Privacy notice on the processing of personal data in the BT PAY mobile app (Privacy policy for the BT Pay mobile app)

Updated version as of October 8, 2026

Printable version of this privacy notice Download

Banca Transilvania S.A., headquartered in Cluj-Napoca, Calea Dorobanților no. 30-36, registered at the Trade Register under no. J1993004155124, VAT number RO5022670 (hereinafter referred to as „BT”), informs you how it will process, as an operator, personal data in the BT Pay mobile application („Application” or ”BT Pay”). The situations in which BT is not the data controller of the processed data are specifically presented in this note.

BT Pay is offered to BT customers, according to The terms and conditions of use of the BT Pay mobile application.

This privacy notice refers exclusively to the processing of personal data belonging to BT Pay users who are at least 18 years old (“adult users”).

👦 Informing minor users:

Minors aged 14+ years, with their own BT card and account:

Minors aged at least 14 years who have an account opened at BT and use BT Pay with their own card, as well as parents/guardians/legal representatives thereof (“parent”), are invited to consult:

Minors, with own BT card attaparent account:

Minors aged between 8 and 18 years who use BT Pay with their own card attached to a parent’s account, are invited to consult:

Privacy notice on the processing in BT Pay of personal data of minor users linked to the parent’s account

For minors under 14 years, it is recommended that this information be read together with the parent/ guardian/legal representative (“parent”).

BT Pay offers various products/services that may involve the processing of personal data for specific purposes and legal grounds, as applicable. Complete details are available in the following privacy notices:

for RoPay -> Privacy notice regarding the processing of personal data within RoPay
for obtaining or increasing the credit card limit -> Privacy notice on the processing of personal data for obtaining a BT credit card exclusively online.
for obtaining or increasing an overdraft -> Privacy notice on the processing of personal data for obtaining an overdraft exclusively online.
for obholding of a personal loan -> Privacy notice on the processing of personal data for obtaining a BT personal needs loan 100% online
for the update of personal data through BT Pay -> Privacy notice on personal data processing for updating data registered with BT through BT Pay
For SANB Service -prevention of fraud in the case of interbank transactions -> Privacy notice regarding the processing of personal data within the Beneficiary Name Display Service (SANB).

BT will update this privacy notice periodically, without imposing less favorable conditions regarding data processing and protection. Changes will be communicated in the BT Pay app, and the updated version will always be available for review in BT Pay and also on BT website, in the section Privacy Hub.

BT Pay users are always subject to the current version of this information.

If you have any questions or complaints regarding how BT processes personal data, you can contact us at dpo@btrl.ro.

🛡️1. For ensuring security in BT Pay/ fraud prevention

For data security in BT Pay and to prevent fraud, when you register or use BT Pay we process, based on legal obligations and legitimate interest, the following types of data:

📱date about device: such as, but not limited to: device ID and name, model, type/version of operating system, the existence of a security method (e.g. password, fingerprint - BT does not have access to these methods, only verifies if they exist), information regarding recent use of the device for calls/conversations (without access to their content or to the phone numbers called/calling), including the presence of potentially dangerous applications (e.g. malware, remote control applications) - we check the device to detect if such applications are installed and, if so, which ones they are. without having information or access to other installed/used applications on the device.

📡IP address and location based on IP

🔑data necessary for: setting/resetting/unlocking PIN, authentication in the application, transaction authorization, as presented in Privacy notice regarding the processing of personal data for identification purposes in BT Pay

Depending on the fraud risks, based on the processing of these data, the bank may take, including automatically, measures such as: blocking the application until the unsafe third-party applications are removed or, as the case may be, until you assume the risks related to their use on a device on which you use BT Pay, blocking suspicious transactions, contacting the user.

