Information note regarding the processing of personal data within the BT PAY mobile application

Printable version of this information note Download

Personal data operator

Banca Transilvania S.A., headquartered in Cluj-Napoca, Calea Dorobanților no. 30-36, registered at the Trade Register under no. J1993004155124, VAT number RO5022670 (hereinafter referred to as „BT”), informs you how it will process, as an operator, personal data in the BT Pay mobile application („Application” or ”BT Pay”). The situations in which BT is not the data controller of the processed data are specifically presented in this note.

BT Pay is offered to BT customers, according to The terms and conditions of use of the BT Pay mobile application.

The persons concerned

This information note refers exclusively to the processing of personal data belonging to BT Pay users who are at least 18 years old (“adult users”).

👦 Informing minor users:

Minors aged 14+ years, with their own BT card and account:

Minors aged at least 14 years who have an account opened at BT and use BT Pay with their own card, as well as parents/guardians/legal representatives thereof (“parent”), are invited to consult:

Information note regarding the processing in BT Pay of personal data of minor users over 14 years old who have a BT account,

Information note regarding the processing of personal data for the purpose of identification in BT Pay

Minors, with own BT card attaparent account:

Minors aged between 8 and 18 years who use BT Pay with their own card attached to a parent’s account, are invited to consult:

Information note regarding the processing in BT Pay of the personal data of minor users attached to the parent's account

For minors under 14 years, it is recommended that this information be read together with the parent/ guardian/legal representative (“parent”).

Specific information

BT Pay offers various products/ services that involve, as the case may be, the processing of personal data for specific purposes and grounds. Complete details are available in the following information notes:

for RoPay -> Information note regarding the processing of personal data within RoPay
for obtaining or increasing the credit card limit -> Information note regarding the processing of personal data for obtaining a BT credit card exclusively online.
for obtaining or increasing an overdraft -> Information note regarding the processing of personal data for obtaining an overdraft exclusively online.
for obholding of a personal loan -> Information note regarding the processing of personal data for obtaining a BT personal needs loan 100% online
for the update of personal data through BT Pay -> Information note regarding the processing of personal data for updating the data registered at BT through BT Pay
for Bill Payment Service, in Information note regarding the processing of personal data within the Bill Payment service
For SANB Service -prevention of fraud in the case of interbank transactions -> Information note on the processing of personal data within the Beneficiary Name Display Service (SANB).

BT will periodically update this information note, without imposing less favorable conditions regarding data processing and protection. The changes will be communicated in the BT Pay application, and the updated version will be available at any time for consultation in BT Pay and also on BT website, in the section Privacy Hub.

BT Pay users are always subject to the current version of this information.

If you have any questions or complaints regarding how BT processes personal data, you can contact us at dpo@btrl.ro.

Personal data processed in BT Pay, purposes and grounds of processing

🛡️1. For ensuring security in BT Pay/ fraud prevention

For data security in BT Pay and to prevent fraud, when you register or use BT Pay we process, based on legal obligations and legitimate interest, the following types of data:

📱date about device: such as, but not limited to: device ID and name, model, type/version of operating system, the existence of a security method (e.g. password, fingerprint - BT does not have access to these methods, only verifies if they exist), information regarding recent use of the device for calls/conversations (without access to their content or to the phone numbers called/calling), including the presence of potentially dangerous applications (e.g. malware, remote control applications) - we check the device to detect if such applications are installed and, if so, which ones they are. without having information or access to other installed/used applications on the device.

📡IP address and location based on IP

🔑data necessary for: setting/resetting/unlocking PIN, authentication in the application, transaction authorization, as presented in Information note regarding the processing of personal data for the purpose of identification in BT Pay

Depending on the fraud risks, based on the processing of these data, the bank may take, including automatically, measures such as: blocking the application until the unsafe third-party applications are removed or, as the case may be, until you assume the risks related to their use on a device on which you use BT Pay, blocking suspicious transactions, contacting the user.

These data are essential for the security of the application. If you refuse their processing, usually you will not be able to use BT Pay

🆕 2. For the registration in BT Pay of some new BT clients holding a current account

At the opening of a business relationship through BT Pay, we use remote identification by means of video, which involves processing data from the identity document, contact data, and biometric data (facial recognition), according to applicable legislation. The details are presented in Information note regarding the processing of personal data for opening the business relationship with Banca Transilvania through BT Pay.

