Transilvania Bank S.A. Policy regarding the processing and protection of personal data within banking activities (“Policy” or “Privacy Policy”)

Valid version in the period 25.05.2018 – 10.07. 2018

La Banca Transilvania S.A. (called hereinafter “BT” or “Bank”) we constantly ensure that the personal data of all natural persons with whom we interact is processed in full compliance with applicable legal provisions and the highest standards of security and confidentiality.

In order to guide and support us in our activity in the field of processing and protection of personal data we have appointed a data protection officer (data protection officer or DPO), who can be contacted by any person regarding any aspects related to how BT processes these data, by sending a notification/complaint to the bank's headquarters from

mun. Cluj-Napoca, str. G. Barițiu, no. 8, jud. Cluj, with the mention “to the attention of the person responsible for personal data protection” or a message to
email address dpo@btrl.ro.

In the following, we present our policy in this very important field for any individual, which we commit to reviewing at certain intervals, with a view to its continuous improvement.

The present Policy does not address the employees of Banca Transilvania, who will be informed about their personal data processed by BT as an employer through a separate document, namely the Policy of Banca Transilvania S.A. regarding the processing and protection of employees' data.

We will explain to you in this policy what personal data we process within our activities from the individuals we interact with, in what ways, for what purposes we use it, to whom we disclose or transfer it, how we ensure their security, as well as what rights the data subjects have regarding the processing of this data and how they can exercise them.

A. Who is Banca Transilvania?

BANCA TRANSILVANIA S.A is a credit institution, Romanian legal entity, headquartered in Cluj-Napoca, G. Baritiu Street, no. 8, Cluj, registered at the Trade Register under no. J12/4155/1993, unique code RO 5022670, having the processing of personal data notified and registered in the Personal Data Operators Registry under number 8728.

BT has over 500 units - branches, agencies, work points, which carry out their activity in Romania, as well as a branch and two agencies that carry out banking activity in Italy.

Our official website is www.bancatransilvania.ro (hereinafter referred to as „website-ul BT”).

The bank also manages other websites, the updated list of which you can consult here.

Banca Transilvania SA is the parent company of the Banca Transilvania Financial Group (hereinafter referred to as „BT Group”), which includes the bank's subsidiary entities about which you can find information on the BT website in the BT FINANCIAL GROUP section.

B. What are personal data and what kind of data does BT process?

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is a person who can be identified, directly or indirectly on the basis of such information.

Within the banking activities it carries out, Banca Transilvania processes the following categories of personal data:

identification data: last name, first name, pseudonym (if applicable), date and place of birth, personal numeric code or another similar unique identification element, series and number of the national or international identity document/passport, as well as its copy, domicile and residence (if applicable), telephone number, fax, email address, citizenship,
profession, occupation, name of employer or nature of own activity (if applicable),
information about the important public function held- if applicable- and political opinions (excluding in the context of obtaining information related to the status of politically exposed person),
information about the family situation (including marital status, number of children, children in care),
information about the economic and financial situation - including data about income, data about bank transactions and their history, data regarding owned assets, as well as data related to behavior,
the image (contained in identity documents or captured by video surveillance cameras installed in the bank's offices, as well as at its ATMs),
the voice, including within the recordings of telephone conversations. BT records audio telephone conversations for the purpose of improving the quality of services and calls, but also to provide proof of the request/consent/option regarding certain;
signature and, in specific cases, fingerprint (in the case of illiterate persons or persons with visual impairments),
identification codes, allocated by Banca Transilvania or other banking or non-banking financial institutions, necessary for providing certain services, such as, but not limited to, IBAN codes attached to bank accounts, debit/credit card numbers, card expiration dates,
data regarding health status, processed exclusively in cases where the processing of such data is necessary for clients to prove the difficult situation they or their family members are in, in order to grant certain facilities, or in the context of providing insurance products intermediated by the Bank,
information regarding fraudulent/potentially fraudulent activity, consisting of data related to accusations and convictions concerning offenses such as fraud, money laundering, and financing of terrorist acts,
information regarding the location of certain transactions (in case of operations performed at ATMs or POS belonging to Transilvania Bank),
data and information related to the products and services offered by the Bank or its collaborators, which the data subjects use (such as, but not limited to credit, deposit, insurance products)

C. Who are the persons whose personal data are processed by BT?

Within its activity, BT primarily processes personal data of Clientscustomary, those with whom it has established a long-term contractual relationship, carried out in accordance with the General Business Conditions of Banca Transilvania applicable - as the case may be - to natural or legal persons (called business relationship). These regular customers are, in general: individuals - adults or minors - who have at least one current account opened at BT as individual clients, authorized persons/legal representatives who operate the accounts opened at BT in the name of individuals or legal entities, and their beneficial owners.

At the same time however, BT offers its services and products for use and Occasional clients. These are persons who do not have an account opened at BT nor any operating rights on them, but sometimes use BT units or equipment (such as ATMs, BT Express, BT Express Plus etc.) for carrying out various types of banking transactions (cash deposits into BT accounts, bill payments), transfers of amounts (for example, Western Union type transfers) or operations at the currency exchange office, provide us with their personal data upon visiting BT websites or units or when calling the support services offered by the Bank's Call Center.

Banca Transilvania is a company listed on the Bucharest Stock Exchange, thus it processes in this capacity also personal data of To the Shareholders sai, in accordance with the provisions of the capital market law.

These Customers or Shareholders sometimes need to provide us - in order to respond to requests, to obtain a product, to carry out an operation/provide a service - with personal data belonging to other persons, such as: spouse, wife, life partner, family members, the beneficiary of a payment operation, the guarantor of a loan, the beneficiary of an insurance, natural persons whose data are inserted in the documents provided by the client.

If the Client or Shareholder is the one providing BT with information about other persons, they have the obligation to inform the respective data subjects about the content of this policy regarding the processing of their personal data.

