1. Who is the data controller and what is the purpose of the processing?
1. Who is the data controller and what is the purpose of the processing?
BT must ensure that online payments are secure. That's why in BT Pay we apply identification rules in line with payment services legislation, checking who you are, what you own and what you know to make sure your identity is secure. We verify your identity in the app for this purpose at several stages: when you register/ re-register with BT Pay, when you set/ reset/ unlock your PIN (security code) in the app, when you access the app or authorize transactions in the app.
2. What data do we use and what happens if you refuse to process it?
2. What data do we use and what happens if you refuse to process it?
To register for BT Pay
- To register for BT Pay, re-register if you haven't set your PIN or if you have a PIN but forgot it
We use the following types of personal data about you:
- your identity card details - will need to be photographed (requires access to camera). We will compare this information with the bank's records.
- the moving image of your face from the selfie video you will need to take (requires access to your camera)
- biometric facial data, obtained by biometrically comparing the image in the selfie with the one in the photographed ID and with your image in the bank's records. The biometric comparison is based on criteria such as color, size and tilt of the eyes, position and distance between the eyes, eyebrows, lips and nose. Biometric data uniquely identifies you. They are special/sensitive data. We only use biometric data with your explicit consent .
- If you are adult user, you express this consent for yourself and/or, where applicable, for a minor over the age of 14 whom you legally represent (e.g. you are a parent/guardian), by ticking the box/pressing the specific button to express this consent, which will be displayed in the application. If you do not wish to express your consent to the processing of this type of data, we can identify you and, where applicable, the minor, in any BT establishment, where we will not use biometric data.
- If you are a minor over the age of 14, we may process your biometric data in BT Pay only if your parent gives us consent explicitly (as set out in the previous paragraph). Even if a parent gives their consent for us to process your biometric data for identification in BT Pay, if you are not comfortable with us using such data, do not start the BT Pay registration process and ask your parent to go to a BT establishment where you can be identified without us processing your biometric data.
- For re-registering with BT Pay after setting a PIN in the app, for setting, resetting and unlocking the PIN
We use for your identification, as the case may be, all or part of the following personal data: the phone number declared to the bank, the PIN set for the application (if you are an adult user), the image from the selfie you will have to take (requires access to the camera) and the image from the ID card in the bank's records that we will compare biometrically, thus using the biometric data of your face (only if you express your consent to the processing of this type of data, through an explicit action that will be requested in a dedicated screen)
- To access the app and authorize transactions in BT Pay (together referred to as "BT Pay login")
In order to identify you for BT Pay authentication purposes, whether the identification for BT Pay registration was made directly in the App or at a BT establishment, we process the following categories of personal data, depending on the method you used to authenticate:
- if you don't have a PIN set in BT Pay, we process your phone's unlocking method (whatever it is: fingerprint, face ID, PIN or phone unlock pattern). In this case, the Bank does not know the unlocking method used, but implicitly knows that it has been entered correctly if the transaction authorization is successfully completed.
- if you have a PIN set in the app, we use your PIN to identify you.
In addition, if you choose to activate the use ofbiometricdatafrom your device forBT Pay authentication (fingerprint, face ID - biometric characteristics of the face), we also use this data, but do not have access to it. BT simply uses the result of comparing the fingerprint/face features applied/scanned with the fingerprint/face features stored on the device you are using to enable you to authenticate into the app. If biometric authentication fails, you will need to use the PIN set in BT Pay for authentication.
To carry out/authorize certain transactions, we will also use biometric data of your face (only if you express your consent to the processing of this type of data by an explicit action that will be requested on a dedicated screen). If you do not want us to use this type of data, you can request that your transaction be processed in a BT unit.
3. Data recipients and transfer of data to third countries
3. Data recipients and transfer of data to third countries
For identification in BT Pay involving the photographing of the identity card and/or the face (selfie/video selfie), BT uses the services of the provider Onfido and its subcontractors, who process, solely on behalf of and under the instructions of the bank, the data from the identity card, the image (including the image from the video selfie taken in BT Pay) and the biometric data of the face used for identification in BT Pay. Data processing will in some cases also take place in third countries. The transfer of personal data to these countries is based on either adequacy decisions issued by the European Commission (e.g. in the UK) or other appropriate safeguards in accordance with the GDPR mechanisms consisting of the Standard Contractual Clauses approved by the European Commission which you can find here: https://eurlex.europa.eu/legal-content/RO/TXT/PDF/?uri=CELEX:32021D0915&from=EN.
4. Special notice to US users of the App regarding the processing of personal data required for identification purposes
4. Special notice to US users of the App regarding the processing of personal data required for identification purposes
U.S. users of BT Pay, as defined in the Terms and Conditions of Use of the App, should be aware that under applicable U.S. law for the processing of biometric data, including the Illinois Biometric Information Privacy Act (BIPA), their personal data of this type is processed by Onfido as detailed in Onfido's Facial Scanning and Voice Recording Policy, found at the following link:https://onfido.com/facial-scan-policy-and-release/
If you are a US user of BT Pay, by continuing the identification process in the App as described above, you confirm that you have read, understand and accept Onfido's Facial Scanning and Voice Recording Policy and Onfido Privacy Policy and Onfido Terms and Conditions.
The provisions of this specific information note shall be supplemented by those of Privacy notice on the processing of personal data within the BT Pay mobile applicationrespectively with those of the Privacy notice on the processing in BT PAY of personal data of users under 14 years of age who have a BT account - (in the case of users under the age of 14 who use the functionality for minors who have a BT account), as well as the the General Privacy notice on the processing and protection of personal data of BT Customers. The General Privacy notice is an integral part of the BT Privacy PolicyPrivacy Policy, which you can find on website of Banca Transilvania in the Privacy Hub section or in BT units. In this notice you will find details about your rights in relation to the processing of your data, the ways in which you can exercise them, the contact details of the BT DPO and the data retention period.
For the english version of this privacy notice tap here.
