BT Go Privacy Policy | Banca Transilvania

1. Who is the controller of personal data, the data subjects and what are the purposes of the processing

Banca Transilvania, S.A. a credit institution with its registered office in Cluj-Napoca, 30-36 Calea Dorobanților Street, Cluj County, registered with the Trade Register under no. J1993004155124, CUI RO 5022670, contact telephone number: 02648028 (hereinafter referred to as "BT") provides its corporate customers with the Internet and Mobile Banking service – BT Go (hereinafter referred to as "BT Go") in accordance with the BT Go Terms and Conditions of Use. In this context, it processes personal data ("personal data") as a data controller, as described below.

If you are an individual using BT Go on behalf of one or more companies who are customers of Banca Transilvania - Romania or of Banca Transilvania – Italy Branch (for the features available to them in BT Go) (referred to as “Customer”), you are considered a user of the service and therefore a data subject whose personal data will be processed.

The account holder who has contracted/uses BT Go is also considered a data subject, if they are a registered sole trader (PFA), individual enterprise (II), individual practitioner of a liberal profession (hereinafter "independent professional")

BT will periodically update this notice, without imposing less favorable conditions regarding the processing and protection of personal data. Any changes will be communicated to you, and the updated version will always be available for consultation in BT Go and also on the BT website, in the Privacy Hub section. The version of this notice that is in force shall apply to BT Go users. If you have any questions or complaints regarding how BT processes personal data, you may contact BT’s Data Protection Officer at dpo@btrl.ro.

2. What personal data do we process, on what legal grounds, what individually automated decisions we make and what happens if you refuse their processing

a. What data do we collect when you open a business relationship with the bank through BT Go?

When opening a business relationship through BT Go mobile for the legal entity you represent, we use remote identification by video, which involves processing data from your identity document, contact details, and biometric data (facial recognition), in accordance with applicable legislation. Details are provided in the Information note on the processing of personal data for opening a business relationship with BT through BT Go - legal entities

b. What data we collect for the identification/authentication of BT Go users

To allow you to use BT Go, we have a legal obligation to verify your identity, namely to identify you as an authorized user of this service, in accordance with the obligation imposed on us by the legislation in the field of payment services, which requires us to verify who you are, what you own, and what you know (strong customer authentication).

For identification, we process the following types of personal data, depending on the situation

your identity card details, which you will be required to photograph in certain situations (this requires access to a camera). We will compare this information with the bank's records.
the moving image of the face from the video selfie that we will ask you to take in certain cases (requires access to the camera).
biometric facial data, obtained by biometric comparison of the selfie image with that of the identity document photographed in the BT Go application and/or with the image already existing in the bank's records. We will onlyprocess this data if you give your explicit consent, whichwe will request in BT Go before performing such processing.Biometric comparisonis based on criteria such as the color, size, and slant of the eyes, the position and distance between the eyes, eyebrows, lips, and nose. If the score issued by the facial recognition tool is unsatisfactory or if you do not wish to give your consent for the processing of this type of personal data, we can identify you at any BT branch or through the call center, where we will not use biometric data.
the login ID for BT Go (hereinafter referred to as "user ID")
the phone number declared at the bank
the security code (PIN) set for BT Go

When using the mobile version of BT Go, you can choose to log in either with the PIN you set for this application or with biometric data (e.g., fingerprint, Face ID from the device you are using). You can also set up biometric authentication for the web version of BT Go. If you choose this login option, BT does not have access to your biometric data, as it is stored on the device you are using. BT only receives information that the biometric authentication method has been validated by your phone.

