:

identification data - last name, first name, the series and number of the national or international identity document/passport, personal numeric code (CNP) or another unique similar identification element, such as CUI for authorized natural persons or CIF for natural persons practicing liberal professions (e.g. another unique identification element is allocated by the bank to Clients classified as "non-residents" and it is represented by a code consisting of a sequence of digits referring to the year, month, day of birth and the identity document number, whole or truncated), home address and - in some cases provided by law - also a copy of the identity document (usually for cash deposits, currency exchanges, money transfer services over a certain amount or presenting signs of suspicion);
details regarding the amount subject to the transaction and explanations regarding the nature of the payment (what the payment represents);
transaction identifier;
signature;
contact details - phone number and/or e-mail address in the case of cash depositors who are not BT Clients and who wish to provide them to us in order to be notified in case the transaction is canceled);
the image (from the identity document, if it is necessary to retain its copy or, as the case may be, captured by video surveillance cameras);
information regarding the location of performing certain transactions (implicitly, in case of operations at BT equipment);

a. Who is a natural person related to the applicant of a BT loan?

There are individuals related to the applicant for a loan* (also called “applicant” or “the debtor”) and form the same group with this one, any of those indicated in the table below:

*The credit applicant is a natural or legal person who submits a credit request to BT.
It is considered that the credit applicant also includes the husband/wife/life partner/co-debtor/guarantor of the main credit applicant.

Spouse/partner of the applicant together with the companies over which the applicant has control or which they manage
Other close family members of the applicant together with the companies over which they have control or that they manage, to the extent that between them and the credit applicant or between the companies they control/manage there is a relationship of : direct or indirect control/dominant influence/economic dependence
Entities in which the applicant exercises direct or indirect control through:
- Holding at least 50% of shares/social parts;
  and/or
- The ability to obtain the majority of votes within the GMS
  and/or
- The ability to appoint/revoke the majority of the members of the governing, administrative or supervisory bodies
Entities in which the applicant is an administrator
Entities in which the applicant is general manager or leader in case of foundations/associations/public bodies
Parent companies/subsidiaries of the companies from points 3 and 4;
Companies controlled by the companies from items 3 and 4.
Administrators and persons who exercise direct or indirect control in companies at points 3, 4, and 6 except those mentioned above
The natural and/or legal person who guarantees the applicant's credit with their assets (including income in the case of the co-debtor/guarantor), if the execution of these guarantees would affect them in such a manner as to put their payment capacity at risk

b. The purposes for which we process personal data belonging to natural persons from a BT debtor group

If you are such a person, we process your data, as the case may be, for the following main purpose:

solvency assessment, credit risk reduction, determining the indebtedness level of Clients interested in personalized offers related to the bank's credit products or the contracting of these types of products (credit risk analysis);

In the context of analyzing the credit application of an individual or legal entity applicant, Banca Transilvania S.A. processes including your personal data, if you fall into any of the categories of individuals indicated in the table above (who are part of the debtor's group), as the bank is subject to legal obligations to establish and analyze its exposure to related customer groups, as part of the credit risk analysis.
Also, as the reporting person, the bank will report these exposures and the composition of the debtor customer groups in connection to the NBR, the Credit Risk Center (only where applicable).
These data of yours are necessary for the bank in order to proceed with the analysis of the credit request/application, and the refusal of the credit applicant (or of you) to provide them or to have them processed may lead to the bank being unable to analyze and/or approve the credit.

Personal data belonging to you is transmitted/disclosed, as the case may be, to the Credit Risk Central of the BNR, as well as, respecting the principle of the need to know, to entities within the BT Financial Group and/or to service providers used by the bank within the credit application analysis process.

The period of retention of your data in the bank's records is equal to that of the existence of a group/some groups of clients in connection of which you are part.

Other purposes related to the main purpose indicated above, in which we process your data are, as applicable, the following:

identity verification, including for confirming/denying your status as a BT Client;
realization and submission of reports to the competent institutions authorized to receive them, in accordance with the legal provisions applicable to the bank (such as, but not limited to: the Credit Risk Central within the National Bank of Romania);
carrying out analyses and keeping records of the bank's economic, financial and/or administrative management;
administration within the internal departments of the services and products offered by the bank;
appearance in court of the bank's rights and interests, resolution of disputes, investigations or any other petitions/complaints/requests in which the bank is involved;
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
taking measures/providing information or responses to requests/notifications/complaints of any nature addressed to the bank by any person and/or by authorities or institutions, through any channel, including via electronic communication services and the internet;
carrying out internal analyses (including statistical);
archiving- both in physical and electronic format - of documents, making backup copies (back-up);
the provision of registry and secretarial services regarding correspondence addressed to the bank and/or sent by it, as well as for the conduct of courier activities;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention.

c. Categories of personal data processed of natural persons from the group of a BT debtor

identification data - name, surname, CNP;
the function, quality, holdings and, as the case may be, representation powers held within legal entities in the debtor's group;
depending on the case, other data found in the bank's records or publicly available, which are necessary to fulfill the main purpose related to credit risk analysis.

a. Who is the signatory/contact person on behalf of the contractual BT partners?

Signatories are usually the legal representatives or other persons designated by the contractual partners to sign the contracts concluded with the bank (regardless of whether the contractual partners are BT Clients legal entities account holders or service providers, collaborators, suppliers of goods contracted by the bank);
Contact persons are persons designated by the contractual partner and communicated to the partner's bank to maintain contact for the proper conduct of the contract, regardless of whether their data are mentioned in the body of the contract or not.

b. The purposes for which we process the data of signatories/contact persons on behalf of the BT contractual partners

If you are the signatory/contact person on behalf of any contractual partner of the bank, we process your data, as applicable, for:

the proper conclusion and execution of the contract concluded with the contractual partner (usually this is your employer), as well as for other purposes, closely related to the conclusion and execution of the contract, namely:
the preparation and submission of reports to the competent institutions to receive them, in accordance with the legal provisions applicable to the bank;
carrying out analyses and keeping records of the bank's economic, financial and/or administrative management;
appearance in court of the bank's rights and interests, resolution of disputes, investigations or any other petitions/complaints/requests in which the bank is involved;
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
taking measures/providing information or responses to requests/complaints/claims of any nature addressed to your bank or to authorities or institutions, through any channel, including via electronic communications and internet services;
carrying out internal analyses (including statistical);
archiving- both in physical and electronic format - of documents, making backup copies (back-up);
performance of registry and secretarial services regarding correspondence addressed to and/or sent by the bank, as well as for carrying out courier activities;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention;

Categories of personal data processed of signatories/contact persons on behalf of contractual partners

We generally process the following categories of personal data concerning you, as applicable:

For signatories:

identification data - surname and first name;
function;
signature.