These data are essential for the security of the application. If you refuse their processing, usually you will not be able to use BT Pay

🆕 2. For the registration in BT Pay of some new BT clients holding a current account

At the opening of a business relationship through BT Pay, we use remote identification by means of video, which involves processing data from the identity document, contact data, and biometric data (facial recognition), according to applicable legislation. The details are presented in Privacy notice regarding the processing of personal data for opening a business relationship with Banca Transilvania through BT Pay.

💳 3. For the registration in BT PAY of existing BT clients

If you already have a relationship with BT and want to register in BT Pay, it is necessary to identify you through a strict authentication process, according to the legislation regarding payment services. For this purpose, we process personal data, according to the details from Privacy notice regarding the processing of personal data for identification purposes in BT Pay accessible from the “Specific Notices” section of this privacy notice.

For registration in BT Pay, based on the conclusion/performance of the contract related to the Application, we process your a username (nickname), an Application Identifier (wallet ID), card data/ card data (card number, expiration date, CVV/CVC code and the name on the card) that you hold at BT or that you register in BT Pay (cards issued by BT, BT Direct or non-BT cards), declared phone number at BT, respectively at BT Direct and, for non-BT cards the confirmation of 3D Secure verification by the issuing institution (BT does not have access to the data used in this verification, nor does it know the method or the personal data used for verification by the card's issuing institution).

🧭4. For using BT Pay

For the execution of the contract related to BT Pay to which you are a party, for fulfilling the bank's legal obligations, based on our legitimate interest and, where applicable, upon your consent, we process personal data as follows:

I. The "Cards", "Cards" and "Savings" Features

1. Card payments at merchants

With devices Android with NFC active, you can pay with BT cards in BT Pay. In this case, we process data such as: device dates (the system and the operating system version, ifhas the NFC function and if it is activated), required authentication (ex. unlocking the phone), transaction details (amount, date, location), card and account detailsi used.

For card enrollment in Google Pay, the app will display the option if you use Android and have unenrolled BT cards. In this case, BT securely transmits to Google card data (its number, expiration date, name), BT client code (BT CIF), Device ID and Wallet ID.

On devices iOS, for NFC payments card enrollment is required in Apple Pay, according to terms Apple. BT Pay will display the quick enrollment option and will process device dates (system and operating system version), card data (PAN, expiration date, name, BIN and card type) on which securely sends it to Apple.

To authorize online payments with "Pay with BT Pay", we process selected card data and authorization method.

2. Transfers based on phone number (P2P) or IBAN

With BT Pay you can: send/request money to/from contacts or other BT Pay users, via phone number (P2P); make transfers based on IBAN; make transfers between your own cards registered in BT Pay.

For P2P transfers, the application can access (only with your consent)phone agenda for the transfer. If you do not allow access, you will have to manually enter the recipient's number.

During the initiation of a P2P, the application will show if the phone number entered is associated with a BT accountPay. Thus, if the phone number on which the BT Pay application is installed is selected or entered by any BT Pay user îin order to carry out a P2P transfer, that user will find out that the BT Pay application is installed on that phone number.

For carrying out P2P transfers we process: card data (including your preferred card for receiving P2P transfers, if you have chosen one), transaction data (amount, date, explanation, IBAN and the name of the payer/beneficiary of the transfer), phone number (yours and the other BT Pay user's).)

For transfers based on IBAN code, we process card and account data you (formal), transaction data (as in a P2P transfer), the beneficiary's transfer details (name, first name, IBAN).

You can send the proof of transfer P2P or by IBAN to a email address.

For transfers between own cards registered in BT Pay we process card data between which you make the transfer and accountsBT to which these are attached and transaction data.

Through BT Pay, users can make and others banking operations, such as cash withdrawals (with code or contactless), setting limits and blocking cards, viewing card details, authenticating online payments, paying bills, setting up recurring payments, issuing cards (including for additional users), transferring money to BT and saving cards with merchants, viewing informationto them about the credit limit/line and the card payments broken down by merchant category for credit cards. For each feature, Banca Transilvania processes relevant personal data (e.g., card details, phone number, transactions). Details about these processes can be found below.

