Who is the controller of personal data?
Who is the controller of personal data?
BANCA TRANSILVANIA S.A. (hereinafter referred to as "the bank" or "BT") credit institution, Romanian legal entity, with the identification and contact details presented in section III of General Information Note on the processing and protection of personal data belonging to BT Customers, offers certain categories of BT customers who are legal entities with current accounts the possibility of obtaining a loan online (hereinafter also referred to as "BT PJ online loan").
In this context, BT processes personal data ("personal data") of individuals who represent the legal entity or are its actual beneficiaries or associates/shareholders, including from their perspective as guarantors and/or sureties. If you have any of these qualities, you are a person affected by this processing. In the general information note indicated above, which is an integral part of the BT Privacy Policy onthe website www.bancatransilvania.ro, also found separately in the Privacy Hub section, you will find the definition of a BT Customer, detailed information about your rights in relation to the processing of personal data and how you can exercise them, and how to contact the data protection officer appointed by BT (BT DPO).
When you apply for and, where applicable, conclude on behalf of the legal entity (hereinafter also referred to as the "credit applicant") a BT PJ online credit, we process your personal data for several purposes and legal grounds, either as the sole data controller or, where applicable, together with other associated controllers, as described below.
On what grounds do we process the data and what happens if you refuse processing?
On what grounds do we process the data and what happens if you refuse processing?
We process your personal data on the following legal grounds:
- the legal obligations to which BT is subject by various normative acts,
- the conclusion/execution of the credit agreement or the steps necessary for its conclusion,
- our legitimate interest and/or that of third parties (e.g., the interest in preventing fraud or the legitimate interest in consulting your status in the records of Biroul de Credit SA to assess your creditworthiness or consulting the status of the legal entity you represent in the Credit Risk Center – “CRC”); our legitimate interest in contacting you to provide support for completing your online application and to ask for your opinion on the application process),
- your consent, if we need to verify your identity based on biometric data (facial recognition).
Where we are obliged by law to process personal data or where it is necessary for the conclusion of the credit agreement, if you refuse processing, we will not be able to consider your request.
For processing based on the legitimate interest of BT or third parties, refusing to have your data processed may make it impossible to analyze your application or obtain BT PJ credit online.
For data processing that requires your consent, we will ask for your agreement at the appropriate point in the online application process. If you refuse to give your consent, you will not be able to obtain BT PJ credit online, but you can apply for it at a BT branch.
By continuing the application process, you agree to the consultation of the legal entity you represent in the CRC records and undertake to sign the dedicated form after the query, with an electronic signature obtained in accordance with the provisions of point D of this information note.
For what purposes do we process personal data, what data do we process, how long do we store it, and to whom can we disclose it?
For what purposes do we process personal data, what data do we process, how long do we store it, and to whom can we disclose it?
Below, we present the purposes for which we would process your personal data so that you can apply for and, where applicable, contract a BT PJ online loan for the legal entity you represent. Depending on the purpose of the processing, we will provide you with information about the data storage period, the categories of data recipients, the existence of automated decision-making processes, and your rights.
A. Personal data processed for identity verification, fraud prevention, money laundering and terrorist financing prevention, to contact you for the purpose of providing support or evaluating the quality of this BT service, as well as for the valid application/conclusion of the credit agreement.
Applicable legislation requires us to verify the identity of persons with whom we are about to enter into contracts/who represent legal entities. At the same time, we have a legitimate interest in preventing attempts at fraud through identity theft in the online environment.
To verify your identity, they will use your BT Go login details and other personal data from BT's records (e.g., your status, holdings, and powers of representation within the legal entity). To ensure that the information we hold about you is accurate and up to date, we will compare the data in your identity document in BT's records with that in your identity document at the General Directorate for Personal Data - D.G.E.P. - (see here for details on the processing of data provided by D.G.E.P.).