For contact persons:

identification data - surname and first name;
contact details - phone number (work) and/or email address (work);
function.

Information note dedicated to signatories and contact persons acting on behalf of BT's contractual partners can be found here: https://www.bancatransilvania.ro//Nota-de-informare-privind-prelucrarea-datelor-cu-caracter-personal-semnatari-persoane-de-contact-pentru-partener-contractual-BT.pdf

a. Who is a BT shareholder/bondholder or a person whose data we process in relation to those of our shareholders/bondholders?

BT Shareholder - you are a BT shareholder if you hold, as a natural or legal person, shares issued by Banca Transilvania S.A.;
BT Obligation- you are a BT bondholder if you hold, as a natural or legal person, bonds issued by Banca Transilvania S.A.;
Natural persons whose we process the dates, as a rule, in relation to those of the BT shareholders/bondholders- legal or conventional representatives of BT shareholders/bondholders, persons who co-own shares/bonds with BT shareholders/bondholders, successors of BT shareholders/bondholders.

b. The purposes for which we process the data of BT shareholders/ bondholders or of other persons in connection with those of BT shareholders/ bondholders

If you are a shareholder and/or a BT bondholder or an individual whose data we process in relation to the shareholders/bondholders, we will use your data, as applicable, for the following purposes:

identity verification, for the purpose of confirming/refuting the status of shareholder/ bondholder of the bank, other status in connection with BT's shareholders/bondholders;
fulfillment of legal specific obligations and activities arising from BT's status as issuer (e.g. organizing the AGM, shareholder services, specific communications for investors);
establishment of garnishments, recording the garnished amounts at the disposal of creditors and providing responses regarding these to the enforcement bodies and/or competent authorities, according to the bank's legal obligations;
carrying out and sending reports to the competent institutions authorized to receive them, in accordance with the legal provisions applicable to the bank;
carrying out analyses and keeping records of the bank's economic, financial and/or administrative management;
administration within the internal departments of the services and products offered by the bank;

appearance in court of the bank's rights and interests, resolution of disputes, investigations or any other petitions/complaints/requests in which the bank is involved;
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
taking measures/providing information or responses to requests/notifications/complaints of any nature addressed to the bank by any person, as well as those addressed by authorities or institutions related to BT shareholders/obligors, through any channel, including via electronic communications and the internet;
the proof of requests/agreements/options regarding certain requested/discussed/agreed aspects, including during phone calls initiated by you or by the bank, by recording the discussed aspects and, as appropriate, audio recording of telephone conversations or, as appropriate, audio video;
carrying out internal analyses (including statistical);
archiving- both in physical and electronic format - of documents, making backup copies (back-up);
performance of registry and secretarial services regarding correspondence addressed to and/or sent by the bank, as well as for carrying out courier activities;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention.

c. Categories of personal data processed of the shareholders/bondholders of BT/other persons in connection with their data

If you have the status of shareholder and/or BT bondholder, another person related to them, we usually process the following categories of personal data:

identification data - last name, first name, personal numeric code or other unique identification element, series and number of the national or international identity document/passport, postal address and, if applicable, a copy of the identity document (for the identification of shareholders in case of requests for shareholder or bondholder certificate or history of shares/bonds held at BT);
citizenship;
tax dates (country of tax residence);
information about the economic and financial situation, referring to the assets held - number of BT shares and/or bonds, including the holding history of these assets;
quality, holdings and, where applicable, powers of representation held within legal entities;
signature (on requests addressed to the bank);
phone number, e-mail address, correspondence address, depending on the communication channel selected within the requests addressed to the bank.

a. Who is a visitor of BT units and/or a user/visitor of BT equipment?

It is visitor of BT units any natural person who visits the bank's units (including its administrative buildings), regardless of whether or not they carry out banking operations;
It is user/visitor of BT equipment any natural person who uses these devices or stands in front of them (ATMs, BT Express, BT Express Plus, etc.), regardless of whether these devices are placed inside BT units or in other locations, regardless of whether the user is a BT Client, an occasional BT Client or any other third party, regardless of whether they initiate banking operations through BT devices, regardless of whether they complete the banking operation initiated through BT devices.

b. The purposes for which we process data of visitors to BT units and/or users/visitors of BT equipment

We process your data, as applicable, for:

monitoring the security of individuals, spaces and/or the bank's assets or those of the visitors to its units;
- Details about data processing through video surveillance can be found here: https://www.bancatransilvania.ro/supraveghere-video/.
- Details about the processing of visitor data for access to some BT units can be found here: www.bancatransilvania.ro/monitorizare.pdf
- making transactions ordered through the bank's equipment;

as well as for other related purposes connected to the main purpose indicated above, namely:

identity verification, if applicable, if necessary for your identification at the request of the competent authorities or when the bank has a legitimate interest;
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
carrying out internal analyses (including statistical);
archiving- both in physical and electronic format- of documents, making backup copies;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention.

Regarding video surveillance, as well as data processing for access to some BT units, the data subjects are informed including through pictograms and/or specific notices displayed at the entrance of the bank's units and respectively on BT equipment.

c. Categories of personal data processed of the visitors of the units and/or users/visitors of BT equipment

If you visit the bank's units (including its administrative buildings) and/or use or stand in front of BT equipment, we will process you, as appropriate:

the image, as it is captured by the installed video surveillance cameras;
any data necessary for the execution of transactions ordered through BT equipment or for other related purposes mentioned above (e.g. time spent in BT units/on BT equipment).

At the same time, to allow you access to certain units where the bank operates, the personnel with security duties will identify you based on identity documents and will record in special letter registers, provided by law, the following data concerning you:

identification data – last name, first name, series and number of the national or international identity document/passport.

a. Who is a visitor of BT's websites/social media pages ?