3. Cash withdrawal from BT ATM based on code

From BT Pay you can generate a temporary code for cash withdrawal from ATM (valid only for cards issued to individuals). We process phone number (selected from the agenda/ entered by you) for sending the code, card and account data, transaction data.

4. Contactless cash withdrawal from BT ATM

With BT Pay the user can withdraw cash contactless from the ATM. This operation will be possible only by entering PIN code related to the respective card.

5. Setting trading limits and/or blocking cards

From BT Pay, transaction limits can be set on BT cards registered in the application, these cards can be blocked - temporarily or permanently - and the unblocking of temporarily blocked cards can be requested. We process information about the set limits, status and card data, as well as the phone number declared at BT (these operations being allowed only based on the OTP code sent via SMS).

6. Displaying card details in the application

Through the BT Pay application, it will be possible to view card data – card number and CVV/CVC code în view of facilitating its use for online payments, as well as PIN code set for card. We process these data and, if applicable, the phone number declared at BT (when display is allowed only based on the OTP code sent via SMS).

7. Authentication/ confirmation of online payments via BT Pay

Online payments (payments made on merchants' websites) initiated with BT cards registered in BT Pay, including in 3D secure, can be authenticated/ declined exclusively through the application. We process card data, transaction data (including the name of the merchant to whom the payment is to be made and the transaction identifier, which will be stored on the device you use, from the initiation of the payment, until the online payment is authenticated or rejected, as the case may be).

The notification related to the authentication or rejection of an online payment is sent to the App. Displaying this notification depends both on the notification settings you have configured in BT Pay and on the notification settings you have set on the device used for BT Pay. On Android phones, with your consent, BT Pay can automatically display the payment confirmation screen without the need to manually open the app or the notification.

8. Activation and Use of the Bill Payments Service

Personal data for activating and using this service are processed according to the specific information, regfound in the Terms and Conditions of service use.

9. Issuing/Reissuing a card

From BT Pay you will be able to request the issuance/reissuance of a card for yourself (including virtual card) or for a person you designate as an additional card user. In this case, we process, as appropriate, your personal data and/or those of the additional card user: date of the card issued/reissued, the IBAN of the account to which it will be attached, the delivery address of the card, the personal numeric code (CNP) and the phone number of the supplementary card user. If the supplementary card user is not yet identified in BT Pay at the time of designation, we will process their personal data also for identification in BT Pay, as provided in Privacy notice regarding the processing of personal data for identification purposes in BT Pay, accessible from the “Specific Notices” section of this privacy notice.

10. The “Add money to BT” option

When you use this functionality we process personal data as follows: transaction data (amounts, transfer recurrence, the bank institution from which you make the transfer), dnon-BT card fees from which you add amounts and BT accounts list in which you add them.

11. “Card saved with merchants” option

When you use this option we process your: name, first name, e-mail address, card details, information about active subscriptions, details about recurring payments (amount, frequency, date) and the sites where the card data were saved.

12. Credit info and expense grouping

For credit cards, you can also view information about the line/ credit limit, minimum payment obligation and the amount paid, any guarantees of the credit line, transactions posted in installments, accumulated Star points number, to activate/ deactivate monthly automatic payment and the amount of this payment, and to see the grouping of expenses according to the category of merchants where payments were made (does not involve analysis or evaluation of payment behavior). We process this personal data to help you manage your financial resources (for financial education purposes).

13. "Accounts" and “Savings”

For viewing, using, and managing current accounts, credit card accounts, savings accounts, deposits, and associated services (such as Round Up, statements, transfers, or payments) in BT Pay, BT processes the following categories of personal data related to these accounts, as applicable: IBANs, balances, currencies, cards linked to accounts, transaction details (amount, explanations, date, exchange rate, payment recipient details - first name, last name, account number, transaction history), recurring payments, predefined beneficiaries, amounts and settings related to the Round Up service, data on the establishment and management of deposits and savings accounts (amounts, start/end dates, transfer frequency), information on interest rates and related taxes.