B. Personal data processed for the analysis of the credit application submitted by the credit applicant (legal entity), including automated decision-making processes based on profiling[1]
In order to analyze the legal entity's application for a BT PJ online loan, we process your personal data in BT's internal records and in the Credit Bureau's records, where we consult your situation. All information related to this processing can be found below, in points I and II of this section B[2].
As it is essential for us to provide you with a quick response to your online credit application, we will make the decision to approve/reject your application by processing your personal data exclusively by automated means. You can find details about this decision in section II (5) below.
[1] This information is valid for the entire duration of the business relationship between the credit applicant (legal entity) and Banca Transilvania, and applies whenever this applicant submits a credit application/request to the bank (including in the case of a supplement/extension/restructuring of an existing credit). if you hold one of the aforementioned positions within the applicant (legal representative/partner/shareholder, potential: co-debtor/guarantor/surety/beneficial owner). You will be provided with new information of this type in the event of substantial changes to the provisions of this information or at your express request. This information is also publicly available on the bank's website www.bancatransilvania.ro, in the Privacy Hub section - specific information notes subsection or, upon request, at any BT branch;
[2] Your personal data will be consulted in the Credit Bureau (i.e., the provisions of Part I of this notice apply to you) only if you are a guarantor/co-debtor/surety/guarantor in a credit application/request submitted to BT by the legal entity credit applicant.
I. Information regarding the processing of personal data in the Credit Bureau System
Identification details of operators
Banca Transilvania S.A., withits registered office in Cluj-Napoca, 30-36 Calea Dorobanților Street, Cluj County, and Biroul de Credit S.A., a Romanian legal entity with its registered office in Bucharest, 29 Sfânta Vineri Street, 4th floor, Sector 3, Cluj County, and Biroul de Credit S.A., a Romanian legal entity with its registered office in Bucharest, 29 Sfânta Vineri Street, 4th floor, Sector 3, asassociated operators, processyour personal data in good faith, fairly and transparently, for specific and legitimate purposes, in accordance with the provisions of Regulation (EU) No. 679 of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the Regulation).
Biroul de Credit SA is the private entity that manages the Credit Bureau System, in which personal data related to the lending activity carried out by Participants is processed.
The participants in the Credit Bureau System are credit institutions, non-banking financial institutions, insurance companies and debt collection companies, which have signed a Participation Agreement with the Credit Bureau.
2. Legal basis and purpose of processing
Banca Transilvania S.A. and the Credit Bureau processes your personal data based on the legitimate interest of the Participants and of the Credit Bureau for carrying out a responsible lending activity, under the conditions of protecting, facilitating access to credit and preventing excessive indebtedness of the data subjects, compliance with the legal framework regarding the assessment of creditworthiness and the reduction of credit risk, as well as the prevention of the use of the financial-banking system to carry out activities contrary to the law.
Banca Transilvania S.A. isrequired, in accordance with the legal regulations in force, to assess your ability to repay the loan before concluding a loan agreement and during its term. To this end, Banca Transilvania S.A. processesthe information indicated in point (4), registered in your name in its own records, and transmits it to the Credit Bureau for processing by that institution and consultation by any Participant for the purpose of initiating or conducting a credit relationship, as well as providing credit products.
3. Obligation to provide data and consequences of non-compliance
The provision of your personal data is necessary for the purpose mentioned in point (2). Refusal to provide your personal data, necessary for the achievement of the above-mentioned purpose, will result in the inability of Banca Transilvania S.A. tofulfill its legal obligations in relation to the granting of credit.
