Information note on the processing of personal data within the Invoice Payment Service

1. Who processes personal data in the Invoice Payment Service?

Banca Transilvania S.A. ("BT", "the bank") offers you the Invoice Payment service, under the conditions set out in Terms and conditions of use of this service. Before you decide whether you want to become a user of this service, it is important to know how we process your personal data if you use it. We provide you with the necessary information in this specific notice.

For the avoidance of doubt, the processing of your data by Banca Transilvania in the context of your status as a BT customer is subject to the following provisions the General Information Notice on the processing and protection of personal data belonging to BT customers.

2. Purposes of processing, categories of data processed and recipients

a. to activate the Invoice Payment service

To use the Bill Pay service you must be a BT Pay user identified as a BT customer. To make sure you meet this requirement, we check your phone number on file, your date of birth and whether you have at least one BT card enrolled in the app.

b. for connecting suppliers to BT Pay 

Once you have selected the suppliers you wish to make payments to from BT Pay, you will be able to log in to our app from each supplier's account by entering the login details requested by the supplier. The categories of data required for logging in are determined by each individual supplier and communicated to us via our partner Timesafe SRL (the provider of the Pago app). Both suppliers and Timesafe process this data as operators, for purposes and by means that they have set up separately from BT, according to their own personal data processing policies.

The bank only processes this data to enable you to connect that supplier account to BT Pay so that you can use the Bill Pay service. Typically, the login details are: the username(s) and password(s) you use to log in to the account created on the respective provider's website. You can log into BT Pay with multiple user accounts from the same provider.

You enter this data into BT Pay, we pass it on to Timesafe, along with an identifier that is assigned to you so that your bank and Timesafe will recognise your future login attempts. If necessary, on the basis of this identifier, BT and Timesafe will carry out the necessary data exchanges to deal with any complaints/complaints you may have in relation to your use of the Bill Pay service. Timesafe then forwards the username and password you entered in BT Pay to each supplier concerned. If these details match those of the supplier, the BT Pay account you have set up with that supplier will be successfully logged into BT Pay.

In order to avoid having to reconnect your account from each provider in case of reinstallation of BT Pay, we will keep in our records the providers you have previously connected and will automatically display them after reinstallation, as long as you still use the same credentials to connect to their accounts.

c. to view invoices and history of paid invoices

Once a supplier's account has been successfully connected, we will process the payment amount from that supplier's invoices, the supplier to whom that amount is owed, the customer codes assigned by that supplier, and various other information, depending on the type of supplier (e.g. We do this processing so that we can display to you the payment amounts due on those invoices, as well as the payment history of the supplier's accounts held on the supplier's account.

The period over which payment history will be displayed for a particular supplier is set by that supplier. BT will only be able to see the payment history available at the time of each connection you make from BT Pay to that provider's account.

d. to connect your account from the Pago app

If you are a user of the Pago app, you can import the suppliers you already have integrated into Pago into BT Pay, without having to connect each of them separately to BT Pay. To do this you will need to enter the email address of your Pago user account and a unique code that will be displayed in the Pago app in BT Pay.

After importing data from Pago, we will process in BT Pay the same data indicated in lit. c, which you have available in the accounts of the suppliers connected in Pago and, if applicable, other data as defined in your account in the Pago application (e.g. type of consumption place related to a supplier, such as: parents' home, holiday home, residence).

e. for scanning invoices

For some suppliers you will be able to pay your invoice by scanning the barcode. To use this functionality, the BT Pay app needs access to the camera. If you have previously given the app access to the camera when using other camera features (e.g. updating data via BT Pay), you may not be asked for this access as it is already allowed. Please note that you may be asked to access the camera differently depending on the operating system of the phone you are using or the version of this system. Depending on the same elements, camera access granted in BT Pay may remain active or be disabled when you no longer use the BT Pay functionality that requires this access. Please check your phone's privacy settings to manage camera access for BT Pay.

f. for the payment of invoices and, where applicable, for the subscription and retention of the option fee Bills Plus or Unlimited Bills

We will process the necessary payment data: first and last name of the payer, amount, currency, date of payment, payee of the payment (the supplier to whom you make the payment), transaction reference, IBAN of the account from which the payment is made, card number attached to the account from which the payment is made, explanation of the payment (as required by the supplier and entered by you or retrieved by scanning the barcode e.g. customer code at the respective supplier), number of invoice payments made, IBAN of the account from which the option amount is charged.

g. for confirmation of payment transactions

We process the data related to the phone unlocking method of your choice to ensure adequate transaction security in accordance with the applicable legal provisions in the field of payment services. The data related to the phone unlocking method you have chosen (e.g. fingerprint, facial identification, model, PIN, password, etc.) is not in the bank's possession, but BT is only the result of the verification (accepted/rejected) by comparison of the data used to authorise each payment transaction with the corresponding witness data stored in your phone.

h. for the transmission to suppliers of the payment status of invoices

In order for the utility providers to whom you have made payments to be able to reconcile them in their systems, we transmit to them, via Timesafe SRL (the provider of the Pago application), the information necessary for this purpose: amount, currency, date of payment, payee (the provider to whom you make the payment), transaction reference, explanation of the payment (as required by the provider and entered by you or retrieved by scanning the barcode e.g. customer code at the respective provider, invoice code etc.).

i. for sending notifications within the application in relation to this service

When a supplier you have connected issues a new bill, 3 days before the bill due date of an already issued bill or about the cards set when you activate the Bills Plus or Unlimited Bills options you will receive notifications in BT Pay. You can disable these notifications from the app settings menu. Please note that in this case you will not receive any other general notifications about BT Pay;

3. The basis for processing personal data and the consequences of refusing to have it processed

The processing operations outlined in the previous lines are, as appropriate, necessary for BT to provide the Bill Pay service to you or are carried out by the bank and based on its legitimate interest in providing you with the same experience and full picture of information as that displayed in a supplier's account you have logged into BT Pay. If you do not want BT to process this data, you will not be able to use this service, but your right to use other features of the BT Pay app or other BT services/products is not affected.

4. Data source and categories of recipients of personal data in the Invoice Payment Service

We also receive and transmit, where applicable, the data mentioned in points b-d and h above from/to our partner Timesafe SRL, provider of the Pago application. The latter processes them as a controller in accordance with the provisions of Timesafe's personal data processing policy.

When you pay bills from the BT account attached to the card you choose from BT Pay, the transaction data is disclosed to the supplier to whom you make the payment and, where applicable, to the credit institution where the supplier's account is opened.

Other categories of recipients of your data processed as a BT customer are those set out in General information notice on the processing and protection of personal data of BT customers.

5. Period of storage of personal data in the context of the use of the Bill Payment service

The personal data referred to in b-d are processed by BT only as long as you use the Bill Pay Service and have at least one supplier account connected to BT Pay. The other categories of data indicated in this information notice are processed, as appropriate, for other functionalities of BT Pay (camera referred to in point e, confirmation of payments via the phone unlocking method referred to in point g), while the data related to payments and those necessary to activate the service are subject to the retention periods of General information note on the processing and protection of personal data belonging to BT Customers, as they are closely linked to your BT customer status.

6. The rights you are guaranteed

As a BT customer, you are guaranteed your rights under the General Data Protection Regulation (GDPR) as detailed in General information notice on the processing and protection of personal data of BT customerswith the provisions of which this specific information notice is supplemented. You can find the general information notice on BT websitewebsite, both as part of the BT Privacy PolicyPrivacy Policy, and separately. You can also request it at any BT branch.