When proof of payment is sent by e-mail, the address entered by the user will also be processed.

II. The “Investments” feature

Products in this BT Pay section are offered by the bank’s subsidiaries (entities that are part of the BT Financial Group). In this case, Banca Transilvania processes your data as an authorized person, and the subsidiary is the data controller. Your data from the bank’s records necessary for concluding/performing the contract you enter into with the subsidiary are sent to that subsidiary, which will process them according to its own Privacy Policy. Details follow:

For the purchase and management of units at funds managed by the bank's subsidiary - BT Asset Management SAI (BTAM) - from BT Pay you can become an investor in the funds managed by BTAM by signing the brokerage contract with BT, to buy/sell and manage fund units (UF) in the fund you choose. Your personal data will be processed by the BTAM operator such as: name, surname, Personal Numeric Code (CNP), BTAM client ID, investment account number, transaction history, balance held in investment funds managed by BTAM, information related to gain/ loss and withholding tax. Veți deveni client BTAM. Details about the processing of personal data carried out by the BTAM operator can be found in the BTAM Privacy Policy, available on the website www.btassetmanagement.ro.

III. The “Pensions” Feature

To become a participant and to view the amounts accumulated in the voluntary pension funds managed by subsidiary băncii - BT Pensii SAFPF S.A. (BT Pensii) - by signing the accession act to a voluntary pension fund (pillar III) managed by BT Pensii, you become a participant in this fund (BT Pensii client). You will be able to set and manage the contribution to the fund, including expressing your options regarding BT Pensii's communication with you. Details about the personal data processing carried out by the BT Pensii operator can be found in the BT Pensii Privacy Policy, available on the website www.btpensii.ro.

To view the amounts accumulated in your privately managed pension by the bank’s subsidiary – BT Pensia Noastră SAFPP S.A. – if you have the private pension (pillar II) at BT Our Pension, you can view the accumulated amount in BT Pay. Details about the processing of personal data carried out by the operator BT Pensia Noastră can be found on the website https://btpensianoastra.ro/

IV. “Loans” Functionality

In case of accessing the "Credits" functionality, the Bank will process personal data about the credit products you have at BT (The IBAN and balance of the credit account, the current account from which the monthly installment is deducted, or the account you select to make an early repayment on a non-card loan, the credit contract number, the contracted loan amount, the start and end dates of the loan, the amount of the monthly installment, any arrears, the repayment schedule, loan-related insurance, and their status).

V. The "Insurance" Functionality

If you use this section of BT Pay, BT processes your data as a controller for: (i) facilitating the conclusion of the insurance contract documentation by pre-filling the data as found in the bank’s records; (ii) payment of insurance policies; and (iii) reconciliation of payments related to insurance policies. However, for the personal data necessary to obtain and display insurance offers in BT Pay, as well as for concluding and executing insurance policies, the data controllers are the insurers from whom you purchase the insurance, and BT acts as their authorized representative.

Travel insurance

With BT Pay, you can get insurance offers and purchase travel insurance from Groupama Asigurări. Details about the processing of personal data by Groupama are available directly in the app, in the "Travel Insurance" section.

Home Insurance

With BT Pay, you can get an insurance offer and take out optional home insurance from Groupama Asigurari, as well as PAD insurance. Details regarding the processing of personal data by Groupama are available directly in the app, under the "Home Insurance" section.

Credit card & overdraft insurance (credit line)

Certain user categories can access the “Credit Line Insurance” option in BT Pay to view the credit line insurance offer and purchase the insurance from the insurer Metropolitan Life directly through BT Pay. Details regarding the processing of personal data carried out by this Insurer are directly accessible in the Application.