Are this quality any natural person who accesses any of the websites from the BT portfolio and/or its social media pages.

b. The purposes for which we process the data of visitors to BT websites/social media pages

Through cookies or other similar technologies we process your data as a visitor of BT websites for the purposes described in detail within the cookies policies of each website and briefly within the cookie banners and settings centers.

For the website www.bancatransilvania.ro , The cookie policy can also be found by accessing the following link: https://www.bancatransilvania.ro/cookie-use-policy/

If on BT websites you enter your data in complaint/request/claim forms, in applications for the bank's products/services/campaigns, in subscriptions to newsletters from various fields, we process the data entered in these forms, as the case may be, for:

taking measures/providing information or responses to requests/notifications/complaints of any nature addressed to the bank by any person, as well as those addressed by authorities or institutions related to BT shareholders/obligors, through any channel, including via electronic communications and the internet;
proof of requests/agreements/options regarding certain requested/discussed/agreed aspects, including within phone calls initiated by you or the bank, by recording the discussed aspects and, where appropriate, the audio recording of telephone conversations or, where appropriate, audio-video;
collecting your opinion regarding the quality of BT services/products/employees (service quality evaluation);
carrying out internal analyses (including statistical);
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
archiving- both in physical and electronic format- of documents, making backup copies;
performance of registry and secretarial services regarding correspondence addressed to and/or sent by the bank, as well as for carrying out courier activities;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention

Please note that subscribing or unsubscribing any email address entered by you in forms/fields of the type/with the name "newsletter", available on BT websites to receive information from various areas of interest, is managed through the respective online forms (subscribing) and respectively from unsubscribe links contained in the messages received following the subscription (unsubscribing).

Also, we inform you that subscribing/unsubscribing to/from the “newsletters” you choose on BT websites does not affect the options regarding the processing of your data for advertising purposes completed on the bank's forms available at branches or on the BT website (the online form found at the following link: https://www.bancatransilvania.ro/gdpr/ is available only to BT Customers for expressing marketing options in the context of the contractual relationship conducted by them with the bank).

c. Categories of personal data processed of visitors of the websites/social media pages of BT

If you visit a website BT we will collect the following categories of personal data:

data processed through cookies;
IP address;
data about the equipment used to access the website.

Also, within the forms available on BT websites, we collect, as appropriate:

identification data- name, first name, and, in some cases, with the consent of the data subjects, the personal numerical code;
contact details - e-mail address and/or phone number.

We draw your attention to the fact that BT websites may contain links to websites whose privacy/personal data processing policy is different from that of BT. Persons who send personal data to any of these websites must be aware that these fall under the privacy/personal data processing policy of those websites, which we recommend to be read. BT's policy regarding the processing and protection of personal data does not apply to the information provided on those websites, BT has no control over the processing of personal data carried out by the providers of these websites for their own purposes and assumes no responsibility regarding these processes.

If you use the social media pages of BT and insert comments, images, opinions and/or appreciations to our posts, we will usually process:

your username on that social media platform
expressed opinions;
inserted images.

In some cases it is possible– as a rule following your participation in various contests/campaigns or your insertion of comments within which you report dissatisfaction related to BT's activity or inquire about any aspects related to our activity– to request from you also the provision of other information that allows us to identify you and/or the reported situation, as well as to provide the response to it. Usually, it is about:

details about the reported situation;
identification data - usually name, first name;
identifiers: as appropriate, BT client ID (BT CIF), IBAN;
contact details: usually the e-mail address and/or phone number.

In case you provide us with such personal data within the social media platform, we will process them for the purposes mentioned above within this section. For the protection of your data, please do not send us personal data within posts that are public on our social media platforms.

Please note that, in situations where you insert images that contain personal data about yourself or other persons or when you tag various other individuals within the bank's social media pages, you express your consent regarding the use of this data by the bank, and you guarantee that you have obtained consent from the persons to whom this data belongs.

Last but not least, we inform you that any personal data you enter on BT's social media pages are also processed by the providers of these social media platforms and are subject to the privacy policies of these platforms. BT has no control over the processing of personal data carried out by the providers of these platforms for their own purposes and assumes no responsibility regarding these processes.

a. Who is a BT prospect?

You can have the status of a BT prospect if you have requested information about BT products/services at the bank's units, through the websites in its portfolio, or through BT's contractual partners, you have initiated contracting them without completing this action, or you have enrolled in various campaigns organized by the bank.

b. The purposes for which we process BT prospects' data

If you are a BT prospect, we process your data, as appropriate, for the following purposes:

identity verification, with the aim of confirming/refuting the status of BT client;
taking measures/providing information or responses to requests/notifications/complaints of any nature addressed to the bank by any person, as well as those addressed by authorities or institutions through any channel, including via electronic communication services and the internet;
proof of requests/agreements/options regarding certain requested/discussed/agreed aspects, including during phone calls initiated by you or the bank, by recording the discussed aspects and, if applicable, audio recording of phone conversations or, if applicable, audio-video recording;
collecting your opinion regarding the quality of BT services/products/employees (service quality evaluation);
carrying out internal analyses (including statistical);
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
archiving- both in physical and electronic format- of documents, making backup copies;
performance of registry and secretarial services regarding correspondence addressed to and/or sent by the bank, as well as for carrying out courier activities;
ensuring the security of IT systems used by BT;
fraud prevention;
calculation of commissions to which certain categories of employees are entitled.

c. Categories of personal data processed for BT prospects

If you are a BT prospect, as the case may be, we usually process you:

identification data- name, first name, and, in some cases, only with your consent or if we justify a legitimate interest, the personal numeric code (CNP);
contact details - email address and/or phone number.

a. Who is a BT candidate ?

