Processing and protection policy of personal data

Transilvania Bank S.A. Policy regarding the processing and protection of personal data within banking activities ("BT Privacy Policy")

Version applicable starting from the date 09.05.2025

Current version of the policy Download Previous version of the policy (valid until 05/09/2025) Download Previous version of the policy (valid until 17.03.2025) Download Previous version of the policy (valid until 23.10.2023) Download Previous versions of the Privacy Policies Download

About this Privacy Policy and our commitments

Banca Transilvania S.A. (from now on and “BT”, “Bank” or "we") undertakes to process personal data (hereinafter also personal data or date) of all natural persons with whom they interact (hereinafter also “targeted persons”), in accordance with the applicable legal provisions and with the highest standards of security and confidentiality, to respect the fundamental human rights and freedoms in connection with this processing and to periodically assess its activity in this field, to ensure that these rights are always respected.

To guide and support us in our activity in the field of processing and protection of personal data, we have appointed a data protection officer (“DPO”). The BT DPO can be contacted by any data subject, at any of the following contact details:

e-mail address dpo@btrl.ro
the BT headquarters in Cluj-Napoca city, Calea Dorobanților street, no. 30-36, Cluj county, with the mention "to the attention of the person responsible for personal data protection"

We present below Our policy in this very important field (hereinafter also “Politics”), which we commit to review periodically, in order to continuously improve it, and to inform the data subjects about the substantial changes made to it.

Through this Policy, we fulfill towards all categories of data subjects whose personal data we process as a controller the obligation to inform in accordance with Articles 13-14 of EU Regulation No. 679/2016 or the General Data Protection Regulation (“GDPR”).

Whenever we can directly inform the data subjects about the processing of their data, we undertake to proceed accordingly. In cases where we either do not have the objective possibility or it would involve a disproportionate effort to directly fulfill this obligation, we inform the data subjects through this Privacy Policy.

If you are a regular client of the bank (hereinafter also “BT Client” or “Client”), to find out how we process your personal data only in this capacity, you also have the separate information available: General information note on the processing and protection of personal data belonging to BT Clients, which is an integral part of this Policy.

You can find the General Policy and Information Note for Clients both on the website www.bancatransilvania.ro (from now on and “the BT website”), including in the section Privacy Hub from this website, as well as in BT units.

Also, for certain services/products/activities of processing personal data that we carry out, we have prepared specific information notes, which you can find on the BT website in the section Privacy Hub.

The present Policy does not refer to the processing carried out by BT regarding the personal data of its employees. They are informed about the processing of their data carried out by BT as an employer through a separate document.

We present below what categories of personal data we process, who the data subjects of this processing are, for what purposes we use this data, to whom we may disclose or transfer it, how long we keep it, how we ensure their security, as well as what rights the data subjects can exercise in relation to this processing.

If you are not familiar with the meaning of the different specialized terms used in the GDPR or in the applicable legislation in the banking field, we recommend that you also study the following section, regarding:

A. Specialized terms used in Politics

When using in this Policy the terms below, they will have the following meaning:

a) "Personal data" or personal data or date means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identification element, such as a name, an identification number, location data, an online identifier, or to one or more specific elements inherent to his or her physical, physiological, genetic, mental, economic, cultural or social identity;

b) "Processing of personal data" or "data processing" means any operation or set of operations performed on personal data or on sets of personal data, with or without the use of automated means, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or making available in any other way, alignment or combination, restriction, deletion or destruction;

c)„GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;

d) "BT Financial Group" or "BT Group" means the Bank together with entities controlled by it (subsidiaries/affiliates BT) such as, BT Microfinance IFN SA ("BT Mic"), BT Asset Management S.A.I. S.A., ( „BTAM”), BT Leasing Transilvania IFN S.A. („BTL”), BT Direct IFN S.A. ("BTD"), BT Capital Partners S.S.I.F. S.A.("BTCP"),BT Pensii Voluntary Pension Fund Management Company SA(BT Pensions), Salt Bank, Victoriabank, BT Leasing Moldova, BT Code Crafters SRL (“BT Code Crafters”), BT Insurance Broker Ltd., Inno Investments S.A.I. S.A., Improvement Credit Collection SRL(“ICC”), BT Building S.R.L., BT Investments S.R.L., Romanian Entrepreneur Club Foundation (“BT Club”), Clujul has a Soul Foundation and other entities that may join this group in the future;

e)Operator means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union (EU) law or the law of a Member State, the controller or the specific criteria for its designation may be provided for by Union law or by the law of the Member State;

In this Policy, when we use the term "operator" we generally refer to Banca Transilvania - when the bank processes personal data for purposes established by itself or by the legislation applicable to it - or, as the case may be, to Banca Transilvania and entities that are operators associated with the bank for certain personal data processing operations, when the purposes and means of processing have been jointly established by us and these entities;

f) „Data subject”means any natural person whose personal data are processed Also included in the category of data subjects are entities such as authorized natural persons (A.N.P.), individual enterprises (I.E.), individual forms of practicing certain liberal professions – “professionals,” such as: individual medical offices, lawyer, notary, judicial executor, accountant, authorized translator, etc;

Legal entities are not, as a rule, included in the category of "data subjects" and information about them is usually not personal data.

g) „Person authorized by the operator” means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

h) „Third party” means a natural or legal person, public authority, agency or other body, other than the data subject, the controller, the processor authorized by the controller and who, under the direct authority of the controller or the processor authorized by the controller, are authorized to process personal data;

i) "Addressee" means the natural or legal person, public authority, agency or another body to which personal data are disclosed, regardless of whether it is a third party or not. However, public authorities to which personal data can be communicated in the context of a specific investigation pursuant to EU law or the law of a Member State of the EU are not considered recipients;

j)"Supervisory Authority” means an independent public authority established by an EU member state, responsible for monitoring the application of the GDPR. In Romania, the supervisory authority is the National Authority for the Supervision of Personal Data Processing – "N.A.S.P.D.P.";

k) „Biometric data means personal data resulting from specific processing techniques related to the physical, physiological, or behavioral characteristics of an individual that allow or confirm the unique identification of that individual, such as facial images or fingerprint data subjected to such techniques;

l) „Health data” means personal data related to the physical or mental health of a natural person, including the provision of medical assistance services, which disclose information about their health status;

m) „Real beneficiary” according to the provisions of art. 4 para. 1 of Law no. 129/2019 for preventing and combating money laundering and financing of terrorism, as well as for amending and supplementing certain normative acts, means any natural person who ultimately owns or controls the client and/or the natural person on whose behalf a transaction, operation or activity is carried out and includes at least the categories of natural persons mentioned in art. 4 para. 2 of this normative act;

n) „Publicly exposed person”– “PEP” - according to the provisions of art. 3 para. 1 of Law no. 129/2019 for the prevention and combating of money laundering and terrorist financing, as well as for the amendment and completion of certain normative acts, is considered the natural person who exercises or has exercised important public functions and includes at least the categories of natural persons mentioned in art. 3 para. 2 of this normative act. Family members of a PEP (defined in art. 3 para. 4 of Law 129/2019), as well as persons known as close associates of a PEP (defined in art. 3 para. 5 of Law 129/2019) are assimilated to PEPs from the point of view of the bank's obligation to apply customer due diligence measures.

B. Who is Banca Transilvania?

BANCA TRANSILVANIA S.A. is a credit institution, Romanian legal entity, registered at the Cluj Trade Registry Office under number J1993004155124, having the unique registration code no. RO5022670 and the following contact details: head office address Str. Calea Dorobanților No. 30-36, postal code 400117, city Cluj-Napoca, Cluj County, Romania Tel: 0801 01 0128 (BT) - available from the Romtelecom network, 0264 308 028 (BT) - callable from any network, including international, *8028 (BT) - callable from Vodafone and Orange networks, e-mail address: contact@bancatransilvania.ro, website www.bancatransilvania.ro.

Banca Transilvania S.A. is the parent company of the BT Financial Group.

The provisions of this Policy refer to the processing of personal data carried out by BT as a data controller.

As part of certain activities, we process personal data together with other entities, as joint controllers. Find details about this processing in the specific information notes in the section Privacy Hub from the BT website.

C. What personal data do we process, who do they belong to and what do we use them for

Banca Transilvania processes different categories of personal data. The data processed and the purposes for which we process them depend on the capacity that the data subject has in relation to us when it is necessary to process those data.

With regard to the capacity you have in relation to us in a certain context, we present below how we process your personal data:

a. Who is the BT Client?

„Client BT” or ”Client” is the natural person who belongs to any of the following categories of targeted persons:

residents/ non-residents, holders of at least one current account opened at the Bank (also called “individual account holder client”) or who rent safety deposit boxes at BT;
legal or conventional representatives of Clients, natural or legal persons, account holders or who have rented safety deposit boxes;
persons with operating rights on the accounts of individual or legal entity clients account holders (“authorized on the account”);
the real beneficiaries of Clients, natural or legal persons holding accounts opened at BT (“real beneficiary”);
persons entitled to submit bank documents, to withdraw account statements and/or to deposit cash on behalf of and for the account of the individual or legal entity Clients account holders (“delegates”);
associates/shareholders of BT Clients Corporate clients;
users of a bank product/service who do not have any of the qualities mentioned above but usually use some BT products/services (e.g. supplementary card users, managers with guarantee management accounts opened at the bank, BT meal voucher users, BT Pay users);
guarantors of any kind of the payment obligations assumed by individual or legal entity Clients account holders;
persons who sign requests on the bank's dedicated forms to become Clients, but this request is rejected or abandoned (even if these persons are not active BT Clients, we are legally obliged to keep their personal data for a certain period of time);
legal or conventional successors of those mentioned above.