Special notice to US users of BT Go, regarding the processing of personal data required for identification via Onfido

US users of BT Go, as defined in the Terms and Conditions for Using and Conducting Bank Transactions via Internet/Mobile Banking BT Go, should note that, in accordance with applicable US law on the processing of biometric data, including the Illinois Biometric Information Privacy Act (BIPA), their personal data of this type is processed by Onfido, as detailed in Onfido's Policy on Facial Scanning and Voice Recording, found at the following link: https://onfido.com/facial-scan-policy-and-release/. If you are a US user of BT Go, by continuing with the identification process in the App as described above, you confirm that you have read, understood, and agree to Onfido's Facial Scan and Voice Recording Policy, as well as Onfido's Privacy Policy and Onfido's Terms and Conditions.

c. What data we collect to ensure the security of BT Go

In order to protect transactions ordered through BT Go and the information within this platform, we will collect and usethe DeviceID of the device on which you have installed the BT Go mobile application, other device security identifiers (e.g., Instance ID/Device Identifier), including the history of devices on which you have used BT Go and the tokens generated, the model, manufacturer of the phone, and its operating system type, to verify that each time you log in, you are still using the same phone with which you registered to use the BT Go app.

We also have a legitimate interest and, where applicable, a legal obligation to collect and use the IP address(es) of the devices you use to connect to BT Go, which also reveals the geographical location from which you are conducting the transaction via BT Go. If you refuse to grant us access to this data, you will not be able to use the BT Go service.

At the same time, we use a tool that scans the list of applications on the device you use toconnect to BT Go to detect malware, including applications that allow remote connection and/or if you use the device for calls while using BT Go. If such applications/situations or other cases are identified that suggest a compromise of your user accounts in other applications offered by BT, we will block your access to your BT Go user account and/or block the use of BT Go on the potentially compromised device. This block is an automated individual decision that we make based on our legal obligations.

Last but not least, we are required by applicable payment services legislation to monitor transactions to prevent fraud. If we detect transactions that are suspected of fraud, we may take the decision to block their processing.

We process this data to protect the information in BT Go. If you refuse processing, you will not be able to use BT Go.

d. What data we process when you use BT Go

In order to fulfill our legal obligations to provide you with the BT Go service you have contracted for your company and, where appropriate, because we have a legitimate interest in preventing fraud and communicating with BT Go users to support them and to ask them to rate the quality of the BT Go service we use:

-> Account, card and transaction data

When you use the various features of BT Go, we will have implicit access to informationregarding: bank accounts (of the legal entity and payment beneficiaries), balances, transactions ordered through the legal entity's accounts or related to amounts collected in its accounts, including information mentioned in the payment explanations, data about the legal entity's BT products (including loans held or that you wish to repay, deposits, investments held or made and their history, cards issued/requested for designated card users and details about them). Although this service is exclusively dedicated to Banca Transilvania's legal entity customers, and information about legal entities is not considered personal data, information about customers who are individual professionals is treated as personal data and the bank will process it in compliance with the applicable legal provisions in this area.

We also process your personal data and/or that of other persons, such asindividual orprofessional payment beneficiariesor other similar persons mentioned in the payment explanations (e.g., the name you want to enter for the predefined beneficiary, address, IBAN) or whom you define as predefined beneficiaries (name/first and last name, IBAN).

At the same time, in order to provide the Beneficiary Name Display Service (SANB) for the purpose of preventing fraud in the case of initiated interbank payments, if you are a legal entity customer of the type indicated above, whose information is subject to personal data protection, we inform you that it is processed in accordance with the details in the Information Note on the processing of personal data within the Beneficiary Name Display Service (SANB), available on the bank's website at the following link: https://www.bancatransilvania.ro/nota-de-informare-sanb.

Also forfraudprevention purposes, in the case of intra-bank payments initiated from BT Go, BT processes – as an independent operator – the same categories of personal data that are used within SANB, but without the involvement of other participating banks or Transfond. The basis for processing personal data is BT's legitimate interest in preventing fraud in the case of intra-bank payments (BT-BT). The truncated name of the entity, as registered with BT, will be displayed to other BT customers who initiate a payment from a bank application to the entity's account opened with the bank, regardless of whether the payment is completed or not.

If you integrate BT Go with the FGO billing platform and allow the provider of this platform access to the transaction history of the legal entity accounts you connect to FGO, you undertake to comply with the applicable legal provisions in the field of personal data processing and protection, including those relating to information and, where applicable, obtaining consent from the data subjects to whom the legal entity has transferred or from whom it has collected amounts in these transactions or whose personal data is included in the transaction explanations, given that this personal data will thus be disclosed to the FGO provider.