You are a candidate for available positions at BT or for internships organized by BT if you have sent us or if we have received your CV to use it for recruitment purposes, directly from you or from/through other persons, or if you have informed us in any other way that you are interested in filling BT positions/participating in BT internships.

b. The purposes for which we process BT candidates' data

We process your data, as applicable, for:

recruitment for the position/positions or, as appropriate, for the internship you wish to occupy/follow within the bank, as well as for purposes closely related to this activity, such as:
taking measures/providing information or responses to requests/notifications/complaints of any nature addressed to the bank by any person, as well as those addressed by authorities or institutions, through any channel, including via electronic communications services and the internet;
proof of requests/agreements/options regarding certain requested/discussed/agreed aspects, including within phone calls initiated by you or the bank, by recording the discussed aspects and, where appropriate, the audio recording of telephone conversations or, where appropriate, audio-video;
carrying out internal analyses (including statistical);
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
archiving- both in physical and electronic format- of documents, making backup copies;
performance of registry and secretarial services regarding correspondence addressed to and/or sent by the bank, as well as for carrying out courier activities;
ensuring the security of IT systems used by BT;
fraud prevention.

In case you apply only for a specific job/internship position, your personal data will be processed by the bank only within the recruitment process for that specific job/internship position, and will be deleted upon the completion of that recruitment process.

If, on the other hand, you choose to be contacted in general for vacant positions/internships conducted at BT, we will keep your data and use it for recruitment purposes for a period of 1 year, a term that can be extended with your consent.

In the recruitment process, references from previous employers or from teaching staff may become relevant. If the bank needs these, it will contact you to request your consent to obtain these references on your behalf. If you do not give your consent in this regard, you will need to obtain these references yourself if you wish to continue the recruitment process.

c. Categories of personal data processed of BT candidates

BT candidates' personal data categories are usually processed by us as indicated in the CV submitted to/sent to the bank:

identification data - last name, first name;
age, for verifying your eligibility to become an employee or, as the case may be, to participate in certain BT internships;
contact details - e-mail address and/or phone number;
data regarding studies and professional experience;
any other relevant data from the CV.

a. Who are we/when do we process your data as a BT petitioner ?

You are such a person if you address BT with any request, on any channel, regardless of whether you are a BT client, a casual BT client, or if you are part of any other category of individuals.

b. The purposes for which we process the data of BT petitioners

Depending on the situation and the specific quality you have in relation to the bank, when you send us a request, we process your personal data for the following purposes:

identity verification, including for the purpose of confirming/refuting the status of BT client;
taking measures/providing information or responses to requests/notifications/complaints of any nature addressed to the bank by any person, as well as those addressed by authorities or institutions, through any channel, including via electronic communications services and the internet;
proof of requests/agreements/options regarding certain requested/discussed/agreed aspects during phone calls initiated by you or the bank, by recording the discussed aspects and, if applicable, audio recording of phone conversations;
collecting your opinion regarding the quality of BT services/products/employees (service quality evaluation);
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
carrying out internal analyses (including statistical);
archiving- both in physical and electronic format- of documents, making backup copies;
performance of registry and secretarial services regarding correspondence addressed to and/or sent by the bank, as well as for carrying out courier activities;
ensuring the security of IT systems used by BT;
fraud prevention;
calculation of commissions to which certain categories of employees are entitled.

c. Categories of personal data processed of BT petitioners

To register, confirm receipt, analyze, formulate and send responses to any requests/notifications/complaints you address to us, we process the following categories of personal data:

identification data: name, surname and other data in this category that you provide us with or personal data that BT needs to process for the identification of the petitioner BT to prevent the disclosure of confidential information (including personal data) to recipients who are not entitled to receive it;
contact details: mailing address, email address, phone number;
the voice, within conversations and recordings of phone calls (initiated by petitioners or by the bank);
depending on the case, any other information known to the bank and necessary for analyzing the requests.

a. Who is/when do we process your data as BT third party?

You are included in this category of targeted persons if any personal data concerning you is disclosed/transferred to us by BT clients, by occasional BT clients in the context of their relationship with us, or by any other person. We process your data in this context as a third party to BT, even if you also have other direct relationships with us (e.g., a BT loan applicant provides us with the sale-purchase contract of the property in which you appear as the seller. In this case, we will process the data from this contract in your capacity as a third party, even if you are also actually a BT client and we process your data for other purposes related to the contractual relationship you have established with the bank).

Thus, by way of example, we process your data in your capacity as BT third parties, if you belong to any of the following categories of natural persons:

members of the family of a BT client or of a BT employee- it is possible that, in certain situations, Clients may inform us about data related to their family members, especially in the context of formulating and analyzing a credit request or carrying out a credit contract.
At the same time, BT employees may provide data belonging to family members, in various contexts related to their employment relationship with us (e.g. minor children of employees, other family members of BT employees);
non-client payers: natural persons who are clients of other institutions that provide payment services and who order transfers of amounts to the accounts of Clients opened at BT (interbank transfers ordered by clients of other payment institutions to BT Clients account holders) - it is necessary to process the data of these persons for the provision of payment services and in accordance with our legal obligations;
non-client payment beneficiaries: natural persons who are clients of other institutions that provide payment services, to the accounts of which BT Clients order transfers of amounts (interbank transfers ordered to clients of other payment institutions by BT Clients) – it is necessary to process the data of this category of persons in order to provide payment services and according to legal obligations;
pnatural persons mentioned in the payment details/explanationsin a payment orderdeposited/sent/received at BT– filling in the fields related to explanations/details of a payment is mandatory according to the legal provisions in the field of preventing money laundering and terrorist financing. According to the principle of data minimization, personal data should be entered in these fields only when absolutely necessary and only the data that is strictly necessary;
authorized persons (others than authorized or delegated on accounts) natural persons nominated to order/initiate on behalf of a BT Client operations – banking or non-banking – through channels offered by BT (e.g. telephone payment instructions);
natural persons whose data are mentioned on various documents made available to the bank– in case a BT client, occasional BT client or any person with whom the bank interacts submits/transmits to the bank various documents, in different situations (e.g. certificates or documents of any type containing personal data of the signatories or, as the case may be, of other persons mentioned in the contents of the documents) the bank will process these data considering the need to keep these documents, even if it may not need to process the data in any other form than their storage;
persons with whom the bank receives requests/applications for information from various institutions and/or public authorities, from notaries, lawyers, bailiffs, etc;
participants in various events or social responsibility actions organized by the bankă, whose data it is necessary to process for the purpose of ensuring event logistics;
any other categories of natural persons whose personal data are made available to us by any person with whom we interact or that come into our possession in any other way.

