Policy on processing and protection of personal data -previous versions-25-05-2018-10-07-2018

Transilvania Bank S.A. Policy regarding the processing and protection of personal data within banking activities (“Policy” or “Privacy Policy”)

Version valid in the period 25.05.2018 – 10.07. 2018 Download

To Banca Transilvania S.A. (called hereinafter “BT” or “Bank”) we constantly ensure that the personal data of all natural persons with whom we interact is processed fully in accordance with the applicable legal provisions and with the highest standards of security and confidentiality.

To guide and support us in our activity in the field of processing and protecting personal data we have appointed a responsible for data protection (data protection officer or DPO), who can be contacted by any person regarding any aspects related to the way BT processes this data, by sending a notification/complaint to the bank's office in

mun. Cluj-Napoca, str. G. Barițiu, nr. 8, jud. Cluj, with the mention "to the attention of the person responsible for personal data protection" or a message to
email address dpo@btrl.ro.

In the following we present our policy in this very important field for any natural person, which we commit to reviewing at certain time intervals, in order to continuously improve it.

The present Policy does not address the employees of Transilvania Bank, who will be informed about their personal data processed by BT as an employer through a separate document, namely the Policy of Transilvania Bank S.A. regarding the processing and protection of employees' personal data.

We will explain to you in this policy which personal data we process within our activities from the persons we interact with, in what ways, for what purposes we use it, to whom we disclose or transfer it, how we ensure its security, as well as what rights the data subjects have in relation to the processing of this data and how they can exercise them.

A. Who is Banca Transilvania?

BANCA TRANSILVANIA S.A is a credit institution, a Romanian legal entity, with its registered office in Cluj-Napoca, G. Baritiu street, no. 8, Cluj, registered at the Trade Register under no. J12/4155/1993, unique code RO 5022670, having the personal data processing notified and registered in the Register of evidence of personal data operators under number 8728.

BT has over 500 units- branches, agencies, work points, which carry out activities in Romania, as well as a branch and two agencies which carry out banking activity in Italy.

Our official website is www.bancatransilvania.ro (denumita in continuare „website-ul BT”).

The bank also manages other websites, the updated list of which you can consult here.

Banca Transilvania SA is the parent company of the Banca Transilvania Financial Group (hereinafter referred to as „BT Group”), which includes the subsidiary entities of the Bank about which you can find information on the BT website in the BT FINANCIAL GROUP section.

B. What are personal data and what kind of such data does BT process?

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is a person who can be identified, directly or indirectly, on the basis of such information.

In the banking activity that it carries out, Banca Transilvania processes the following categories of personal data:

identification data: name, surname, pseudonym (if applicable), date and place of birth, personal numeric code or another similar unique identification element, series and number of the national or international identity document/passport, as well as a copy thereof, domicile and residence (if applicable), telephone number, fax, electronic mail address, citizenship,
profession, occupation, employer's name or nature of own activity (if applicable),
information about the important public function held - if applicable - and political opinions (excluding in the context of obtaining information related to the status of politically exposed person),
information about family situation (including marital status, number of children, children in custody),
information about the economic and financial situation - including data about income, data about bank transactions and their history, data regarding owned assets, as well as data related to behavior,
the image (contained in identity documents or captured by video surveillance cameras installed in bank premises, as well as at its ATMs),
the voice, including within the recordings of telephone conversations. BT records the audio of telephone conversations for the purpose of improving the quality of services and calls, but also to provide proof of the request/consent/option regarding certain;
signature and, in specific cases, fingerprint (in the case of illiterate persons or persons with visual impairments),
identification codes, allocated by Banca Transilvania or other banking or non-banking financial institutions, necessary for providing certain services, such as, but not limited to, the IBAN codes attached to bank accounts, debit/credit card numbers, card expiration dates,
data concerning the state of health, processed exclusively in the case where the processing of such data is necessary for the clients to prove the difficult situation in which they or their family members find themselves, for the purpose of granting certain facilities, or in the context of the provision of insurance products intermediated by the Bank,
information regarding fraudulent/potentially fraudulent activity, consisting of data related to accusations and convictions concerning offenses such as fraud, money laundering, and financing of acts of terrorism,
information regarding the location of certain transactions (in case of operations performed at ATMs or POS belonging to Transilvania Bank),
data and information related to the products and services offered by the Bank or its collaborators, which the data subjects use (such as, but not limited to, credit, deposit, insurance products)

C. Who are the persons whose personal data are processed by BT?

In the course of its activity, BT processes primarily personal data of Clientsusual, those with whom it has established a long-term contractual relationship, conducted in accordance with the General Business Conditions of Banca Transilvania applicable - as the case may be - to natural or legal persons (hereinafter referred to as business relationship). These usual clients are, in general: natural persons - adults or minors - who have at least one current account opened at BT as a natural person client, authorized persons/legal representatives who operate on accounts opened at BT in the name of natural or legal persons, and their real beneficiaries.

At the same time, however, BT offers its services and products for use and Occasional clients. These are persons who do not have an account opened at BT nor operation rights on these, but sometimes use BT units or equipment (such as ATMs, BT Express, BT Express Plus, etc.) for carrying out various types of banking transactions (cash deposits into BT accounts, bill payments), transfer of amounts (for example Western Union type transfers) or currency exchange operations, provide us with their personal data when visiting the BT websites or units or when using the support services offered by the Bank's Call Center.

Banca Transilvania is a company listed on the Bucharest Stock Exchange, so it processes personal data in this capacity as well To the shareholders sai, in accordance with the provisions of the capital market law.

These Clients or Shareholders sometimes need to provide us - in order to respond to their requests, to obtain a product, to carry out an operation/provide a service - with personal data belonging to other persons, such as: spouse, wife, life partner, family members, beneficiary of a payment transaction, guarantor of a loan, beneficiary of an insurance, natural persons whose data are included in the documents made available by the client.