In the contracts that BT signs with anyone supplier/provider of goods/services (contractual partner) personal data of the signatories of these contracts are inserted (usually name, surname, the held position and the signature belonging to the legal or conventional representatives of the contractual partners), of the contact persons designated by the contractual partner (usually name, surname, phone number and e-mail address), of other categories of individuals whose data are disclosed to the Bank by the contractual partner. This personal data will be processed by BT in connection with the conclusion and execution of these contracts, for internal administrative-financial management, storage and archiving of contractual documentation, testing and use of IT systems and services, complaint management, carrying out audit missions. The legal basis for processing the personal data belonging to these categories of persons is the legal obligation of the bank, the conclusion/execution of the contract and the legitimate interest of the Bank. The personal data that we become aware of in the context of the relationship with a contractual partner are disclosed, as the case may be: to the contractual partner who provided them to us, to entities from the BT Group, to BT partners who need to know them, to authorities and public institutions entitled to request them. The data will be processed at BT level during the contract period and afterward, until the expiration of the contractual documentation archiving term. To meet the mentioned purposes, the Bank may transfer certain categories of personal data that the contractual partner has made available to us outside the European Economic Area EEA. The data subjects of this processing benefit from the rights provided within this policy for data subjects of processing.

All these categories of individuals that we have listed above will hereinafter be referred to as “target persons” of processing personal data.

D. What does processing personal data mean and how does BT come to process this data?

„Processing” personal data means any operation or set of operations performed on the data, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or making available in any other way, alignment or combination, restriction, deletion or destruction

Personal data that we use in our activity are usually obtained directly from the data subjects, on various occasions and in various ways:

at the time of establishment and during the course of the business relationship with BT
on the occasion of concluding and executing contracts for products/services offered by the bank, on its own behalf or for third parties
by filling out some forms available on the BT website, on other websites owned by the bank or by other entities of the Group
by registering/participating in various contests/campaigns organized by BT in its units, on the BT website or on the bank's pages on social networks
when we are asked for information/we receive notifications/complaints at the bank's telephone numbers, at the email addresses, through messages sent on the bank's social media pages or received in writing at BT units
when to apply for available positions in the bank (online, sending/submitting CVs at BT units or to various email addresses, at career fairs or other events)

Indirect, we can find out personal data of the data subjects from/by:

authorities and public institutions or of public interest, correspondent banks, lawyers, notaries, bailiffs or other persons who transmit us complaints/requests
authorized representatives of the persons concerned for the opening/conducting of the business relationship with BT
consulting some external databases, public or private, directly or through third-party providers, such as the National Trade Register Office, Credit Bureau S.A., the Romanian courts portal managed by the Ministry of Justice, third-party holders of databases of persons accused of terrorism or politically exposed persons
employers of the data subjects, in case we conclude with them agreements for transferring salaries or other types of amounts
alte entitati din Grupul BT, cu care persoanele vizate intra in relatii contractuale si este nevoie ca Banca sa cunoasca datele lor in baza apartenentei sale la grupul BT si pentru buna desfasurare a activitatii economice comune pe care o deruleaza impreuna cu celelalte entitati din Grupul BT
collaborators of the bank, who collect on its behalf data of persons who wish to be contacted by BT for the presentation of certain products/services they are interested in
Central Depository S.A., in the case of the Bank Shareholders' data
the use by the targeted persons of the BT website, of other websites owned by the bank (through cookies, Google Analytics, etc.) or by other entities in the Group. For details about these aspects and about the ways in which you can enable or block cookies, please consultcookie policy of the website usage.

E. What are the grounds on which BT processes personal data?

Activities carried out by Banca Transilvania, in its capacity as a credit institution, are strictly regulated through various normative acts. Thus, many of the personal data processing activities carried out by BT are imposed by the legal obligations it has. At the same time, however, BT processes personal data necessary for the conclusion and/or execution of contracts concluded with the data subjects, based on its legitimate interest or, when applicable, based on the consent of the data subjects.

Except for cases where personal data is processed based on the consent of the data subjects, the refusal of individuals to have their data processed by BT will make it impossible to provide the requested services or to resolve their requests.

F. What are the purposes for which BT processes personal data?

Carrying out any operation requested at the counters of BT units by regular or occasional clients requires the Bank to go through the identification stage of these persons. In this respect, BT employees will ask the persons to present their valid identity document. In some cases imposed by law, it will also be necessary to make and retain by BT a copy of the identity document, for the period provided by law.

The cases in which BT is obliged to apply the standard customer due diligence measures, including carrying out and retaining a copy of the identity document, are the following:

in establishing a business relationship;
when carrying out occasional transactions amounting to at least 15,000 euros or equivalent, regardless of whether the transaction is carried out through a single operation or several operations that appear to be connected;
when there are suspicions that the operation in question aims at money laundering or terrorist financing, regardless of the applicability of derogatory provisions from the obligation to apply the standard customer due diligence measures established in this law and the value of the operation;
if there are doubts regarding the veracity or relevance of the identification information already held about the client;

Under the legal obligation to apply standard customer due diligence measures, which any Romanian credit institution has according to the provisions of BNR Regulation no. 9/2008 regarding customer knowledge for the purpose of preventing and combating money laundering, Law 656/2002 regarding the prevention and combating of money laundering and terrorist financing, and HG Decision 594/2008 for the application of Law 656/2002 regarding the combating of money laundering and terrorist financing, at the time of establishing a business relationship, it is necessary to collect and keep in BT's records at least the following categories of personal data: first name, last name, date and place of birth, personal numerical code or another similar unique identification element, domicile, telephone number, fax, e-mail address, citizenship, and, if applicable, pseudonym, residence address, occupation, employer's name or nature of own activity, held important public function, name of the real beneficiary.

