Information note on the processing of personal data within the Beneficiary Name Display Service (BNDS)

1. What is the Beneficiary Name Display Service (BNDS)?

Banca Transilvania S.A. ("BT", "the bank", "we", "us") together with other banks in Romania ("participating banks") offer the Beneficiary Name Display Service (BNDS) to prevent fraud to which their individual customers may be exposed. .

This service is available to customers of participating banks who initiate payments to accounts opened at another participating bank within payment/internet banking applications. SANB involves the truncated display of the truncated name of the payee - a customer of one participating bank - to the payment initiator - a customer of another participating bank. Details of SANB can be found on the BT website here.

SANB can only function if participating banks exchange the information necessary to display the payee's name in truncated form. When directly or indirectly identifying a natural person, this information is personal data.

As you are a BT customer (participating bank), your personal data is processed within SANB. Thus, you are a data subject of the processing and we are informing you through this information notice about this.

For the avoidance of doubt, all information in this information notice relates to your data processed for the provision of the SANB service. The processing of your data by Banca Transilvania, as an independent controller, in the context of your status as a BT customer is subject to the following provisions the General Information Notice on the processing and protection of personal data belonging to BT customers.

2. Personal data controllers

The exchange of information necessary for the operation of the SANB will be carried out through a common database, which will be managed by the Funds Transfer and Settlement Company ("Transfond").

The participating banks and Transfond will process data subjects' data as joint controllers, as that term is defined in the General Data Protection Regulation ("GDPR"), and have agreed on their responsibilities for fulfilling the obligations imposed by the GDPR, in particular those relating to the privacy and security of personal data, and their role and relationship towards them.

The list of banks participating in SANB may be subject to change, with some banks joining or withdrawing from SANB. You will find an up-to-date list of all SANB participating banks here.

3. Purpose of processing, categories of data processed and recipients

The exchange of personal data is carried out by the associated operators exclusively for the purpose of displaying the truncated name of the beneficiary to the customers of the participating banks, in order to prevent fraud.

The categories of personal data processed are your first name (one or more, as appropriate), the initial of your surname and the IBAN code of the account(s) opened with a participating bank.

As a SANB participating bank, BT sends Transfond your first name and initial, together with the IBAN code of the account(s) opened with BT.

In the case of your BT account data, we are the controller that collects this data and transmits it to the Transfond associated operator, where the data will be stored. Subsequently, if a customer of a participating bank initiates a payment to your BT account, this data concerning you will also become accessible to the participating bank from which the person initiates the payment and, implicitly, to the customer of that bank initiating the payment (after he himself enters the IBAN of your BT account in the payment application). Your first name (in full) and initial will be displayed to him/her, as recorded in BT's records, regardless of whether the payment is completed or not.

At the same time, if you initiate a payment from a BT payment/internet banking application to a customer's account at another participating bank, you will be shown the customer's first name and initial as registered with that participating bank after entering the IBAN of the customer's account at that participating bank.

4. The basis for processing personal data and the consequences of refusing to have it processed

The basis for the processing of your personal data is the legitimate interest of the participating banks to provide a fraud prevention tool for interbank payments initiated via payment/internet banking applications.

If you refuse to allow your personal data to be processed for SANB, a customer of a participating bank who wants to initiate a payment to you from internet banking will not be shown your truncated name and thus, if they make a mistake in your code, they will not be shown your name. If you miss a character in your IBAN code, it is possible that the amount for you will go to another person.

5. Period of storage of personal data in the context of SANB

Your personal data related to SANB will be stored in the Transford database, and will thus be available - where applicable - to other participating banks and their payment initiator customers, as long as you are a BT customer and Banca Transilvania is a SANB participant.

6. The rights you are guaranteed

In connection with the processing of your personal data within SANB, you are guaranteed the exercise of your rights under the GDPR. You can exercise these rights at any of the associated controllers, at the contact details of their Data Protection Officers (DPOs) found in the Privacy Policies on their websites. As a general rule, each controller will respond to requests by data subjects exercising their rights in relation to the processing for which that controller is responsible, but where necessary, the associated controllers, through Transfond, will inform each other and provide each other with the necessary information to be able to respond to any requests from data subjects.

The rights guaranteed to you are: the right to information (we fulfil our obligation to inform you through this information notice), the right to object to the processing of your data for SANB, the right of access to processed data, the right to rectification of data, the right to erasure of data, the right to restriction of processing, the right to data portability, the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).