If the Client or Shareholder is the one who provides BT with information about other persons, they have the obligation to inform those concerned persons regarding the content of this policy in connection with the processing of their personal data.

In the contracts that BT enters into with any supplier/provider of goods/services (contractual partner) personal data of the signatories of these contracts are inserted (usually name, surname, the held position and signature belonging to the legal or conventional representatives of the contractual partners), of the contact persons designated by the contractual partner (usually name, surname, phone number, and email address), of other categories of natural persons whose data are disclosed to the Bank by the contractual partner. These personal data will be processed by BT in connection with the conclusion and execution of these contracts, for internal administrative-financial management, storage and archiving of contract documentation, testing and use of IT systems and IT services, handling complaints, carrying out audit missions. The legal basis for processing the personal data belonging to these categories of persons is the legal obligation of the bank, the conclusion/execution of the contract, and the legitimate interest of the Bank. The personal data that we become aware of in the context of the relationship with a contractual partner are disclosed, as appropriate: to the contractual partner who provided them to us, to entities within the BT Group, to BT partners who need to know them, to authorities and public institutions entitled to request them. The data will be processed at BT level during the contract period and subsequently, until the expiration of the contract documentation archiving period. In order to fulfill the mentioned purposes, it is possible that the Bank transfers certain categories of personal data that the contractual partner has made available to us outside the European Economic Area (EEA). Data subjects of this processing benefit from the rights provided within this policy for data subjects.

All these categories of natural persons that we have listed above will be hereinafter referred to as “targeted persons” of the processing of personal data.

D. What does the processing of personal data mean and how does BT come to process these data?

„Processing” personal data means any operation or set of operations performed on the data, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or making available in any other way, alignment or combination, restriction, deletion or destruction

Personal data that we use within our activity is usually obtained directly from the data subjects, on various occasions and in various ways:

at the time of establishment and during the course of the business relationship with BT
on the occasion of concluding and executing contracts for products/services offered by the bank, on its own behalf or for third parties
by completing some forms available on the BT website, on other websites owned by the bank or by other entities from the Group
by registering/participating in various contests/campaigns organized by BT in its units, on the BT website or on the bank's pages in social networks
when we are requested information / receive notifications / complaints at the bank's telephone numbers, on the email addresses, through messages sent on the bank's social media pages or received in writing at BT units
when to apply for available positions in the bank (online, by sending/submitting CVs at BT units or to various e-mail addresses, at career fairs or other events)

Indirect, we can find out personal data of the data subjects from/by:

authorities and public or public interest institutions, correspondent banks, lawyers, notaries, judicial executors or other persons who send us notifications/requests
authorized representatives of the persons concerned for the opening/conducting of the business relationship with BT
consultation of external databases, public or private, directly or through third-party providers, such as the National Trade Registry Office, Credit Bureau S.A., the portal of courts in Romania administered by the Ministry of Justice, third parties holding databases of persons accused of terrorism or politically exposed persons
the employers of the concerned persons, in case we conclude with them agreements for transferring salaries or other types of amounts
other entities from the BT Group, with which the data subjects enter into contractual relationships and it is necessary for the Bank to know their data based on its membership in the BT group and for the proper conduct of the joint economic activity carried out together with the other entities of the BT Group
collaborators of the bank, who collect on its behalf the data of persons who wish to be contacted by BT for the presentation of products/services they are interested in
Central Depository S.A., in the case of the Bank Shareholders' data
use by the targeted persons of the BT website, other websites owned by the bank (through cookies, Google Analytics etc) or by other entities from the Group. For details about these aspects and about the ways in which you can enable or block cookies, please consultcookie usage policy of the website.

E. What are the grounds on which BT processes personal data?

Activity carried out by Banca Transilvania, in its capacity as a credit institution, is strictly regulated by various normative acts. Thus, many of the personal data processing activities carried out by BT are imposed by the legal obligations it has. At the same time, however, BT processes personal data necessary for the conclusion and/or execution of contracts concluded with the data subjects, based on its legitimate interest or, when applicable, based on the consent of the data subjects.

Except in cases where personal data is processed on the basis of the consent of the data subjects, the refusal of individuals to have their data processed by BT will make it impossible to provide the requested services or to resolve their requests.

F. What are the purposes for which BT processes personal data?

The carrying out of any operation requested at the counters of BT units by regular or occasional clients requires the Bank to go through the identification stage of these persons. In this respect, BT employees will ask individuals to present their valid identity document. In some cases imposed by law, it will also be necessary for BT to make and retain a copy of the identity document for the period provided by law.

The cases in which BT is obliged to apply the standard measures of customer identification, including making and retaining a copy of the identity document, are as follows:

in establishing a business relationship;
when carrying out occasional transactions amounting to at least 15,000 euros or equivalent, regardless of whether the transaction is carried out in a single operation or multiple operations that appear to be connected;
when there are suspicions that the operation in question aims at money laundering or financing terrorism, regardless of the applicability of the derogatory provisions from the obligation to apply the standard customer due diligence measures established in this law and the amount of the operation;
if there are doubts regarding the veracity or relevance of the identifying information already held about the client;

Under the legal obligation to apply standard client knowledge measures, which any Romanian credit institution has according to the provisions of the BNR Regulation no. 9/2008 regarding client knowledge for the purpose of preventing and combating money laundering, Law 656/2002 regarding the prevention and combating of money laundering and terrorism financing, and HGR 594/2008 for the application of Law 656/2002 regarding combating money laundering and terrorism financing, at the moment of establishing a business relationship, it is necessary to collect and keep in BT records at least the following categories of personal data: name, first name, date and place of birth, personal numeric code or another similar unique identification element, domicile, telephone number, fax, email address, citizenship and, if applicable, pseudonym, residence address, occupation, employer's name or nature of own activity, held important public position, name of the real beneficiary.