b. The purposes for which we process third party BT data

We process your data as a third party BT according to the purpose for which it is necessary in our relationship with the person who provided it to us, as well as for the following related purposes:

managing labor relations with BT employees, as appropriate;
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
carrying out internal analyses (including statistical);
archiving- both in physical and electronic format- of documents, making backup copies;
the provision of registry and secretarial services regarding correspondence addressed to the bank and/or sent by it, as well as for the conduct of courier activities;
ensuring the security of IT systems used by BT;
fraud prevention.

c. Categories of personal data processed by BT third parties

The most common data we process for BT third parties are, by way of example:

identification data- name, first name, personal numerical code (CNP);
the relationship between you and a BT client or employee, as applicable;
position held within a legal entity;
signature;
any other data made available to us by any person with whom we interact in the course of our activity.

a. Who can be the persons who have expressed at BT options regarding the processing of their data for advertising purposes (as applicable, consent or refusal)

Currently, the following categories of data subjects who have expressed their consent to BT for the processing of their personal data for advertising purposes are considered to be:

BT clients, occasional BT clients or any BT third parties who have given their consent on the dedicated BT form used in BT units starting from 12.03.2018 and on the BT website www.bancatransilvania.ro (online the form from this link: https://www.bancatransilvania.ro/gdpr/ is available only for BT clients) starting with the month of May 2018;
BT clients, occasional BT clients or any third parties who have expressed this consent on forms used in the bank's activity prior to 12.03.2018 and have not modified/withdrawn this consent in the meantime, neither after the information that the bank sent them in May 2018 regarding this possibility, nor on their own initiative.

There are currently persons who have expressed their refusal to have their personal data processed for advertising purposes BT clients, occasional BT clients or any BT third parties who have initially expressed their refusal to have their data processed for this purpose, as well as persons who, although they initially expressed consent to have their data processed for advertising purposes, subsequently withdrew this consent.

b. The purposes for which we process the data of persons who have expressed at BT options regarding the processing of their data for advertising purposes (as the case may be, consent or refusal)

If you have expressed your consent for your data to be processed for advertising purposes, we will process them as follows:

the transmission of advertising messages*, according to the expressed consent (advertising purpose);
verification of individuals' identity, for the purpose of confirming/denying their status as BT Client;
proving requests/agreements/options regarding issues related to advertising options, by recording the discussed aspects and, if applicable, the audio recording of phone conversations (initiated by the bank or by you);
carrying out internal analyses (including statistical);
archiving- both in physical and electronic format- of documents, making backup copies;
performance of registry and secretarial services regarding correspondence addressed to and/or sent by the bank, as well as for carrying out courier activities;
ensuring the security of IT systems used by BT;
fraud prevention.

If you have expressed your refusal regarding the processing of personal data for advertising purposes, we will process your data for all the above purposes, except for the one related to sending advertising messages.
*BT wishes to inform interested persons about the products/services/events offered/organized by the bank, by the entities from the BT Financial Group or by their partners, in this sense processing the personal data of these persons, if they have expressed their consent to receive advertising messages.
The form dedicated to expressing/collecting marketing preferences currently used by BT is accessible in any branch of the bank and on the website www.bancatransilvania.ro, or directly at the following link: https://www.bancatransilvania.ro/gdpr/
The online form is available only for BT Customers and can be used by them not only for the initial expression of marketing options, but also for modifying previously expressed options, as well as, where applicable, for withdrawing consent to receive advertising messages.

c. Categories of personal data processed of the persons who have expressed to BT their consent regarding the processing of their data for advertising purposes, the recipients of these data and the period of their processing

The data processed by BT for the purpose of sending advertising messages are usually:

identification data: name, first name;
contact details: phone number and/or email address or correspondence address provided by the interested persons to receive advertising messages or, as appropriate, those declared in the bank's records for the purpose of knowing the clientele (conducting the contractual relationship) in the case of BT Clients;
in the case of BT Clients: other information that we learn about clients, in the context in which they use BT services/products (e.g. data about transactions, age, location, income range etc.), which we will study automatically (profiling) to form an opinion related to the products/services/events that would suit them (personalized advertising).

Personal data will be processed by the bank for sending advertising messages until the termination of the contractual relationship with BT Clients or, as the case may be, until the moment of their withdrawal of consent to receive such messages (the latter also applies in the case of any other categories of persons who are not BT Clients).

In some cases, for sending advertising messages, BT will contract service providers who will process the personal data of the data subjects on behalf of and for BT, only for sending the established advertising messages strictly following BT's instructions and under the careful supervision of the Bank.

Persons interested can choose to receive advertising messages from several categories, including: products and services of BT and BT subsidiaries, events organized by BT, products/services of partners related to products/services of BT or BT subsidiaries, and events organized by BT partners.

BT subsidiaries whose products/services and events are to be promoted in advertising messages sent to persons who have opted in this regard are the following entities within the BT Financial Group:BT Microfinancing IFN SA ("BT Mic"), BT Asset Management S.A.I. S.A., ( "BTAM"), BT Leasing Transilvania IFN S.A. ("BTL"), BT Direct IFN S.A. ("BTD"), BT Capital Partners S.S.I.F. S.A.("BTCP"), other entities that can join the BT Group in the future.

List of current partners of BT and/or BT subsidiaries whose products/services and events are intended to be promoted within advertising messages sent to persons who have opted in this regard is accessible at the link: https://www.bancatransilvania.ro/partners.

In case you have opted to receive advertising messages about products/services or events offered/organized by BT subsidiaries or partners, these entities will process personal data for the purpose of sending these messages, under the careful supervision and coordination of the Bank and, where applicable, together with it. For any personal data processing carried out by BT partners/BT subsidiaries apart from or in addition to sending advertising messages, such as, for example, for the purpose of concluding contracts related to their promoted products/services, these partners shall act as controllers of the processed personal data.

The consent to be contacted for advertising purposes can be withdrawn or modified at any time through multiple methods, distinctly indicated on the form dedicated to expressing consent for the processing of personal data for advertising purposes.
The withdrawal of consent operates only for the future and does not affect the legality of data processing carried out before the moment of this withdrawal.