When accessing the investment functionality , certain users will be able to invest on behalf of the legal entity in funds managed by BT Asset Management SAI (BTAM) by signing the brokerage agreement with BT, to buy/sell fund units (UF) in the selected fund, set, modify, or cancel a recurring investment, view transactions in progress, transaction history, and balance, generate portfolio statements and transaction confirmations, details about ex post costs, and certificates of investment accounts held. Banca Transilvania will process, as a person authorized by the BTAM operator, as appropriate, the following personal information/data concerning you: first name, last name, CNP, BTAM client ID, investment account number, transaction history, balance held in investment funds managed by BTAM, information regarding gains/losses and withholding tax.

-> Contact details

Because we have a legitimate interest in providing you with support in using BT Go (support) and because we want to know your opinion about this service (service quality assessment), we will use the contact details you have provided to the bank in your capacity as a customer. You have the right to object to such contact. For details, please read the section on your rights regarding the processing of your personal data.

-> Permissions requested in the context of using the application

When installing the app, you will be asked for permission to access your phone's status and identity, as well as the device's camera, which is necessary for photographing your ID during the identification process for registration in BT Go. Depending on the Android/iOS version of your phone, you can grant access as follows:

Allow/Deny access
Allow/Deny/While using the app
Allow/Deny/Just this once

If you refuse to grant access to the camera, you will not be able to register in the BT Go app. After registration, you can withdraw this permission, in which case you will not be able to use the BT Go features that require the use of the camera (e.g., invoice scanning), but you will be able to use other sections of BT Go.

Also, when you first log in to the app, you will be asked for permission to send notifications. If you refuse to grant access, you will still be able to use the app, but you will no longer receive in-app notifications.

To upload invoices, the app will need access to thephotos/files sectionof your device.

Other permissions required for the use and operation of the application, as determined by the operating system provider of the device you are using and for which the explicit consent of the user is not required, are detailed in the "permissions" section of the Play Store/Apple Store/App Gallery for the BT Go application (e.g., permissions to notify you when you are not connected to the internet).

-> Notifications

Through the BT Go mobile banking app, we'll send you different types of notifications, depending on the actions you take and the category of user you are, i.e. notifications:

To log in to the web version of BT Go
For authorizing payments made in the internet banking application
About transactions on the customer's account (e.g., receipts, payments, cash deposits/withdrawals at ATMs or at the counter, setting up or lifting garnishments)
About products owned by the customer (e.g. about loans, deposits, cards)
About new features/updates to BT Go
Of general interest to BT Go users
About offers/promotions (activation only)

You will be able to enable/disable push notifications as you wish. If you opt out of receiving notifications/any type of notifications, you will still be able to use the app, but you will no longer benefit from push notifications, which may make it more difficult for you to use BT Go (e.g. you will need to navigate to different sections of BT GO to identify transactions that require action from you).

3. To whom we may disclose data as a result of your use of BT Go

For sole trader customers, data about their accounts and transactions in BT Go indirectly identify the natural person representing the sole trader and are thus personal data. We will disclose this data, as appropriate, to:

➢ other BT Customers who have a right and need to know

BT Go users (all BT Go users are BT Customers) if you have granted other persons BT Go user rights on the individual professional accounts opened with BT, we will disclose them to these persons - within BT Go - bank details (accounts, transactions, account and transaction identifiers, etc.) corresponding to the accounts for which you have granted user rights
BT customers to whom you order payments from BT Go
When you make transactions through BT Go to other BT customers' accounts, the data related to these transactions (usually the name of the individual professional, amount, IBAN of the BT account, explanation of the payment) will be accessible to the beneficiaries to whom you made the payment.