4. Categoriesof personal data processed in the Credit Bureau system
a. identification data of the data subject: surname, first name, personal identification number, or CUI for authorized natural persons or CIF for natural persons exercising liberal professions or country code and passport series/number for non-residents, home address/residence, telephone number, date of birth;
b. employer details: employer's name and address, date of registration of this information, CUI;
c. data relating to credit products requested/granted: type and name of the Participant, type of product, status of the product/account, date of granting, duration of the account, amounts granted, amounts owed, date of update, currency, frequency of payments, amount paid, monthly rate, outstanding amounts, number of days in arrears, date of first arrears, arrears category, date of last payment;
d. data relating to events occurring during the term of the credit product, such as those relating to restructuring/refinancing, payment in kind, assignment of the credit agreement, assignment of the claim;
e. data relating to relationships with other accounts: information relating to credit products for which the data subject is a co-debtor and/or guarantor;
f. insolvency data: information relating to data subjects against whom insolvency proceedings have been initiated;
g. number of queries: indicates the number of Credit Reports issued by the Credit Bureau at the request of one or more Participants;
During the pre-analysis of the credit application/analysis of the applicant's request, Banca Transilvania SA will ask the Credit Bureau to issue a Credit Report in your name, without a FICO® Score, to verify whether you fall within the debt ratio established by law, as your situation in the Credit Bureau could impact the credit applicant's (legal entity) ability to repay the loan. In order to obtain the Credit Report, Banca Transilvania SA will send your first name, last name, and personal identification number to the Credit Bureau.
5. FICO® Score from credit bureau
The personal data referred to in point (4) may be processed by the Credit Bureau, including for the purpose of calculating, at the request of Participants, the FICO® Score from the Credit Bureau.
Participants may use the FICO® Score from the Credit Bureau to reduce the credit risk associated with a borrower/potential borrower.
The FICO® Score from the Credit Bureau is a number between 300 and 850, obtained following a statistical process that processes the information recorded by Participants in the Credit Bureau System and indicates the probability that the person concerned will pay their installments on time in the future. The main causes that led to the decrease in the FICO® Score from the Credit Bureau are displayed in the form of reason codes.
The FICO® Score from the Credit Bureau takes into account the following elements that provide predictability: payment history, current debt, duration of credit account(s) (average number of months since loans were granted), new credit applications (number of inquiries and loans granted in the last 6 months), credit mix (types of loans granted), age of the person concerned. The influence of these elements on the FICO® Score from the Credit Bureau may vary depending on the information recorded at the Credit Bureau for each person concerned.
The FICO® Score from the Credit Bureau is a highly predictive analysis tool which, together with the data in the Credit Report and information obtained by Participants from other sources, contributes to the accurate assessment of the creditworthiness of the person concerned for the purpose of concluding/executing the credit agreement.
6. Recipients of the data
Personal data recorded in the Credit Bureau System is disclosed to Participants, upon request, for the purpose mentioned in point (2).
Personal data processed in the Credit Bureau System will not be disclosed to third parties, except to public authorities and institutions, in accordance with their powers and applicable legislation, such as the National Supervisory Authority for Personal Data Processing, the National Bank of Romania, the National Integrity Authority, courts, notaries public, bailiffs, and criminal investigation bodies.
7. Storage period
Personal data is stored at the Credit Bureau and disclosed to Participants for 4 years from the date of update, except for data of credit applicants who have withdrawn their credit application or who have not been granted credit, which isstored and disclosed to Participants for a period of 6 months. stored and disclosed to Participants for a period of 6 months.
8. Rights of data subjects regarding the processing of personal data
As a data subject, you may exercise your rights under the Regulation as follows:
a. The right of access to data may be exercised:
- by a signed written request sent by mail to the Credit Bureau, or
- by securely accessing the Credit Bureau website (www.birouldecredit.ro), or
- in person or electronically, to the Participant who is your creditor/potential creditor
At the same time, you have the right to obtain, upon request, at the time of communication of the credit decision, a copy of the Credit Report issued by the Credit Bureau, which was used by Banca Transilvania S.A. in the analysis of the credit application;
b. the right to rectify data,
c. the right to erasure of data,
d. the right to restrict data,
e. the right to object to processing, including automated individual decision-making,
may be exercised:
- by securely accessing the Credit Bureau website (www.birouldecredit.ro), or
- in person or electronically, to the Participant who is the creditor/potential creditor of the data subject.
f. the right to address the National Authority for the Supervision of Personal Data Processing and the courts.