The same information is collected also in case a client is represented in the relationship with the bank by another person, who acts as proxy, curator, guardian or in any other capacity and, in addition, data related to the nature and limits of the authorization.

In case of establishing and conducting the business relationship with a legal entity client, the data mentioned in the above paragraphs will be collected for identifying the persons who, according to the constitutive documents and/or the decision of the statutory bodies, are invested with the competence to conduct and represent the entity and regarding their powers to bind the entity, as well as for identifying the person acting on behalf of the client and information to establish that this person is authorized/empowered in this regard. The bank is obliged to verify these data also in the public registers.

Under the same legal obligations, the real beneficiary's identity data is also collected, if applicable.

Verification of the collected data will be done based on identity documents, as well as by checking other sources.

Carrying out and retaining a copy of the identity document of all these persons is also mandatory for the bank.

In the process of getting to know the clientele, the bank has the legal obligation to collect information including that related to the status of politically exposed person of clients with whom it enters into a business relationship. Exclusively for this purpose, BT will process information that falls into the category of political opinions - personal data of a special nature.

Also, in accordance with the legal obligations incumbent upon it in this matter, at the enrollment and account opening stage BT will classify clients according to risk levels, based on criteria such as nationality, residence, affiliation, important functions or positions held.

Within the process of knowing the clientele, based on the legal obligations from Emergency Ordinance no. 202/2008 regarding the implementation of international sanctions and Regulation no. 28/2009 regarding the supervision of the manner of implementation of international sanctions, as well as on the basis of its legitimate interest not to enter into business relationships with persons accused or suspected of legal violations, the bank processes information related to fraudulent/potentially fraudulent activity (data related to accusations and convictions concerning offenses such as fraud, money laundering, and financing of terrorist acts)

BT has the obligation to ensure that all these data are updated in its records throughout the duration of the business relationship with clients, in this sense it will request them to update the data provided at the initiation of the business relationship, whenever necessary, even being able to update them on its own initiative, from safe external sources, public or private, accessed directly or through third-party providers.

All these data are kept in the bank's records according to the established legal term, which is at least 5 years from the termination of the customer's business relationship with BT.

In case the application to initiate the business relationship is completed online, in the sections available on the BT website, applicants will have to provide the same data required by the legal provisions mentioned above, with the registration process (establishing the business relationship) to be completed only after signing the documentation at a bank branch. In case, within 60 days from completing the online application for opening the business relationship, the applicant does not present himself/herself at a BT unit for signing and finalizing the registration process, his/her data will be deleted from the bank's records.

Credit is one of the main activities carried out by a credit institution. The conclusion and execution of a credit contract, with a natural or legal person, involves going through several stages during which personal data is processed based on the Bank's legal obligations, based on the conclusion and execution of the credit/guarantee/evaluation contract, based on the legitimate interest justified by the Bank, as well as, in some specific situations, based on the consent of the data subjects.

1. 1. Processing of personal data within the stage of pre-offer or analysis of a credit application submitted to Banca Transilvania

1.1.Processing of personal data in the Credit Bureau System

1.1.a.Legal basis and purpose of data processing in the Credit Bureau system

The bank has the obligation, according to the legal regulations in force, to evaluate the applicants' capacity to repay the loan before concluding a credit agreement and during its term. For this purpose, it processes the information indicated in point 1.1.c below, both in its own records and by transmitting them to the Credit Bureau for processing by this institution and for consultation by any Participant in this system, for the purpose of initiating or conducting a credit relationship, as well as for securing loan-type products.

For credit applicants and certain categories of persons related to them, during the analysis stage of a credit application, the Bank consults the Credit Bureau System, justifying a legitimate interest in this regard for carrying out responsible lending activities.

Credit Bureau SA is the private law entity that manages the Credit Bureau System, in which personal data related to the lending activity carried out by Participants are processed.

Participants in the Credit Bureau System are credit institutions, non-banking financial institutions, insurance companies, and debt collection companies that have signed a Participation Agreement with the Credit Bureau.

1.1.b. The obligation to provide data and the consequences of not complying with it

The provision of personal data is necessary for the purpose mentioned in point 1.1.a. The refusal of the data subjects to provide their personal data, necessary for the achievement of the above-mentioned purpose, will lead to the Bank's inability to fulfill its legal obligations related to the granting of the loan.

1.1.c. Categories of personal data processed in the Credit Bureau System

The data processed in the Credit Bureau System are:

identification data of the data subject: name, first name, personal numeric code, home/residence and correspondence address, landline/mobile phone number, date of birth, country code and passport series/number in the case of non-resident persons;
information regarding the employer: the name and address of the employer;
data related to requested/granted credit type products: the type and name of the Participant, type of product, product/account status, granting date, granting term, granted amounts, amounts owed, due date, currency, payment frequency, paid amount, monthly installment, overdue amounts, number of overdue installments, number of days of delay, delay category, product closing date;
date relating to events occurring during the term of the credit product , such as those relating to restructuring/refinancing, handing over in payment, assignment of the credit contract, assignment of the claim;
data related to relationships with other accounts: information regarding credit-type products for which the data subject is a co-borrower and/or guarantor;
data regarding insolvency: information regarding the targeted persons against whom an insolvency procedure has been opened;
number of queries: indicates the number of Credit Reports issued by the Credit Bureau, at the request of one or more Participants;

1.1.d Recipients of the data

Personal data registered in the Credit Bureau System are disclosed to the Participants in this system, upon request, for the purpose mentioned in point 1.1.a.

Personal data processed in the Credit Bureau System will not be disclosed to third parties, except for authorities and public institutions, according to their competencies and applicable legislation, such as the National Authority for the Supervision of Personal Data Processing, the National Bank of Romania, the National Integrity Authority, the courts, notaries public, judicial executors, criminal investigation bodies.