💳 3. For the registration in BT PAY of existing BT clients

If you already have a relationship with BT and want to register in BT Pay, it is necessary to identify you through a strict authentication process, according to the legislation regarding payment services. For this purpose, we process personal data, according to the details from Information note regarding the processing of personal data for the purpose of identification in BT Pay accessible from the “Specific information” section of this information note.

For registration in BT Pay, based on the conclusion/performance of the contract related to the Application, we process your a username (nickname), an Application Identifier (wallet ID), card data/ card data(card number, expiration date, CVV/CVC code and the name on the card) that you hold at BT or that you register in BT Pay (cards issued by BT, BT Direct or non-BT cards), declared phone number at BT, respectively at BT Direct and, for non-BT cards the confirmation of 3D Secure verification by the issuing institution (BT does not have access to the data used in this verification, does not know the method or the personal data used for verification by the card issuing institution).

🧭4. For using BT Pay

For the execution of the contract related to BT Pay to which you are a party, for fulfilling the bank's legal obligations, based on our legitimate interest and, where applicable, upon your consent, we process personal data as follows:

I. "Cards" Functionality

1. Card payments at merchants

With devices Android with NFC activated, you can pay with BT cards from BT Pay. In this case, we process data such as: device dates (the system and the operating system version, if it has the NFC function and if it is activated), required authentication (ex. unlocking the phone), details about transactions (amount, date, location), card and account data used.

For card enrollment in Google Pay, the application will display the option if you use Android and have unenrolled BT cards. In this case, BT securely transmits to Google card data (its number, expiration date, name), BT client code (BT CIF), Device ID and Wallet ID.

On devices iOS, for NFC payments card enrollment is required in Apple Pay, according to Apple terms. BT Pay will display the quick enrollment option and will process device dates (system and operating system version), card data (PAN, expiration date, name, BIN and card type) on which sends it securely to Apple.

To authorize online payments with "Pay with BT Pay", we process selected card data and authorization method.

For online payments through "Click to Pay", users need to create a Click to Pay profile from the app. If e-mail and phone number registered at the bank match those used at the merchant, the transaction can be authorized without manually entering the card details. Details regarding the processing of personal data arăsesc in the dedicated section of Terms and conditions of use of the functionality„Click to Pay” from BT Pay.

2. Transfers based on phone number (P2P) or IBAN

With BT Pay you can: send/request money to/from contacts or other BT Pay users, via phone number (P2P); make transfers based on IBAN; make transfers between your own cards registered in BT Pay.

For P2P transfers, the application can access (only with your consent)phone agenda for the transfer. If you do not allow access, you will have to manually enter the recipient's number.

During the initiation of a P2P, the application will show if the phone number entered is associated with a BT accountPay. Thus, if the phone number on which the BT Pay application is installed is selected or entered by any BT Pay user îin order to carry out a P2P transfer, that user will find out that the BT Pay application is installed on that phone number.

For carrying out P2P transfers we process: card data (including your preferred card for receiving P2P transfers, if you have chosen one), transaction data (amount, date, explanation, IBAN and the name of the payer/beneficiary of the transfer), phone number (yours and the other BT Pay user's).)

For transfers based on IBAN code, we process card and account data you (formal), transaction data (as in a P2P transfer), the beneficiary's transfer details (name, first name, IBAN).

You can send the proof of transfer P2P or by IBAN to a email address.

For transfers between own cards registered in BT Pay we process card data between which you make the transfer and accountsBT to which these are attached and transaction data.

Within the “Cards” functionality, BT Pay allows users to perform other banking operations as well, such as cash withdrawals (with code or contactless), setting limits and blocking cards, viewing card details, authenticating online payments, paying bills, enrolling in Open Banking, issuing cards (including for additional users), transferring money to BT, and saving cards with merchants, viewing information about the limit/credit line and payments made with the card broken down by merchant category where they were made, for credit cards. For each functionality, Banca Transilvania processes relevant personal data (e.g., card data, phone number, transactions) .

3. Cash withdrawal from BT ATM based on code

From BT Pay you can generate a temporary code for cash withdrawal from ATM (valid only for cards issued to individuals). We process phone number (selected from the agenda/ entered by you) for sending the code, card and account data, transaction data.

4. Contactless cash withdrawal from BT ATM

With BT Pay the user can withdraw cash contactless from the ATM. This operation will be possible only by entering PIN code related to the respective card.