9. The contact details of the data protection officers are:
- For Banca Transilvania S.A. - e-mail dpo@btrl.ro
- For the Credit Bureau - email address rpd@birouldecredit.ro
II. Information regarding the processing of personal data within Banca Transilvania S.A. and, where applicable, in other external records
This is a specific information note regarding the processing of your personal data for the pre-analysis of a credit application/analysis of a credit request submitted to BT by the credit applicant. The provisions of this note are supplemented by the general information note on the processing and protection of personal data belonging to BT customers, which also sets out the other purposes for which your data is processed as a BT customer. The general information note is an integral part of BT's Privacy Policy, which can be found on the website www.bancatransilvania.ro, including in the Privacy Hub section of the website, and can be obtained on request at any BT branch.
1. Identity of the operator
Banca Transilvania S.A., headquartered in Cluj-Napoca, str. Calea Dorobanților, nr. 30-36, jud. Cluj processes your personal data as a controller for the purpose of pre-analyzing a request/analyzing a credit application submitted to the bank by the credit applicant.
2. Legal basis and purpose of processing
For the purpose of pre-analyzing a request/analyzing a credit application submitted to BT by the credit applicant, in accordance with the need to conduct responsible lending activities, in addition to processing your personal data in the Biroul de Credit S.A. system (where applicable, see footnote no. 2) - about which you were informed in point I. of this notice - BT processes this data in its own records and in other external records, based on the legal obligations it must comply with, the conclusion of the credit agreement, and its legitimate interest.
3. Obligation to provide data and consequences of non-compliance
The provision of personal data is necessary for the purpose mentioned in point II. (2). Refusal to provide the personal data necessary to achieve this purpose would prevent the bank from fulfilling its legal obligations in relation to the granting of credit, so that the credit application of the applicant, a legal entity, cannot be reviewed.
4. Categories of personal data processed in BT records and, where applicable, in other external records
The categories of personal data referred to in points I. (4), as applicable (see footnote 2), and II. (5) of this notice, as well as other personal data belonging to you, collected in the credit application/request submitted to BT by the credit applicant, are processed by BT for the pre-analysis/analysis of the applicant's credit application/request. This data (usually the first name, last name, and/or personal identification number) may be verified, as applicable, in public databases such as websites—the court portal, ONRC, etc.—or private databases (e.g., related to the International Sanctions Regime).
5. The existence of an automated decision-making process, including the creation of profiles using the BT scoring application[3]
For the purpose of objectively verifying the eligibility conditions for the pre-analysis of an application/analysis of some of the credit applications submitted by certain types of legal entities (see footnote 3 in Part I of the information note), BT processes the data of some of the data subjects[4] in itsown automated system ("BT scoring application") on the basis of its legitimate interest.
The BT scoring application enters and analyzes data and information about the credit applicant, as well as the following categories of personal data of the data subject: CNP, date of birth, country of residence, existence of entries in the Sanctions Regime databases, status and, where applicable, length of time as a BT customer, as well as, in the case of customers in the medical sector, specialty, degree, and position held. This data is automatically analyzed within the scoring application, which issues a score based on a profile of the debtor/potential debtor, thus determining the credit risk and the probability of future timely repayment of installments.
Based on this score, to which is added information resulting from checks carried out in the Bank's own records, such as those relating to monthly income, and in public databases such as websites, the court portal, ONRC, etc., - BT determines whether the eligibility conditions set out in its internal regulations are met and will decide whether to accept or reject the credit applicant's request, a decision that is based on the analysis carried out by the bank's employees (human intervention).
As an exception, we will use exclusively automated means to approve/reject the credit application only in specific cases, namely when the application is submitted online and it is essential to provide the credit applicant with a response within a very short time frame. in which case the decision is made exclusively by automated means in order to quickly analyze the application and, where appropriate, conclude the credit agreement.
[3] The scoring application is used only for SME-type legal entities, as this category is defined in accordance with the Bank's internal regulations.