We remind you that complete details, in printable format, about the processing of data of the bank's regular customers – BT Customers – can also be found in General information note regarding the processing and protection of personal data belonging to BT Clients.

b. The purposes for which we process BT Clients' data

As a BT Client, we process your data, depending on the situation, for:

application of measures regarding customer due diligence for the prevention of money laundering and terrorist financing. Details in specific information note from Privacy Hub;
solvency assessment, reduction of credit risk, determination of the indebtedness degree of Clients interested in personalized offers related to the bank's credit products or in contracting these types of products (credit risk analysis), including through data processing in the Credit Bureau system. Details in specific information note from Privacy Hub;
concluding and executing contracts for the products/services offered to BT clients (such as, but not limited to: cards, deposits, loans, internet and mobile banking, BT Pay, SMS Alert); Details about the processing of personal data for certain BT products/services can be found in the specific information notes on Privacy Hub;
conclusion and execution of contracts for occasional transactions, (see section C point 2 of the Privacy Policy when making occasional transactions, even if you are also a regular client of BT);
processing/settlement of bank transactions;
establishment of garnishments, recording the garnished amounts at the disposal of creditors and providing responses regarding these to the enforcement bodies and/or competent authorities, according to the bank's legal obligations;
reports to the competent authorities, according to the bank's legal obligations (e.g. reports to the National Agency for Fiscal Administration – N.A.F.A., the National Bank of Romania – N.B.R. - including to the National Office for the Prevention and Control of Money Laundering, the Credit Risk Center, and the Payment Incidents Center within the N.B.R. etc);
carrying out analyses and keeping records of economic, financial and/or administrative management of the bank;
administration within internal departments of the services and products offered by the bank, as well as human resource management;
collection of receivables and debt recovery;
the legal defense of the bank's rights and interests, the resolution of disputes, investigations or any other petitions/complaints/requests in which the bank is involved;
performing risk checks on the bank's procedures and processes, as well as carrying out audit or investigation activities, including for the prevention and management of conflicts of interest;
taking measures/providing information or responses to requests/notifications/complaints of any nature addressed to the bank by any person, including by authorities or institutions;
proving the requests/agreements/options regarding certain requested/discussed/agreed aspects within telephone calls initiated by Clients or by the bank, by recording the discussed aspects and, as appropriate, the audio recording of telephone conversations or, as appropriate, audio-video;
informing Customers about the products/services held at the bank, for the proper execution of the contractual relationship (carried out, as appropriate, by sending messages of general or particular interest addressed to Customers such as, but not limited to: sending account/card statements, transaction reports, notifications regarding the insertion of garnishments on accounts, notifications about the existence of unauthorized debts or overdue loan payments, notifications about the approaching expiry date of a certain product/service held, notifications about improvements or new facilities offered in connection with the product/service held, about changes to the general business conditions or the general information note regarding the processing of personal data, about the need to update data, etc.);
the transmission of advertising messages/commercial communications to Clients who have given their consent to the processing of their personal data for this purpose;
evaluation/improvement of service quality (requesting/collecting Clients' opinions regarding the quality of services/products/BT employees);
financial education of Clients;
carrying out internal analyses (including statistical ones), both regarding products/services, as well as regarding the portfolio and the profile of Clients, conducting market studies, analyses of Clients' opinions regarding the bank's products/services/employees;
development and testing of BT products/services;
archiving in physical/electronic format of documents/information, including backup copies;
performing registry/secretarial services regarding correspondence addressed to the bank and/or sent by it;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
monitoring the security of BT persons/areas/goods and of visitors to BT units/equipment. Details about data processing for this purpose can be found in specific information note regarding video surveillance and in specific information note regarding visits to some BT offices from section Privacy Hub.
fraud prevention;

c. What personal data do we process from BT Clients

BT clients’ personal data categories are processed, as appropriate, as follows:

identification data: surname, first name, pseudonym (if applicable), date and place of birth, personal numerical code (C.N.P.) or another similar unique identification element (e.g. CUI for authorized natural persons or CIF for natural persons practicing liberal professions), other details from the identity card/passport, as well as copies of these documents, signature (handwritten or electronic), citizenship, domicile address, residence, as well as the address where the Client lives and its legal status;
contact details: phone number, e-mail and correspondence address, fax;
financial data (such as, but not limited to data about transactions, data related to payment behavior, data about accounts and financial/banking products, held/realized at BT or other financial institutions);
tax dates (e.g. country of tax residence, tax identification number);
professional data (e.g. profession, occupation, position, name of the employer or nature of own activity, education level, specialization, information about the public office held, if you are a politically exposed person (PEP), capacity, holdings and, where appropriate, powers of representation held within legal entities);
information about the family situation (e.g. marital status, matrimonial regime, number of dependents, kinship relationships, marriage, cohabitation);
information about the economic and financial situation (e.g. data about income, data regarding owned/possessed assets, source of wealth – if you are a PEP);
data about the BT products and services requested/used (e.g. information about the purpose and nature of the business relationship, the source/destination of funds used within the contractual relationship/transactions, the type of products/services, the contractual period, other details related to products/services, including, for credit products: type of product, term of granting, granting date, due date, amounts and credits granted, amounts owed, account status, account closing date, credit currency, payment frequency, amount paid, monthly rate, name and address of employer, amounts owed, outstanding amounts, number of outstanding installments, due date of the arrears, number of days of delay in credit repayment. Data about credit products is processed both in the bank's records and - as the case may be - in the Credit Bureau's records and/or in other records/systems of this type);
the image (contained in identity documents or captured by video surveillance cameras, as well as the image from video recordings);
the voice in conversations and recordings of telephone or audio/video conversations (initiated by Clients or by the bank);
biometric data (e.g. facial recognition, used in remote identification processes through video means, within the methods of unlocking devices on which you have installed bank applications, if you have set methods such as facial recognition or fingerprint-based – in this latter case BT does not have access to biometric data, but only relies on them to allow you to access/use certain BT applications);
age, for verifying the eligibility to contract certain products/services/offers of the bank (e.g. credit products, products dedicated to minors, etc.);
opinions, expressed within notifications/complaints/conversations, including telephone ones, regarding products/services/employees of the bank;
identifiers allocated by BT or by other financial-banking or non-banking institutions, such as, but not limited to: BT client code (BT CIF), references/identifiers of transactions, IBAN codes of bank accounts, debit/credit card numbers, contract numbers, identifiers allocated by the bank to Clients classified as "non-residents", formed from a sequence of digits referring to the year, month, day of birth and the identity document number, whole or truncated, IP addresses, device identifiers (e.g. mobile phones) and the operating system of the devices used to access mobile banking services/mobile payment applications;
data regarding health status, in case such information is provided to us within the documentation submitted to the bank, results from transactions or if their processing is necessary for the proof by Clients of the difficult situation they or their family members are in, especially for the purpose of granting facilities on credit products;
information regarding fraudulent or potentially fraudulent activity;
information regarding the location of certain transactions (implicitly, in the case of operations carried out on BT equipment belonging to Banca Transilvania);
any other personal data belonging to the Clients, which are brought to our attention in various contexts by other Clients or by any other persons.

a. Who we process your data as an occasional BT Client / in what situations

“Occasional BT client” is the natural person who carries out at the counters or through BT equipment transactions of the following types:

cash deposits in BT accounts for which they have no capacity;
currency exchanges;
money transfers via Western Union (WU);
payment of amounts in cash to legal entities with which BT has concluded agreements for collecting these amounts (e.g. utility providers);
cash withdrawals at the bank's counters of amounts owed to you by legal entities with which BT has concluded amount distribution agreements (e.g. for dividend payments);

We process your data as an occasional BT client whenever you carry out transactions of the type listed above, even if you also have the status of a regular client of the bank.

b. The purposes for which we process the data of occasional BT Clients

When you act in relation to BT as an occasional client, your data is processed, as applicable, for the following purposes:

application of measures regarding customer due diligence for the prevention of money laundering and terrorist financing. Details in specific information note from Privacy Hub.
the conclusion and execution of the contract for occasional transactions (including the processing/settlement of this transaction);
reports to the competent authorities, according to the bank's legal obligations (e.g. reports to the National Bank of Romania – N.B.R. – including to the National Office for the Prevention and Control of Money Laundering, the Credit Risk Central and the Payment Incidents Central within the N.B.R.);
carrying out analyses and keeping records of the bank's economic, financial and/or administrative management;
administration within the internal departments of the services and products offered by the bank;
the legal defense of the bank's rights and interests, the resolution of disputes, investigations or any other petitions/complaints/requests in which the bank is involved;
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
monitoring the security of BT persons/areas/goods and of visitors to BT units/equipment. Details about data processing for this purpose can be found in specific information note regarding video surveillance from Privacy Hub;
taking measures/providing information or responses to requests/notifications/complaints of any nature addressed to the bank by any person, including by authorities or institutions;
carrying out internal analyses (including statistical);
archiving in physical/electronic format of documents/information, including backup copies (back-up);
carrying out registry and secretarial services regarding correspondence addressed to the bank and/or dispatched by it;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention.