The same information is collected also in the case when a client is represented in the relationship with the bank by another person, who acts as attorney, curator, guardian or in any other capacity and, in addition, data concerning the nature and limits of the authorization.

In the case of establishing and carrying out the business relationship with a legal entity client, the data mentioned in the above paragraphs will be collected for identifying the persons who, according to the constitutive acts and/or decisions of the statutory bodies, are vested with the competence to manage and represent the entity and regarding their powers to bind the entity, as well as for identifying the person acting on behalf of the client and information to establish that this person is authorized/empowered in this regard. The bank is obligated to verify this data, including in public registers.

Under the same legal obligations, the identity data of the actual beneficiary are also collected, if applicable.

The verification of the collected data will be done based on identity documents, but also by checking other sources.

Making and retaining a copy of the identity document of all these persons is also mandatory for the bank.

As part of the process of knowing the clientele, the bank has the legal obligation to collect including information related to the status of politically exposed persons of the clients with whom it enters into a business relationship. Exclusively for this purpose, BT will process information that falls into the category of political opinions - special category personal data.

Also, in accordance with the legal obligations incumbent upon it in this matter, at the enrollment and account opening stage, BT will classify clients by risk levels, based on criteria such as nationality, residence, affiliation, functions or important positions held.

Within the process of knowing the clientele, based on the legal obligations from Government Emergency Ordinance no. 202/2008 regarding the implementation of international sanctions and from Regulation no. 28/2009 regarding the supervision of the manner of implementing international sanctions, as well as based on its legitimate interest not to enter into business relationships with persons accused or suspected of violations of the law, the bank processes information related to fraudulent/potentially fraudulent activity (data related to accusations and convictions concerning offenses such as fraud, money laundering, and financing of terrorist acts)

BT has the obligation to ensure that all these data are updated in its records throughout the business relationship with the clients, in this sense it will request them to update the data provided at the initiation of the business relationship, whenever necessary, even being able to update them on its own initiative, from reliable external sources, public or private, accessed directly or through third-party providers.

All these data are kept in the bank's records according to the established legal term, which is at least 5 years from the termination of the business relationship of the client with BT.

In case the request to initiate the business relationship is completed online, in the sections available on the BT website, applicants will have to provide the same data required by the legal provisions mentioned above, and the enrollment process (establishing the business relationship) will be completed only after signing the documentation at a bank branch. In case, within 60 days from completing the online application to open the business relationship, the applicant does not present themselves at a BT branch for signing and thus finalizing the enrollment process, their data will be deleted from the bank's records.

Credit is one of the main activities carried out by a credit institution. The conclusion and execution of a credit contract, with a natural or legal person, involves going through several stages during which personal data is processed based on the Bank's legal obligations, based on the conclusion and execution of the credit/guarantee/assessment contract, based on the legitimate interest justified by the Bank, as well as, in some specific situations, based on the consent of the persons concerned by the processing.

1. 1. Processing of personal data within the pre-offer stage or the analysis of a credit request submitted to Banca Transilvania

1.1.Processing of personal data in the Credit Bureau System

1.1.a. Legal basis and purpose of data processing in the Credit Bureau system

The bank has the obligation, according to the legal regulations in force, to assess the applicants' ability to repay the loan before concluding a credit agreement and during its term. For this purpose, it processes the information indicated at point 1.1.c below, both in its own records and by transmitting it to the Credit Bureau for processing by this institution and for consultation by any Participant in this system, for the purpose of initiating or carrying out a credit relationship, as well as for securing credit-type products.

For credit applicants and certain categories of persons related to them, during the stage of analyzing a credit application, the Bank consults the Credit Bureau System, justifying a legitimate interest in this regard for carrying out responsible lending activities.

Credit Bureau SA is the private law entity that manages the Credit Bureau System, in which personal data related to the lending activity carried out by Participants is processed.

Participants in the Credit Bureau System are credit institutions, non-banking financial institutions, insurance companies, and debt collection companies that have signed a Participation Contract with the Credit Bureau.

1.1.b. The obligation to provide data and the consequences of non-compliance thereof

Provision of personal data is necessary for the purpose mentioned in point 1.1.a. The refusal of the data subjects of this processing to provide their personal data, necessary for achieving the aforementioned purpose, will lead to the Bank's inability to fulfill its legal obligations related to granting the loan.

1.1.c. Categories of personal data processed in the Credit Bureau System

The data processed in the Credit Bureau System are:

identification data of the data subject: name, surname, personal numerical code, home/residence and correspondence address, landline/mobile phone number, date of birth, country code and passport series/number in case of non-resident persons;
data relating to the employer: the name and address of the employer;
data related to the requested/granted credit-type products: type and name of the Participant, type of product, product/account status, date of granting, granting term, amounts granted, amounts due, due date, currency, payment frequency, amount paid, monthly installment, outstanding amounts, number of overdue installments, number of days of delay, delay category, product closing date;
data related to events occurring during the term of the credit-type product, such as those referring to restructuring/refinancing, debt settlement, assignment of the credit agreement, assignment of receivables;
data related to relationships with other accounts: information regarding credit-type products for which the data subject has the status of co-debtor and/or guarantor;
data related to insolvency: information regarding the persons concerned against whom an insolvency procedure has been opened;
number of queries: indicates the number of Credit Reports issued by the Credit Bureau, at the request of one or more Participants;

1.1.d Data recipients

Personal data recorded in the Credit Bureau System are disclosed to Participants in this system, upon request, for the purpose mentioned in point 1.1.a.

Personal data processed in the Credit Bureau System will not be disclosed to third parties, except for authorities and public institutions, according to their competencies and applicable legislation, such as the National Authority for the Supervision of Personal Data Processing, the National Bank of Romania, the National Integrity Authority, courts of law, notaries public, bailiffs, criminal investigation bodies.