[4] If you are, as applicable: the partner/shareholder with the largest stake, legal representative, or beneficial owner of the credit applicant.
6. Recipients of the data
In addition to the recipients mentioned in point I.(6) of this notice, the personal data processed for the purpose indicated in point II.(2) is disclosed, as applicable, to the following recipients: Biroul de Credit S.A. (for consulting your status in the records of this institution), insurance companies, appraisers (in the case of loans for which an appraisal of the collateral is performed), providers of services used by Banca Transilvania S.A. as part of the credit application analysis process, companies (funds) guaranteeing certain types of credit, such as: FNGCIMM, FGCR or APIA, to which - when acting on personal data for purposes and by means established jointly with the bank, as associated operators - we disclose certain personal data under the terms of agreements concluded in accordance with the law, through which we have mutually committed to ensuring the adequate protection of personal data and respect for your rights regarding the processing of such data, rights which you can exercise both at the bank and at the bank's associated operator.
7. Storage period
The personal data filled in in the loan application are kept in the records of Banca Transilvania for limited periods established legally (e.g. according to the legislation in the financial accounting field) or internally.
8. Rights of data subjects regarding the processing of personal data
To exercise your rights (right of access to data, right to rectify data, right to erase data, right to restrict data, right to object to processing) provided for in the Regulation in relation to the processing of personal data in the Biroul de Credit S.A. system in relation to Banca Transilvania S.A., you may use any of the methods indicated in section I, point (8) of this notice.
If you exercise these rights at Banca Transilvania S.A. (both for the processing of personal data in the Biroul de Credit S.A. system and within Banca Transilvania S.A.), you can send your written request to the address in Mun. Cluj-Napoca, str. Calea Dorobanților, nr. 30-36, jud. Cluj, with the mention – "to the attention of the data protection officer (DPO)" or electronically to the e-mail address dpo@btrl.ro.
You also have the right to contact the National Authority for the Supervision of Personal Data Processing.
III. Information regarding the processing of personal data for the purpose of establishing the debtor group
Banca Transilvania S.A., as a credit institution, is subject to legal obligations to determine and analyze its exposure to related customer groups as part of its credit risk analysis.
For this purpose, it is necessary to use information about persons with whom you form the same debtor group, as you are related customers. Your spouse is always a person related to you.
In addition to your spouse, there may be other individuals or legal entities with whom you are part of the same group of debtors. To verify whether and with whom you have such relationships, we will query your data in our internal and public records (e.g., ONRC).
To understand which categories of people are considered to be related to you, we recommend that you study the details available in the BT Privacy Policy on our website www.bancatransilvania.ro, in section C, point 3, or at the following link: https://www.bancatransilvania.ro/Informare-Apartenenta-la-Grupuri-Credit-Online.pdf. People who are related to you can also find out information about how we process their data for this purpose in the same section of the BT Privacy Policy.
As a reporting entity, BT has a legal obligation to report these exposures and the composition of related customer debtor groups to the NBR, the CRC (only where applicable) and, based on its legitimate interest, may disclose this data to entities within the Banca Transilvania Financial Group and service providers used by BT in the credit application analysis process.
Your refusal to have this data processed may make it impossible for BT to review the application and/or approve credit for the credit applicant.
The retention period of these individuals' data on BT's records is equal to the existence of the group(s) of connected customers of which they are part, plus non-excessive storage periods.
C. Information regarding the processing of personal data upon conclusion and during the term of a credit agreement entered into by legal entity customers with Banca Transilvania S.A.
If the credit application submitted to the bank by the credit applicant is approved, we will inform you below how we will process your data upon conclusion (signing with electronic signature) and during the term of the credit agreement.
This is a specific Privacy notice concerning the processing of personal data for the purpose of concluding and carrying out a credit agreement. The provisions of this notice are supplemented by the General Privacy notice on the processing and protection of BT Customers' personal data, which details all other purposes for which your data is processed as a BT customer.