Please note that subscribing or unsubscribing any e-mail address entered by you in forms/fields of the type/named "newsletter", available on BT websites to receive information from various areas of interest, is managed through the respective online forms (subscription) and respectively from unsubscribe links contained in the messages received following the subscription (unsubscription).
Also, we inform you that subscribing/unsubscribing to/from the “newsletters” you opt for on BT websites does not affect the options regarding the processing of your data for advertising purposes completed on the bank's forms available in the branches or on the BT website.

As a rule, personal data belonging to the data subjects whose data we process are collected by us directly from them, on various occasions and in various ways, such as:

at the time of establishment and during the course of the business relationship with BT;
on the occasion of concluding and carrying out contracts for products/services offered by the bank, on its own behalf or for third parties;
by filling in some forms available on the BT website, on other websites owned by the bank or by other entities in the Group;
by registering/participating in various contests/campaigns organized by BT in its units, on the BT website or on the bank's pages on social media platforms;
when we are requested information/we receive notifications/complaints at the bank's phone numbers, at email addresses, through messages sent on the bank's social network pages or received in writing at BT units;
when applying for available positions in the bank (online, sending/depositing CVs at BT units or to various email addresses, at career fairs or other events);
when visiting BT's websites/social media platforms.

Nevertheless, there are situations when data is collected from other sources, such as:

from other Clients, natural or legal persons account holders, in situations such as, but not limited to: authorizing other Clients on their accounts opened at the bank, contracting bank products/services by a Client on behalf of another Client who has authorized them in this regard, contracting by employers who are legal entity Clients of BT of bank products/services for/on behalf of their employees (e.g. meal vouchers, benefits for collecting salary income in accounts opened at BT, management guarantee accounts, etc);
from payers - natural or legal persons, regardless of whether they have the status of BT Clients - in the context in which they transfer/deposit amounts into the accounts of natural/legal person Clients account holders;
from authorities or public institutions (e.g. courts of law, public prosecutor's offices, judicial executors, National Bank of Romania, National Authority for Consumer Protection, National Supervisory Authority for Personal Data Processing etc.), notaries, lawyers in the context in which they send us notifications or requests;
from/through Transfond, SWIFT, international payment organizations etc;
from credit institutions with which Banca Transilvania S.A. merged (Volksbank Romania S.A. and Bancpost S.A.);
from partner banks and correspondent banks, from banks or financial institutions participating in syndicated loans;
from international payment organizations;
from other entities of the Financial Group Banca Transilvania etc;
from public sources, such as but not limited to: the Trade Office Register, the National Register of Movable Property Advertising, the Cadastre and Real Estate Advertising Office, the courts' portal, the Official Gazette, social media, internet, etc.;
from records of the type Credit Bureau, Credit Risk Center, in case there is a legal basis and a determined and legitimate purpose for consulting them;
from private database providers – e.g. entities authorized to manage databases with persons accused of financing acts of terrorism and those politically exposed;
from entities in the BT Financial Group, for their use for determined and legitimate purposes, generally for the smooth conduct of the common economic activity carried out together with the other entities in the BT Group and for fulfilling the legal requirements related to the supervision based on the consolidation of the BT Financial Group;
from contractual partners of the bank from various fields
from debt collection/recovery companies (e.g. we can find out the new contact details of Clients from companies that support us in debt recovery activities, data that the latter obtain based on their own interactions with them or with persons close to them);
from evaluation companies;
from insurance companies;
from companies managing pension and investment funds;
from the Central Depository S.A., in the case of bank shareholders' data;
from any other natural or legal persons who send us notifications/requests containing personal data (e.g. persons notifying us that some BT Clients no longer have the same contact details they declared in the bank's records).

The bases on which BT processes personal data are, as the case may be:

the necessity to process data for the fulfillment of a task serving a public interest;
the bank's legal obligation;
conclusion/execution of contracts concluded with the data subject;
the legitimate interest of the bank and/or of some third parties;
the consent of the data subjects.

Except in cases where personal data is processed based on the consent of the data subjects, and in some cases where the processing basis is legitimate interest, the refusal of individuals to have their data processed by BT will make it impossible to provide the requested services or to resolve their requests.

The personal data of the Bank's Clients and, where applicable, of other categories of data subjects mentioned in this Policy, are disclosed by BT or, where applicable, transferred, in accordance with the GDPR principles, based on the applicable legal grounds depending on the situation and only under conditions that ensure full confidentiality and data security, to categories of recipients, such as, but not limited to:

other Clients who have the right and the need to know them;
entities within the BT Financial Group;
assignees;
contractual partners (service providers) used by the bank in the conduct of its banking activity, including but not limited to: IT services (maintenance, software development), archiving in physical and/or electronic format, courier, audit, services related to card issuance and enrollment in platforms, market research/study services, advertising message transmission, monitoring of traffic and behavior of online tool users, marketing services through social media resources, etc);
interbank payment processing companies and transmitting information regarding interbank operations (e.g. Transfond SA, Society for Worldwide Interbank Financial Telecommunication - SWIFT);
partners of the bank from various fields, whose products/services/events we can promote to BT Clients based on their consent. The updated list with the bank's partners can be found here: https://www.bancatransilvania.ro/partners;
international payment organizations (e.g. Visa, Mastercard);
payment processors;
financial-banking entities participating in payment and interbank communication schemes/systems such as SWIFT, SEPA, ReGIS, financial-banking institutions to whom we confirm or from whom we request confirmation of signatures and/or certain information that may be found within letters of creditworthiness, bank guarantee letters, other addresses issued by the Bank's Clients in favor of their business partners, other entities (such as banks or financial-banking institutions) in the context of assignment or restructuring operations of portfolios of receivables and/or other rights of the Bank arising from the legal relationships with the Clients;
partner banks and correspondent banks, banks or financial institutions participating in syndicated loans;
authorities and public institutions, such as, but not limited to: the National Bank of Romania (BNR), the National Agency for Fiscal Administration (ANAF)*, the Ministry of Justice, the Ministry of Administration and Interior, the National Office for Prevention and Control of Money Laundering (ONPCSB) **, the National Agency for Cadastre and Real Estate Publicity (ANCPI), the National Registry for Movable Publicity (RNPM), the Financial Supervisory Authority (ASF), including, as appropriate, their territorial units;
guarantee companies (funds) for various types of credit/deposit products (e.g. FNGCIMM, FGDB etc.);
notaries public, lawyers, bailiffs;
Credit Risk Center***;
Credit Bureau and Participants in the Credit Bureau System****;
insurance companies;
evaluation companies;
companies for collection of outstanding debts/claims of the bank;
management companies of pension and investment funds entities to which the Bank has outsourced the provision of financial-banking services;
banks or state authorities, including from outside the European Economic Area - in the case of international SWIFT transfers or as a result of processing carried out for the purpose of applying FATCA and CRS legislation;
social media platform providers.