5. Setting trading limits and/or blocking cards

From BT Pay, transaction limits can be set on BT cards registered in the application, these cards can be blocked - temporarily or permanently - and the unblocking of temporarily blocked cards can be requested. We process information about the set limits, status and card data, as well as the phone number declared at BT (these operations being allowed only based on the OTP code sent via SMS).

6. Displaying card details in the application

Through the BT Pay application, it will be possible to view card data – card number and CVV/CVC code în view of facilitating its use for online payments, as well as PIN code set for card. We process these data and, if applicable, the phone number declared at BT (when display is allowed only based on the OTP code sent via SMS).

7. Authentication/ confirmation of online payments via BT Pay

Online payments (payments made on merchants' websites) initiated with BT cards registered in BT Pay, including in 3D secure, can be authenticated/ declined exclusively through the application. We process card data, transaction data (including the name of the merchant to whom the payment is to be made and the transaction identifier, which will be stored on the device you use, from the initiation of the payment, until the online payment is authenticated or rejected, as the case may be).

Notification related to the authentication/ rejection of such an online payment will be transmitted on the "general" channel in the Application. Not enabling notifications sent on the "general" channel will prevent receiving the notification for authentication/ rejection of online payment. On Android phones, with your consent, BT Pay can automatically display the payment confirmation screen, without manually opening the application or notification. Permission is requested after the first online payment or can be activated from the phone settings, applications section – BT Pay.

8. Activation and use of the Bill Payment service

Personal data for the activation and use of this service are processed in accordance with the specific information note, accessible from the "Specific Information" section of this information note.

9. Enrollment in Open Banking

For using the Open Banking functionality (available for non-BT cards added in BT Pay), BT processes the following information which are, as the case may be, personal data :IBAN, the balance of the non-BT card/account and the history/data of transactions from non-BT accounts (date, amount, transaction details, counterparty from the transaction performed in the non-BT account).

10. Issuing/reissuing a card

From BT Pay you will be able to request the issuance/reissuance of a card for yourself (including virtual card) or for a person you designate as an additional card user. In this case, we process, as appropriate, your personal data and/or those of the additional card user: date of the card issued/reissued, the IBAN of the account to which it will be attached, the delivery address of the card, the personal numeric code (CNP) and the phone number of the supplementary card user. If the supplementary card user is not yet identified in BT Pay at the time of designation, we will process their personal data also for identification in BT Pay, as provided in Information note regarding the processing of personal data for the purpose of identification in BT Pay, accessible from the “Specific notifications” section of this information note.

11. Option “Move your money to BT”

When you use this functionality we process personal data as follows: transaction data (amounts, transfer recurrence, the bank institution from which you make the transfer), card and account data,

12. Option “Card saved with merchants”

When you use this option we process your: name, first name, e-mail address, card details, information about active subscriptions, details about recurring payments (amount, frequency, date) and the sites where the card data were saved.

13. Credit info and expense grouping

For credit cards, you can also view information about the line/ credit limit, minimum payment obligation and the amount paid, any guarantees of the credit line, transactions posted in installments, accumulated Star points number, to activate/ deactivate monthly automatic payment and the amount of this payment, and to see the grouping of expenses according to the category of merchants where payments were made (does not involve the analysis or evaluation of payment behavior). We process this personal data to help you manage your financial resources (purpose of financial education)

II. The functionalities "Accounts" and “Savings”

For viewing, using and managing in BT Pay a current accounts, credit card accounts, savings accounts, deposits and associated services (such as Round Up, extracts, transfers or payments), BT processes the following categories of personal data related to these accounts, as applicable: IBANs, balances, currencies, cards attached to accounts, data regarding transactions (amount, explanations, date, exchange rate, payment recipients' details - last name, first name, account number, transaction history), recurring payments, predefined beneficiaries, amounts and settings related to the Round Up service, data regarding the establishment and management of deposits and savings accounts (amounts, start/end dates, transfer frequency), information regarding interest and related taxes.

In case of sending the proof of payment by e-mail, it will also be processed and address entered by user.

III. The “Credits” Functionality

In case of accessing the "Credits" functionality, the Bank will process personal data aboutthe products you have at BT (IBAN and the credit account balance, of the current account from which the monthly installment is withheld or of the account you select to make an early repayment on a non-card credit, număthe credit contract term, the contracted credit amount, the start and end date of the credit, the amount related to the monthly instalment, any arrears, the repayment schedule, insurances related to the credits and their status).