1.2. Processing of personal data in the records of Banca Transilvania S.A.

1.2.a. Legal basis and purpose of personal data processing

For the purpose of pre-offering and, as the case may be, analyzing a submitted credit request, in accordance with the need to carry out a responsible lending activity, besides processing personal data in the Credit Bureau S.A. system, the Bank processes such data in its own records based on the legal obligations it must comply with, the conclusion of the credit/guarantee/evaluation/insurance contract, based on its legitimate interest and, as the case may be, with the consent of the data subjects.

1.2.b. Obligation to provide data and the consequences of non-compliance thereof

Provision of personal data is necessary for the purpose of pre-offering/analyzing a credit application. Refusal to provide the data necessary to achieve this purpose will lead to the inability of Banca Transilvania S.A. to fulfill its legal obligations related to granting the credit, and the credit application will not be able to be analyzed.

1.2.c. Categories of personal data processed within Banca Transilvania S.A.

The personal data previously mentioned as being processed in the Credit Bureau system are processed by Banca Transilvania S.A. also in its own records. To these data are added information that the Bank learns as a result of verifying the persons concerned in its own records, as well as in public databases such as websites - the court portal, ONRC etc.

1.2.d.Existence of an automated decision-making process, including the creation of profiles made through the BT scoring application

In order to objectively verify the fulfillment of the eligibility conditions for pre-offering and, where appropriate, to analyze the credit application - BT processes in some cases, based on its legitimate interest, the personal data of credit applicants (natural persons and legal representatives of legal entities) as well as other natural persons participating in the credit application analysis stage in its own automated system ("BT scoring application").

In the BT scoring application, personal data, identification data, other data completed in the credit application, information resulting from checks carried out in the Bank's own records or in those of the Credit Bureau SA, such as whether the persons targeted by this processing receive income in an account opened at the Bank or are regular clients of the Bank, the level of monthly payment obligations, payment history in the case of other loans contracted from the Bank, etc., are entered and analyzed. Following the analysis of these data/information, the BT scoring application issues a score based on a profile of the debtor/potential debtor as a good or bad payer. The returned score thus determines the credit risk and the likelihood of timely future payment of installments.

Based on the score issued by the BT scoring application, which is complemented by the result of verifying the relevant personal situation in public databases such as websites - the courts portal, ONRC, etc. - the Bank determines whether the eligibility conditions established by its internal regulations are met and will make the decision to approve or reject the credit application, a decision that is based on the analysis carried out by the Bank’s employees (human intervention).

1.2.e At this stage of the lending process, applicants will be handed a form by signing which they can express their consent for the bank to consult the ANAF database, for a limited period - a maximum of 5 working days - regarding the income earned by them, considering that the level of the income earned is an essential element for establishing the compliance with the bank's lending conditions.

Also at this stage, for some types of credit products the Bank wishes to consult the records of the Credit Risk Central, in which case it will hand the credit applicant a dedicated consent form for completion and signature.

2. Processing of personal data on the occasion of concluding and during the course of a credit agreement concluded with the Bank

2.1. Legal basis and purpose of processing

For the conclusion and execution of credit contracts and, where applicable, guarantee/valuation/insurance contracts related thereto, the Bank processes the categories of personal data mentioned in this section at point 2.3, based on its legal obligations, the conclusion and execution of contracts, and on its legitimate interest

2.2. Obligation to provide data and the consequences of non-compliance

Providing personal data is necessary for the purpose of concluding and performing credit agreements and, where appropriate, their ancillary contracts (e.g., guarantees). The refusal of persons to process the personal data necessary to achieve the mentioned purpose will lead to the Bank's inability to offer you the requested credit.

2.3. Categories of processed personal data

Personal data processed by the Bank for the purpose mentioned in point 2.1 of this section are those used during the pre-offer/credit application analysis stage, to which other such data that have been completed and/or received on the occasion of/for the conclusion or during the credit and guarantee contract are added.

BT allocates to each of its clients a client code (Client Id) on the basis of which they are identified in the bank records, as well as an IBAN code corresponding to each cont (current, card, savings etc) opened in the client's name at the bank.

Also, for each of the the cards issued by BT to its clients, a unique number (PAN) is assigned, which BT inscribes on the card along with its expiration date, the cardholder's first and last name, and the CVV code (back). Based on the cardholders' agreement, there is a possibility of inscribing the IBAN code on the card as well.

Banca Transilvania constantly strives to offer its clients with whom it has entered into a business relationship online services and products, such as–internet banking service- with the BT24 variants, BT24 mobile or BT24 Invoices - the payment application of the digital wallet type - BT Pay, the chat bot “Livia from BT” accessible via Facebook, the Self Serv service reachable by phone. For the use of these services, it is necessary for the bank to process certain categories of personal data for the purpose of identifying persons as BT clients and, subsequently, as users of the services. These data are usually - name, surname, date of birth, client code, phone number.

A part of BT applications, which are accessible with the help of mobile devices (example: mobile BT24, BT Pay), may request their users, either at the time of installation or during their use, access to certain additional personal data such as, but not limited to: the camera (for example, for the option to scan invoice barcodes), location (within certain sections of the applications, for displaying nearby BT units and ATMs or for indicating stores of merchants registered in the Star BT loyalty program), contacts (only when accessing the Email/SMS/P2P payment option to automatically fill in beneficiary details), SMS (for automatically filling in SMS-OTP codes required within various application sections), phone status and identity (e.g., the phone's IMEI is required for activating the MBT24 mobile internet banking application), information regarding the existence or non-existence of a security method of the phone used within the applications.

Also, in the case of using online services, to ensure the security of the transactions made, the IP address of the device you are using will be processed in some situations. This data is requested and used strictly for the purpose of ensuring the security of the transactions and processed only for the strictly necessary period.

In order to provide certain banking services, such as, but not limited to internet and mobile banking - with the BT24 options, BT24 mobile or BT24 Invoices- SMS Alert, BT Alert, the bank will process the phone number communicated by clients for the purpose of providing the respective services.