*According to the provisions of the Fiscal Procedure Code (Law 207/2015), in its capacity as a credit institution, BT has the legal obligation to communicate daily to the central fiscal authority – A.N.A.F. – the list of account holders who are natural persons, legal entities, or any other entities without legal personality that open or close accounts, as well as the identification data of persons who have the signing right for the accounts opened with them, the list of persons who rent safe deposit boxes, as well as the termination of the rental contract. A.N.A.F. may communicate this data to local fiscal authorities or other central and local public authorities, under the conditions of the law.

**In case the conditions are met for BT to transmit personal data to the National Office for the Prevention and Control of Money Laundering, according to Law no. 129/2019 for the prevention and combating of money laundering and terrorist financing, as well as for the amendment and completion of certain normative acts, these are transmitted simultaneously and in the same format to A.N.A.F.

***The Bank has the legal obligation to report to the Credit Risk Center (CRC) the credit risk information for each debtor who meets the reporting condition (including the identification data of a debtor, natural person or non-banking legal entity, and the operations in lei and foreign currency through which the Bank is exposed to risk towards that debtor), namely to have registered an individual risk towards them, as well as information about detected card frauds.
****The bank has a legitimate interest in reporting to the Credit Bureau System, to which other Participants also have access (mainly credit institutions and non-banking financial institutions) the personal data of debtors who register delays in credit payments of at least 30 days, after prior notification of the persons concerned in this respect at least 15 days before the reporting date.

When necessary for the fulfillment of the contracts concluded with BT Clients or occasional BT Clients, and only in specific situations or based on appropriate guarantees, the bank will transfer personal data abroad, as applicable, including to countries that do not ensure an adequate level of protection thereof. Countries that do not ensure an adequate level of protection are countries outside the European Union/European Economic Area, except for countries to which the European Commission has recognized an adequate level of protection, namely: Andorra, Argentina, Canada (only commercial companies), Switzerland, the Faroe Islands, Guernsey, Israel, the Isle of Man, Jersey, New Zealand, Uruguay, Japan, the United States of America – only within the limits of protection offered by the EU-US Privacy Shield – (as long as no contrary decision is issued regarding any of these countries).

If BT Clients or BT Occasional Clients order through the bank transactions in which the payment recipients are located in countries that do not provide an adequate level of protection of personal data, the transfer of data to those countries is based on the provisions of the General Data Protection Regulation concerning: the transfer that is necessary for the performance of a contract between the bank and the Client or for the application of pre-contractual measures adopted at the request of the Client or, as the case may be, the transfer that is necessary for the conclusion of a contract or for the performance of a contract concluded in the interest of the data subject.
In case it is necessary to transfer personal data to third countries/international organizations and in other circumstances, the bank will proceed in this regard only with the legally provided guarantees for these transfers.

In some circumstances, only by fulfilling the GDPR provisions, within the banking activity carried out by BT, automated decision-making processes are used, including as a result of profiling. These are decisions made by the bank as the case may be, with or without human intervention, and may produce legal effects and/or may significantly similarly affect the data subjects.

Such situations, presented as examples, are the following:

for the application of customer knowledge measures for the purpose of preventing and combating money laundering and terrorist financing, checks will be carried out in the databases with persons accused of financing acts of terrorism or, as the case may be, with persons at high risk of fraud and, if the Clients are found registered in these records, the bank reserves the right to refuse to enter into a business relationship with them or to terminate the contractual relationship;
to protect BT Clients and Occasional Clients against frauds, as well as for the bank to properly fulfill its customer due diligence obligations, it monitors their transactions and, if it identifies suspicious operations (such as unusually frequent or high-value payments, also in relation to the source of funds declared by Account Holder Clients or the purpose and nature of the business relationship, transactions initiated from different locations within short time intervals, which did not allow travel between those locations), it accordingly adopts measures to block the transactions, cards and accounts, making these decisions exclusively on an automatic basis;
according to legal provisions, the granting of credit products is conditioned by the existence of a certain degree of indebtedness of the applicants. For determining the eligibility to contract a credit product related to the degree of indebtedness, it will be determined based on automatic criteria, starting from the level of income and expenses recorded by the applicant;
in order to objectively verify the fulfillment of the eligibility conditions for pre-offering and, if applicable, analyzing a credit request submitted to BT by an applicant, in most cases a bank scoring application will be used that will analyze data filled in the credit application, information resulting from checks carried out in the bank's own records and/or those of Credit Bureau S.A. and will issue a score that determines the credit risk and the probability of future on-time payment of installments. To the issued score is added the result of other checks on the applicant's situation, which will be analyzed by bank employees to determine whether the eligibility conditions established by internal regulations are met. However, the final decision to approve or reject the credit application is based on the analysis carried out by the Bank's employees (human intervention);
in case BT Clients have expressed on the dedicated form their consent for their personal data to be processed for advertising purposes for sending personalized messages, these are based on a profile created on various criteria, such as, but not limited to, data about transactions, age, location, income range, which the bank will automatically study to form an opinion regarding the products/services/events that would suit the Clients. In some cases, this created profile will only determine the promotion of a certain product/service to persons determined to meet the profile conditions, and other times it will make only persons who meet the profile criteria able to contract/benefit from certain promotional offers.

Personal data processed by the bank for the purpose of customer knowledge for prevention of money laundering and terrorist financing, including data regarding transactions carried out through accounts opened at the bank, will be kept by the bank at least 5 years from the date of termination of the business relationship with the Client natural person or legal entity account holder, according to the legally established retention period imposed on the bank.