1.2. Processing of personal data in the records of Banca Transilvania S.A.

1.2.a. Legal basis and purpose of personal data processing

In order to pre-offer and, where applicable, to analyze a credit request made, in accordance with the need to carry out responsible lending activity, besides processing personal data in the system of Credit Bureau S.A., the Bank processes such data in its own records based on the legal obligations it must comply with, the conclusion of the credit/guarantee/evaluation/insurance contract, based on its legitimate interest and, where applicable, with the consent of the data subjects.

1.2.b. The obligation to provide data and the consequences of non-compliance therewith

The provision of personal data is necessary for the purpose of pre-offering/analyzing a credit application. Refusal to provide the data necessary for this purpose will lead to the impossibility for Transilvania Bank S.A. to fulfill its legal obligations regarding the granting of the credit, and the credit application will not be analyzed.

1.2.c. Categories of personal data processed within Banca Transilvania S.A.

The personal data previously mentioned as being processed in the Credit Bureau system are processed by Banca Transilvania S.A. also in its own records. To this data are added information that the Bank obtains as a result of verifying the persons concerned in its own records, as well as in public databases such as websites - the courts' portal, ONRC etc.

1.2.d.Existence of an automated decision-making process, including the creation of profiles made through the BT scoring application

In order to objectively verify the fulfillment of eligibility conditions for pre-offering and, where applicable, to analyze the credit application - BT processes, in some cases, based on its legitimate interest, the personal data of credit applicants (natural persons and legal representatives of legal entities) as well as other natural persons participating in the credit application analysis stage in its own automated system ("BT scoring application").

In the BT scoring application, personal data, identification data, other data completed in the credit application, information resulting from verifications carried out in the Bank's own records or in those of the Credit Bureau SA, such as whether the persons subject to this processing receive income into an account opened at the Bank or are regular customers of the Bank, the level of monthly payment obligations, the payment history in the case of other loans contracted from the Bank, etc., are entered and analyzed. Following the analysis of these data/information, the BT scoring application issues a score based on a profile of the debtor/potential debtor as a good or bad payer. The returned score thus determines the credit risk and the likelihood of timely payment of installments in the future.

Based on the score issued by the BT scoring application, which is accompanied by the result of the verification of the relevant personal situation in public databases such as the websites - the court portal, ONRC etc. - the Bank determines whether the eligibility conditions established by its internal regulations are met and will make the decision to approve or reject the credit request, a decision that is based on the analysis carried out by the Bank's employees (human intervention).

1.2.e In this stage of the lending process, applicants will be handed a form by signing which they can express their consent for the bank to consult the ANAF database, for a limited period - a maximum of 5 working days - regarding the income earned by them, considering that the level of income earned is an essential element for establishing compliance with the bank's lending conditions.

Also in this stage, for some types of credit products, the Bank wishes to consult the records of the Credit Risk Center, in which case it will hand over to the credit applicant a dedicated agreement form for completion and signing.

2. Processing of personal data on the occasion of concluding and during the course of a credit contract concluded with the Bank

2.1. Legal basis and purpose of processing

For the conclusion and execution of credit agreements and, where appropriate, guarantee/valuation/insurance contracts related thereto, the Bank processes the categories of personal data mentioned in the present section at point 2.3, based on its legal obligations, the conclusion and execution of contracts, and based on its legitimate interest

2.2. The obligation to provide data and the consequences of non-compliance with it

The provision of personal data is necessary for the purpose of concluding and executing credit contracts and, where applicable, their ancillary contracts (e.g. guarantee). The refusal of persons to process the personal data necessary to achieve the aforementioned purpose will result in the Bank's inability to offer you the requested credit.

2.3. Categories of personal data processed

Personal data processed by the Bank for the purpose mentioned in point 2.1 of this section are those used during the pre-offer/credit application analysis stage, to which other such data completed and/or received on the occasion/for the conclusion or during the credit and guarantee contract are added.

BT allocates to each of its clients a client code (Client Id) based on which it is identified in the bank records, as well as an IBAN code corresponding to each cont (current, of card, of savings etc) opened in the client's name at the bank.

At the same time, for each of the cards issued by BT to its clients, a unique number (PAN) is allocated, which BT inscribes on the card along with its expiration date, the cardholder's last and first name, and the CVV code (back). Based on the agreement of the cardholders, there is the possibility of inscribing the IBAN code on the card as well.

Banca Transilvania constantly cares to offer its clients with whom it has concluded a business relationship online services and products, such as–internet banking service- with the BT24 variants, mobile BT24 or BT24 Bills - the digital wallet type payment application - BT Pay, the chat bot "Livia from BT" accessible via Facebook, the Self Service telephone service. For the use of these services it is necessary for the bank to process certain categories of personal data in order to identify persons as BT customers and, subsequently, as users of the services. These data are usually - name, surname, date of birth, client code, phone number.

A part of the BT applications, which are accessible with the help of mobile devices (example: mobile BT24, BT Pay), may require their users, either at the time of installation or during their use, access to certain additional personal data such as, but not limited to: camera (for example for the barcode scanning option of invoices), location (within certain sections of the applications, for displaying some BT units and ATMs nearby or for indicating the stores of merchants enrolled in the Star BT loyalty program), contacts (only when accessing the payment option via Email/SMS/P2P for automatically filling in the beneficiary details), SMS (for automatically filling in the SMS-OPT codes required within various sections of the applications), phone status and identity (e.g. the phone's IMEI is necessary for activating the MBT24 mobile internet banking application), information related to the presence or absence of a security method on the phone used within the applications.

Also, in the case of using online services, to ensure the security of the transactions carried out, the IP address of the device you are using will be processed in some situations. These data are requested and used strictly for the purpose of ensuring the security of the transactions and processed only for the strictly necessary period.