VI. The "Auto" Functionality

RCA Insurance

In the "RCA" section of BT Pay, users can obtain quotes or conclude RCA insurance policies. If you use this section of BT Pay, BT processes the data as a controller for: (i) facilitating the conclusion of the necessary contractual documentation by pre-filling identification and contact details (e.g., phone number) as recorded in the bank's records; (ii) payment of RCA insurance policies if you contract them based on insurance offers obtained by BT Broker from the insurers it collaborates with; and (iii) reconciliation of payments related to the insurance policies. However, for the personal data necessary to obtain and display RCA insurance offers in BT Pay, as well as for concluding and executing RCA insurance policies, the data controllers are, as applicable, BT Broker and the insurers from whom you choose to contract the insurance policy.

Road toll

When you purchase or renew the road vignette for Romania from BT Pay, BT will process: vehicle data, card used and available balance.

VII. Functionality Top up phone card and purchase eSIM”

Phone card top-up

When you use this option, we process: phone number for which the top-up is made, card data, account balance from which you make the loading.

Purchaseyou eSIM

When you use this option and purchase an eSIM data plan from our partner – Timesafe SRL (Pago), which provides this service in BT Pay, BT will process, including disclose to Pago, your data consisting of in: name, surname, unique identifier (BT client code – BT CIF), data regarding the transaction through which you purchased the eSIM (payment transaction reference, payment status, information regarding the payment method used for the eSIM purchase - bank card).

In the context of using the eSIM functionality from BT Pay, Pago processes your data as an independent operator, as provided in the Timesafe SRL Privacy Policy for eSIM in BT Pay, which you can access from the relevant eSIM section.

VIII. The "Kiddo" Feature

1. BT Pay Kiddo – for minors aged 14 +, with own BT card and account

If you initiate, as a parent, a connection of a minor from this section in BT Pay Kiddo , we will check if you meet the conditions set out in BT Pay Kiddo Terms. In this regard, we will process the following personal data: name, first name, CNP, age,the status of parent of the minor and of theauthorized on his account.

2. BT Pay Kiddo – for minors with own BT card attachedat the parent's account:

If you initiate, as a parent, a connection of a minor from this section in BT Pay Kiddo, we will verify if you meet the conditions provided in BT Pay Kiddo terms for minors attached to the parent's account. For this purpose, we will process the following personal data: name, first name, CNP, age șand implicit personal data consisting of the relationship between you and the respective minor.

IX. Other BT Pay Features

1. Identification via BT Pay in calls or at BT branches

If you choose identification through BT Pay during a call with an agent from the BT call center or at a BT unit, we will process your personal data: the status of BT client BT Pay user, phone number, authentication method (PIN, biometrics, phone unlock) and application version.

The notification related to identification through BT Pay is sent to you in the App. Displaying this notification depends both on the notification settings you have configured in BT Pay and on the notification settings you have set on the device used for BT Pay.

2. Updating personal data

Through this feature, you can update certain personal data registered with the bank. Details about the processing of personal data can be found in the specific privacy notice in the “specific notices” section of this privacy notice.

3. Manage authorized representatives

If you have received/have access in BT Pay to the accounts of other BT individual clients, adults or minors, on which you are designated with operating rights (authorized representative), we process data about your status as authorized representative on those accounts, about the transactions and any actions you perform on those accounts. Also, we process your data if these clients revoke your status as authorized representative in BT Pay on their accounts.

If you grant access in BT Pay to other BT clients, adult individuals authorized to operate (authorized representatives) on your accounts, we process data regarding your status as the account holder who has designated authorized representative(s) with access rights in BT Pay. Additionally, if the authorized representatives carry out transactions and any actions on your accounts, we process the necessary data (name, surname, accounts, transactions, balance, etc.).

4. Invite a friend

In this feature, BT will process data such as: name, surname, unique identifiers (your BT client code (BT CIF) and your referral code, representing a string of characters allocated by BT). You can share the referral code either by using the function that allows you to copy it or by using the function that allows you to share it. When you share your referral code, BT does not know to whom you have sent it. However, if those persons use your referral code in BT Pay, we will know that they received the code from you or through you.