c. What personal data do we process for occasional BT Clients

Occasional BT clients, where appropriate, we process the following categories of personal data:

identification data: last name, first name, personal numerical code (P.C.N.), the series and number of the identity document/passport, home address, citizenship and - in some cases provided by law - including a copy of the identity document/passport (usually for cash deposits, currency exchanges, money transfer services above a certain amount or which show signs of suspicion), signature (handwritten or electronic);
financial data about the occasional transaction (e.g. the amount subject to the transaction, the currency, the payment recipient, explanations/details regarding the transaction, the reference/identifier of the transaction, implicitly information related to the location where certain transactions are carried out, in case of operations performed in BT units or at BT equipment) and about the history of occasional transactions made at BT;
tax dates (e.g. country of residence);
contact details: phone number, e-mail address declared by cash depositors who are not BT Clients to be notified if the transaction is canceled, respectively the phone number/e-mail address declared to the bank by occasional clients who are also BT Clients;
the image (from the identity document, if the bank has the obligation to execute/retain its copy or, as the case may be, captured by video surveillance cameras);
other personal data required by law, depending on the specifics of the transaction

Details in specific information note from Privacy Hub.

a. Who is a natural person related to the applicant of a BT loan

There are individuals connected to the applicant of a BT credit/debtor who are included in the "Group of related clients" together with the applicant, any of the individuals mentioned here: Information on group membership

b. The purposes for which we process the data of persons who are part of a BT debtor's group

If you are such a person, we process your data for the following main purpose:

solvency assessment, credit risk reduction, determining the indebtedness level of Clients interested in personalized offers related to the bank's credit products or the contracting of these types of products (credit risk analysis);

When analyzing a loan application of an individual or legal entity applicant, BT also processes your data, as it has the legal obligation to establish and analyze its exposure to related customer groups, as part of the credit risk analysis. Your data is necessary for the bank in order to analyze the applicant's loan application, and the refusal of the applicant (or you) to provide or to have it processed may result in the bank's inability to analyze and/or approve the loan.

Also, a secondary purpose of processing your data is that of:

reporting to the competent authorities, according to the bank's legal obligations;

As the reporting person, the bank will report these exposures and the composition of the debtor client groups in connection to the NBR – Credit Risk Center (if applicable).

Personal data belonging to you may be disclosed, respecting the need-to-know principle, also to entities within the BT Group and/or to service providers used by the bank in the process of analyzing the credit application. The retention period of your data is equal to that of the existence of a group/s of BT client groups connected to which you belong.

Other purposes related to the purposes indicated above, for which we process your data, are, as applicable, the following:

confirmation/refutation of your status as a BT Client;
carrying out analyses and keeping records of the bank's economic, financial and/or administrative management;
administration within the internal departments of the services and products offered by the bank;
the legal defense of the bank's rights and interests, the resolution of disputes, investigations or any other petitions/complaints/requests in which the bank is involved;
performing risk checks on the bank's procedures and processes, as well as carrying out audit or investigation activities, including for the prevention and management of conflicts of interest;
taking measures/ providing information or responses to requests/ notifications/ complaints of any kind addressed to the bank by any person, including authorities or institutions;
carrying out internal analyses (including statistical);
archiving in physical/electronic format of documents/information, including backup copies;
provision of registry and secretarial services regarding correspondence addressed to the bank and/or dispatched by it;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention.

c. What personal data do we process from persons in a BT debtor's group

identification data: last name, first name, personal numeric code - P.N.C.;
professional data (e.g. position, quality, holdings within legal entities in the debtor's group);
depending on the case, other data found in the bank's records or publicly available, which need to be processed to fulfill the main purpose related to credit risk analysis.

a. Who is the signatory/contact person on behalf of the contractual partners BT

The signatories are any of the following:

legal representatives or other persons designated by the contractual partners to sign the contracts concluded with the bank (regardless of whether the contractual partners are BT Clients or service providers, collaborators, suppliers of goods contracted by the bank);
legal representatives or other representatives of institutions/authorities who sign documents submitted to the bank

Contact persons are any of the following:

persons designated by the contractual partner to maintain contact with the bank for negotiating/concluding/implementing the contract, regardless of whether their data is mentioned in the contract content or not;
persons designated as point of contact by institutions/authorities sending various requests to the bank

b. The purposes for which we process the data of signatories/contact persons on behalf of BT contractual partners/institutions/authorities

If you are a signatory/contact person on behalf of any BT contractual partner or on behalf of an institution/authority, we process your data, as appropriate, for:

negotiation, conclusion and proper execution of the contract concluded between the bank and the contractual partner (usually this is your employer) or, where appropriate, to manage requests addressed to the bank by the institution/authority where you carry out your professional activity;
reports to the competent institutions to receive them, in accordance with the legal provisions applicable to the bank;
carrying out analyses and keeping records of the bank's economic, financial and/or administrative management;
the legal defense of the bank's rights and interests, the resolution of disputes, investigations or any other petitions/complaints/requests in which the bank is involved;
performing risk checks on the bank's procedures and processes, as well as carrying out audit or investigation activities, including for the prevention and management of conflicts of interest;
taking measures/providing information or responses to requests/notifications/complaints of any nature addressed to the bank by any person, including by authorities or institutions;
carrying out internal analyses (including statistical);
archiving in physical/electronic format of documents/information, including backup copies;
carrying out registry and secretarial services regarding correspondence addressed to the bank and/or dispatched by it;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention;

c. What personal data do we process from signatories/contact persons on behalf of contractual partners/institutions/authorities

We usually process the following categories of personal data concerning you, as applicable:

For signatories:

identification data: name and surname, signature (handwritten or electronic);
professional data: position/professional title, employer;

For contact persons:

identification data: name and surname;
contact details: phone number, email address (work);
professional data: position/professional quality, employer.

In Privacy Hubfind againinformative note specific for signatories/ contacts acting on behalf of BT contractual partners.

a. Who is the BT shareholder/bondholder or person whose data we process in connection with those of our shareholders/bondholders

BT shareholder - you are a BT shareholder if you own or have owned as a natural or legal person shares issued by Banca Transilvania S.A.;
BT bondholder- you are a BT bondholder if you hold bonds issued by Banca Transilvania S.A. as a natural or legal person;
Natural persons whose data we usually process in relation to those of BT shareholders / bondholders - legal or conventional representatives of BT shareholders / bondholders, persons who jointly own shares / bonds with BT shareholders / bondholders, successors of BT shareholders / bondholders.

b. The purposes for which we process the data of BT shareholders/bondholders or those of other persons in connection with those of BT shareholders/bondholders

If you are a shareholder and/or a BT bondholder or an individual whose data we process in relation to the shareholders/bondholders, we will use your data, as applicable, for the following purposes:

identity verification, for the purpose of confirming/refuting the status of shareholder/ bondholder of the bank, other status in connection with BT's shareholders/bondholders;
fulfillment of legal obligations and specific activities arising from the status of BT issuer (e.g. organization of the G.M.A., shareholder services, specific communications for investors);
establishment of garnishments, recording the garnished amounts at the disposal of creditors and providing responses regarding these to the enforcement bodies and/or competent authorities, according to the bank's legal obligations;
reports to the competent institutions to receive them, in accordance with the legal provisions applicable to the bank;
carrying out analyses and keeping records of the bank's economic, financial and/or administrative management;
the legal defense of the bank's rights and interests, the resolution of disputes, investigations or any other petitions/complaints/requests in which the bank is involved;
performing risk checks on the bank's procedures and processes, as well as carrying out audit or investigation activities, including for the prevention and management of conflicts of interest;
taking measures/ providing information or responses to requests/ notifications/ complaints of any kind addressed to the bank by any person, including authorities or institutions;
proof of requests/ agreements/ options regarding certain requested/ discussed/ agreed aspects, including within telephone calls initiated by you or the bank, by recording the discussed aspects and, if applicable, audio recording of telephone conversations or, if applicable, audio video;
carrying out internal analyses (including statistical);
archiving in physical/electronic format of documents/information, including backup copies (back-up);
carrying out registry and secretarial services regarding correspondence addressed to the bank and/or dispatched by it;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention.

c. What personal data do we process of BT shareholders/bondholders/other persons in connection with their data

In your capacity as a BT shareholder and/or bondholder, or another person connected to them, we usually process the following categories of personal data:

identification data: name, surname, Personal Numeric Code or other unique identification element, series and number of the identity document / passport, citizenship, postal address and, if applicable, copy of the identity document (for identifying shareholders in case of requests for shareholder or bondholder certificate or history of shares/bonds held at BT), signature (handwritten or electronic);
tax data: country of tax residence, tax identification number);
information about the economic and financial situation, relating to owned assets: number of BT shares and/or bonds, including the history of holdings of these assets;
professional data: quality, holdings and, as the case may be, the powers of representation held within legal entities;
contact details: phone number, e-mail address, postal address.

a. Who is a visitor of BT units and/or user/visitor of BT equipment

Visitor of BT units - any natural person who visits the bank's units (including its administrative buildings), regardless of whether or not they perform banking operations;
User/visitor of BT equipment - any natural person who uses these devices or stands in front of them (ATMs, BT Express, BT Express Plus, etc.), regardless of where they are located, regardless of whether the user is a BT Client, an occasional BT Client, or a third party, regardless of whether they initiate/perform banking operations through BT equipment or not.

b. The purposes for which we process the data of visitors to BT units and/or users/ visitors of BT equipment

We process your data, as appropriate, for:

monitoring the security of BT persons/spaces/goods and BT units/equipment visitors;
processing/settlement of transactions ordered at BT equipment;
identity verification, if applicable, if necessary for your identification at the request of the competent authorities or when the bank has a legitimate interest;
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
carrying out internal analyses (including statistical);
archiving in physical/electronic format of documents/information, including backup copies (back-up);
the legal defense of the bank's rights and interests, the resolution of disputes, investigations or any other petitions/complaints/requests in which the bank is involved;
ensuring the security of the IT systems used by BT and the physical spaces where the bank carries out its activity;
fraud prevention.

