a. What data we collect to identify/ authenticate BT Go users
In order to be able to use BT Go as a user, we are legally required to verify your identity, i.e. to identify you as a user authorized to use this service. This identification is based on your BT Go login ID ('user ID') and/or password. We will also use (in the case of SMS OTP log-in) the telephone number declared to the bank.
When using the mobile version of BT Go, you can choose to use either the BT Go PIN you set yourself or biometric data (e.g. fingerprint, face-ID) for logging in. Biometric authentication is also available for the web version of BT Go. If you choose this option, BT does not have access to the biometric data, it is stored on the device you are using. BT only gets the information that the biometric authentication method has been validated by your phone.
b. What data we collect to ensure BT Go security
In order to be able to protect transactions ordered through BT Go and the information within this platform, we will collect and use theDeviceID of the device on which you have the BT Go mobile application installed, other device security identifiers (e.g. Instance ID/ Device Identifier), including the history of devices you have used BT Go on and the tokens generated, the model, manufacturer of the phone and the type of operating system of the phone, to verify that at each login you are still using the same phone that you registered to use the BT Go application.
We also have a legitimate interest and, where applicable, a legal obligation, to collect and use the IP address(es) of the devices you connect to BT Go, including the geographic location from which you transact via BT Go. If you refuse to give us access to this data, you will not be able to use BT Go.
We also use a tool that scans the list of applications on the device you connect to BT Go with for malware, including applications such as those that allow remote/remote connectivity and/or if you use your device for calls while using BT Go. If such applications/ situations or other instances are identified that suggest a compromise of your user accounts in other applications offered by BT, we will block your access to your BT Go user account and/or block your use of BT Go on the potentially compromised device. This blocking is an individually automated decision that we make based on the legal obligations placed on us.
Last but not least, we are required by applicable payment services legislation to monitor transactions to prevent fraud. If we detect transactions that are suspected of fraud, we may take the decision to block their processing.
We process this data to protect the information in BT Go. If you refuse processing, you will not be able to use BT Go.
c. What data we process when you use BT Go
In order to fulfill our legal obligations to provide you with the BT Go service you have contracted for your company and, where appropriate, because we have a legitimate interest in preventing fraud and communicating with BT Go users to support them and to ask them to rate the quality of the BT Go service we use:
-> Account, card and transaction data
When you use the various BT Go functionalities, we will implicitly have access to information relating to: bank accounts (of the legal entity and of the payees), balances, transactions ordered through the accounts of the legal entity or related to amounts received on the accounts of the legal entity, including information referred to in the payment explanations, data about the BT products of the legal entity (including loans held or that you wish to repay, deposits, investments held or that you are making and their history, cards issued/requested for designated card users and details about them). Although this service is dedicated exclusively to legal entity customers of Banca Transilvania and information about legal entities is not considered personal data, information about customers who are individual professionals is subject to the personal data regime and the bank will treat it in compliance with the applicable legal provisions in this field.
We also process the personal data of you and/or other persons, such as the payees individuals or individualprofessionals or other such persons mentioned in the explanations of payments (e.g. the name you want to insert for the default payee, address, IBAN) or that you define as default payees (name/ first and last name, IBAN).
At the same time, in order to provide the Beneficiary Name Display Service (BNDS) for the purpose of fraud prevention in case of initiated interbank payments, if you are a legal entity customer of the type indicated above, whose information has the personal data regime, we inform you that they are processed according to the details in the Information Note on the processing of personal data within the Beneficiary Name Display Service (BNDS), available on the bank's website, at the following link: https://www.bancatransilvania.ro/nota-de-informare-sanb.
Also for the prevention of fraud, for intra-bank payments initiated from BT Go, BT processes - as an independent controller - the same categories of personal data that are also used within SANB, but without the involvement of other participating banks or Transfond. The basis for the processing of personal data is BT's legitimate interest in preventing fraud in intra-bank payments (BT-BT). The truncated name of the entity, as registered with BT, will be displayed to other BT customers who initiate a payment from a BT application to the entity's account with the bank, regardless of whether the payment is completed or not.
If you integrate from BT Go with the FGO billing platform and allow the provider of this platform access to the transaction history of the accounts of the legal entity you connect to FGO, you undertake to comply with the applicable legal provisions in the field of processing and protection of personal data, including those of informing and, where applicable, obtaining the consent of the data subjects to whom the legal entity has transferred amounts or from whom it has received amounts in these transactions or whose personal data is contained in the transaction explanations, as such personal data will be disclosed to the FGO provider.
When accessing the investment functionality , certain users will be able to invest on behalf of the legal entity in funds managed by BT Asset Management SAI (BTAM) by signing the brokerage contract with BT, buy/sell fund units (FUs) in the chosen fund, set, modify or cancel a recurring investment, view transactions in process, transaction history and balance, generate portfolio statements and transaction confirmations, ex post cost details and certificates of investment accounts held. Banca Transilvania will process, as processor of the BTAM operator, as the case may be, the following information/personal data concerning you: name, surname, CNP, BTAM client_ID, investment account number, transaction history, balance held in the investment funds managed by BTAM, information on gain/loss and withholding tax.
-> Contact date
Because we have a legitimate interest in helping you use BT Go (support) and because we want to know what you think about this service (service quality assessment) we will use the contact details you have provided to the bank as a customer. You have the right to object to such contact. For details, please read the section on your rights regarding the processing of your personal data.
-> Permissions required when using the application
When you install the app, you will be prompted for permissions to access your phone's status and identity, as well as your device's camera to scan the QR code when you first log in to the BT Go app. Depending on the Android/ iOS version of your phone you can grant access as follows:
- Allow/ Deny access
- Allow/ Deny/ While using the app
- Allow/ Refuse/ Just this once
If you refuse to grant access to the camera when the QR code needs to be scanned, you will not be able to use the BT Go app. You can then withdraw this permission, in which case you will not be able to use the BT Go features that require the use of the camera, but you will be able to use other parts of BT Go.
Also, the first time you log into the app, you will be asked for permission to send notifications. If you refuse to grant access, you will still be able to use the app, but you will no longer receive notifications in the app.
Other permissions required for the use and operation of the app, as set by the operating system provider of the device you are using and for which explicit user consent is not required, are detailed in the 'permissions' section of the Play Store/ Apple Store for the BT Go app (e.g. permissions to notify you when you have no internet connection).
-> Notifications
Through the BT Go mobile banking app we will send you different types of notifications depending on the actions you take, such as but not limited to the following:
- To log in to the web version of BT Go
- For authorising payments made in the internet banking application (web version)
You will be able to separately enable/disable push or other notifications in the app. If you decline to receive notifications, you will still be able to use the app, but you will no longer receive push and/or in-app notifications, which may make it more difficult for you to use BT Go (e.g. you will need to navigate to different sections of BT GO to identify transactions that require action from you).