5. RoPay Service

In the context of using the service RoPay, your personal data is processed according to the details in the dedicated privacy notice, found in the section Specific notifications.

6. Click to Pay

To make online payments via "Click to Pay," users must create a Click to Pay profile within the app. If e-mail and phone number registered at the bank match those used at the merchant, the transaction can be authorized without manually entering the card details. Details regarding the processing of personal data arăsesc in the dedicated section of Terms and conditions for using the "Click to Pay" feature in BT Pay, separately for cards issued under the Mastercard brand, respectively Visa.

7. Beneficiary Name Display Service (SANB) for fraud prevention purposes

We have the legal obligation and legitimate interest to prevent banking frauds. To protect you in case interbank transactions (payments to accounts in other banks), BT together with other associated operators, process your personal data according to the details in Privacy notice on the processing of personal data within the Beneficiary Name Display Service (SANB), from the “Specific Notices” section of this privacy notice. In case intrabank settlements (payments to BT accounts), BT processes the same categories of personal data on its own as those used within SANB. The basis for processing your data is BT's legitimate interest in preventing fraud in the case of intrabank payments (BT-BT). The first name(s) (one or more, as applicable) in full and the initial of your registered last name at BT will be displayed to other BT clients who initiate a payment to your BT account from a bank application, regardless of whether the payment is completed or not.

🔊 5. For communication with BT Pay users through the application

a. Notifications

Through BT Pay we send you several types of notifications:

Notifications related to card payments: confirmation/ denial of payments made with cards registered in the application, authentication/rejection of online payments initiated with BT cards enrolled in the application and in 3D Secure.
Notifications related to transfers: acceptance/ rejection of the transaction initiated via P2P; confirmation of the successful execution of the transaction;
Notifications related to partial prepayment of non-card credit: information regarding the status of the request for partial early repayment of the non-card loan.
Notifications for identification through BT Pay: identification requests in the application (in call with BT call center agent or for identification with BT Pay in units).
Notifications for the Bill Payments service: messages dedicated to the users of this service.

Previously indicated notifications will be sent in the App, but their display depends both on the notification settings you configured in BT Pay and on the notification settings you set on the device used for BT Pay.

b. Other types of messages

General Interest Messages: relevant information about the BT Pay app and/or related to your status as a BT client, other than those related to the functionalities above.
Messages of particular interest: e.g. changes to the bank's General Business Conditions, fee changes, updates to our data processing information notes; notifications regarding the need to update data in the bank's records, confirmations of transactions made via BT Pay.
Advertising messages,if you have given your consent to BT to process your data for advertising purposes, through the dedicated form (available in the units, on BT website, in BT Pay Web or in the process of opening a business relationship with the bank for BT Pay for individuals or through BT Go for legal entities).
Notifications about “Offers” from BT Pay: notifications regarding new offers added in the app; Notifications about unlocked offers in the "Offers – prizes on the move" section. By accessing the "Offers" section in the app, you agree that BT may collect information about: the offers you have viewed (saved, activated, or applied for), in order to present relevant offers in the future and to apply preferential conditions related to the offers you have activated or accessed. If you enable notifications for offers in BT Pay, athe application will also request access to device location, to display valid offers in your area (e.g., for the automatic display of Star partners' offers (for Star credit cardholders, to show partner locations related to the offers on the map). You are not required to allow location access; you have the option to select the locality manually. If you deny access, the other BT Pay features can be used without restrictions.

🏃‍♀️ Awards în Mișwhich – BT Pay - to encourage an active lifestyle, BT Pay includes in the “Offers” section the subsection ““Awards in Motion”, where users can unlock special offers from partners and the bank.