Information about the processing of personal data through our video surveillance system or to allow you access to certain bank locations can also be found within specific pictograms and/or information notes displayed at the entrance of the bank units and respectively on BT equipment. Also, you will find details in specific information note regarding video surveillance and in specific information note regarding visits to some BT offices from section Privacy Hub.

c. What personal data we process from the visitors of the units and/or users/visitors of the BT equipment

If you visit the bank's units (including its administrative buildings) and/or use/stand in front of BT equipment, we process the following data, as appropriate:

the image, as it is captured by the video surveillance cameras;
any data necessary for processing transactions ordered through BT equipment or for other related purposes mentioned above (e.g., time spent in BT units/at BT equipment).

At the same time, in accordance with the legal obligations we have, to allow you access to some premises where the bank operates, the security personnel will identify you based on an identity document and some identification data: name, first name, series and number of the identity document/passport will be recorded and kept, usually for 2 years.

a. Who is a visitor of BT's websites/social media pages

It is a visitor of BT websites/social media pages any natural person who accesses any of the websites in the BT portfolio and/or its social media pages. The websites in the BT portfolio are https://bancatransilvania.ro/and those found here: https://www.bancatransilvania.ro/files/app/media/site-uri-bt.pdf ("BT websites").

Our social media pages are: Facebook, Instagram, Twitter, TikTok, YouTube, LinkedIn (“BT social media pages").

b. The purposes for which we process the data of visitors to BT websites/social media pages

Through cookies or other similar technologies, we process your data whenever you visit a BT website for the purposes described in detail within the cookie policies corresponding to each of the websites in our portfolio and briefly within the cookie banners and settings centers.

For the website https://bancatransilvania.ro/, The cookie policy can be found in the footer of the website or by accessing the following link: https://www.bancatransilvania.ro/cookie-use-policy .

If you fill in data on BT websites in forms for notifications/requests/complaints, applications for bank products/services/campaigns, subscriptions to newsletters from various fields, we process the data entered in these forms, as appropriate, for:

taking measures/ providing information or responses to requests/ notifications/ complaints of any kind addressed to the bank by any person, including authorities or institutions;
proof of requests/agreements/options regarding certain requested/agreed aspects;
evaluation/ improvement of the quality of services (requesting/ collecting your opinion regarding the quality of services/ products/ BT employees);
carrying out internal analyses (including statistical);
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
archiving in physical/electronic format of documents/information, including backup copies;
carrying out registry and secretarial services regarding correspondence addressed to the bank and/or dispatched by it;
ensuring the security of IT systems used by BT;
fraud prevention.

Please note that subscribing or unsubscribing any email address you enter in forms/fields of the type/with the name "newsletter", available on BT websites to receive information from various areas of interest, is managed through the respective online forms (subscription) and respectively through unsubscribe links in the emails received following the subscription (unsubscription).

c. What personal data do we process from visitors to BT's websites/social media pages

If you visit a BT website we will process the following categories of personal data:

data processed through cookies;
IP address;
data about the device used to access the website (e.g. if you access the website from a laptop, computer or phone and, in the latter case, the type of the phone's operating system);

Additionally, when you fill in data on BT websites, we collect, where appropriate:

identification data: name, first name, and, in some cases, with the consent of the data subjects, the personal numerical code (C.N.P.);
contact details: e-mail address, phone number, postal address.

Before accessing our social media pages, we recommend you read Data Protection Guide in Social Media from the section Privacy Hub.

If you insert comments, images, opinions and/or reactions on BT social media pages, we will usually process:

the username on the respective social media platform and the profile picture;
the opinions/reactions posted;
inserted images.

In some cases – usually when you participate in various contests/campaigns or enter comments in which you report/complain about certain aspects related to our activity - we may ask you for additional information to identify/verify the reported/complained situation, so that we can provide you with an answer. Usually, we ask you for:

details about the reported/complained situation;
identification data: usually last name, first name;
identifiers (e.g. BT client code - BT CIF -, IBAN);
contact details (e.g. e-mail address, phone number).

To protect your data, please do not insert it into public posts on BT social media pages. If we observe that you have inserted data into public posts, we reserve the right to delete them.

Also, if you insert pictures with your image or that of other persons or if you tag other persons in the comments on BT social media pages or send them to us in private messages, by posting/tagging you express your consent for the bank to use them.

Please note that any data you enter on BT's social media pages is accessible to social media platform providers and is subject to their privacy policy provisions. BT has no control over the data processing carried out by social media platform providers for their own purposes and assumes no responsibility for such processing.

We would like to draw your attention to the fact that BT websites/BT social media pages may contain links to websites/social media pages managed by other operators, which have their own privacy/personal data processing policy. If you access these websites/social media pages or provide personal data on any of them, the processing of your data is subject to the privacy/personal data processing policy of those websites/social media pages, which we recommend you read. BT assumes no responsibility regarding the processing of your data on websites/social media pages not controlled by the bank.

a. Who is a BT prospect

You are a BT prospect if you are not a BT client and you have requested from the bank, through BT websites or contractual partners, information about BT products/services or you have scheduled online at BT units.

Details about the processing of personal data for online appointments at BT can be found in specific information note from section Privacy Hub.

b. The purposes for which we process BT prospects' data

If you are a BT prospect, we process your data, as appropriate, for the following purposes:

identity verification;
taking measures/ providing information or responses to requests/ notifications/ complaints of any kind addressed to the bank by any person, including authorities or institutions;
proof of requests/ agreements/ options regarding certain requested/ discussed/ agreed aspects, including within telephone calls initiated by you or the bank, by recording the discussed aspects and, if applicable, audio recording of telephone conversations or, if applicable, audio video;
carrying out internal analyses (including statistical);
carrying out risk controls on the bank's procedures and processes, as well as performing audit or investigation activities;
archiving in physical/electronic format of documents/information, including backup copies;
carrying out registry and secretarial services regarding correspondence addressed to the bank and/or dispatched by it;
ensuring the security of IT systems used by BT;
fraud prevention;

c. What personal data do we process from BT prospects

If you are a BT prospect, we process you, as applicable:

identification data: name, first name, and, in some cases, only with your consent or if we justify a legitimate interest, the personal numerical code (P.N.C.);
contact details: e-mail address, phone number
voice (if you request information by phone).

a. Who is a BT candidate

You are a candidate for available positions at BT or for internship programs organized by BT if you have sent us / we have received your CV from other persons to use it for recruitment purposes or if you have informed us in any other way that you are interested in occupying BT positions / participating in BT internship programs.

b. The purposes for which we process BT candidates' data

We process your data, as appropriate, for:

recruitment;
taking measures/ providing information or responses to requests/ notifications/ complaints of any kind addressed to the bank by any person, including authorities or institutions;
proving requests/ agreements/ options regarding certain requested/ discussed/ agreed aspects, including within phone calls initiated by you or by the bank, by recording the discussed aspects and, if applicable, audio recording of phone calls or, if applicable, audio-video;
carrying out internal analyses (including statistical);
performing risk checks on the bank's procedures and processes, as well as carrying out audit or investigation activities, including for the prevention and management of conflicts of interest;
archiving in physical/electronic format of documents/information, including backup copies;
carrying out registry and secretarial services regarding correspondence addressed to the bank and/or dispatched by it;
ensuring the security of IT systems used by BT;
fraud prevention.

In case you apply only for a certain job/internship at BT, we will process your data only within the recruitment process for the respective job/internship and we will delete or anonymize it upon its completion. If, on the other hand, you choose to be contacted in general for vacant positions/internships at BT, we will keep your data and use it for recruitment purposes for a period of 1 year, a term that can be extended if you give your consent.

In the recruitment process, if we need references from previous employers or from teachers, we will ask for your consent to obtain these references on your behalf. If you do not give your consent in this regard, you will need to obtain these references and provide them to us if you wish to continue the recruitment process.

c. What personal data do we process from BT candidates

For BT candidates we usually process the following categories of personal data:

identification data: name, first name;
age, for verifying your eligibility to become an employee or, as the case may be, to participate in certain BT internships;
contact details - e-mail address and/or phone number;
professional data (e.g. profession, occupation, previous employers, information about education, experience and professional training, references from previous employers/teaching staff);
any other relevant data from the CV.