Also, in case in which the business relationship is not open, the data in the content of the request will be stored at BT level for at least 5 years from the date of the bank's refusal to establish the respective contractual relationship.

Personal data filled in a loan application are kept in the BT records for a period of 3 years from the date of signing the loan application, in case it is rejected and, respectively, for a period of 5 years starting from the date of termination of the business relationship with the client's bank, in case a credit agreement will be concluded following the approval of the credit application.
Regarding the data processed within BT activity in the Credit Bureau system, these are stored at the level of this institution and disclosed to the Participants for a period of 4 years since the date of the last update, except data of credit applicants who have withdrawn their credit application or to whom the credit was not granted, which are stored and disclosed to Participants for a period of 6 months.

Personal data for which BT has the legal obligation to report to Credit Risk Center (CRC) will be maintained in the CRC records for a period of 7 years from the date of their registration.
For the data processed based on the consent of the data subjects for the purpose of sending advertising messages, these will be processed until the termination of the business/contractual relationship with the bank or, as appropriate, until the withdrawal of the said consent.

For the purpose of proving that they have been received notifications/complaints/information requests/measures and that responses to these have been formulated and sent, the data related to these petitions will be kept in BT records (together with the personal data contained therein) both in paper and electronic format, for the duration of the business relationship for BT clients, respectively for a period necessary to fulfill the purpose for which they were processed (response formulation/provision of information), plus a period of 3 years - the legal limitation period in cases where the data does not belong to BT clients.

Personal data processed BT candidates will be kept until the end of the recruitment process for the available position or, if the candidates have expressed interest in being contacted for multiple positions that would suit them, the data from the CVs and other documents they have made available to BT for this purpose will be kept for a period of at most 1 year, if during this time interval their deletion from the Bank's records is not requested. This term can be extended with the candidate's agreement.

Storage duration of data obtained through the video surveillance system is proportional to the purpose for which the data is processed, namely does not exceed 30 days, the period after which the recordings are deleted by automatic procedure, in the order in which they were recorded. In the event of a security incident (including a breach of personal data security), the retention period of the relevant recorded material may exceed the normal limits depending on the time required for further investigation of the security incident.

Any other personal data processed by BT for other indicated purposes will be retained for the period necessary to fulfill the purposes for which they were collected, to which non-excessive deadlines may be added, established in accordance with the applicable legal obligations in the field, including but not limited to the provisions regarding archiving.

Any data subject is guaranteed the exercise of the rights provided by GDPR, namely:

right of access:the data subjects can obtain from BT confirmation that their personal data are being processed, as well as information about the specifics of the processing such as: the purpose, categories of personal data processed, recipients of the data, the period for which the data are stored, the existence of the right to rectification, erasure or restriction of processing. This right allows data subjects to obtain free of charge a copy of the personal data processed, as well as additional copies at a cost;
the right to data rectification: the persons concerned may request BT to modify the incorrect data concerning them or, as the case may be, to complete the data that are incomplete;
the right to deletion: the data subjects may request the deletion of their personal data when:
- these are no longer necessary for the purposes for which we collected and process them;
- consent for the processing of personal data has been withdrawn and BT can no longer process them on other grounds;
- personal data are processed contrary to the law;
- personal data must be deleted in accordance with the relevant legislation;
the right to withdraw consent: the data subjects can withdraw their consent at any time regarding the processing of personal data processed based on consent. The withdrawal of consent does not affect the lawfulness of processing carried out before this moment.
right of opposition: the data subjects may object at any time to processing for marketing purposes, as well as processing based on the legitimate interest of BT, for reasons related to their specific situation;
the right to restriction of processing: the data subjects may request the restriction of processing their personal data if:
- contest the accuracy of personal data, for a period that allows us to verify the accuracy of the data in question;
- processing is illegal, and the data subject objects to the deletion of personal data, instead requesting the restriction of their use;
- the data is no longer necessary for processing, but the data subject requests them from us for a court action;
- in case the data subject has objected to the processing, for the time period during which it is verified whether the legitimate interests of BT as the controller prevail over the rights of the data subject.
the right to data portability: the data subjects may request, under the conditions of the law, that the bank provide them with certain personal data in a structured form, commonly used and which can be read automatically. If the data subjects request, BT may transmit the respective data to another entity, if technically possible.
the right to file a complaint with the National Authority for the Supervision of Personal Data Processing: the data subjects have the right to lodge a complaint with the National Authority for the Supervision of the Processing of Personal Data if they consider that their rights have been violated: National Authority for the Supervision of the Processing of Personal Data, General Gheorghe Magheru Blvd. 28-30 Sector 1, postal code 010336 Bucharest, Romania anspdcp@dataprotection.ro
For exercising the rights mentioned in points a) – g) above, or for any questions about the processing of personal data carried out by BT, the data subjects may use the contact details of the data protection officer appointed by BT, sending the request:
- by postal mail, at the address in Cluj-Napoca city, G. Barițiu street, no. 8, Cluj county, with the mention "to the attention of the person responsible for data protection"
- at the email address dpo@btrl.ro.

BT develops an internal framework of standards and policies to maintain the security of personal data. These are periodically updated to comply with the regulations applicable to the Bank and the highest standards in the field.

Specifically and according to the law, the Bank adopts and applies appropriate technical and organizational measures (policies and procedures, IT security, etc.) to ensure the confidentiality and integrity of personal data and the manner in which they are processed.
BT employees are obligated to maintain confidentiality and may not illegally disclose personal data that they process within the scope of their activity.
The bank ensures that its contractual partners who have access to personal data and who act as BT's authorized person are imposed contractual obligations in accordance with legal provisions and that it verifies their compliance with the obligations they have assumed.
Contractual partners acting as authorized representatives of the bank will process personal data on behalf of and for the bank, only in accordance with the instructions received from it and only by respecting the security and confidentiality requirements within the imposed limits.
We guarantee that BT will not sell the personal data it has collected from the visited persons and that it will only transmit this data to those entitled to know it, in compliance with the legally established principles and obligations.

The present policy is regularly reviewed to guarantee the rights of the data subjects and to improve the methods of processing and protection of personal data.