In order to provide certain banking services, such as, but not limited to internet and mobile banking - with the BT24, BT24 mobile or BT24 Bills options- SMS Alert, BT Alert, the bank will process the phone number communicated by clients for the purpose of providing the respective services.

Also, the phone number, email address or home/residence/correspondence address provided by clients for conducting the business relationship will be processed by the bank for the purpose of Information for Clients regarding aspects of interest related to the functioning of services/products contracted from BT, such as, but not limited to interruptions in the functioning of certain services, the establishment of garnishments on bank accounts, warnings about the expiration of BT issued bank cards or identity documents, as well as for contacting them within debt collection activities.

In case of some online application type services for various BT products/services/contests/events, available in the form of forms on the BT website and on other websites controlled by the bank, we usually request the completion of the following personal data: name, first name, phone number, and e-mail address, in order to contact the applicants to provide them with answers/information regarding these requests.

Depending on the specifics of the product/service for which the application is made online, there are however situations when it is necessary to provide additional data, either those imposed by legal provisions, or those processed by BT based on the legitimate interest of identifying individuals in order to be able to provide/render the requested products/services/information.

The data filled in these forms are processed by the bank for the purpose of providing the requested products/services/information, for the period necessary to fulfill these purposes, in accordance with the bank's retention policies developed in compliance with the principles and obligations established by the applicable laws in the field of the processing and protection of personal data.

BT will not collect and will not store the personal data of those who completed them online, if they have not completed their registration.

Any person has the right to deposit cash amounts into accounts opened at BT, if the holders of these accounts have allowed such deposits to be made by third parties.

For the purpose of making such a deposit, the bank has the legal obligation to identify the payers based on their identity documents, and also to process a series of their personal data - name, first name, identity document series and number, personal numeric code, address, details regarding the deposited amount and explanations regarding the nature of the payment (what the payment represents).

In cases provided by law, mentioned in point I of this section, for making the cash deposit the Bank must also make and keep in its records a copy of the identity document belonging to the occasional Client making the deposit

In case certain occasional Clients repeatedly present themselves at the bank units to make cash deposits into accounts opened at BT, in order to streamline the bank's activity, respectively to reduce the waiting time in units, the bank has the legitimate interest to use their data collected during previous deposits, which will then be pre-filled in the cash deposit receipt form. The data of external depositors will not be processed for other purposes, will be accessed only by personnel who need to know them, and will be kept only for the periods provided in the internal retention policies and within the normative acts that contain provisions regarding this aspect.

Any person has the possibility to address the bank with requests, to request the provision of information/taking of certain measures or can send complaints/claims through various channels such as – by sending/submitting written complaints at the bank's headquarters or its territorial units, by calling the BT call center phone number or any other phone number allocated to BT units, by sending messages to the email addresses made available to clients or to the email addresses of the bank's employees, by sending electronic messages within the secure BT24 internet banking platform, by filling out dedicated forms on the BT website or on other websites controlled by the bank - for the list of all BT websites visit here.

To identify the requesting persons, to analyze the reported situation and to respond to these requests for information/reports/complaints, the bank processes a series of personal data - name, first name, phone number, email or correspondence address from which the request was received, other personal data provided within the messages or that needs to be processed in order to formulate responses/provide the requested information.

In order to prove the fact that these complaints/claims/requests for information/measures have been received, as well as for the quality control of the responses/information/actions sent/taken by the bank, and also for the purpose of quality control of support services, the received messages will be kept in BT's records both in the format in which they were received and in electronic format, and telephone calls will be recorded and kept for the duration of the business relationship for BT's clients, or for a period necessary to fulfill the purpose for which they were processed (formulating the response/providing the information), plus a period of 3 years - the legal limitation period in case the data does not belong to persons with whom the bank has an established business relationship.

According to the provisions of Law no. 333/2003 regarding the guarding of objectives, goods, valuables and the protection of persons, with subsequent amendments and completions, as well as Government Decision no. 301 of April 11, 2012 for the approval of the Methodological Norms of Law no. 333/2003 regarding the guarding of objectives, goods, valuables and the protection of persons, BT has the legal obligation to video supervise the ATM area, as well as the access route areas, halls and other high-risk areas.

Under its legitimate interest, the bank intends to monitor video and other publicly accessible areas that present a potential security risk to people/spaces or property.

Video surveillance activity involves processing the image of persons, and the places where the cameras are installed are appropriately marked by a specific and visible notice accompanied by the icon.

The video surveillance system is not used for any purpose other than the one mentioned, it is not used for monitoring the activity of the public, employees, or attendance tracking. Also, the system is not a means of investigation or obtaining information for internal inquiries or disciplinary procedures, except in situations where a physical security incident occurs or criminal behavior is observed (in exceptional circumstances the images can be transferred to investigation bodies within a disciplinary or criminal investigation).

The system can record any movement detected by the cameras installed in the monitored area, along with date, time, and location. All cameras are operational 24 hours a day, 7 days a week. When necessary, the image quality allows for the recognition of persons passing through the camera’s field of action. Video recordings are stored in the bank’s internal records.

Alongside image processing within the video surveillance activity, to allow visitors access to certain areas where the bank operates, the personnel with security duties will identify the visiting persons based on their identity documents, and the name, surname, series, and number of the identity document of these persons will be entered in special registers and kept in written format for the legally established period.

BT wishes to inform interested persons about the products/services/events offered/organized by the bank, by the entities within the BT Financial Group or by their partners, in this sense processing the personal data of these persons, if they have given their consent to receive such advertising messages by filling in the dedicated form, accessible in any bank branch and on the website.

The data processed by BT for the purpose of sending advertising messages are the first name, last name, phone number and/or email address or mailing address provided by the persons interested in receiving advertising messages.