As a result of connecting a physical activity monitoring application, BT Pay will request permission to access data such as: number of steps, kilometers traveled, active minutes. These data are visible only to the user who connected them and are used exclusively for: verifying eligibility for offers, awarding prizes. The data is stored only for the duration necessary to fulfill these purposes. Some offers may also include other parameters, such as activity with the card or in the application, specify clearly in each offer. In case these data fall under the category of health data by granting access to these data from the monitoring application, you express your explicit consent for their processing for the purposes mentioned in this paragraph. If you grant access to the data from the monitoring application, you can revoke it at any time from the settings of the respective application or of the phone. Withdrawal of access also represents a withdrawal of consent. Without access, you will not be eligible for offers in this category.

Accessing the Moving Awards section is optional and does not affect the general use of BTPay. If you have granted access to the data from the monitoring application, you can revoke it at any time from the settings of that application or the phone. Without access, you will not be eligible for offers in this category.

c. assistance and support via the BT Pay chatbot

Through the BT Pay chatbot you can chat in real time with a BT consultant. In this context, we process data such as: name, BT CIF, client type, card names, application version, phone operating system, and the language selected in the chat, for identification and support.

📈 6. For the analysis and improvement of BT Pay performances

In order to compile statistics that allow the measurement of BT Pay's performance, with the aim of improving it, we have a legitimate interest in collecting the following information about the devices on which it is installed - device identifier (Device ID), phone type, operating system, operating system version, device name, device settings, permissions required for internet connection.

Except for the situations expressly mentioned in this privacy notice or in those in the " sectionInformăspecific terms”, your data, as a BT client, as well as the data regarding transactions carried out through BT Pay, will be retained for a period of 5 years from the termination of your business relationship with the bank, which may be extended in accordance with applicable legal provisions, except for data that must be kept for a period of 10 years, according to the legal provisions in the financial, accounting, and tax fields.

Data provided directly by the users of the application or that the Bank may become aware of in the context of installation, registration, enrollment/ use of the Application, may be disclosed by Banca Transilvania to certain categories of recipients, as follows:

other Clients of BT who have the right and need to know them (all BT Pay users are BT Clients)

a. BT Pay users which you have authorized on your accounts including in the application

If you have fully authorized representatives on all BT accounts and have granted them access to these in the application as well, they will have access in the application to personal data about you and the counterparties in the transactions mentioned in the section II. The functionalities "Accounts" and "Savings" from this privacy notice, except for cards linked to accounts. Authorized users can view this data, make transfers and currency exchanges, access statements and transaction history, share the IBAN, set up recurring payments, and manage savings and deposits.

b. BT Pay users who have appointed you with full operational rights on all their accounts opened at BT.

If other BT customers, natural persons, account holders, have granted you full operating rights on all their BT accounts, they will see in the application your first and last name, as well as the fact that you are their authorized representative. When you perform transactions on these accounts, we will disclose to the account holders the data regarding the transactions made (data about you and about the counterparties involved in the transactions).

c. other BT clients who hold additional user cards attached to your accounts

If you have requested the issuance of additional cards on your account in the name of additional card users, they can view your account balance in BT Pay.

d. other BT clients, on whose account you hold a supplementary card issued in your name.

If you have an additional card issued on another BT client's account, the account holder client will also be able to see in BT Pay details about the transactions made with that card (amount, merchant, date, etc.).

e. other BT clients BT Pay users, who find out from the icon displayed next to your phone number/contact in their device's address book that you are a BT Pay user (and implicitly find out that you also have BT client status).