For the case in which you have already been selected to occupy a BT position, we process your data for the purpose of presenting the job offer and, if you accept it, to go through the necessary formalities for employment as you are informed in detail through specific information note from Privacy Hub.

a. Who is/when do we process your data as a BT complainant

You are a BT petitioner if you address the bank with any request/notification/complaint (“petition”), through any channel, regardless of whether you are a BT client, an occasional BT client, or if you belong to any other category of concerned persons.

b. The purposes for which we process BT petitioners' data

Depending on the situation and the specific quality you have in relation to the bank, when you send us a request, we process your personal data for the following purposes:

identity verification, including for the purpose of confirming/denying the status as a BT Client;
taking measures/ providing information or responses to requests/ notifications/ complaints of any kind addressed to the bank by any person, including authorities or institutions;
evidencing requests/ agreements/ options regarding certain requested/ discussed/ agreed aspects during telephone calls initiated by you or the bank, by recording the discussed aspects and, if applicable, the audio recording of phone conversations;
evaluation/ improvement of the quality of services (requesting/ collecting the opinion of BT petitioners regarding the quality of the responses provided to petitions);
performing risk checks on the bank's procedures and processes, as well as carrying out audit or investigation activities, including for the prevention and management of conflicts of interest;
carrying out internal analyses (including statistical);
reports to the competent authorities, according to the bank's legal obligations;
administration within internal departments of the services and products offered by the bank, as well as human resource management;
archiving in physical/electronic format of documents/information, including backup copies;
carrying out registry and secretarial services regarding correspondence addressed to the bank and/or dispatched by it;
ensuring the security of IT systems used by BT;
fraud prevention.

c. What personal data do we process of BT petitioners

To register, confirm receipt, analyze, formulate and send a response to any petitions you address to us, we process, as appropriate, the following categories of personal data:

identification data: surname, first name and other data in this category that you provide to us or personal data that need to be processed to identify you, to identify and verify the situation regarding which you send us the petition, to formulate the response to the petition, to prevent the disclosure of confidential information (including personal data) to recipients who are not entitled to receive them;
contact details: postal address, e-mail address, telephone number.

Please note that, in case you are a BT Client and you send us a petition using contact details that you have not declared to the bank, if we cannot confirm beyond any doubt that the petition was sent to us by you, in order to protect the data that needs to be included in the response to the petition, we reserve the right to send you this response to the contact details you have declared to the bank;

the voice, within conversations and recordings of telephone conversations (initiated by BT petitioners or by the bank);
depending on the case, any other information known by the bank and necessary for handling complaints.

a. Who is/when do we process your data as a BT third party

We process your data as a third party BT (even if you have other statuses mentioned in this Policy) when you are a natural person in situations such as those exemplified below:

you are a client of another bank/financial institution and you make a transfer to a BT account from the account you hold at the other bank;
you are a client of another bank/financial institution and a BT client initiates a transfer to your account from that bank. In this case, based on payment schemes to which BT may adhere, we find out your name and the initial of your first name as they appear in the records of the other bank, even if the BT client enters a different name associated with the IBAN code when initiating the transfer to your account in another bank;
make online payments with cards issued by other banks/financial institutions on websites using payment solutions offered by BT. We process your data according to the rules of international payment organizations;
dates concerning you are mentioned in the details/explanations of the payment in a payment order submitted/transmitted/received at BT – filling in the fields related to the explanations/details of a payment is mandatory according to the legal provisions in the field of payment services;
a BT client submits supporting documents for transactions or constitutive acts for BT corporate Clients and your data is found in them;
a BT loan applicant must provide us with the sale-purchase contract of the property for which they are requesting the loan or which they bring as collateral, and your details appear in that contract or the loan applicant submits an extract from the land register of the property in which your details also appear;
BT clients use open banking services and integrate transactions from other financial institutions, which also contain your data, into BT applications;
use cards issued by other banks/financial institutions at BT equipment (ATMs, BT Express, BT Express Plus), including when they are captured and need to be returned to you;
we receive requests from various individuals, including institutions/authorities, notaries, lawyers, judicial executors, in which your data is mentioned;
are you authorized persons (other than proxies or delegates on accounts) to order/initiate on behalf of a BT Client operations – banking or non-banking – through the channels offered by BT (e.g. telephone payment instructions);
a BT employee provides us with data concerning you because you are a family member under their care or the BT employee is entitled to leave/time off based on the relationship they have with you (e.g. leave for marriage, leave for child care, medical leave for children, etc.) or to provide you with benefits that we offer to family members of BT employees;
we collect data concerning you in the process of preventing and managing conflicts of interest – either from BT employees within their conflict of interest declaration, or following the checks we carry out – and we collect your data because you are related to a BT employee (e.g., you are a relative, husband, wife, life partner, business partner with the employee or with his/her close family members, etc.);
participants in various events, press conferences, social responsibility actions, etc. organized by the bank;
the data is mentioned on various documents submitted to BT in different situations (e.g. certificates or documents of any type containing personal data of the signatories or, as the case may be, of other persons mentioned in the content of the documents). We will process this data considering the need to keep these documents, even if it may not be necessary to process them in any way other than storing them;
your personal data is provided to us by any other person with whom we interact or comes into our possession in any other way.

b. The purposes for which we process third party data BT

We process your data as a BT third party depending on the purpose for which it is necessary in our relationship with the person who provided it to us, as well as, where applicable, for the following related purposes:

managing labor relations with BT employees, as appropriate;
performing risk checks on the bank's procedures and processes, as well as carrying out audit or investigation activities, including for the prevention and management of conflicts of interest;
carrying out internal analyses (including statistical);
archiving in physical/electronic format of documents/information, including backup copies;
providing registry and secretarial services regarding correspondence addressed to the bank and/or sent by it, as well as for carrying out courier activities;
ensuring the security of IT systems used by BT;
fraud prevention.

c. What personal data do we process for BT third parties

The most common categories of data that we process as a BT third party are, as the case may be, those presented by way of example in the following lines:

identification data: last name, first name, personal numeric code (P.N.C.), signature (handwritten or electronic);
the relationship between you and the person who provided us with your data;
position held within a legal entity;
any other data made available to us by any person with whom we interact in the course of our activity.

a. Who are the persons who have expressed their options regarding the processing of their data for advertising purposes (where applicable, consent or refusal)

Currently, the following categories of data subjects who have expressed their consent to BT for the processing of their personal data for advertising purposes are considered to be:

natural persons of age - BT Clients (account holders or non-account holders) or non-clients (occasional BT clients or any other person) - who have expressed their options regarding the processing of their data for advertising purposes hereinafter "marketing options" on the dedicated BT form (hereinafter "BT marketing form"), starting from 12.03.2018. The marketing options may be, as the case may be, consent/agreement (hereinafter "marketing agreement") or refusal to have their personal data processed for advertising purposes.

BT clients can find the marketing form at any BT unit, in BT Internet Banking applications, as well as by accessing the dedicated area on the bank's website, in the section Privacy Hub.

Non-clients can find the BT marketing form for non-clients at any BT branch.

No person is obliged to express their marketing consent at BT. The refusal of any person to express this consent does not affect their right to become or remain a BT Client.

The marketing agreement can be withdrawn at any time. BT customers can withdraw their consent by selecting the refusal option (“I do not wish to receive advertising messages”) in the BT marketing form, in any of the ways indicated above where this form can be completed. Non-customers can withdraw their marketing consent at the bank's branches or online (by filling out the marketing consent withdrawal form dedicated to non-customers, available in the Privacy Hub).

Within a maximum of 5 working days from the date when a data subject withdraws their marketing consent, we will no longer process their personal data for advertising purposes.

To BT clients who express their marketing consent and do not subsequently withdraw it, we will process their personal data for advertising purposes as long as they hold the status of Client.

BT clients should keep in mind that any marketing option expressed on the BT marketing form does not refer to and does not affect general interest or particular interest messages for Clients, transmitted by BT based on its legitimate interests in the proper conduct of the business relationship or based on its legal obligations.

a. BT clients, as well as non-clients, must be aware that the options expressed through the BT marketing form:

- does not refer to and does not influence the subscription/unsubscription of any e-mail address entered in forms available on BT websites to receive information from various areas of interest. Subscription to the respective newsletters is made through the respective online forms, and unsubscription is managed by following the unsubscribe link contained in the messages received after subscribing.

Individuals who have expressed marketing consent should know that we use tracking pixels and/or other similar technologies in our marketing emails to better understand how they interact with this type of messages we send. These technologies allow us to collect information such as: whether the email was opened, the time it was opened, links or certain areas accessed within the email. This data helps us improve our marketing strategies and send more relevant advertising messages to individuals who have expressed marketing consent. Data subjects can avoid email tracking carried out through these technologies by adjusting their email inbox settings (according to the options offered by the service provider with whom they created their email account) or, they have the right to withdraw their marketing consent expressed at BT at any time.

b. The purposes for which we process the data of persons who express marketing preferences (where applicable, consent or refusal)

If you express your consent for data processing for advertising purposes, we will process them as follows:

transmission of advertising messages*, according to the expressed consent (advertising/marketing purpose);
service quality evaluation, more specifically the efficiency of the advertising messages we transmit;
verification of individuals' identity, for the purpose of confirming/denying their status as BT Client;
proving requests/agreements/options regarding issues related to advertising options, by recording the discussed aspects and, if applicable, the audio recording of phone conversations (initiated by the bank or by you);
carrying out internal analyses (including statistical);
archiving in physical/electronic format of documents/information, including backup copies;
ensuring the security of IT systems used by BT;
fraud prevention.

