Information notice on the processing in BT PAY of personal data of users under 14 years of age who have a BT account

1. About this information note

Please read this information note if:

• you are at least 14 years of age but less than 18 years of age (hereinafter "minor" or "underageuser") and wish to use from the BT Pay mobile application ("BT Pay" or the "App") the functionalities described in Chapter V of the BT Pay Kiddo Terms and Conditions for minors who have a BT account (hereinafter "BT Pay") for minors who have a BT account") with a card of your own attached to the BT account opened in your name
• you are a parent/guardian/legal representative of a minor over 14 years of age ("parent") and you intend to allow the minor to use BT Pay for minors who have a BT account with a card issued in the minor's name and attached to the minor's BT account

This information should be read before the minor starts the identification process in BT Pay. 

With this information, Banca Transilvania ("BT", "the bank") informs the minor and his/her parent how it will process the minor's personal data in BT Pay.

When we write "personal data" or "data" in this information notice, we mean any information that directly or indirectly identifies the minor (e.g. name, surname, identifiers, telephone number, email address, ID card/password data, transactions you make through BT Pay, etc.) and when we write that we use, collect, verify, store such data we mean that we "process" it.

If you are a minor and do not understand some of the words used in this information or have questions about how we process your data in BT Pay, please ask your parent for help or email us at dpo@btrl.ro. The person we have appointed at BT as our Data Protection Officer ("BT DPO") will help you with answers. We recommend that you do not use BT Pay for minors who have a BT account if you do not understand this notice.

If we change this information note we will announce it in BT Pay. The current version of this notice and the date from which it applies are available in BT Pay or on our website - www.bancatransilvania.ro - in the Privacy Hub.

2. Who processes the minor's personal data in BT Pay

The personal data of the minor in BT Pay are processed by Banca Transilvania S.A. Details of the identity and contact details of BT can be found in section III of the General Information Note on the processing and protection of personal data of BT customersin which we inform how we generally process BT Customers' data. 

3. What we use the minor's data for in BT Pay and on what grounds

We use the minor's data in the App to:

• applying know-your-customer measures to prevent money laundering and terrorist financing (as a bank, we have to collect and process some data from our customers, as required by law, including from minors, who are also BT customers);
• fraud prevention (e.g. so that people who are not entitled do not get access to the minor's data and money);
• conclusion and execution of the contract for the BT Pay for minors service (for the minor to use BT Pay for minors);
• sending notifications in the App (App version update notifications or push notifications, if the different types of notifications in the App are enabled);
• financial education of the minor (by grouping the types of expenditure according to the type of shops where minors make card payments);
• internal analysis (including statistical analysis), to analyse whether BT Pay is functioning properly;
• archiving information and documents (keeping data and transactions from BT Pay at the bank);
• ensuring the security of BT Pay (BT Pay is a banking application in which we must protect the data and money of BT customers using this Application).

The grounds on which we process this data are, depending on the situation, those set out in Section VII of the General Information Notice for BT Customers, set out above.

4. What personal data we process about the minor in BT Pay

• identification data: name, surname, BT Pay username, date of birth, personal identification number (PIN), nationality, home address, residence, other details from the minor's identity card ("bulletin");
• biometric date:
  • of the minor's face (facial recognition - face ID) for identification in BT Pay, only with explicit parental consent/agreement. Details of the conditions under which consent can be given for the processing of the minor's biometric data for identification in BT Pay, including the possibility of identification in BT establishments without the use of biometric data, can be found in Information notice on the processing of personal data for identification purposes in BT Pay which please read
  • related to the security methods of the minor's phone - e.g. facial or fingerprint recognition - if the minor uses such methods. In this case BT does not have access to the biometric data, but only relies on it to enable access/use of BT Pay);
• information about the family situation - the relationship between the minor and the parent;
• image: contained in the ID card and taken from the identification process in BT Pay. Details in the identification information in BT Pay;
• voice: taken from the identification process in BT Pay. Details in the identification information in BT Pay;
• age, to check if the minor can use BT Pay (must be at least 14 years old) and to stop using this service when he/she turns 18,
• contact details: telephone number (for sending unique codes to check whether the minor has access to this number and for using certain functionalities), e-mail address used in BT Pay (for sending unique codes to check whether the minor has access to this address and for sending documents, if the minor requests such submissions from BT Pay);
• financial data: data on transactions made with the minor's BT cards, data on BT accounts to which the minor's BT cards are attached registered in BT Pay;
• identifiers: BT card details and IBAN codes of BT accounts to which the minor's BT cards are attached, phone identifiers (e.g. device ID, security method, operating system type, phone model), unique codes (SMS-OTP) sent to the phone number declared to BT for the minor's card, payment method chosen for BT Pay, card PIN code, which is verified if the minor withdraws contactless cash from the ATM;
• information on the location of certain transactions (e.g. when the minor makes a payment with a BT Pay card at certain shops, we will implicitly know that they were at the location of that shop at the date and time they made the payment, or if they use BT Pay to withdraw cash from BT ATMs, we will know that they were at the location of that BT ATM at that date and time)
• other personal data:
  • the application list of the phone on which the minor has BT Pay installed, to check for malware, including remote/remote login applications. Depending on the situation, the bank may take the following measures as appropriate: blocking the application until third-party applications that may compromise the privacy of BT Pay information are uninstalled or the bank contacts the parent
  • physical activity data (e.g. number of steps, number of kilometres travelled and/or number of active minutes), if the minor connects an activity tracker app in BT Pay to unlock offers in the Rewards on the Go section. We will only process this data to check that you meet the conditions for unlocking those offers and only as long as necessary to verify those conditions;
  • Like any app, BT Pay will have some permissions. BT Pay:

a. will have access to read from the phone used by the minor the SMS sent by BT, for pre-filling SMS-OTP codes in the App,

b. will be able to check whether the phone has NFC and whether it is enabled when the minor tries to make payments with the phone in shops or wants to withdraw contactless cash,

c. will check whether the phone being used has an Android or IOS operating system to make it easier to register cards in Apple Pay,

d. for online payments BT Pay will save the transaction identifier in the phone used by the minor until the online payment is confirmed or rejected,

e. will request permission to automatically display the payment confirmation screen,

f. when the minor initiates transfers based on telephone numbers, BT Pay will request access to the contact list if the telephone number to which the transfer is made is to be chosen from the phone book.

5. Where do we get the minor's data that we process in BT Pay

As the case may be, we have the minor's details:

• from the bank's records (provided to us by the parent when opening the minor's account at the bank or when updating his/her details),
• from the parent who initiates the process of registering the minor in BT Pay (we receive from the parent the telephone number and the CNP of the minor. Based on these data and on the parent's data, we also verify the existence of the parent-child relationship in the bank's records);
• directly from the minor when using BT Pay for minors

6. To whom may we disclose the minor's data processed in BT Pay

We never sell or rent personal data from BT Pay. However, we may disclose the personal data of the minor:

• any of your parents/guardians/legal representatives, as long as you are a minor (under 18);
• service providers who help us provide the App. Some of them are located in third countries. See details in Information notice on the processing of personal data for the purpose of identification in BT Pay;
• other BT Pay users (e.g. all other BT Pay users will see the BT Pay icon next to the minor's phone number if they initiate transfers to that number. In this case, those users will implicitly know that the minor is a BT Customer and uses BT Pay, the users to whom the minor makes transfers from BT Pay will know the name and surname of the minor and the amount he/she wants to transfer);
• to Apple Pay, if the minor's phone has an iOS operating system and they have chosen to enroll their BT card in Apple Pay within BT Pay;
• to public authorities/institutions (e.g. police) who may request such information about our Customers (including minors) in accordance with the law;

7. How long we keep the minor's data processed by BT Pay

Because, before being a BT Pay user, the minor is a BT customer, the law obliges us to keep his/her data (including transactions made through BT Pay) for a period of 5 or 10 years after he/she is no longer a BT customer. The 5/10 year period applies depending on which law requires us to keep the data.

8. What rights are guaranteed with regard to the processing of the minor's data

With regard to the minor's data processed, the minor and his/her parent have the following rights: the right to be informed (the information is in this notice), the right of access, rectification, opposition, the right to withdraw consent (for processing based on consent), the right to erasure of data, to portability, the right not to be subject to a decision based on automated data processing (we do not make such decisions in BT Pay with regard to the minor's data), the right to lodge a complaint with the ANSPDCP.

Details of these rights, including how they can be exercised, as well as contact details for the BT DPO can be found at General information notice on processing and protection personal data of BT customerswith which this Information Notice is supplemented.

The general information note is an integral part of the BT Privacy PolicyPolicy, available on the www.bancatransilvania.ro (including in the Privacy Hubsection) or in BT's offices.

The minor and his parent should also know the following:

9. BT Pay security

The bank guarantees that it has taken appropriate measures to ensure data security in BT Pay. However, it is not solely up to us who has access to the minor's data in the App. Therefore, we cannot guarantee that people who would not be entitled to do so do not gain access to this data, especially if they access it because the minor has not taken sufficient care.

As a minor BT Pay user, you are responsible for the following:

• keep your BT Pay data confidential, which depends on you (e.g. do not allow unauthorised persons to see your BT Pay data);
• keep your phone safe (don't leave it unattended) and in particular your phone's unlock password (password, fingerprint or another security method provided by your phone), as well as the data you use to log into other apps (third party apps), e.g.: fitness tracking apps, if you connect such an app via BT Pay;
• for what happens to your cards in the App and the accounts they are attached to;
• as soon as you find out that your phone or its security features have reached people who should not know about them, you should notify the bank.

10. Links and third party sites/applications

BT Pay contains links to partner websites and gives the possibility to connect third party applications - e.g. physical activity monitoring - by logging in with the account details of that application via the BT Pay application. Each site/third application accessed from BT Pay has its own rules regarding the processing of personal data, which should be read. The Bank is not responsible for the processing of the minor's data carried out by those third party sites/applications.