Also, the phone number, email address, or home/residence/correspondence address provided by clients for conducting the business relationship will be processed by the bank for the purpose of Information to Clients regarding issues of interest related to the operation of contracted BT services/products, such as, but not limited to disruptions in the operation of certain services, the institution of garnishments on bank accounts, warnings about the expiration of bank cards issued by BT or identity documents, as well as for contacting them within the activity of debt collection.

In case of some “apply online” type services for various products/services/contests/events BT, available in the form of forms on the BT website and other websites controlled by the bank, we usually request the completion of the following personal data: last name, first name, phone number, and e-mail address, in order to contact applicants to provide them with answers/information regarding these requests.

Depending on the specifics of the product/service for which the application is made online, there are, however, situations when it is necessary to provide additional data, either those required by legal provisions, or those processed by BT on the basis of the legitimate interest to identify individuals in order to provide/render the requested products/services/information.

The data completed in these forms are processed by the bank for the purpose of providing the requested products/services/information, for the period necessary to fulfill these purposes, according to the bank's retention policies developed in accordance with the principles and obligations established by the applicable laws in the field of processing and protection of personal data.

BT will not collect or store the personal data of those who completed them online if they did not complete their registration.

Any person has the right to deposit cash amounts into accounts opened at BT, if the holders of these accounts have allowed such deposits to be made by third parties.

For the purpose of making such a deposit, the bank has the legal obligation to identify the payers based on their identity documents, and also to process a series of personal data of these - name, first name, identity document series and number, personal numeric code, address, details regarding the deposited amount, and explanations regarding the nature of the payment (what the payment represents).

In the cases provided by law, mentioned at point I of this section, for making the cash deposit the Bank must also make and keep in its records a copy of the identity document belonging to the occasional Client who makes the deposit

In case certain occasional Clients repeatedly present themselves at the bank's units to make cash deposits into accounts opened at BT, in order to streamline the bank's activity, respectively to reduce the waiting time in units, the bank has the legitimate interest to use their data collected on previous deposit occasions, in such a way that these will be pre-filled in the cash deposit receipt form. The external depositors' data will not be processed for other purposes, will be accessed only by personnel who need to know them, and will be kept only for the periods provided in the internal retention policies and within the normative acts that contain provisions regarding this aspect.

Any person has the possibility to address requests to the bank, to request the provision of information/taking of certain measures or can send complaints/claims through various channels such as – by sending/submitting written complaints at the bank's headquarters or its territorial units, by calling the BT call center phone number or any other phone number allocated to BT units, by sending messages to the email addresses provided to customers or to the email addresses of the bank's employees, by sending electronic messages within the secure BT24 internet banking platform, by filling out dedicated forms on the BT website or on other websites controlled by the bank - for the list of all BT websites enterhere.

In order to identify the requesting persons, to analyze the reported situation and to respond to these requests for information/notifications/complaints, the bank processes a series of personal data - name, first name, phone number, email or correspondence address from which the request was received, other personal data provided within the messages or which is necessary to be processed in order to formulate the responses/provide the requested information.

In order to prove that these complaints/claims/requests for information/measures have been received, as well as for quality control of the responses/information/actions sent/taken by the bank, and for the purpose of quality control of support services, the received messages will be kept in BT's records both in the format in which they were received and in electronic format, and phone calls will be recorded and kept for the duration of the business relationship for BT clients, respectively for the period necessary to fulfill the purpose for which they were processed (formulation of the response/provision of information), plus a period of 3 years - the legal limitation period in case the data does not belong to persons with whom the bank has established a business relationship.

According to the provisions of Law no. 333/2003 regarding the guarding of objectives, goods, valuables and the protection of persons, with subsequent amendments and completions and of Decision no. 301 of April 11, 2012 for the approval of the Methodological Norms of Law no. 333/2003 regarding the guarding of objectives, goods, valuables and the protection of persons, BT has the legal obligation to video monitor the ATM area, as well as the access ways areas, the corridors and other high-risk areas.

Under its legitimate interest, the bank intends to monitor video and other public areas accessible to the public that present a potential security risk for people/spaces or assets.

Video surveillance activity involves processing the images of individuals, and the places where the cameras are installed are appropriately marked with a specific and visible notice accompanied by an icon.

The video surveillance system is not used for any purpose other than the one mentioned, it is not used to monitor the activities of the public, employees, or for timekeeping. Also, the system is not a means of investigation or obtaining information for internal inquiries or disciplinary procedures, except in situations where a physical security incident occurs or criminal behavior is observed (in exceptional circumstances the images may be transferred to investigative bodies as part of a disciplinary or criminal investigation).

The system can record any movement detected by the cameras installed in the monitored area, along with date, time, and location. All cameras are operational 24 hours, 7 days a week. When necessary, the image quality allows for the recognition of individuals passing through the cameras' field of view. Video recordings are stored in the bank's internal records.

Besides image processing within video surveillance activities, to allow visitors' access to certain spaces where the bank operates, the security staff will identify the visiting persons based on their identity documents, and the names, surnames, series, and numbers of the identity documents of these persons will be recorded in special registers and kept in written format for the legally established period.

BT wishes to inform interested persons about the products/services/events offered/organized by the bank, by the entities within the BT Financial Group or by their partners, in this sense processing the personal data of these persons, if they have expressed their consent to receive such advertising messages by completing the dedicated form, accessible in any bank unit and on the website.

The data processed by BT for the purpose of sending advertising messages are the name, surname, phone number and/or email address or correspondence address provided by the persons interested in receiving advertising messages.

Advertising messages will be sent through one or more of the following channels: SMS, phone call, email address, postal correspondence address, or internet/mobile banking – BT24 (for clients who have contracted this service).