If you have expressed your refusal to have your data processed for advertising purposes, we will process your data for all the above purposes, except for the one related to *sending advertising messages.

c. What personal data do we process for people who express marketing preferences

The data processed by BT for the purpose of sending advertising messages are usually:

identification data: name, first name;
internal identifiers: client code (BT CIF);
contact details: phone number, e-mail or postal address
only in the case of BT Clients: other information we learn about them when using BT services/products, to send them personalized advertising messages;
personal data collected through tracking pixels and/or other similar technologies (only for individuals who have given marketing consent).

If you refuse to have your data processed for advertising purposes, we process your identity and contact data and, if you are a BT customer, including the customer code – BT CIF – only to mark and respect your choice.

D. What are the sources from which BT collects personal data

As a rule, the personal data we process are collected directly from the data subjects (e.g. when they become BT Clients, update their data at the bank, carry out transactions, visit or fill out forms on BT websites, etc.).

Nevertheless, there are situations when data is collected from other sources, from/of:

other Clients of BT (e.g. authorizing other Clients on their accounts opened at the bank, contracting bank products/services by a Client on behalf of another Client who authorized them in this respect, contracting by employers who are corporate Clients of BT of products/services of the bank for/on behalf of their employees - meal vouchers, collection of salary income in accounts opened at BT, guarantee management accounts etc);
persons who are not BT clients (e.g. persons who deposit cash amounts into the accounts of BT Clients, persons who send petitions claiming that they use data declared at the bank by BT Clients);
authorities or public institutions (e.g. the General Directorate for Persons Records – G.D.P.R. – from which we receive current data of the identity document of clients/ persons who are going through the steps to become BT clients, which we process for the purpose of knowing the clientele according to the details in the section Privacy Hub from the site, subsection “Knowing the client”, courts, prosecutor's offices, police, judicial executors, B.N.R., A.N.P.C., A.N.S.P.D.C.P., etc.), notaries, lawyers;
institutions involved in the field of payment services (e.g. Transfond, S.W.I.F.T, international payment organizations, etc);
other credit institutions with which Banca Transilvania S.A. has merged (e.g. Volksbank România S.A., Bancpost S.A., OTP Bank România S.A.) or with which it will merge in the future or from which some contracts have been assigned (e.g. Idea::Bank, currently named Salt Bank) or will be assigned in the future;
other banks/financial institutions, including partner banks and correspondent banks or banks/financial institutions participating in syndicated loans;
other entities of the BT Financial Group, for determined and legitimate purposes, generally for the proper conduct of financial/economic activity and for fulfilling the legal requirements related to the supervision on the consolidated basis of the BT Group;
public sources, such as but not limited to: the National Trade Register Office (N.T.R.O.), the National Register of Movable Property Advertising (N.R.M.P.A.), the Office of Cadastre and Real Estate Advertising (O.C.R.E.A.), the court portal (portaljust), the Official Gazette, social media, internet etc.;
records of the type Credit Bureau, the Credit Risk Central of the National Bank of Romania, in case there is a legal basis and a determined and legitimate purpose for consulting them;
database providers (e.g. entities authorized to manage databases with persons accused of financing acts of terrorism, publicly exposed persons, providers who aggregate and redistribute data collected from public sources, etc);
contractual partners of the bank from various fields (e.g. evaluation companies, insurance companies, pension and investment fund management companies);
debt collection / debt recovery companies (e.g. we can find out the new contact details of Customers from companies that support us in debt recovery activity);
Central Depository S.A., Bucharest Stock Exchange (B.S.E) in the case of the bank's shareholders data;

E. On what legal grounds does BT process personal data and what happens if you refuse their processing

The legal grounds on which BT processes personal data are, as the case may be:

the bank's legal obligation (when data processing is necessary for the fulfillment of a legal obligation of the bank);
conclusion/execution of contracts (processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract);
the legitimate interest of the bank and/or of some third parties;
the necessity of processing data for the fulfillment of a task serving a public interest (e.g. the application of measures for customer identification to prevent money laundering and terrorist financing);
the consent of the data subject.

When the legal provisions require us to process certain data in a certain situation or if your data are necessary for concluding or carrying out contracts for BT products/services/occasional transactions, if you refuse the processing of these data you will not be able to become/remain BT clients or we will not be able to process the transactions you request from us.

If we process your data based on our legitimate interest or that of third parties, you may object to such processing for reasons related to your particular situation (e.g., if you are a BT Client and do not wish to receive general interest messages or messages requesting you to evaluate the quality of our services/products, we will accommodate your request without affecting the business relationship you have with BT). In some cases, our legitimate interest or that of third parties may outweigh yours, and we will not be able to accommodate the request in which you oppose the processing (e.g., data processing in the Credit Bureau system, if there are no other reasons to accommodate the objection request).

If we process your data based on your consent/agreement, you have the right to withdraw this agreement at any time. However, the withdrawal will not affect the prior processing of your data (e.g. we process your data based on consent for advertising/marketing purposes and you have the right to withdraw this agreement. Withdrawal of marketing consent does not affect your right to become or remain a BT customer; data processing through some cookies is based on your consent. If you do not give your agreement for placing these cookies, you can use BT websites without any negative consequences for you).

F. To whom can we disclose/transfer the personal data we process

Personal data that we process may sometimes be disclosed/transferred by BT in accordance with the GDPR principles, based on the applicable legal grounds depending on the situation and only under conditions that ensure their full confidentiality and security.

We commit to respecting fundamental human rights and freedoms in the case of such disclosures, especially the right to the protection of personal data and the right to privacy, and to periodically evaluate our activity in this area to ensure that these rights are always respected.

Find below within this section (* -> ***) details about legal provisions that require us to report/communicate personal data concerning you to certain authorities.

Also, when public authorities/institutions request from us the provision of personal data, we commit that these will be disclosed only if we have a legal obligation or a legitimate interest, only based on clear internal procedures and only with the approval of persons in management positions.

We will provide the authorities only the strictly necessary data and if it is proven that we have made such personal data disclosures in violation of human rights, we commit to remedy the damage caused to the data subjects.

Categories of recipients to whom we may disclose personal data, as appropriate, are:

other Clients who have the right and the need to know them;
other entities within the BT Financial Group;
companies involved in payment processing (e.g.: Transfond S.A., payment processors);
financial-banking entities (e.g. participants in payment and interbank communication schemes/systems such as S.W.I.F.T., S.E.P.A., ReGIS, partner banks and correspondent banks, banks or financial institutions participating in syndicated loans);
international payment organizations (e.g. Visa, Mastercard);
contractual partners (service providers) used in BT's activity, such as, but not limited to, providers/suppliers of: digital certificate issuance services (for applying qualified/extended electronic signature), services for collecting outstanding debts/claims, IT services (maintenance, implementation, support, cloud), archiving services in physical and/or electronic format, courier services, audit services, card-related services, market study/research services, email/SMS/telephony transmission services, marketing services, other services provided by suppliers to whom BT has outsourced certain financial-banking services, etc);
insurance companies;
real estate appraisal companies;
management companies of pension and investment funds;
guarantee companies (funds) for various types of credit/deposit products (e.g. F.N.G.C.I.M.M., F.G.D.B. etc.);
partners of the bank from various fields, whose products/services/events we can promote to BT Clients based on their consent. The updated list with the bank's partners can be found here: https://www.bancatransilvania.ro/partners;
social media platform providers;
assignees;
authorities and national public institutions, such as, but not limited to: the National Bank of Romania (N.B.R.), the National Agency for Fiscal Administration (N.A.F.A.)*, the Ministry of Justice, the Ministry of Internal Affairs (M.I.A.), the General Directorate for Persons Records (G.D.P.R.) to which we send the first name, last name and personal numerical code (CNP) of clients/persons who go through the steps to become BT clients for the validation of these data and for providing additional information from their current identity documents, which we process for the purpose of knowing the clientele according to the details in the section Privacy Hub from the site, subsection “Customer Knowledge”, the National Office for the Prevention and Control of Money Laundering (O.N.P.C.S.B.) **, the National Agency for Cadastre and Real Estate Publicity (A.N.C.P.I.), the National Register of Movable Property Publicity (R.N.P.M.), the Financial Supervisory Authority (A.S.F), including, as the case may be, their territorial units;
banking institutions or state authorities, including from outside the European Economic Area - in the case of international S.W.I.F.T. transfers or as a result of processing carried out for the purpose of applying F.A.T.C.A. and C.R.S. legislation;
notaries public, lawyers, bailiffs;
Credit Risk Center***;
Credit Bureau and Participants in the Credit Bureau System****;

* disclosure of personal data to A.N.A.F.

According to the provisions of the Tax Procedure Code (Law no. 207/2015), in its capacity as a credit institution, BT has the legal obligation to:

1. Communicate daily to A.N.A.F.:

- the list of natural persons, legal entities or other entities without legal personality who open or close bank or payment accounts at BT, persons who have the right to sign for the opened accounts, persons claiming to act on behalf of the client, the real beneficiaries of the account holders, together with the identification data provided in art. 15 para. (1) of Law no. 129/2019 for preventing and combating money laundering and terrorist financing, as well as for amending and supplementing certain normative acts, with subsequent amendments and completions, or with the unique identification numbers assigned to each person/entity, as appropriate, as well as information regarding the IBAN number and the opening and closing dates for each individual account.

- list of persons who have rented safe deposit boxes, accompanied by the identification data provided in art. 15 para. (1) of Law no. 129/2019, with subsequent amendments and completions, or by the unique identification numbers assigned to each person/entity, as applicable, together with data regarding the termination of rental contracts.