IV. “Investments” functionality

Products in this BT Pay section are offered by subsidiary companies of the bank (member entities of the BT Financial Group). In this case, Banca Transilvania processes your data as an authorized person, and the subsidiary is the operator. Your data from the bank's records necessary for concluding/performing the contract you enter into with the subsidiary are sent to the respective subsidiary, which will process them in accordance with the provisions of its own Privacy Policy. You can find details below:

For the purchase and management of units at funds managed by the bank's subsidiary - BT Asset Management SAI (BTAM) -from BT Pay you can become an investor in the funds managed by BTAM by signing the brokerage contract with BT, to buy/sell and manage fund units (UF) in the fund you choose. Your personal data will be processed by the BTAM operator such as: name, surname, Personal Numeric Code (CNP), BTAM client ID, investment account number, transaction history, balance held in investment funds managed by BTAM, information related to gain/ loss and withholding tax. Veți deveni client BTAM. Details about the processing of personal data carried out by the BTAM operator can be found in the BTAM Privacy Policy, available on the website www.btassetmanagement.ro.

To become a participant and to view the amounts accumulated in the voluntary pension funds managed by subsidiary băncii - BT Pensii SAFPF S.A. (BT Pensii) - by signing the accession act to a voluntary pension fund (pillar III) managed by BT Pensii, you become a participant in this fund (BT Pensii client). You will be able to set and manage the contribution to the fund, including expressing your options regarding BT Pensii's communication with you. Details about the personal data processing carried out by the BT Pensii operator can be found in the BT Pensii Privacy Policy, available on the website www.btpensii.ro

To view the amounts accumulated in your pension managed privately by the bank's subsidiary – BT Pensia Noastră SAFPP S.A. – if you have the private pension (pillar II) at BT Our Pension, you can view the accumulated amount in BT Pay. Details about the processing of personal data carried out by the operator BT Pensia Noastră can be found on the website https://btpensianoastra.ro/

V. Functionality "Kiddo"

1. BT Pay Kiddo – for minors aged 14 +, with own BT card and account

If you initiate, as a parent, a connection of a minor from this section in BT Pay Kiddo , we will check if you meet the conditions set out in BT Pay Kiddo Terms. In this regard, we will process the following personal data: name, first name, CNP, age,the status of parent of the minor and of theauthorized on his account.

2. BT Pay Kiddo – for minors with own BT card attached at the parent's account:

If you initiate, as a parent, a connection of a minor from this section in BT Pay Kiddo, we will verify if you meet the conditions provided in BT Pay Kiddo terms for minors attached to the parent's account. For this purpose, we will process the following personal data: name, first name, CNP, age șand implicit personal data consisting of the relationship between you and the respective minor.

VI. Other BT Pay functionalities

1. Identification through BT Pay in calls or at BT units

If you choose identification through BT Pay during a call with an agent from the BT call center or at a BT unit, we will process your personal data: the status of BT client BT Pay user, phone number, authentication method (PIN, biometrics, phone unlock) and application version.

2. Beneficiary Name Display Service (SANB) for the purpose of fraud prevention

We have the legal obligation and legitimate interest to prevent banking frauds. To protect you in case interbank transactions (payments to accounts in other banks), BT together with other associated operators, process your personal data according to the details in Information note on the processing of personal data within the Beneficiary Name Display Service (SANB) , from the “Specific notifications” section in this information note. In case intrabank settlements (payments to BT accounts), BT processes the same categories of personal data on its own as those used within SANB. The basis for processing your data is BT's legitimate interest in preventing fraud in the case of intrabank payments (BT-BT). The first name(s) (one or more, as applicable) in full and the initial of your registered last name at BT will be displayed to other BT clients who initiate a payment to your BT account from a bank application, regardless of whether the payment is completed or not.

3. Updating personal data

Through this functionality, you can update some personal data at the bank. Details about the processing of personal data can be found in the specific information note in the "specific information" section of this information note.

4. Managing authorized representatives

If you have received/have access in BT Pay to the accounts of other BT individual clients, adults or minors, on which you are designated with operating rights (authorized representative), we process data about your status as authorized representative on those accounts, about the transactions and any actions you perform on those accounts. Also, we process your data if these clients revoke your status as authorized representative in BT Pay on their accounts.