➢ contractual partners (service providers) used in BT's business

a. For identification in BT Go that involves photographing the identity document and/or the face (selfie/video selfie), BT uses the services of the provider Onfido and its subcontractors, who process, solely on behalf and under the instructions of the bank, the data from the identity document, the image (including that from the video selfie taken in BT Go), and the biometric facial data, used for identification in BT Go. Data processing may also take place in third countries in some cases. The transfer of personal data to these countries is based either on adequacy decisions issued by the European Commission (e.g., in the United Kingdom), or on other appropriate safeguards, in accordance with the mechanisms provided by the GDPR, consisting of Standard Contractual Clauses approved by the European Commission, which you can find here: https://eur-lex.europa.eu/legal-content/RO/TXT/PDF/?uri=CELEX:32021D0914
BT Go allows you to connect to services offered by the bank's contractual partners (e.g., billing services). If you use these features, the data required to activate/connect/operate these services is disclosed to these partners (these partners are also BT Customers).
Your data processed in BT Go may be accessed, on a need-to-know basis and only on the basis of appropriate personal data protection safeguards, by the bank's contractual partners who support us in providing the BT Go service.

➢ financial-banking entities

When you make transactions via BT Go to customers of other banks/payment institutions, the payment details (usually the name of the professional customer making the payment, the amount, and the payment details) will be sent to the beneficiary's bank for processing the transaction.
When using the open banking functionality in BT Go for the accounts of the legal entity for which you are a user, we will disclose to the financial institutions to which you grant access, and for the accounts to which you grant access, as applicable: the account number, balance, and transactions carried out through these BT accounts (with all their details—date, amount, currency, account number and name/name of the counterparty in the transaction, etc.)

The list of recipients is supplemented by the one provided in the General Information Note on the processing and protection of personal data belonging to BT customers, section VIII.

4. How long do we keep data processed in the context of providing the BT Go service

Your data, as a BT customer, as well as the data on the transactions carried out through the accounts (including through BT Go) are subject to the retention regime provided for by the applicable regulations, being at least 5 years from the end of your business relationship with the bank, unless longer legal terms are applicable, which can be up to 10 years from the end of the business relationship.

5. How we ensure the protection of personal data in BT Go

Banca Transilvania takes all necessary technical and organizational measures to protect personal data within BT Go.

Notwithstanding these precautions, the Bank cannot guarantee that unauthorized persons will not gain access to your personal data through the terminals you use to access BT Go if they are unprotected or inadequately protected.

You are solely responsible for maintaining the confidentiality and keeping secure the terminal used to access BT Go (phone, computer, etc.) and in particular the login ID and/or passwords for logging in (password, fingerprint or other security method provided by the phone).

6. What rights do BT Go users have

In accordance with the provisions of the General Data Protection Regulation ("GDPR"), as a data subject concerned by the processing of personal data in the context of the use of BT Go, you are guaranteed the following rights: the right to be informed (we fulfill our obligation to inform you by this notice), the right of access, the right of rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to object, the right to apply to the National Authority for the Supervision of Personal Data Processing (ANSPDCP) and to justice.

These rights are also detailed in the General Information Note on the processing and protection of personal data belonging to BT Customers, which supplements this specific information note and can be found on the bancatransilvania.ro website, in the Privacy Hub section.

You can exercise these rights at BT or you can contact the BT Data Protection Officer (DPO) by sending a request by post to the BT office indicated above - marked 'for the attention of the DPO' - or by email to dpo@btrl.ro.

You also have the right to contact the National Authority for the Supervision of Personal Data Processing (ANSPDCP) -(plangere@dataprotection.ro).

This BT Go privacy policy may be revised by BT from time to time. Users will find specific information notes, the latest version of the note, in the app and on the BT website, in the Privacy Hub section.

Previous version of this information note (valid until December 5, 2025)

Download Previous version of this information note (valid until October 10, 2025)

Download Previous version of this information note (valid until August 31, 2025)

Download Previous version of this information note (valid until May 23, 2025)

Download Previous version of this information note (valid until February 22, 2025)

Download

Privacy notice on the processing and protection of personal data in the context of the provision of the BT Go Internet and Mobile Banking service ("BT Go Privacy Policy")