In some cases, for the transmission of advertising messages on these channels, BT will contract service providers, who will process the personal data of individuals on behalf of and for BT, only for the transmission of advertising messages established in strict accordance with BT's instructions and under the close supervision of the Bank.

The individuals who wish can opt to receive advertising messages from several categories, among which we list: products and services of BT, products and services of BT subsidiaries, events organized by BT, products/services of partners, which are related to products/services of BT or BT subsidiaries, and events organized by BT partners.

BT subsidiaries whose products/services and events are intended to be promoted within advertising messages sent to persons who have opted for this are the following entities within the Financial Group Banca Transilvania

BT Microfinancing IFN SA ( "BT Mic")
BT Asset Management S.A.I. S.A., ( "BTAM")
BT Leasing Transilvania IFN S.A. ("BTL")
BT Direct IFN S.A. ("BTD")
BT Capital Partners S.S.I.F. S.A.(„BTCP”)
alte entitățand those who can haveăthe shift of this group in the future

Persons who wish to receive advertising messages about products/services/events of the bank's partners or subsidiaries related to BT's services/products can also opt for this purpose on the dedicated form for expressing marketing consent.
List of current BT partners categories and/or BT subsidiaries is accessible at the link https://www.bancatransilvania.ro//Partners_BT_Privacy_Policy_25.05.2018-30.07.2019_Version_1.pdf or in any BT unit or BT subsidiaries.

In case you opted to receive advertising messages about products/services and events offered/organized by BT subsidiaries or by partners, these entities will process personal data for the purpose of sending these messages, under the careful supervision and coordination of the Bank. For any eventual processing of personal data carried out by BT partners/BT subsidiaries outside or adjacent to the sending of advertising messages, such as, for example, for the conclusion of contracts related to their promoted products/services, these partners will act as controllers of the processed personal data.

In case BT or its subsidiaries already hold certain personal data of persons who wish to receive advertising messages, based on the express consent of the persons concerned, these data may be automatically processed for the creation of profiles (taking into account criteria such as age, location, income range, BT products or BT subsidiaries' products used) in order to send personalized proposals. In the situation where the persons concerned do not express their express consent to receive personalized advertising messages, they will only be sent information about general offers addressed to the general public. Expressing a disagreement to receive personalized messages does not result in the impossibility of obtaining a personalized offer, upon request of the interested persons, according to their needs, which can be brought to the attention of one of the bank employees within BT units or BT subsidiaries.

Personal data collected for profile creation in order to send personalized advertising messages will be processed by BT, as applicable, until the purpose detailed in the previous paragraphs is fulfilled or until the consent given in this regard is withdrawn.

The consent to receive advertising messages can be withdrawn or modified through the following methods:

sending a request in this regard to the BT headquarters in Cluj-Napoca city, G. Barițiu street, no. 8, Cluj county, with the mention "to the attention of the person responsible for the protection of personal data";
by message sent to the e-mail address dpo@btrl.ro;
by accessing the dedicated section on the BT website - www.bancatransilvania.ro - "unsubscribe/change advertising message," which can also be found at the following link www.bancatransilvania.ro/data-processing-agreement;

In certain specific cases, with strict respect for the rights and freedoms of individuals, Banca Transilvania will process personal data for the purpose of sending advertising messages based on its legitimate interest in promoting the products and services it offers.

BT is one of the companies with the largest number of employees in Romania, and announcements about various vacant positions in the bank are posted on recruitment websites. Persons who access these sites and apply for specific available positions in BT or the "careers" section on the website www.bancatransilvania.ro, will be directed to the secure recruitment platform used by Banca Transilvania.

Within this platform, whether they want to apply for only a specific position, or if they prefer the bank to be able to contact them for various available positions within the company, candidates will be required to create an account, entering their last name, first name, a phone number, and an email address where they can be contacted for recruitment purposes and to upload at least their CV.

In case it will apply only for a certain position accessed, the candidate's personal data will be processed by the bank only within the recruitment process for the respective position, following that these and the account created on the platform will be deleted at the completion of the recruitment process for the respective position.

If, on the other hand, the candidate chooses to be contacted generally for vacant positions in BT, it will be necessary to select a series of predefined criteria in the platform, based on which we will notify him about the availability of positions that match. In this case, the candidate's data will be kept for recruitment purposes for a period of 1 year from the moment of registering this option.

The same retention period applies also in the case when CVs have been handed over/transmitted to the Bank by candidates through any other channels.

After the mentioned deadline expires, BT will anonymize the personal data collected for recruitment purposes, and they will only be used for generating statistical reports for the internal use of the bank. Once these records become anonymous, they can no longer identify the person to whom they belong.

Within the recruitment process, references from the candidates' previous employers may become relevant. If the bank needs these, it will contact the candidate to request their consent to obtain them on their behalf. In the event that the candidate does not express their consent in this regard, they will need to obtain these references themselves if they wish to continue the recruitment process.

The candidate has the option to delete at any time the account created within the BT recruitment platform, which will be equivalent to withdrawing his consent for the bank to further process his personal data for recruitment purposes. From the moment the account is deleted on the platform, only the candidate will be able to access his recorded data, not BT.

In case the bank receives CVs or job applications through channels other than the recruitment platform mentioned above, it will retain this data for the same time periods mentioned above, respectively until the end of the recruitment process for the chosen position, or, if applicable, for a period of 6 months, which may be extended at the candidate's request, if they wish to apply for various positions available within the company.