If you grant access in BT Pay to other BT customers, adult natural persons designated with operating rights (authorized person) on your accounts, we process data about your quality as an account holder who has designated an authorized person(s) with access rights in BT Pay. Also, if the authorized persons carry out transactions and any actions on your accounts, we process the necessary data (name, surname, accounts, transactions, balance, etc.)

5. Current account subscription management

Through this functionality, you can activate and deactivate current account subscriptions and view details about the subscription you have active. For the execution of contracts related to each of the products and services offered by BT that are part of these subscriptions, we process your necessary personal data, as provided in General information note regarding the processing and protection of personal data belonging to BT clients. For insurance products that are included in some of the subscriptions, the operator of your personal data for concluding and executing the insurance policy is the Insurer.

6. RCA Insurance

Through the "RCA Insurance" section in BT Pay you can obtain quotes or conclude RCA policies. Through the "RCA Insurance" section in BT Pay you can obtain quotes or conclude RCA policies. If you use this section of BT Pay, BT processes the data as an operator for: (i) facilitating the conclusion of the necessary contractual documentation, by pre-filling identification and contact data (e.g., phone number) as found in the bank's records; (ii) payment of RCA insurance policies, if you contract them based on insurance offers obtained by BT Broker from the insurers it collaborates with; and (iii) for reconciling payments related to the insurance policies. In return, the personal data necessary for obtaining and displaying RCA insurance offers in BT Pay, as well as for concluding and executing RCA insurance policies, the data operators are, as applicable, BT Broker and the Insurers from whom you choose to contract the insurance policy.

7. Travel insurance

Through BT Pay you can obtain insurance offers and conclude travel insurance from Groupama Insurance. For this functionality, BT processes personal data as an authorized person of Groupama. Details regarding the processing of personal data carried out by Groupama are accessible directly from the application, in the "Travel Insurance" section.

8. Home insurance

Through BT Pay you can obtain the insurance offer and conclude a voluntary home insurance from Groupama Insurance and a PAD insurance. For this functionality, BT processes personal data as an authorized person of Groupama. Details regarding the processing of personal data carried out by Groupama are directly accessible from the application, in the "Home Insurance" section.

9. Phone card recharge

When you use this option, we process: phone number for which the recharge is made, card details, account balance from which you make the loading.

10. Purchaseyou eSIM

When you use this option and purchase an eSIM data plan from our partner – Timesafe SRL (Pago) which offers this service in BT Pay, BT will process, including disclose to Pago, your data consisting of: name, first name, unique identifier (BT client code – BT CIF), data regarding the transaction through which you purchased the eSIM (payment transaction reference, payment status, information regarding the payment method used for the eSIM purchase - bank card).

In the context of using the eSIM functionality from BT Pay, Pago processes your data as an independent operator, as provided in the Timesafe SRL Privacy Policy for eSIM in BT Pay, which you can access from the relevant eSIM section.

11. Purchase of road vignette

When you purchase or renew the road vignette for Romania from BT Pay, BT will process: data about the vehicle, the card used and the available balance

🔊 5. For communication with BT Pay users through the application

a. Notifications

Through BT Pay we send you several types of notifications:

Notifications related to card payments: confirmation/ denial of payments made with cards registered in the application, authentication/rejection of online payments initiated with BT cards enrolled in the application and in 3D Secure.
Notifications related to transfers: acceptance/ rejection of the transaction initiated via P2P; confirmation of the successful execution of the transaction;
Notifications related to partial prepayment of non-card credit: information regarding the status of the request for partial early repayment of the non-card loan.
Notifications for identification through BT Pay: identification requests in the application (in call with BT call center agent or for identification with BT Pay in units).
Notifications for the Bill Payments service: messages dedicated to the users of this service.
Notifications/ messages of general interest: relevant information about the BT Pay application, other than those related to the above functionalities.
Notifications/ messages of particular interest: ex. changes to the Bank's General Business Conditions, changes in fees, updates to the information notes regarding the processing of personal data; notifications of data update in the bank's records.
Advertising messages,if you have given your consent to BT to process your data for advertising purposes, through the dedicated form (available in the units, on BT website, in BT Pay Web or in the process of opening a business relationship with the bank for BT Pay for individuals or through BT Go for legal entities).
Notifications about “Offers” from BT Pay: notifications regarding new offers added in the app; Notifications about unlocked offers in the "Offers – prizes on the move" section. By accessing the "Offers" section in the application, you agree that BT may collect information about: the offers accessed (saved, activated, or applied to), for the purpose of presenting relevant offers in the future and for applying the preferential conditions related to the activated or accessed offers.