1. Identity of the operator
Banca Transilvania S.A., headquartered in Cluj-Napoca, Calea Dorobanţilor no. 30–36, Cluj County, processes your personal data as a controller for the conclusion and execution of the credit agreement concluded with the Bank and, where applicable, the guarantee agreements—accessories to the credit agreement.
2.Legal basis and purpose of processing
For the conclusion and execution of credit agreements and, where applicable, related guarantee agreements, the Bank processes the categories of personal data mentioned in this section under point (4), based on its legal obligations, the conclusion and execution of the agreement, and its legitimate interest.
3. Obligation to provide data and consequences of non-compliance
The provision of your personal data is necessary for the purpose mentioned in point (2). Refusal to have your personal data processed for the purpose mentioned above will result in the Bank being unable to offer the requested credit.
4. Categories of personal data processed
The personal data processed by the Bank for the purpose mentioned in point (2) are those that you have been informed are processed during the pre-offer/credit application analysis stage, to which are added other similar data that were completed and/or received on the occasion of/for the conclusion of the credit agreement, together with its accessories.
5. Recipients of the data
Personal data processed for the purpose mentioned in point (2) shall be disclosed or transferred in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and data security, to the following categories of recipients - insurance companies, appraisal companies, service providers used by the Bank in the lending process, debt collection companies, OCPI, RNPM, public authorities and institutions, notaries public, lawyers, bailiffs, Credit Risk Center*, guarantee companies (funds) for various types of credit products, such as: FNGCIMM, FGCR or APIA, to which - when acting on personal data for purposes and by means established jointly with the bank, as associated operators - we disclose certain personal data under the terms of agreements concluded in accordance with the law, through which we have mutually committed to ensuring the adequate protection of personal data and respect for your rights regarding the processing of such data, rights which you can exercise both at the bank and at the bank's associated operator.
*The bank has a legal obligation to report credit risk information to the Credit Risk Center (CRC) for each debtor who meets the reporting criteria (including the identification data of a debtor, natural person or non-bank legal entity, and transactions in lei and foreign currency through which the Bank is exposed to risk in relation to that debtor), i.e. to have recorded an individual risk in relation to that debtor, as well as information about detected card fraud.
6. Duration of storage of personal data
Personal data processed for the purpose indicated in point (2) is stored in the Bank's records for a period of 5 years after the termination of the business relationship.
In the records of the Credit Risk Center, the data reported pursuant to the Bank's legal obligation, namely credit risk information and information on card fraud, are kept for a period of 7 years from the date of registration.
7. Rights of data subjects regarding the processing of personal data
As a data subject, you can exercise your rights under EU Regulation 679/2016- General Data Protection Regulation: the right of access, the right to rectify data, the right to erase data, the right to restrict data, the right to object to processing, as well as the right to appeal to the National Authority for the Supervision of Personal Data Processing and to the courts.
These rights may be exercised by sending a written request to the address in Cluj-Napoca, str. Calea Dorobanților, nr. 30-36, jud. Cluj, with the mention – “to the attention of the data protection officer (DPO)” or electronically to the e-mail address dpo@btrl.ro.
D. Information on the processing of personal data for the purpose of issuing and managing the Qualified Digital Certificate issued to the User by Alfatrust Certification S.A. for signing the documentation in relation to BT
If you wish to obtain a BT PJ loan online, you will need to sign the loan documentation with a qualified electronic signature. The issuance and use of the digital certificate for signing does not entail any costs for you, but BT and Alfatrust, as associated operators, need to process your personal data in order to issue this electronic signature.
Detailed information about the processing of your data for this purpose can be found below.
1. Controllers of personal data
Pursuant to Articles 13-14 of EU Regulation 679/2016 - General Data Protection Regulation ("GDPR"), Alfatrust Certification S.A. ("Alfatrust") and Banca Transilvania S.A. ("BT") hereby inform you about the processing of your personal data as a User ("data subject"), which they carry out as joint controllers for the purpose mentioned in point b of this notice.