Advertising messages will be sent through one or more of the following channels: SMS, phone call, email address, postal mailing address, or internet/mobile banking – BT24 (for clients who have contracted this service).

In some cases, for sending advertising messages on these channels, BT will contract service providers, who will process the personal data of individuals on behalf of and for BT, only for sending the established advertising messages exactly following BT's instructions and being under the careful supervision of the Bank.

Persons interested can choose to receive advertising messages from several categories, among which we list: BT products and services, products and services of BT subsidiaries, events organized by BT, products/services of partners, which are related to products/services of BT or BT subsidiaries, and events organized by BT partners.

BT subsidiaries whose products/services and events are intended to be promoted within advertising messages sent to persons who have opted in this respect are the following entities within the Financial Group Banca Transilvania

BT Microfinancing IFN SA ("BT Mic")
BT Asset Management S.A.I. S.A., ( "BTAM")
BT Leasing Transilvania IFN S.A. ("BTL")
BT Direct IFN S.A. ("BTD")
BT Capital Partners S.S.I.F. S.A.("BTCP")
alte entitățthose who can to theăthe shift of this group in the future

Persons who wish to receive advertising messages about products/services/events of the bank's partners or subsidiaries related to BT's services/products can also opt for this on the dedicated form for expressing marketing consent.
List of current BT partners' categories and/or BT subsidiaries is accessible at the link https://www.bancatransilvania.ro//Parteneri_BT_Politica_Confidentialitate_25.05.2018-30.07.2019_Versiunea_1.pdf or in any BT unit or BT subsidiaries.

In case the option was chosen to receive advertising messages about products/services events offered/organized by BT subsidiaries or by partners, these entities will process personal data for the purpose of sending these messages, under the close supervision and coordination of the Bank. For any possible processing of personal data carried out by BT partners/BT subsidiaries outside or adjacent to the sending of advertising messages, such as, for example, for the purpose of concluding contracts related to their promoted products/services, these partners will act as controllers of the processed personal data.

In case BT or its subsidiaries already hold certain personal data of persons who wish to receive advertising messages, based on the express consent of the persons concerned, these data may be processed automatically to create profiles (taking into account criteria such as age, location, income range, BT products or BT subsidiaries' products used) in order to send personalized proposals. In the situation where the persons concerned do not express their express consent to receive personalized advertising messages, they will only receive information about general offers addressed to the general public. Expressing disagreement to receive personalized messages does not lead to the impossibility of obtaining a personalized offer, upon the request of the interested persons, depending on their needs, which can be communicated to one of the bank's employees within the BT units or BT subsidiaries.

Personal data collected for profile creation for the purpose of sending personalized advertising messages will be processed by BT, as applicable, until the purpose detailed in the previous paragraphs is fulfilled or until the withdrawal of the consent granted in this respect.

The agreement to receive advertising messages can be withdrawn or modified by the following methods:

sending a request in this regard to the BT headquarters in Cluj-Napoca municipality, G. Barițiu street, no. 8, Cluj county, with the mention "for the attention of the person responsible for personal data protection";
by message sent to the e-mail address dpo@btrl.ro;
by accessing the dedicated section of the BT website - www.bancatransilvania.ro - "unsubscribe/change advertising message", which you can also find at the following link www.bancatransilvania.ro/data-processing-agreement;

In certain specific cases, with strict respect for the rights and freedoms of individuals, Banca Transilvania will process personal data for the purpose of sending advertising messages based on its legitimate interest in promoting the products and services it offers.

BT is one of the companies with the largest number of employees in Romania, and announcements about various vacant positions in the bank are posted on recruitment websites. People who access these sites and apply for certain available positions in BT or the "careers" section of the website www.bancatransilvania.ro, will be directed to the secure recruitment platform used by Banca Transilvania.

Within this platform, whether they want to apply for only a specific position or prefer that the bank contact them for various available positions within the company, candidates will be required to create an account by entering their last name, first name, a phone number, and an e-mail address at which they can be contacted for recruitment purposes and to upload at least their CV.

In case it will be applied only for a specific accessed position, the candidate's personal data will be processed by the bank only within the recruitment process for that position, with these and the account created on the platform being deleted at the end of the recruitment process for that position.

If, instead, the candidate chooses to be contacted in general for vacant positions at BT, it will be necessary to select a series of predefined criteria in the platform, based on which we will notify them about the availability of suitable positions. In this case, the candidate's data will be retained for recruitment purposes for a period of 1 year from the moment of registering this option.

The same retention period applies also in the case where the CVs have been submitted/transmitted to the Bank by candidates through any other channels.

After the mentioned deadline, BT will anonymize the personal data collected for recruitment purposes, and they will only be used for generating statistical reports for the bank's internal use. Once these records become anonymous, they can no longer identify the person to whom they belong.

Within the recruitment process, references from the candidates' previous employers may become relevant. If the bank needs these, it will contact the candidate to request their consent to obtain them on their behalf. If the candidate does not express their consent in this regard, they will need to obtain these references themselves if they wish to continue the recruitment process.

The candidate has the option to delete his account created within the BT recruitment platform at any time, which will be equivalent to withdrawing his consent for the bank to continue processing his personal data for recruitment purposes. From the moment the account is deleted on the platform, only the candidate will be able to access his registered data, not BT.

In case the bank receives CVs or job applications through channels other than the recruiting platform mentioned above, it will keep this data for the same durations mentioned above, respectively until the end of the recruitment process for the chosen position, or, as the case may be, for a period of 6 months, which can be extended at the candidate's request, if they wish to apply for various positions available within the company.