Outside the purposes detailed within the previous sections, Banca Transilvania processes personal data for other purposes as well, such as:

carrying out analyses and keeping records of economic, financial and/or administrative management in the Bank;
administration within the internal departments of the services and products offered by the bank;
evaluation and monitoring of the financial-commercial behavior of Clients during the course of the business relationship with the Bank;
creating or analyzing profiles for the improvement of BT products/services or those of entities in the BT Group;
analyzing the behavior of website users through the use of cookies, both BT's and third parties', in order to provide general or personalized content, offers tailored to users' interests (details in the Cookie Policy);
carrying out internal analyses (including statistical), both with regard to products/services and with regard to the customer portfolio, for the improvement and development of products/services, as well as carrying out studies and market analyses regarding the Bank's products/services;
calculating the commissions to which employees acting within the BT sales force are entitled;
archiving both in physical and electronic format of the documents, providing registry services for the correspondence addressed to BT and sent by it, as well as performing courier activities;
resolution of disputes, investigations or any other petitions/complaints/requests in which BT is involved;
the risk control of BT procedures and processes, as well as the conduct of audit activities or investigations;
the preparation and transmission of reports to the competent institutions to receive them in accordance with the applicable legal provisions BT (e.g.: reports on payment incidents to the Payment Incident Center within the BNR, declaration of transactions exceeding the amount established by law to the National Office for the Prevention and Control of Money Laundering);
for monitoring clients' activity in order to detect unusual transactions and suspicious transactions;

G. To whom does Banca Transilvania disclose the personal data that it processes?

Personal data of the Bank's Clients are disclosed or, as the case may be, transferred, in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and security of the data, to categories of recipients, such as, but not limited to:

branches, agencies, offices, representations of the Bank,
entities within the BT Financial Group mentioned in this policy or on the BT website and others that may join the BT Group in the future
Service providers used by the Bank for: IT services (maintenance, software development), archiving in physical and/or electronic format; courier; audit; services related to card issuance and their enrollment in platforms; market study/research services, advertising message transmission services, monitoring of traffic and user behavior of online tools, marketing services through social media resources, etc;
processing of interbank payments and transmission of information regarding interbank operations (e.g., Transfond, Society for Worldwide Interbank Financial Telecommunication - SWIFT);
authorities and public institutions (such as, but not limited to BNR, ANAF*, police, National Office for the Prevention and Control of Money Laundering**),
companies (funds) guaranteeing various types of credit/deposit products (e.g. FNGCIMM, FGDB etc),
ONRC, OCPI, AEGRM, public notaries, lawyers, bailiffs;
Credit Risk Center***;
Credit Bureau and Participants in the Credit Bureau System****;
insurance companies;
evaluation companies;
companies for collecting outstanding debts or claims;
entities to which the Bank has outsourced the provision of financial-banking services;
partners of the Bank;
international payment organizations (e.g. Visa, Mastercard);
banking institutions or state authorities, including from outside the European Economic Area - in the case of international SWIFT transfers or as a result of processing carried out for the purpose of applying FATCA and CRS legislation, social network providers, debt recovery and/or collection service providers, appraisers, real estate agencies.

*According to the provisions of the Fiscal Procedure Code (Law 207/2015), in its capacity as a credit institution, BT has the legal obligation to communicate daily to the central fiscal authority – A.N.A.F. – the list of account holders who are natural persons, legal entities, or any other entities without legal personality that open or close accounts, as well as the identification data of the persons entitled to sign for the accounts opened with them, the list of persons who rent safe deposit boxes, as well as the termination of the rental contract. A.N.A.F. may communicate this data to local fiscal authorities or other central and local public authorities, according to the law.

**In case the conditions for transmission by BT of personal data to the National Office for Prevention and Control of Money Laundering are met, according to Law no. 656/2002 for the prevention and sanctioning of money laundering, as well as for the establishment of measures to prevent and combat the financing of terrorism, republished, with subsequent amendments, these are transmitted simultaneously and in the same format to A.N.A.F.

***The bank has the legal obligation to report to the Credit Risk Center (CRC) the credit risk information for each debtor who meets the reporting condition (includes identification data of a debtor, natural person or non-bank legal entity, and the operations in lei and foreign currency through which the bank is exposed to risk towards that debtor), respectively to have recorded an individual risk towards this debtor, as well as information about detected card frauds.

****The bank has the legitimate interest to report in the Credit Bureau System, which is also accessed by other Participants (mainly credit institutions and non-banking financial institutions) your personal data in case you register delays in credit payment of at least 30 days, after prior notification of the persons concerned in this regard at least 15 days before the reporting date.

In order to provide banking services that are the subject of the contracts concluded between the Client and the Bank, the latter will transfer personal data abroad, as appropriate, including to countries that do not ensure an adequate level of protection of these data. The initiation by the Client of operations such as payment orders represents their consent for the transfer of their personal data by the Bank to the respective countries. Countries that do not ensure an adequate level of protection are countries outside the European Union/the European Economic Area, except for countries to which the European Commission has recognized an adequate level of protection, namely: Andorra, Argentina, Canada, Switzerland, the Faroe Islands, Guernsey, Israel, the Isle of Man, Jersey, New Zealand, Uruguay (to the extent that no contrary decision will be issued regarding any of these countries).

H. How long does BT process personal data?

For the fulfillment of the purposes presented within this Policy, personal data will be processed by BT throughout the contractual relationship with the data subjects and after its termination in order to comply with applicable legal obligations, including those related to archiving.

Personal data completed in the credit application and those processed for client knowledge for the purpose of preventing and sanctioning money laundering and combating terrorism are stored in BT records for a period of 3 years from the date of signing the credit application, in case it is rejected, and, respectively, for a period of 5 years starting from the date of termination of the credit relationship, in case a credit contract is concluded following the approval of the credit application.

Regarding the data processed within BT's activity in the Credit Bureau system, these are stored at the level of this institution and disclosed to Participants for 4 years from the date of updating, except for the data of credit applicants who have withdrawn the credit application or to whom the credit was not granted, which are stored and disclosed to Participants for a period of 6 months.

Personal data for which BT has the legal obligation to report to the Credit Risk Center (CRC) will be maintained in the CRC records for a period of 7 years from the date the credit is registered.

