Information note on the processing of personal data when concluding and during the performance of a credit agreement (card or non-card) concluded with Banca Transilvania S.A.

1. General provisions

Banca Transilvania, S.A., (hereinafter also referred to as "the bank", "BT", "we", "us"), hereby informs you of how it intends to process your data for the main purpose of concluding and performing a credit agreement you have entered into with the bank.

This is a specific information notice on the processing of personal data for the purpose of concluding and performing a credit agreement. The provisions of this note are supplemented by General information notice on the processing and protection of personal data of BT customerswhere all other purposes for which your data are processed are detailed. The General Information Notice is an integral part of the BT Privacy PolicyPrivacy Policy, found on the www.bancatransilvania.ro and can be obtained on request from any BT branch.

Banca Transilvania S.A. with head office in mun. Calea Dorobantilor, 30-36, Cluj-Napoca, jud. Cluj processes your personal data as data controller for the conclusion and execution of the credit agreement concluded with the Bank and, where applicable, of the guarantee agreement - accessory to the credit agreement.

2. Legal basis and purpose of the processing

For the conclusion and performance of credit agreements and, where applicable, related guarantee agreements, the Bank shall process the categories of personal data referred to in this section under point (4) by virtue of its legal obligations, the conclusion and performance of the agreement and its legitimate interest.

The Bank shall use any of the contact details provided by the borrower for the purposes of the contractual relationship with the Bank for the purpose of informing the borrower of the due date of each instalment and, where applicable, for the purpose of sending notifications of the expiry of insurance policies, for the recovery of debts on the credit taken out and for other events occurring in connection therewith.

3. Obligation to provide data and consequences of non-compliance

The provision of your personal data is necessary for the purpose mentioned in point (2). Refusal to process your personal data necessary for the purpose mentioned will make it impossible for the Bank to provide you with the requested credit.

4. Categories of personal data processed

The personal data processed by the Bank for the purpose mentioned in point (2) are those of which you are aware that they are processed during the pre-offer/ credit application analysis stage, plus other such data that have been filled in and/or received from you on the occasion of/ for the conclusion of the credit agreement, together with its accessories. At the time of the conclusion of the agreement, you will be allocated an IBAN code for the credit taken out, through which payments will be made. In addition, in the case of credit cards, they will contain, in addition to the name and surname of the cardholder, the card number (PAN), as well as information on the expiry date of the card and the CVV code.

5. Recipients of the data

Personal data processed for the purpose mentioned in point (2) are disclosed or transferred in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and data security, to the following categories of recipients - Credit Bureau S.A. and Participants in this system, insurance companies, valuation companies, service providers used by the Bank in the lending process, debt recovery companies, OCPI, the National Registry of Real Estate Publicity (RNPM), public authorities and institutions, notaries public, lawyers, bailiffs, the Credit Risk Centre*, companies (funds) guaranteeing various types of credit products, the Bank's partners - Rotary and Flying Blue, for credit cards issued in collaboration with them.

*The Bank is legally obliged to report to the Credit Risk Centre (CRC) the credit risk information for each debtor that meets the condition to be reported (it includes the identification data of a debtor, whether an individual or a non-bank legal entity, and the transactions in lei and in foreign currency through which the Bank is exposed to risk towards that debtor), i.e. to have registered an individual risk towards that debtor, as well as the information on the card frauds detected.

** The Bank has a legitimate interest in reporting your personal data to the Credit Bureau System, to which other Participants (mainly credit institutions and non-bank financial institutions) have access, if you are at least 30 days in arrears with your credit payment, after giving you at least 15 days' prior notice.

6. Duration of storage of personal data

Personal data processed for the purpose indicated in point (2) are stored in the Bank's records for legally established (e.g. under financial accounting legislation) or internal limited periods.

Those personal data that are processed in the Credit Bureau system and disclosed to Participants in this system are stored in the records of this institution for 4 years from the date of update. In the Credit Risk Bureau's records, the data reported under the Bank's legal obligation, i.e. credit risk information and card fraud information, are maintained for a period of 7 years from the date of entry.

7. Rights of data subjects regarding the processing of personal data

As a data subject, you can exercise your rights under EU Regulation 679/2016 - General Data Protection Regulation: right of access, right to rectification of data, right to erasure of data, right to restriction of data, right to object to processing.

These rights may be exercised as follows:

• to the Bank, by sending a written request to the bank's address in mun. Calea Dorobantilor, no. 30-36, Cluj-Napoca, jud. Cluj, with the mention - "for the attention of the Data Protection Officer (DPO)" or by e-mail to dpo@btrl.ro.
• by securely accessing the Credit Bureau website (www.birouldecredit.ro), in the case of data processed in the Credit Bureau System, as well as the right to address the National Authority for the Supervision of Personal Data Processing and Justice.