BT client accounts to which you make payments from BT Pay

When making transactions through BT Pay to accounts/ phone numbers of other BT clients from accounts that belong to you, the data related to these transactions (usually, your first and last name, the amount, the account number, the payment explanations), will be accessible to the beneficiaries to whom you have made the payment.

contractual partners of the bank

a. Service providers who assist us in providing the Application and in related activities (e.g. SMS transmission service providers, e-mail; trusted service providers for signing documentation in the application with advanced electronic signature, etc); identification service providers (for identification in BT Pay which involves photographing the identity document and/or the face - selfie/video selfie - , BT uses the provider's services Onfido and some of its subcontractors, who process, only on behalf of and under the instructions of the bank, the data from the identity document, the image - including the one from the video selfie taken in BT Pay - and respectively the biometric data of the face, used for identification in BT Pay. The processing of data will in some cases also take place in third countries. The transfer of personal data to these states is based either on adequacy decisions issued by the European Commission (e.g. in the United Kingdom), or on other appropriate safeguards, in accordance with the mechanisms provided by the GDPR consisting of Standard Contractual Clauses approved by the European Commission which you can find here: https://eur-lex.europa.eu/legal-content/RO/TXT/PDF/?uri=CELEX:32021D0914)

b. Apple (Apple Pay solution), in case you opted to enroll your card in this payment solution

c. other entities within the BT Financial Group whose services/products are accessible through BT Pay (e.g. distribution of fund units through BTAM, optional pension funds managed by BT Pensions or privately managed by BT Our Pension)

d. BT partnerswhose services/products are accessible through BT Pay, including in accordance with specific privacy notices (e.g. insurance companies, Timesafe SRL for eSIM, etc)

Categories of recipients to whom personal data is disclosed in the context of registration or enrolment in/through BT Pay as well as the separate RoPay BT, Bill Payments services, Overdraft, Credit Card and credit line increase exclusively online, 100% online personal loan are mentioned in the specific privacy notices for the processing of personal data within these services.

Recipient list above is completed with that provided in General privacy notice on the processing and protection of BT Clients' personal data, section VIII.

Links and third-party applications

The application contains links to the websites belonging to partner merchants.

At the same time, the application offers users the possibility to access:

third-party applications - for monitoring physical activity- by logging in with the account data from the respective application through the BT Pay application, in order to unlock some preferential offers from the section Moving awards a BT Pay.
through section Offers, customized links from partner merchants, when accessed, third parties will be able to know that the person accessed them through BT Pay, thus implicitly that they are a BT client.

🔒 Responsibility for the processing of personal data - the bank does not control, manage, or take responsibility for how partner merchants process your personal data on their websites or applications, even if you access these platforms through BT Pay. BT cannot guarantee that this data is handled in accordance with personal data protection laws (e.g., GDPR, Law 506/2004, Law 190/2018), nor can it verify the accuracy or currency of the data these platforms/websites hold about you. Each third-party website or application has its own data processing rules. We recommend that you review their privacy policies to ensure they align with your interests.

Your personal data processing within BT Pay is subject, in addition to this notice, to the provisions General privacy notice on the processing and protection of personal data belonging to BT clients, integral part of BT Privacy Policies, which you can find on the website www.bancatransilvania.ro, in the Privacy Hub section or on request at any bank unit.

Within the mentioned general privacy notice, you will also find the rights you can exercise regarding the processing of your personal data, the ways in which you can exercise them, as well as the contact details of the Data Protection Officer (DPO) and how to reach them.

You can exercise the following rights regarding the processing of your data by the BT operator: a. the right of access, b. the right to rectification of data, c. the right to deletion (the “right to be forgotten”), d. the right to withdraw consent, e. the right to object, f. the right to restriction of processing, g. the right to data portability, h. the right to object to decisions based solely on the automated processing of personal data, including profiling, i. the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (N.S.A.P.D.P.), at the contact details of the authority available on the site www.dataprotection.ro.

For exercising at BT the rights mentioned in points a. – h. above, please use the contact details of the data protection officer appointed by BT (DPO BT), sending the request in any of the following ways: 1. to the e-mail address dpo@btrl.ro; 2. by postal mail, to the address in Cluj-Napoca city, Calea Dorobanților Street, no. 30-36, Cluj County, with the mention "to the attention of the data protection officer", 3. by filling out the online form available for Clients in the section: ”How to exercise your GDPR rights at BT”, available on Privacy Hub