The agreements for consulting the ANAF database will be kept in the Bank's records for a period of 10 years from their signing - if the loan application was rejected - and respectively for 5 years from the termination of the lending relationship, but no less than 10 years from the date of signing the agreement - in the case where the loan application was approved and a lending contract was concluded. Upon request, these agreements shall be made available to ANAF, upon request.

For the data processed based on the consent of the data subjects for the purpose of sending advertising messages, they will be processed until the termination of the business relationship with the Bank or, as the case may be, until the withdrawal of the respective consent.

In order to prove the fact that notifications/complaints/requests for information/measures have been received and that responses have been formulated to these, including for the quality control of the responses provided by BT, messages of this type received on any channel will be kept in BT's records both in paper and electronic format, for the duration of the business relationship for BT's clients, respectively for a period necessary to fulfill the purpose for which they were processed (formulating the response/providing information), plus a period of 3 years - the legal statute of limitations in case the data does not belong to persons with whom BT has an established business relationship.

The personal data processed for recruitment purposes will be kept by BT until the end of the recruitment process for the available position. If the data subjects wish to be contacted for multiple positions that would suit them, the data from CVs and other documents they have provided to BT for this purpose will be kept for a period of up to 1 year, unless they request their deletion from the Bank's records within this timeframe.

The storage duration of data obtained through the video surveillance system is proportional to the purpose for which the data is processed, and does not exceed 30 days, the period after which recordings are deleted automatically, in the order in which they were recorded. In the event of a security incident, the retention period of relevant filmed material may exceed the normal limits depending on the time required for further investigation of the security incident.

Any other personal data processed by BT for other indicated purposes will be kept for the period necessary to fulfill the purposes for which they were collected, to which non-excessive terms may be added, established in accordance with the applicable legal obligations in the field, including but not limited to the provisions regarding archiving.

I. What are the rights that the data subjects can exercise regarding the personal data processed by Banca Transilvania?

Any data subject has the following rights regarding the processing of their personal data by BT.

a. The right to be informed:

It means the right of the data subjects to receive from BT clear, transparent information, written in language that is easy to understand, regarding the way BT uses personal data, as well as about the rights they have. BT intends to fulfill this information obligation through the details provided in this document, as well as through other information notes inserted within the forms and contracts used in its activity

b. The right of access:

The data subjects have the right to access personal data, namely to obtain confirmation that BT processes or does not process their personal data, as well as a copy of them, so that they have the possibility to verify whether they are processed by BT in accordance with the provisions of the legislation in this field.

c. The right to rectification:

The data subjects have the right to have their personal data corrected if they are found in BT records in erroneous format, if they are inaccurate or incomplete

d. The right to data deletion

This right is also called the "right to be forgotten". On its basis, data subjects can request the deletion of their personal data processed by BT, in case there is no longer a basis for their processing

e. The right to restriction of processing:

Targeted persons may, in some cases, stop BT's use of their data for a certain period of time. When the processing of these data is restricted, the personal data will still be kept in BT's records, but will no longer be used during this period and will be marked as restricted from processing.

f. The right to data portability:

The data subjects have the right to obtain from BT, in a format that can be read automatically, the data they have provided to us or they can request us to transfer this data to another operator chosen by them

g. The right to objection:

Data subjects can object to certain processing of personal data concerning them, such as processing for the purpose of receiving advertising messages.

h. The right of the data subjects to address the National Authority for the Supervision of Personal Data Processing (ANSPDCP) and the judiciary.

On the basis of this right, the concerned persons may address ANSPDCP or the courts with requests/petitions regarding the processing of their personal data by BT

The ways in which the data subjects can exercise the rights mentioned in points 2-7 above are:

by sending by mail a written request to the BT headquarters in Cluj-Napoca Municipality, G. Baritiu street, no. 8, Cluj county, with the mention - "attention to the person responsible for data protection (DPO)" or
by electronic means to the e-mail address dpo@btrl.ro.

Also, for the data processed by BT in the Credit Bureau System, as provided in this policy, the data subjects of this processing may exercise their rights of access and restriction mentioned above, also at Credit Bureau S.A., as follows:

by a written, signed request, sent by mail to the Credit Bureau, or
by securely accessing the Credit Bureau website (www.birouldecredit.ro).

The persons concerned by the processing of their personal data in the Credit Bureau System also have the right to obtain, upon request, at the time of communication of the credit decision, a copy of the Credit Report issued by the Credit Bureau, which was used by BT in the analysis of the credit application.

J. How does BT protect the personal data it processes?

BT develops an internal framework of standards and policies to maintain the security of personal data. These are periodically updated to comply with the regulations applicable to the Bank and the highest standards in the field.

Specifically and according to the law, we take appropriate technical and organizational measures (policies and procedures, IT security, etc.) to ensure the confidentiality and integrity of personal data and the way they are processed.

BT employees are obliged to maintain confidentiality and cannot disclose personal data that they process within their activity.

We ensure that our contractual partners who have access to the personal data we process are imposed contractual obligations in accordance with legal provisions and that we verify their compliance with the obligations they have assumed. They will process personal data on behalf of and for BTD, only in accordance with the instructions received from it and only respecting the security and confidentiality requirements within the imposed limits.

We guarantee that BT will not sell the personal data collected from the visited persons and that it will only transmit this data to those entitled to know them, in compliance with the principles and obligations established by law.

We draw the attention of BT website visitors that these may contain links to websites whose privacy/personal data processing policy is different from that of BT. If you send personal data to any of these sites, your information falls under their privacy/personal data processing statement. BT's policy regarding the processing and protection of personal data does not apply to the information provided on those websites. In this regard, we recommend that you carefully read the privacy policy of any website you visit.

The present policy is regularly reviewed to guarantee the rights of the persons concerned and to improve the methods of processing and protection of the personal data processed.