What is the RoPay Payment Scheme?
Banca Transilvania S.A.("BT", "the bank") and Societatea de Transfer de Fonduri si Decontări - TRANSFOND S.A. (hereinafter "TRANSFOND"), together with other banks in Romania (hereinafter "participating banks") process your personal data, as a data subject, in accordance with the provisions of the General Data Protection Regulation (hereinafter "GDPR"), for the purposes and by means of the processing means set out in the RoPay Set of Rules (hereinafter "RoPay").
RoPay is offered by Banca Transilvania under the conditions set out in the BT RoPay Terms of Use. The BT customer using RoPay through Banca Transilvania is a "RoPay user".
If you are a natural person, it is important that you understand how your personal data is processed in the context of using this service, as you are a data subject in relation to this processing.
RoPay offers users two services:
- RoPay SPL Service – facilitates the initiation of payments/payment requests based on a proxy (alias – phone number) linked to an account (IBAN), registered in the RoPay SPL, which enables a consumer to initiate a payment or payment request.
- QR Code Payment Request Initiation Service – allows the payee to generate a QR code that the payer can scan to initiate a payment.
For clarity, all information in this specific privacy notice refers exclusively to the personal data processed for the provision of the RoPay service. The processing of BT customers’ personal data by Banca Transilvania, as an independent data controller, is subject to the the General Information Notice on the processing and protection of BT Customers' personal data
Joint Data Controllers
The RoPay payment initiation scheme operates only if participating banks exchange personal data necessary for payment initiation, in accordance with the RoPay Scheme Rulebook. This exchange is facilitated via a shared database managed by TRANSFOND.
Participating banks and TRANSFOND process personal data as joint controllers, as defined under Article 26 of the GDPR, and have entered into a joint controllership agreement that sets out their respective responsibilities for compliance with GDPR obligations, particularly those related to data confidentiality and security, as well as their roles and interactions with data subjects.
The list of participating banks may change over time due to new entries or withdrawals from the RoPay scheme. The up-to-date list of participating banks is available here.
Purpose of Processing
Personal data is jointly processed by the controllers solely for the purpose of providing services that facilitate the initiation of instant payments/payment requests, in accordance with the RoPay Scheme Rulebook, for customers of participating banks, in the use cases defined therein.
Categories of Personal Data Processed
The categories of personal data processed by the joint controllers in the context of RoPay include:
- Full name and phone number (proxy) of the RoPay user, either payer or payee, who is a natural person customer of a participating bank;
- IBAN of the account held by the RoPay user (payer or payee), used to send or receive payments/payment requests to/from customers of participating banks.
These data relate to the following categories of data subjects: BT customers with current accounts in RON opened at BT, who use BT’s mobile banking service dedicated to individual customers. Data subjects may act as payers and/or payees in transactions via the RoPay service.
Legal Bases for Processing
The legal bases for processing personal data by participating banks under the RoPay scheme are:
- Performance of a contract to which the data subject is party (Article 6(1)(b) GDPR);
- Legitimate interest of the paying bank to execute the RoPay service and to present the RoPay user with a pre-filled payment order (Article 6(1)(f) GDPR).
The legal basis for TRANSFOND’s processing of personal data is its legitimate interest in executing the RoPay service under the conditions set out in the RoPay Scheme Rulebook (Article 6(1)(f) GDPR).
Recipients of Personal Data
Personal data processed by the joint controllers may be disclosed, where applicable, to public institutions and authorities with supervisory and control responsibilities.
Data Retention Period
Your personal data related to the RoPay service provided via BT will be stored in TRANSFOND’s database and will be accessible to other participating banks and their RoPay users for as long as you use the RoPay service. Personal data will no longer be used for the provision of RoPay if you request data erasure, object to the processing, or cease to be a customer of the bank.