2. Communicate, at the request of A.N.A.F., for each holder subject to the request, all turnovers and/or balances of the bank accounts opened, as well as the information and documents regarding the operations carried out through the respective accounts.

3. Transmits to A.N.A.F. - on the occasion of the request to open a bank account or rent a safe deposit box - the request for the assignment of the tax identification number / the tax registration code, for non-resident individuals who do not have it. The request sent by BT to A.N.A.F. will include the following data of the non-resident: last name, first name, date and place of birth, gender, home address, identity document data and copy, tax identification code from the country of residence (if any). BT may also send to A.N.A.F. supporting documents of the information filled in the request. Based on the transmitted data, the Ministry of Finance assigns the tax identification number or, where appropriate, the tax registration code, registers the respective person for tax purposes, and communicates to BT the information relating to the tax registration.

** O.N.P.C.S.B. - In case the conditions for the transmission by BT of some personal data to the National Office for Prevention and Control of Money Laundering are met, according to the legislation for the prevention and combating of money laundering and terrorism financing, these are simultaneously transmitted in the same format also to A.N.A.F.

*** C.R.C. - The Bank has the legal obligation to report to the Credit Risk Center (C.R.C) within the B.N.R. the credit risk information for each debtor who meets the condition to be reported (includes identification data of an individual debtor and transactions in lei and foreign currency through which the Bank is exposed to risk towards that debtor), respectively to have recorded towards this debtor an individual risk, as well as information about detected card frauds.

**** Credit Bureau S.A./participants in the Credit Bureau system - The bank has a legitimate interest in reporting to the Credit Bureau System, to which other Participants also have access (mainly credit institutions and non-bank financial institutions, as associated operators of the bank and the Credit Bureau) the personal data of Clients who have contracted loans, as well as of Clients who have delays in loan repayments of at least 30 days, under certain conditions. The data is also disclosed to these recipients in the case of inquiries into this system, made by the bank in the process of analyzing a loan application or request.

G. Transfers of personal data to third countries or international organizations

Some of the contractual partners who provide us with services necessary for the proper conduct of our activity and/or their subcontractors are not located within the territory of the European Union (E.U.) or the European Economic Area (E.E.A.), but in other countries ("third countries").

When these partners/their subcontractors or international organizations may have access to the personal data we process, we will only allow the transfer of data when it is strictly necessary and only based on adequacy decisions or, in the absence of these decisions, based on appropriate guarantees provided by the GDPR.

To ensure that these transfers respect human rights, especially the right to the proper protection of personal data wherever it may be processed, we commit ourselves - both before allowing the transfer of data to third countries or international organizations, and throughout the entire period during which the transfer takes place, including when changes occur to the circumstances initially considered - to analyze whether there are risks to the rights and freedoms of the data subjects and to manage them appropriately, including by taking any additional necessary measures, so that the data benefits from the same level of protection that it would have within the EU/EEA.

The European Commission may decide that some third countries, some territories or some sectors in a third country provide an adequate level of protection for personal data. The European Commission has issued adequacy decisions for the following third countries/sectors: Andorra, Argentina, Canada (only commercial companies), Switzerland, the Faroe Islands, Guernsey, Israel, the Isle of Man, Jersey, New Zealand, Uruguay, Japan, the United Kingdom of Great Britain, South Korea. To these countries/sectors (insofar as a contrary decision has not been issued regarding any of them), as well as to other countries that the Commission will recognize in the future as providing an adequate level of protection, transfers of personal data do not require special authorizations and are assimilated to disclosures of personal data to recipients from the EU/EEA. The updated list of third countries for which an adequacy decision has been issued is the one mentioned on the European Commission website.

To any other third country or international organization, we will make transfers of personal data only based on appropriate safeguards permitted by the GDPR, usually those consisting of Standard Contractual Clauses approved by the European Commission which you can find here and, if these guarantees are not sufficient, we will take other additional measures for the proper protection of data.

By way of exception, if BT Clients or occasional BT Clients order through the bank transactions to beneficiaries located in third countries that have not been recognized as having an adequate level of personal data protection, the data transfer to those countries is based on the provisions of GDPR according to which: the transfer which is necessary for the performance of a contract between the bank and the Client or for the application of pre-contractual measures taken at the request of the Client or, as the case may be, the transfer which is necessary for the conclusion of a contract or for the performance of a contract concluded in the interest of the data subject.

H. Automated decision-making processes, including profiling

In some circumstances, only in compliance with the GDPR provisions, within BT's activity, automated decision-making processes are used, including as a result of profiling.

These are decisions taken by the bank based on automatic processing of personal data, with or without the intervention of a human factor, and which can produce legal effects and/or can affect the data subjects similarly, to a significant extent.

Similar situations are the following:

for the application of client knowledge measures for the purpose of preventing and combating money laundering and terrorist financing (including for the implementation of international sanctions), according to our legal obligation, we will carry out checks in databases with persons accused of financing terrorist acts, in international sanctions lists or in warning lists regarding persons with high risk of fraud. If the targeted persons are found in these records, the bank reserves the right to refuse entering into a business relationship with them or to terminate the contractual relationship or, as the case may be, to refuse processing the occasional transaction they initiated. For the same purpose, we will send and receive from D.G.E.P. data from the identity document of clients/persons going through the steps to become BT clients. The data received from D.G.E.P. will be recorded or, as the case may be, updated in our records as data from the clients' identity documents. BT will not take any measures that produce legal effects or that would similarly affect clients to a significant extent solely based on the automated processing of data provided by D.G.E.P., unless the provisions of art. 22 of the General Data Protection Regulation (GDPR) are complied with.
to protect BT Clients and Occasional Clients against fraud, as well as for the bank to adequately fulfill its customer knowledge obligations, it monitors their transactions and, if it identifies suspicious operations (such as payments unusual in frequency, value, including compared to the declared source of funds or the purpose and nature of the business relationship, transactions initiated from different localities at short intervals of time, which did not allow travel between those locations, transactions whose details raise suspicions of money laundering or financing of terrorist acts, attempts to use BT cards on suspicious websites), it may take measures to block transactions, cards, accounts, making these decisions exclusively on an automated basis;
according to legal provisions, granting credit products is conditioned by the existence of a certain degree of indebtedness of the applicants. In determining the eligibility to contract a credit product related to the degree of indebtedness, it will be determined based on automatic criteria, starting from the level of income and expenses recorded by the applicant;
in order to objectively verify the fulfillment of eligibility conditions for pre-offering and, as the case may be, analyzing a credit application of an applicant – natural or legal person - in most cases a bank scoring application will be used which will analyze data filled in the credit application, information resulting from verifications carried out in the bank's own records and/or those of Credit Bureau S.A. and will issue a score that determines the credit risk and the likelihood of paying the installments on time in the future. To the issued score is added the result of other verifications of the applicant's situation, which will be analyzed by bank employees to determine whether the eligibility conditions established by internal regulations are met. The final decision to approve or reject the credit application is however based on the analysis carried out by the Bank's employees (human intervention). An exception to human intervention is the situations when you request credit products exclusively online. In these cases, we will make the decision to grant the credit or, as the case may be, to reject this application based solely on automated data processing. Making the decision by such means is necessary to quickly analyze the application and conclude the credit contract. However, you are guaranteed the right to request human intervention, that is, the analysis of the credit application by a bank employee, to express your point of view and to contest the exclusively automatic decision;
for the confirmation of your identity, in the case of opening a remote business relationship, in the case of updating data through online means or for remote identification through video means, certain information of your face (taken from static or video image) is compared with the identity photo and, if you are already a BT Client, the information extracted based on your face and from the identity document are confronted with those we already have in the bank's records. Also, within these online processes, your access to the phone number, email address is verified and these are compared with those already declared to BT (if you are a BT Client). If following these automated processes we identify discrepancies, we will carry out checks through our employees and, where appropriate, we will ask you to repeat the enrollment/update/identification process at a BT unit;
In the case of BT Clients who have expressed their consent on the dedicated form for their data to be processed for advertising purposes, we will create a profile of them based on certain criteria (e.g. transaction data, age, locality, income range), which we will study automatically to form an opinion about the advertising messages that would be relevant to them. In some cases, this profile will only result in promoting a certain product/service to persons who meet the profile conditions. In other cases, it will mean that only persons who meet the profile criteria can contract/benefit from certain promotional offers. The rest of the Clients can, however, benefit from products/services under standard conditions.

I. For how long do we keep personal data

1. Retention period for BT Clients and BT Occasional Clients data

According to the legal obligation we have, the personal data that we process for the application of client knowledge measures for the prevention of money laundering and terrorist financing, together with all records obtained through the application of these measures, such as the monitoring and verifications carried out by the bank, the supporting documents and transaction records, including the results of any analysis conducted in relation to the client, which determine the client's risk profile, must be kept for 5 years after the termination of the business relationship the Client who is the account holder with the bank or, as the case may be, from the date of the occasional transaction. We have the obligation to keep this data for the indicated period and also in the case where the Client's request to open the business relationship with the bank is rejected or the Client withdraws from it or, as the case may be, if the occasional transaction could not be processed or was withdrawn from. In this case, the retention period of 5 years will be calculated from the date of rejection of the request or the client's withdrawal, respectively from the date of the occasional transaction.

