Information note on the processing in BT PAY of personal data of minor users attached to the parent's account

1. About this information note

Please read this information note if:

• you are at least 10 years old (and not yet 18 years old) and you want to use from the BT Pay application (hereinafter referred to as "BT Pay" or the "Application"), with a card issued in your name that is linked to your parent's account, the services referred to in Chapter V of the Terms and Conditions of Use of the "BT Pay Kiddo" functionality for minors linked to the parent's account. When we refer to you, we will say "child" or "minor".

or

• you are a parent/guardian/legal representative ("parent") of a minor who is at least 10 years of age and under 18 years of age and you intend to allow them to use BT Pay features with a card issued in their name but attached to an account in your name

This information should be read before a child starts installing BT Pay.

With this information, Banca Transilvania ("BT", "the bank") informs the child and his/her parent how it will use the child's personal data in BT Pay.

When we write "personal data" or "data" in this information, we mean any information that identifies the child, directly or indirectly (e.g. name, surname, telephone number, transactions the child makes through BT Pay, child's card number, etc.) and when we write that we use, collect, verify, store such data, we mean that we "process" it.

If you do not understand any of the words used in this information or have any questions about how BT uses your child's data in BT Pay, you can write to us at dpo@btrl.ro. The person appointed at BT as your Data Protection Officer (hereafter referred to as "BT DPO") will help you with answers. We recommend that the minor does not use the services in BT Pay available to users in his/her age category if you do not understand this information.

If we change this information we will notify you by messages in BT Pay. The version of this notice that applies and the date from which this version applies are available in BT Pay or on our website - www.bancatransilvania.ro - in the Privacy Hub.

2. Who processes your child's personal data in BT Pay

The personal data of the minor in BT Pay is collected and used by Banca Transilvania S.A. Details of who BT is and how they can be contacted can be found in section III of the General Information Note on the processing and protection of personal data of BT customerswhere BT informs its customers about how BT uses their personal data in general.

3. What we use children's data for in BT Pay and on what grounds

We use your child's data in BT Pay to:

• fraud prevention (e.g. so that people who are not entitled do not get access to the child's data and money and the amounts that are in the account associated with his/her card);
• conclusion and execution of the contract for the BT Pay service for minors aged 10 to 14;
• sending notifications in BT Pay (BT Pay version update notifications or push notifications, if the different types of notifications in BT Pay are enabled);
• internal analysis (including statistical analysis), to analyse whether BT Pay is functioning properly;
• archiving information and documents (keeping data and transactions from BT Pay at the bank);
• ensuring the security of BT Pay (BT Pay is a banking application where we must protect the data and money of users who use this Application).

The grounds on which we process this data are, depending on the situation, those set out in Section VII of the General Information Notice for BT Customers, set out above.

4. What personal child data we use in BT Pay

• identification data: name, surname, personal identification number (C.N.P.), date of birth (taken from the CNP), nationality;
• information about the family situation - the relationship between the child and the parent who granted the child the right/access to use BT Pay for minors;
• age, to check whether the minor can use BT Pay available for the age category 10 years - 18 years under 18 years, and to stop using this service when the minor turns 18;
• contact details: telephone number (for sending unique codes to check whether the minor has access to this number and for using some BT Pay services available to the minor);
• financial data: data on transactions made with the BT card issued in the child's name, data on BT accounts to which the child's BT card registered in BT Pay is attached (although the account is opened in the parent's name and the child's card is linked to it, transactions made through this account indirectly identify the child);
• identifiers: BT card details and IBAN codes of the BT (parent's) accounts to which the child's BT cards are attached, phone identifiers (e.g. device ID, security method, operating system type, phone model), unique codes (SMS-OTP) sent to the phone number declared to BT by the parent for the child's card, payment method chosen for BT Pay;
• information on the location of certain transactions (e.g. when your child pays with BT Pay at certain shops, we will indirectly know that they were at the location of that shop at the date and time they made the payment or if they use BT Pay to withdraw cash from BT ATMs, we will know that they were at the location of that BT ATM at that date and time)
• other personal data:

- Like any app, BT Pay will require some permissions. Thus, BT Pay:

a. will have access to read from the phone used by the child the SMS messages sent by BT, for pre-filling SMS-OTP codes in the App;

b. will be able to check if the phone has NFC and if it is enabled when the child tries to make payments with the phone in shops;

c. will check whether the phone being used has an Android or IOS operating system to make it easier to register cards in Apple Pay,

d. when the child initiates transfers based on telephone numbers (the child can only initiate requests for money from the parent who granted the right), BT Pay will have access to the number of the parent who granted the child access to BT Pay, who is the only person from whom the child can receive money.

e. the list of applications of the device on which the minor has installed/uses BT Pay, to check for malware, including remote/remote login applications. Depending on the situation, the bank may take the following measures as appropriate: blocking the application until the uninstallation of third party applications that may compromise the privacy of BT Pay information or the bank contacting the parent.

5. Where do we get the child data we use in BT Pay

As the case may be, we have the child's data:

• from the parent who initiates the process of registering the child with BT Pay (we receive the child's first and last name, phone number and National ID from the parent);
• directly from the child when using BT Pay for minors attached to the parent's account.

6. To whom we may disclose child data used in BT Pay

We never sell or rent personal data from BT Pay. However, we may disclose your child's personal data:

• any of your parents/guardians/legal representatives, as long as they are minors;
• service providers who help us deliver BT Pay;
• other BT Pay users (e.g. all other BT Pay users will see the BT Pay icon next to the child's phone number if they try to initiate transfers to the child's phone number. In this case, those users will implicitly know that the child is using BT Pay (however, transfers to the child based on the phone number will only be successful from the phone number of the parent who granted access to BT Pay);
• to Apple Pay if your child's phone has an iOS operating system and they have chosen to enroll their BT card in Apple Pay within BT Pay;
• to public authorities/institutions (e.g. police) who may request such information about our Customers (including minors) in accordance with the law;

7. How long we keep the child's data used in BT Pay

Because any child's card is linked to the account opened in the name of the parent, who is a BT Customer account holder, we are required by law to keep their details (including transactions made through BT Pay) for 5 or 10 years after they are no longer a BT Customer. The 5/10 year period applies depending on which law requires us to keep the data.

8. What rights are guaranteed with regard to the processing of children's data

With regard to the child's processed data, the following rights are guaranteed: the right to be informed (information is in this notice), the right of access, rectification, opposition, the right to erasure of data, to portability, the right not to be subject to a decision based on automated data processing (we do not make such decisions in BT Pay with regard to the child's data), the right to complain to the ANSPDCP. The rights can be exercised on behalf of the child by the parent.

Details of these rights, including how they can be exercised, as well as contact details for the BT DPO can be found at General information notice on processing and protection personal data of BT customerswith which this Information Notice is supplemented.

The general information note is an integral part of the BT Privacy PolicyPolicy, available on the www.bancatransilvania.ro (including in the Privacy Hubsection) or in BT's offices.

The child and his/her parent should also know the following:

9. BT Pay security

The bank guarantees that it has taken appropriate measures to ensure data security in BT Pay. However, it is not up to BT alone who has access to the child's data in BT Pay. Therefore, we cannot guarantee that people who would not be entitled do not gain access to this data, especially if the minor has not taken sufficient care.

Even if you are a child, when you use BT Pay, you are responsible for the following:

• not allow people who are not entitled to see your BT Pay data (e.g. don't show it to friends, colleagues. We recommend that you only show them to your parents);
• keep your phone safe (don't leave it unattended);
• take care of the phone's unlock password (password, fingerprint or another security method provided by the phone), so that other people cannot see it or know it who are not entitled to (e.g. make sure that friends, colleagues, people on the bus or at stations, etc. do not see it);
• for what happens to your BT Pay cards (don't let people who don't have the right to use the phone you have BT Pay installed on);
• as soon as you find out that your phone or the password to unlock your phone has reached people who should not know it, you should let your parent know so they can contact the bank.