Apart from the purposes detailed in the previous sections, Banca Transilvania processes personal data for other purposes, such as:

carrying out analyses and keeping records of economic, financial and/or administrative management in the Bank;
administration within the internal departments of the services and products offered by the bank;
evaluation and monitoring of the financial-commercial behavior of Clients during the course of the business relationship with the Bank;
creating or analyzing profiles for improving BT products/services or those of entities within the BT Group;
analyzing the behavior of website users through the use of cookies, both those of BT and those of third parties, in order to provide general or personalized content, offers adapted to the users' interests (details in the Cookie Policy);
performing internal analyses (including statistical), both regarding products/services, as well as regarding the client portfolio, for the improvement and development of products/services, as well as performing studies and market analyses regarding the Bank's products/services;
calculating the commissions to which the employees acting within the BT sales force are entitled;
archiving both physical and electronic document formats, providing registry services for correspondence addressed to BT and sent by it, as well as carrying out courier activities;
the resolution of disputes, investigations, or any other petitions/complaints/requests in which BT is involved;
carrying out risk controls on BT procedures and processes, as well as performing audit activities or investigations;
carrying out and sending reports to the competent institutions to receive them in accordance with the applicable legal provisions BT (e.g.: reports on payment incidents to the Payment Incidents Center within the BNR, declaring transactions exceeding the amount established by law to the National Office for Prevention and Control of Money Laundering);
for monitoring clients' activity in order to detect unusual transactions and suspicious transactions;

G. To whom does Banca Transilvania disclose the personal data it processes?

The personal data of the Bank's Clients are disclosed or, as appropriate, transferred, in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and security of the data, to categories of recipients such as, but not limited to:

branches, agencies, workplaces, representations of the Bank,
entities within the BT Financial Group mentioned within this policy or on the BT website and others that may join the BT Group in the future
Service providers used by the Bank for: IT services (maintenance, software development), archiving in physical and/or electronic format; courier; audit; services related to card issuance and their enrollment in platforms; market study/research services, advertising message transmission, monitoring online tools users' traffic and behavior, marketing services through social media resources, etc;
processing of interbank payments and transmission of information regarding interbank operations (e.g., Transfond, Society for Worldwide Interbank Financial Telecommunication - SWIFT);
authorities and public institutions (such as, but not limited to, the NBR, ANAF*, police, National Office for the Prevention and Control of Money Laundering**),
guarantee companies (funds) for various types of credit/deposit products (e.g., FNGCIMM, FGDB etc),
ONRC, OCPI, AEGRM, public notaries, lawyers, bailiffs;
Credit Risk Center***;
Credit Bureau and Participants in the Credit Bureau system****;
insurance companies;
evaluation companies;
companies for collection of outstanding debts or receivables;
entities to which the Bank has outsourced the provision of financial-banking services;
partners of the Bank;
international payment organizations (e.g. Visa, Mastercard);
banking institutions or state authorities, including from outside the European Economic Area - in the case of international SWIFT transfers or as a result of processing carried out for the purpose of applying the FATCA and CRS legislation, social networking providers, debt recovery and/or collection service providers, appraisers, real estate agencies.

*According to the provisions of the Fiscal Procedure Code (Law 207/2015), in its capacity as a credit institution, BT has the legal obligation to communicate daily to the central fiscal authority – A.N.A.F. – the list of individual holders, legal entities or any other entities without legal personality that open or close accounts, as well as the identification data of the persons who hold the signing right for the accounts opened with them, the list of persons who rent safe deposit boxes, as well as the termination of the rental contract. A.N.A.F. may communicate this data to local fiscal authorities or to other central and local public authorities, in accordance with the law.

**In case the conditions for BT to transmit personal data to the National Office for Prevention and Control of Money Laundering are met, according to Law no. 656/2002 for the prevention and sanctioning of money laundering, as well as for the establishment of measures to prevent and combat the financing of terrorism, republished, with subsequent amendments, they are transmitted simultaneously and in the same format also to A.N.A.F.

***The bank has the legal obligation to report to the Credit Risk Center (CRC) the credit risk information for each debtor who meets the condition to be reported (includes the identification data of a debtor, a natural person or a non-banking legal entity, and transactions in local currency and foreign currency through which the bank is exposed to risk towards that debtor), as well as to have recorded an individual risk towards that debtor, as well as information about detected card frauds.

****The bank has the legitimate interest to report in the Credit Bureau System, to which other Participants also have access (mainly credit institutions and non-bank financial institutions) your personal data in case you register payment delays on the loan of at least 30 days, after prior notification of the data subjects in this regard at least 15 days before the reporting date.

In order to provide banking services that are the subject of contracts concluded between the Client and the Bank, the latter will transfer personal data abroad, as appropriate, including to countries that do not ensure an adequate level of protection of such data. The initiation by the Client of operations such as payment orders represents his consent for the transfer of his personal data by the Bank to the respective countries. Countries that do not ensure an adequate level of protection are countries outside the European Union/European Economic Area, except for countries to which the European Commission has recognized an adequate level of protection, namely: Andorra, Argentina, Canada, Switzerland, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Uruguay (to the extent that a contrary decision will not be issued regarding any of these countries).

H. How long does BT process personal data?

For the achievement of the purposes presented within this Policy, personal data will be processed by BT throughout the duration of the contractual relationship with the data subjects and after its completion in order to comply with applicable legal obligations, including those regarding archiving.

Personal data completed in the credit application and those processed for customer knowledge in order to prevent and sanction money laundering and combat terrorism are stored in BT records for a period of 3 years from the date of signing the credit application, if it is rejected, and respectively, for a period of 5 years starting from the date of termination of the credit relationship, if a credit contract is concluded following the approval of the credit application.

In what concerns the data processed within BT's activity in the Credit Bureau system, these are stored at the level of this institution and disclosed to Participants for 4 years from the date of updating, except for the data of credit applicants who have withdrawn their credit application or to whom the credit was not granted, which are stored and disclosed to Participants for a period of 6 months.

Personal data for which BT has a legal obligation to report to the Credit Risk Center (CRC) will be retained in the CRC records for a period of 7 years from the date of credit registration.

