Information notice on the processing of personal data within the Alias Pay BT service

1. What is the SPL and Alias Pay BT payment scheme?

Banca Transilvania S.A. ("BT", "the bank") together with other banks in Romania ("participating banks") have joined a payment scheme called "SPL" (Standardised Proxy Lookup), in order to offer any of their customers wishing to benefit from this payment service the possibility to receive amounts in a bank account from any customer of a participating bank, by providing the latter with the payee's telephone number. The telephone number is a proxy/alias of the IBAN of the bank account. The SPL payment scheme is subject to special rules, which participating banks must comply with, and which are publicly available on the website of the Romanian Association of Banks.

At Banca Transilvania we have named this payment service Alias Pay BT, which we offer as follows Alias Pay BT Termswhich we recommend you to consult. The BT customer who chooses to activate this service through Banca Transilvania will be called "Alias Pay BT user".

Before deciding whether to become an Alias Pay BT user, if you are a natural person, it is important to know how your personal data would be processed in the context of the use of this service, as you would be the data subject of this processing.

For the avoidance of doubt, all information in this information notice relates to your data processed for the provision of the Alias Pay BT service. The processing of your data by Banca Transilvania, as an independent controller, in the context of your status as a BT customer is subject to the following provisions Notice General Information Notice on the processing and protection of personal data belonging to BT customers.

2. Personal data controllers

The SPL payment scheme can only work if the participating banks exchange the information necessary to initiate payments based on the telephone number (proxy/alias). The exchange of information will take place via a common database, which will be managed by the Funds Transfer and Settlement Company ("Transfond").

Where it directly or indirectly identifies a natural person, this information is personal data. Participating banks and Transfond will process data subjects' data as joint controllers, as that term is defined in the General Data Protection Regulation ("GDPR"), and have agreed on their responsibilities for fulfilling the obligations imposed by the GDPR, in particular those related to the privacy and security of personal data, and their role and relationship towards these individuals.

The list of banks participating in this scheme may be subject to change, with some banks joining or withdrawing from the SPL scheme. You will find an up-to-date list of all participating banks here.

3. Purpose of processing, categories of data processed and recipients

Personal data are processed by the associated operators exclusively for the purpose of providing the service of facilitating the initiation of payments based on telephone number (alias / proxy), only on the territory of Romania. The categories of data processed are name and surname, telephone number (alias/proxy), IBAN of the bank account. If you activate Alias Pay through Banca Transilvania, we are the operator who will collect this data and transmit it to Transfond, where your data will be stored.

Whenever a customer of a participating bank initiates a payment to you by entering the telephone number on which you have activated Alias Pay BT, that participating bank will extract this data from the database managed by Transfond and provide it to its customer initiating the payment for inclusion in the payment order. That bank and its customer who initiated the payment based on your phone number will have access to your data, regardless of whether that payment is completed or not.

4. The basis for processing personal data and the consequences of refusing to have it processed

The processing operations described in the above lines are necessary for BT to provide you with the Alias Pay BT service, but can only be carried out with your consent to the processing of this data.

You are not obliged to give this consent in order to receive amounts from customers of other banks into BT accounts. Any customer of any bank has the possibility to make transfers to your BT accounts by entering the IBAN of these accounts. However, if you wish to initiate this transfer by entering your telephone number instead of the IBAN, i.e. if you wish to use the Alias Pay service, you need to give your consent.

You have the right to withdraw your consent to the processing of your personal data within Alias Pay at any time by deleting the alias from the BT application in which you created it. As soon as you do so, the data attached to this alias will also be deleted from the Transfond database. Withdrawal of consent to data processing operates for the future only, without affecting the lawfulness of processing operations carried out prior to withdrawal.

5. Period of storage of personal data in the context of the use of Alias Pay

Your personal data related to the Alias Pay service contracted through BT will be stored in the Transford database, and will thus be available to other participating banks and their customers who initiate payments, as long as you use the Alias Pay BT service. The grounds for termination of this service are detailed in the Alias Pay BT Terms.

6. The rights you are guaranteed

In connection with the processing of your personal data within the Alias Pay service, you are guaranteed the exercise of your rights under the GDPR. You can exercise these rights at any of the associated controllers, at the contact details of their Data Protection Officers (DPOs) found in the Privacy Policies on their respective websites. Find details here. As a general rule, each controller will respond to requests by data subjects to exercise their rights in relation to the processing for which that controller is responsible, but where necessary, the associated controllers, through Transfond, will inform each other and provide each other with the necessary information to be able to respond to any requests from data subjects.

The rights you are guaranteed are: the right to information (we fulfil our obligation to inform you through this information notice), the right of access to the data processed, the right to rectification of data (you can exercise it by deleting from the BT application the alias containing incorrect, incomplete, outdated data and activating a new alias with correct data), the right to erasure of data and the right to withdraw consent (you can exercise them at BT by deleting the previously created alias from the BT application), the right to restriction of processing, the right to data portability, the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Based on the above information, please tick the appropriate box in the application Banca Transilvania if you wish to consent to the processing of your data your personal data within the Alias Pay BT service.

If you do not wish to give your consent, please do not tick the box. In in this case you will not be able to activate the Alias Pay BT service.