🏃‍♀️ Awards în Mișwhich –BT Pay -

to encourage an active lifestyle, BT Pay includes in the “Offers” section the subsection ““Awards in Motion”, where users can unlock special offers from partners and the bank. Accessing the Moving Awards section is optional and does not affect the general use of BT Pay.

As a result of connecting a physical activity monitoring application, BT Pay will request permission to access data such as: number of steps, kilometers traveled, active minutes. These data are visible only to the user who connected them and are used exclusively for: verifying eligibility for offers, awarding prizes . The data is stored only for the duration necessary to fulfill these purposes. Some offers may also include other parameters, such as activity with the card or in the application, specify clearly in each offer. In case these data fall under the category of health data by granting access to these data from the monitoring application, you express your explicit consent for their processing for the purposes mentioned in this paragraph. If you grant access to the data from the monitoring application, you can revoke it at any time from the settings of the respective application or of the phone. Withdrawal of access also represents a withdrawal of consent. Without access, you will not be eligible for offers in this category.

BT Pay will also ask for access to device location, for displaying valid offers in the area where you are located (e.g. for the automatic display of Star partners' offers (for Star credit card holders, for displaying partner locations related to the offers on the map). You are not required to allow location access, but you have the option to manually select the locality. If you refuse access, the other BT Pay functionalities can be used without impediments

You can enable/disable notifications from the app's Settings menu. If notifications are not turned on ("on"), they will not be received as push notifications but will be available in the Notifications section of the app.

b. assistance and support through the BT Pay chatbot

Through the BT Pay chatbot you can chat in real time with a BT consultant. In this context, we process data such as: name, BT CIF, client type, card names, application version, phone operating system, and the language selected in the chat, for identification and support.

📈 6. For the analysis and improvement of BT Pay performances

In order to be able to compile statistics that allow the measurement of BT Pay's performances, aimed at improving its performances, we have the legitimate interest to collect the following information about the devices on which it is installed - device identifier (Device ID), phone type, operating system, operating system version, device name, device settings, necessary accesses to have internet connection.

Period of retention of personal data processed in BT Pay

Except in cases expressly mentioned within this information note, your data, as a BT client, as well as data regarding transactions carried out through BT Pay will be kept for a period of 5 years from the termination of your business relationship with the bank, according to applicable legal provisions, except for data that must be kept for a period of 10 years, according to legal provisions in the financial accounting and fiscal domain.

Recipients of personal data processed in BT Pay

Data provided directly by the users of the application or that the Bank may become aware of in the context of installation, registration, enrollment/ use of the Application, may be disclosed by Banca Transilvania to certain categories of recipients, as follows:

other Clients of BT who have the right and need to know them (all BT Pay users are BT Clients)

a. BT Pay users which you have authorized on your accounts including in the application

If you have fully authorized representatives on all BT accounts and have granted them access to these in the application as well, they will have access in the application to personal data about you and the counterparties in the transactions mentioned in the section II. The functionalities "Accounts" and "Savings" from this information note, except for cards attached to accounts. The authorized persons can view these data, make transfers and currency exchanges, access statements and transaction history, share the IBAN, set up recurring payments and manage savings and deposits.

b. BT Pay users who have appointed you with full operational rights on all their accounts opened at BT.

If other BT customers, natural persons, account holders, have granted you full operating rights on all their BT accounts, they will see in the application your first and last name, as well as the fact that you are their authorized representative. When you perform transactions on these accounts, we will disclose to the account holders the data regarding the transactions made (data about you and about the counterparties involved in the transactions).

c. other BT clients who hold additional user cards attached to your accounts

If you have requested the issuance of additional cards on your account in the name of additional card users, they can view your account balance in BT Pay.

d. other BT clients, on whose account you hold a supplementary card issued in your name.

If you have an additional card issued on another BT client's account, the account holder client will also be able to see in BT Pay details about the transactions made with that card (amount, merchant, date, etc.).

e. other BT clients BT Pay users, who find out from the icon displayed next to your phone number/contact in their device's address book that you are a BT Pay user (and implicitly find out that you also have BT client status).

