Information notice on the processing of personal data for identification for the purpose of providing banking information through Ino

Banca Transilvania S.A. ("the Bank", "BT") is legally obliged to verify the identity of customers when they request personalised information about the products/services contracted from the bank ("banking information"), in order to ensure that it is provided only to authorised persons. The more sensitive the banking information requested, the higher the level of identification we will need to apply.

When customers are unable to reach a BT unit or find the waiting time in the call centre too long, it is essential for us to accommodate their requests as quickly as possible while ensuring the confidentiality of their banking information. That's why we also offer you the possibility to obtain some banking information via the Ino chatbot (hereinafter "Ino"). In this case, we will identify you remotely, by electronic means and, if the information requested/provided is of a higher sensitivity, also by video means.

For this identification process we process your personal data as follows:

Basic identification (for less sensitive banking information, including entering into online chat communication with a BT employee)

1. enter your personal identification number (CNP) and the telephone number declared to the bank. To this number we send you an SMS with a unique code (SMS-OTP), which you will have to enter in Ino. In this way we verify your identity and your status as a BT customer.

If you pass this step, depending on the information you request, the BT employee with whom you will communicate within Ino may ask you additional identifying questions.

Additional identification (for more sensitive banking information)

If the banking information requested/provided through Ino is of a higher sensitivity, we will apply a higher level of identification to you. Therefore, in addition to the basic identification, you will need to go through the following additional steps:

2. you upload a picture of your identity card ("IC") - we take the data from your IC using optical character recognition (a process that automatically extracts the letters and numbers from the uploaded IC) and compare them with those already in the bank's records to make sure they match.

3. you move in front of the camera (requires camera access) - we record your moving image and use it to make sure you are a real person.

4. in order to confirm your unique identification, we want to apply a technology to your image (face) that uses so-called biometric data (comparing the characteristics of your face from two photos).

We will not use biometric data without your explicit consent. Before you decide freely whether you wish to express it, here is how we would use it:

• the software solution we use identifies your face from the uploaded CI and from the video we record when you move in front of the camera, selects it and compares it with the face in the copy of the CI that is already recorded in BT's records
• the comparison is made biometrically, based on criteria such as: colour, size and slant of the eyes, position and distance between the main elements of the face such as eyes, eyebrows, lips and nose
• Following the biometric comparison, the software solution outputs a confidence score, indicating the likelihood that the face in the two images belongs to the same person.

If we want to use biometric data to identify you in Ino, we will ask for your explicit consent before using such data. To consent to the processing of biometric data (facial recognition), you will have to select the "I explicitly consent to the processing of my biometric data" button in Ino and if you refuse to have your biometric data processed, you will select the "I do not want my biometric data to be used" button.

However, if we do not use biometric data to identify you in Ino, we do not need to ask for your consent, only to inform you that we are processing your data as required by law. To confirm that you have read this information, we will display the "I have taken note" button.

If you refuse to have any of your personal data processed for identification purposes in Ino, you will not be able to obtain banking information about your BT accounts/products via chat. Instead, you can use the general question/answer (FAQ) sections about BT products and services, for which we do not need to identify you. In the event that we need to use biometrics to identify you and you do not explicitly consent to their use, you will be able to call a BT call centre agent where your identity will be verified without the use of biometrics.

We will make the decision whether or not to provide you with your banking information in the Ino chat by processing your personal data mentioned above by automated means only. Making the decision in this way is necessary to be able to quickly verify your identity in order to provide your banking information in Ino. With respect to this automated decision, you are guaranteed the right to express your views and to challenge it, as well as the right to request human intervention - i.e. the right to request that your identity be verified by a bank employee. To do this, you can either call a call centre agent or go to a BT branch.

This information note is supplemented by the provisions General information notice on the processing and protection of personal data of BT customerswhich we recommend that you consult. It is an integral part of the BT Privacy Policy, which you can find on the bank's website www.bancatransilvania.ro. The general information note includes the definition of BT Customer, as well as details about the recipients of BT Customer data, your rights in relation to the processing of your data, how you can exercise them or how to contact the BT Data Protection Officer (BT DPO).