2. Purpose and basis of the processing of personal data
The purpose for which the associated operators process the User's data is to issue and manage the Qualified Digital Certificate (the "Certificate").
BT is the operator that identifies the User, collects the personal data necessary for issuing the Qualified Digital Certificate, and transmits it to Alfatrust so that this operator can issue the certificate.
The data that BT collects from Users are those processed by BT in its own records, in the context of the business relationship that is already established between the User and BT at the time of transmitting the data to Alfatrust.
During the period of validity of the certificate, personal data are processed by the associated controllers, as the case may be, as well as in situations where users request the suspension or revocation of the certificate in the ways detailed in the Terms and Conditions of Service Provision.
The grounds for the processing of personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit.c GDPR), the conclusion / execution of the contract (Art. 6 para. 1 lit.b GDPR) and the legitimate interest of the associated operators (Art.6 para. 1 lit. f GDPR).
With regard to legal obligations, both BT, as a credit institution with which the User has established a business relationship, and Alfatrust, as an accredited certification service provider from which the User wishes to obtain a certificate, are subject to the applicable legal provisions in the field of money laundering and terrorist financing prevention, according to which they must collect a series of personal data from customers. This data is also necessary for the conclusion/execution of the contract under which the User is allowed to use the certificate to sign documentation in relation to BT.
In order to support Users who wish to submit a request for suspension or withdrawal of the certificate, the associated operators justify a legitimate interest in offering them (who are also BT customers) the possibility to submit these requests not only directly to Alfatrust, but also through BT. The resolution of these requests involves the exchange of Users' personal data between the two associated operators.
Contact details—telephone number and home address—will be processed by any of the associated operators whenever it is necessary to contact the end user for the proper performance of the contractual relationship related to the qualified digital certificate.
3. Categories of personal data and persons whose personal data are processed
The personal data processed for the purpose mentioned above are those required by law to be collected by a credit institution or a certification service provider for the prevention of money laundering and the financing of terrorism, namely: surname, first name, personal identification number, home/residence address, date of validity of the identity document, telephone number, copy of the identity document. All this data, as provided by the User to BT, will be transmitted to Alfatrust for the issuance and management of the Qualified Digital Certificate.
The processing of these personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate.
The data subjects of this processing are only the Users as defined in the Alfatrust Terms and Conditions of Use.
4. Recipients of personal data
With the exception of the associated controllers between whom an exchange of the personal data processed to fulfill the purpose of the processing will be carried out, the data shall be disclosed, where appropriate, to the providers of IT services, audit services, authorities and institutions entitled to know them.
5. Period of processing of personal data
Information regarding a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its expiry, in accordance with the terms established by law.
At BT level, the remote electronic signature, applied on the basis of the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship exists between the User and BT, to which are added the terms established in the applicable legislation.
6. Rights of data subjects for the processing of their personal data
Any User, in their capacity as a data subject, is guaranteed the exercise of the following rights regarding the processing of their personal data by any of the associated operators: the right of access, the right to rectification, the right to restriction of processing, the right to erasure, the right to object to processing, the right to data portability.
Users can exercise these rights or contact the data protection officers for any questions / requests regarding the processing of your personal data, as follows:
- to Banca Transilvania S.A. - by email to dpo@btrl.ro or by sending a request to the bank's address in Cluj-Napoca, str. Cale Dorobanților nr. 30-36, jud. Cluj, marked "for the attention of the Data Protection Officer (DPO)".
- to Alfatrust Certification S.A. – by email to suport@alfasign.ro or by sending a request to the Alfatrust headquarters, marked “for the attention of the Data Protection Officer (DPO)”.
Users also have the right to lodge a complaint with the supervisory authority—the National Supervisory Authority for Personal Data Processing (ANSPDCP), located inBucharest, Sector 1, Bd. G-ral Gh. Magheru nr. 28-30.