Consultation agreements for the ANAF database will be kept in the Bank's records for a period of 10 years from their signing - if the credit application was rejected - and respectively for 5 years from the termination of the credit relationship, but no less than 10 years from the date of signing the agreement - in case the credit application was approved and a credit contract was concluded. Upon request, these agreements are to be made available to ANAF, upon request.

For the data processed based on the consent of the data subjects for the purpose of sending advertising messages, they will be processed until the termination of the business relationship with the Bank or, as the case may be, until the withdrawal of the respective consent.

In order to prove that complaints/claims/requests for information/measures have been received and that responses have been formulated to these, including for the quality control of the responses offered by BT, messages of this type received through any channel will be kept in BT records both in paper format and electronic, during the business relationship period for BT clients, or for a period necessary to fulfill the purpose for which they were processed (formulating the response/providing the information), plus a period of 3 years - the legal limitation period in case the data does not belong to persons with whom BT has an established business relationship.

Personal data processed for recruitment purposes will be kept by BT until the end of the recruitment process for the available position. If the data subjects wish to be contacted for multiple positions that might suit them, the data from CVs and other documents they have provided to BT for this purpose will be kept for a maximum period of 1 year, unless deletion from the Bank's records is requested within this time frame.

The storage duration of data obtained through the video surveillance system is proportional to the purpose for which the data is processed, and does not exceed 30 days, after which recordings are automatically deleted in the order in which they were recorded. In the event of a security incident, the retention period of the relevant filmed material may exceed the normal limits depending on the time required for further investigation of the security incident.

Any other personal data processed by BT for other indicated purposes will be kept for the period necessary to fulfill the purposes for which they were collected, to which reasonable periods may be added, established in accordance with the applicable legal obligations in the field, including but not limited to, the provisions regarding archiving.

I. What are the rights that the data subjects can exercise with regard to the personal data processed by Banca Transilvania?

Any data subject has the following rights regarding the processing of his or her personal data by BT.

a. The right to be informed:

It means the right of the data subjects to receive from BT clear, transparent information, written in language that is easy to understand, regarding how BT uses personal data, as well as about the rights they have. BT intends to fulfill this information obligation through the details provided in this document, as well as through other information notes inserted in the forms and contracts used in its activity

b. Right of access:

The data subjects have the right to access personal data, namely to obtain confirmation of whether BT processes their personal data or not, as well as a copy thereof, so that they have the possibility to verify if they are processed by BT in accordance with the provisions of the legislation in this field.

c. The right to rectification:

The data subjects have the right to have their personal data corrected if they are found in BT records in an erroneous format, if they are inaccurate or incomplete

d. The right to data deletion

This right is also called the "right to be forgotten". Based on it, data subjects can request the deletion of their personal data processed by BT, in case there is no longer a basis for their processing

e. The right to restriction of processing:

Data subjects may, in some cases, stop BT from using their personal data for a certain period of time. When the processing of these data is restricted, the personal data will still be kept in BT's records, but will no longer be used during this period and will be marked as restricted from processing.

f. The right to data portability:

The data subjects have the right to obtain from BT, in a format that can be read automatically, the data they have provided to us or they can request us to transmit this data to another operator chosen by them

g. The right to objection:

Data subjects may object to certain processing of their personal data, such as processing for the purpose of receiving advertising messages.

h. The right of the data subjects to address the National Authority for the Supervision of Personal Data Processing (ANSPDCP) and the judiciary.

Based on this right, the data subjects can address ANSPDCP or the courts with requests/petitions regarding the processing of their personal data by BT

The ways in which the data subjects can exercise the rights mentioned in points 2-7 above are:

by sending by mail a written request to the BT headquarters in Cluj-Napoca, G. Baritiu street, no. 8, Cluj county, with the mention – "to the attention of the data protection officer (DPO)" or
by electronic means at the e-mail address dpo@btrl.ro.

Also, for the data processed by BT in the Credit Bureau System, as provided in this policy, the data subjects of this processing may exercise their rights of access and restriction mentioned above, also at Credit Bureau S.A., as follows:

by a written, signed request, sent by mail to the Credit Bureau, or
by securely accessing the Credit Bureau website (www.birouldecredit.ro).

Persons whose personal data are processed in the Credit Bureau System also have the right to obtain, upon request, at the time of communication of the credit decision, a copy of the Credit Report issued by the Credit Bureau, which was used by BT in the analysis of the credit application.

J. How does BT protect personal data that it processes?

BT develops an internal framework of standards and policies to maintain the security of personal data. These are updated periodically to comply with the regulations applicable to the Bank and the highest standards in the field.

Specifically and in accordance with the law, we take appropriate technical and organizational measures (policies and procedures, IT security, etc.) to ensure the confidentiality and integrity of personal data and the way it is processed.

Employees of BT have the obligation to maintain confidentiality and cannot disclose personal data they process within their activity.

We ensure that our contractual partners who have access to the personal data we process are imposed contractual obligations in accordance with the legal provisions and that we verify their compliance with the obligations they have assumed. They will process personal data on behalf of and for BTD, only in accordance with the instructions received from it and only respecting the security and confidentiality requirements within the imposed limits.

We guarantee that BT will not sell the personal data collected from the visited persons and that it will only transmit this data to those entitled to know it, in compliance with the legally established principles and obligations.

We draw the attention of visitors of BT websites that these may contain links to websites whose privacy/personal data processing policy is different from that of BT. If you send personal data to any of these sites, your information falls under their privacy/personal data processing statement. BT's policy regarding the processing and protection of personal data does not apply to the information provided on those websites. In this regard, we recommend that you carefully read the privacy policy of any website you visit.

The current policy is regularly reviewed to guarantee the rights of the persons concerned and to improve the ways of processing and protecting the processed personal data.