BT client accounts to which you make payments from BT Pay

When making transactions through BT Pay to accounts/ phone numbers of other BT clients from accounts that belong to you, the data related to these transactions (usually, your first and last name, the amount, the account number, the payment explanations), will be accessible to the beneficiaries to whom you have made the payment.

contractual partners of the bank

a. Service providers who assist us in providing the Application and in related activities (e.g. SMS transmission service providers, e-mail; trusted service providers for signing documentation in the application with advanced electronic signature, etc); identification service providers (for identification in BT Pay which involves photographing the identity document and/or the face - selfie/video selfie - , BT uses the provider's services Onfido and some of its subcontractors, who process, only on behalf of and under the instructions of the bank, the data from the identity document, the image - including the one from the video selfie taken in BT Pay - and respectively the biometric data of the face, used for identification in BT Pay. The processing of data will in some cases also take place in third countries. The transfer of personal data to these states is based either on adequacy decisions issued by the European Commission (e.g. in the United Kingdom), or on other appropriate safeguards, in accordance with the mechanisms provided by the GDPR consisting of Standard Contractual Clauses approved by the European Commission which you can find here: https://eur-lex.europa.eu/legal-content/RO/TXT/PDF/?uri=CELEX:32021D0914)

b. Apple (Apple Pay solution), in case you opted to enroll your card in this payment solution

c. other entities within the BT Financial Groupwhose services/products are accessible through BT Pay (e.g. distribution of fund units through BTAM, optional pension funds managed by BT Pensions or privately managed by BT Our Pension)

d. BT partnerswhose services/products are accessible through BT Pay, including according to specific information notes (e.g. insurance companies, Timesafe SRL for eSIM etc)

Categories of recipients to whom personal data is disclosed in the context of registration or enrollment in/through BT Pay as well as separate services RoPay BT, Bill Payments, Overdraft,Credit Card and credit line increase exclusively online, 100% online personal loan are mentioned in the specific information notes for the processing of personal data within these services.

Recipient list above is completed with that provided in General information note regarding the processing and protection of personal data belonging to BT Clients, section VIII.

Links and third-party applications

The application contains links to the websites belonging to partner merchants.

At the same time, the application offers users the possibility to access:

third-party applications - for monitoring physical activity- by logging in with the account data from the respective application through the BT Pay application, in order to unlock some preferential offers from the section Moving awards a BT Pay.
through section Offers,customized links from partner merchants, upon accessing which third parties will be able to know that the person accessed them from BT Pay, thus implicitly the fact that he is a BT client.

🔒Responsibility regarding the processing of personal data - the bank does not control, does not manage and is not responsible for the way its merchant partners process your personal data on their websites or applications, even if you access these platforms from BT Pay. BT cannot guarantee that this data is managed in accordance with personal data protection legislation (e.g. GDPR, Law 506/2004, Law 190/2018), cannot verify the accuracy or timeliness of the data these platforms/websites have about you. Each third-party website or application has its own rules regarding data processing. We recommend that you consult their privacy policies to ensure they align with your interests.

Rights related to the processing of personal data in BT Pay

Your processing of your personal data within BT Pay is subject, in addition to this information, to the provisions General information notes regarding the processing and protection of personal data belonging to BT clients, integral part of BT Privacy Policies, which you can find on the website www.bancatransilvania.ro, in the Privacy Hub section or on request at any bank unit.

Within the mentioned General Information Note you will also find the rights you can exercise regarding the processing of your personal data, the ways in which you can exercise them, as well as the contact details of the Data Protection Officer (DPO) and how you can contact him.

You can exercise the following rights regarding the processing of your data by the BT operator: a. the right of access, b. the right to rectification of data, c. the right to deletion (the “right to be forgotten”), d. the right to withdraw consent, e. the right to object, f. the right to restriction of processing, g. the right to data portability, h. the right to object to decisions based solely on the automated processing of personal data, including profiling, i. the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (N.S.A.P.D.P.), at the contact details of the authority available on the site www.dataprotection.ro.

For exercising at BT the rights mentioned in points a. – h. above, please use the contact details of the data protection officer appointed by BT (DPO BT), sending the request in any of the following ways: 1. to the e-mail address dpo@btrl.ro; 2. by postal mail, to the address in Cluj-Napoca city, Calea Dorobanților Street, no. 30-36, Cluj County, with the mention "to the attention of the data protection officer", 3. by filling out the online form available for Clients in the section: ”How to exercise your GDPR rights at BT”, available on Privacy Hub

Information note on the processing of personal data in the BT PAY mobile application (Privacy Policy related to the BT Pay mobile application)