At the request of the competent authorities, the initial legal period of 5 years mentioned above may be extended, up to a maximum of 10 years from the termination of the business relationship/occasional transaction date.

Upon expiration of the legal retention period (initial or extended, as applicable), the bank will delete or anonymize this data, except in cases where other legal provisions require their continued retention. Other legal provisions that obligate us to retain Client data or, as applicable, occasional Clients' data for a longer period are those from:

The fiscal procedure code, which provides that some of the data processed for the application of customer knowledge measures must also be processed for reporting to A.N.A.F. The legal retention period of these data is 10 years from the termination of the business relationship or from the date of the occasional transaction;
the financial-accounting legislation provides that accounting documents relevant to financial records and supporting documents, including contracts on the basis of which the accounting entries were made (implicitly also the personal data contained therein) must be kept until 10 years since the end of the financial year in which they were created;
the national legislation applicable in the field of electronic signature obliges providers issuing digital certificates to keep information regarding a qualified certificate for a period of minimum 10 years from the date of its expiry. In cases where Romanian providers we collaborate with in this field process personal data as associated operators with the bank, it is possible that we keep data regarding certificates for this period;
for Clients whose personal data has been queried in the records of A.N.A.F. (according to the agreement expressed by them), the legal term imposed for keeping the interrogation consent forms (implicitly also for the personal data contained therein) is 8 years;

As for the data that the bank is legally obliged to report to the Credit Risk Center (C.R.C.), the documents containing the credit risk information and the information about reported card frauds (including personal data therein) shall be kept for a period of 7 years.

Regarding the data processed in the Credit Bureau system based on the legitimate interest of the Participants in this system, they are stored at the level of this institution and disclosed to the Participants for 4 years since the date of the last update, cu excepția datelor solicitanților de credit care au renunțat la cererea de credit sau cărora nu li s-a acordat creditul, care sunt stocate și dezvăluite Participanților pentru o perioadă de 6 months.

For all cases in which data/some data is subject to multiple retention periods, the longest of these shall apply. After the expiration of the longest period, the data shall be deleted or anonymized.

2. The retention period for data captured by video surveillance cameras

Data collected through video surveillance cameras is kept for 30 days, after which it is deleted through an automatic procedure. In specific cases, thoroughly justified, only with compliance with applicable legal provisions, the retention period of relevant video recordings may be extended up to 6 months from the end of the month in which the images were captured or, if necessary, for a longer period, until the completion of the investigations of the incident that made it necessary to extend the storage period. In the case of video images that are subject to data access requests, the retention periods of BT petitioners' personal data apply.

3. Retention period for the data of individuals who have expressed marketing preferences

BT Client Data who have expressed consent to receive advertising messages are processed for this purpose until the consent is withdrawn or, otherwise, until the termination of their status as BT Client. Non-client data who have expressed this consent are processed for this purpose until the consent is withdrawn.

4. Data retention period for BT candidates

Personal data processed for BT candidates will be kept until the end of the recruitment process for the position they applied for or, if the candidates expressed interest in being contacted for other BT positions that may suit them, the data will be kept for 1 year. This period may be extended with the candidate's consent.

Data of BT candidates who become BT employees are subject to the retention periods for BT employees' data, provided in the information dedicated to BT employees.

5. Data retention period of BT petitioners

To prove that complaints/claims/information requests/measures have been received and responses to them have been formulated and transmitted, the data related to these petitions will be kept (together with the personal data contained in them), as follows: BT clients' petitions, for the duration of their business relationship with the bank plus 3 years, and petitions from persons who did not have/do not have BT client status, 3 years from the date of sending the response to the petition (legal statute of limitations).

Any other personal data processed by BT for other purposes indicated in this Policy will be retained for the period necessary to fulfill the purposes for which they were collected, to which non-excessive terms may be added, established in accordance with the applicable legal obligations in the field, including but not limited to provisions regarding archiving, or established internally, according to the legitimate interests of the bank.

J. What rights do the data subjects have regarding the processing of personal data

All data subjects are guaranteed the rights below regarding their personal data processed by BT.

You should know that we treat these requests with the highest degree of professionalism and their status is periodically brought to the attention of the Bank's management.

Each of the requests is carefully analyzed, the responses to them are documented and, whenever necessary, we take corrective measures to ensure that we respect the rights you have regarding the legal processing and proper protection of your data, which is an essential component of our obligation to respect human rights.

a) right of access: the data subjects can obtain from BT confirmation that their personal data are processed, as well as information regarding the specifics of the processing such as: the purpose, categories of personal data processed, recipients of the data, the period for which the data is kept, the existence of the right to rectification, deletion or restriction of processing. This right allows the data subjects to obtain a free copy of the processed personal data;

b) the right to correction : the persons concerned may request BT to modify the incorrect data concerning them or, as the case may be, to complete the data that are incomplete;

c)right to erasure (the “right to be forgotten”): the data subjects can request the deletion of their personal data when:

these are no longer necessary for the purposes for which we collected and process them;
the consent for the processing of personal data has been withdrawn and BT can no longer process them on other grounds;
the personal data is processed contrary to the law;
personal data must be deleted according to relevant legislation;

d) the right to withdraw consent : the data subjects can withdraw their consent at any time regarding the processing of personal data processed based on this legal ground. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal;

For withdrawing consent for data processing for advertising purposes, you can also use the following online forms available in the section Privacy Hub:

if you are a BT Client: access the form “Do you want marketing or not?” (options for BT clients) and check the option "I do not want advertising messages";
if you are not a BT client: access the form “Don’t want marketing anymore?” (withdrawal of marketing consent for non-clients);

e) the right of opposition: the data subjects may object at any time to processing for marketing purposes, as well as to processing based on BT's legitimate interest, for reasons related to their specific situation;

f) the right to restriction of processing: the data subjects may request the restriction of processing of their personal data if:

challenge the accuracy of personal data, for a period that allows us to verify the accuracy of the data in question;
the processing is illegal, and the data subject opposes the deletion of personal data, requesting instead the restriction of their use;
the data are no longer necessary to us but the person concerned requests them from us for an action in court;
in the event that the data subject has objected to processing, for the period of time during which we verify whether BT's legitimate rights as controller prevail over the rights of the data subject.

g) the right to data portability: the data subjects may request, under the conditions of the law, that the bank provide them with certain personal data in a structured, commonly used format that can be read automatically. If the data subjects wish, BT can transmit such data to another entity, if technically feasible.

h) rights regarding automated individual decision-making process: as a rule, the data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, if it produces legal effects concerning them or similarly significantly affects them. They have the right to express their point of view, to challenge the decision, and to request human intervention (review of the automatic decision by a BT employee).

i) the right to file a complaint with the National Supervisory Authority for Personal Data Processing (N.S.A.P.D.P.) : the data subjects have the right to file a complaint with the Supervisory Authority if they consider that their rights have been violated:

National Authority for the Supervision of Personal Data Processing, G-ral. Gheorghe Magheru Blvd. 28-30 Sector 1, postal code 010336 Bucharest, Romania, e-mail: anspdcp@dataprotection.ro

For exercising the rights mentioned in points a) – h) above, please use the contact details of the data protection officer designated by BT (DPO BT), sending the request in any of the following ways:

at the e-mail address dpo@btrl.ro
by postal mail, to the address in Cluj-Napoca city, Calea Dorobanților street, no. 30-36, Cluj county, with the mention “to the attention of the data protection officer”

Before sending us the request, we recommend you read the instructions in the section ”How to exercise your GDPR rights at BT” available on Privacy Hub.

K. How do we protect the personal data we process

BT has developed an internal framework of policies, procedures, and standards to maintain the security of personal data. These are periodically reviewed to comply with the regulations applicable to the Bank and the highest standards in the field of data security.

Specifically, the Bank adopts and implements appropriate technical and organizational measures (policies and procedures, IT security, etc.) to ensure the confidentiality, integrity, and availability of personal data and the processing thereof only in accordance with the applicable legal provisions in the field of personal data.

BT employees are obliged to maintain confidentiality and may not illegally disclose personal data to which they have access in the course of their professional activity.

All employees are regularly trained in the field of personal data processing and protection.

In the event that your data is involved in incidents that constitute breaches of their security and if, following the assessment we carry out regarding the incident, we conclude that this incident is likely to pose high risks to your rights and freedoms as a data subject, we commit to inform you about the occurrence of the breach and to provide you with all the information required by law for these cases.

At BT we ensure – both before entering into contractual relationships with partners/suppliers who need to have access to personal data (as an authorized person by the operator), and throughout the entire period during which they have access to the data – that they:

processes the data only in the name and under the instructions of the bank (except when they have the legal obligation to process them);
have implemented appropriate technical and organizational measures to ensure the proper security of data;
assumes contractual obligations in accordance with the provisions of the GDPR and these obligations are respected;
does not disclose personal data of other persons authorized except with prior authorization from BT;
if I cannot ensure the processing of data only in the E.U./E.E.A., I perform the transfer of data to third countries or international organizations only based on adequacy decisions or appropriate safeguards provided by the GDPR, including taking additional measures if necessary for the adequate protection of the data

We guarantee that BT will not sell the personal data of any visited person and that it will disclose this data only to those entitled to know them, respecting the principles and obligations established by law.

The present policy is regularly reviewed to guarantee the rights of the data subjects and to improve the methods of processing and protection of personal data.