Information notice on the processing of personal data for the exclusive online opening of a business relationship and/or the contracting of BT transactional products/services

1. Who is the controller of personal data?

BANCA TRANSILVANIA S.A. (hereinafter referred to as "the bank" or "BT") a credit institution, Romanian legal entity, with the identification and contact details set out in section III of the Information Notice processing and protection of personal data belonging to BT customersThe BT Bank offers individuals the possibility to open exclusively online a business relationship with the bank ("current account"), to contract certain products/services (debit card, internet/mobile banking) with which they will be able to carry out transactions on this account ("transactional products"), as well as to express their options in relation to the processing of their personal data for advertising purposes during the business relationship ("marketing options"). All individuals who successfully complete the steps on the platform become BT account holders (if they did not have this status before).

In the general note indicated above, which forms an integral part of the BT Privacy Policy website www.bancatransilvania.royou will also find information about the rights that the bank's customers have in relation to the processing of your personal data, how they can exercise these rights or how they can contact the BT Data Protection Officer (BT DPO).

2. Who are the persons concerned?

If you initiate the application process for opening an online-only business relationship and/or contracting transactional products/services, BT will process certain personal data about you. Therefore, you are a "data subject" of this processing. We will process your data for a number of purposes and legal grounds, as we inform you through this notice.

This online process is dedicated to major resident individuals who: either already have a relationship with BT but do not have an account opened in their name (e.g.. Individuals who are already BT account holders can also go through the steps of the flow to contract exclusively online transactional products (e.g. internet/mobile banking).

3. On what grounds do we process the data and what happens if you refuse processing?

The processing of personal data carried out by BT when you go through the steps for opening an exclusively online business relationship with the bank and/or contracting BT transactional products/services is based on the following grounds:

• the legal obligations to which BT is subject under various pieces of legislation (e.g. legislation in the area of customer due diligence for the prevention of money laundering and terrorist financing);
• conclusion/execution of the contract for the current account and transactional products or the completion of the necessary steps to conclude these contracts;
• our legitimate interest and/or that of third parties, (e.g. interest in fraud prevention, interest in requiring customers to express their choices about the processing of their data for advertising purposes);
• the consent of the data subjects, to the extent that they wish to express it (e.g. your explicit consent to the processing of biometric data for the verification of your identity online, consent to the recording of your image and voice in the audio-video interview you will have to go through in order to open your account/contract transactional products, consent to receive advertising messages or to be contacted for support if you interrupt your online flow);

If you do not agree to the processing of biometric data or the recording of your voice and image, you will not be able to complete the online process, and if you refuse to express your marketing options or to be contacted for support purposes, there are no consequences and you can continue with the application process.

On the other hand, where we are required by law to carry out some processing of personal data or where it is necessary for the conclusion of contracts, if you refuse to process it, BT will not be able to open your account or allow you to obtain the transactional products available on this platform.

4. For what purposes do we process personal data, what is the data, how long do we keep it and to whom may we disclose it?

A. Personal data processed for the verification of identity and, where applicable, for confirmation of BT Customer status

The anti-money laundering legislation applicable to us obliges us to verify the identity of the persons with whom we are going to conclude various contracts/transactions. We also have a legitimate interest in ensuring that we prevent identity theft fraud attempts, especially online.

When a person applies to open a bank account or to take out certain banking products at a BT establishment, their identity and whether they are a BT customer is verified on the basis of their original identity card.

We don't have that online, so we'll do things a little differently. We have chosen a method that ensures we know who the person is who wants to go through the flow (including whether they are already a BT customer), so that we can prevent possible fraud attempts and fulfil our legal obligations to verify their identity. This method uses the latest technology, processing so-called biometric data. However, we will not be able to use this data without your explicit consent. If you choose to express this consent, please tick the box next to the text "I agree to the processing of my data ". biometric data" on the platform. If you do not agree, you can apply in a BT unit.

Before you decide freely whether you want to give your explicit consent, here is what the use of your biometric data entails:

1. you will need to upload a copy of your identity card ("CI") or take a photo of it on the spot, which also contains your photo/picture. The picture will be automatically taken from the CI (requires access to the camera);

2. then take a selfie on the platform (requires camera access);

3. a facial recognition tool will first make sure that you are a real person and then, it will detect your face in the picture in the CI and in the selfie taken, identify in the two images - by automatic means - features such as: estimated age, emotions, gender, attitude, smile, and other facial features, which it will compare and check the probability that the two faces belong to the same person. Following the automatic comparison process, the facial recognition tool will issue a "confidence" score. The higher this score, the higher the probability that the faces in the two images belong to the same person;

4. We do not make the decision to open your business relationship or allow you to contract a transactional product solely on the basis of this automated processing of your data, but you will enter into an audio-video call with a BT employee, who will verify this data and collect other necessary information to ensure that there are no impediments to closing the contracts. The video call will be recorded and will require access to your device's camera and microphone to record and play back the image and voice

If the score issued by the facial recognition tool is unsatisfactory, you will be able to resume the application process in a BT unit. If the confidence score is satisfactory, we will continue verifying your identity and, if applicable, your customer status in this way:

We will automatically retrieve the data from the photographed ID (through optical character recognition) and based on it we will check if you are already a BT customer and if you meet the conditions to apply (major and resident). The data retrieved from the CI will also be used to complete the application to open a business relationship with the bank and to contract transactional products, if applicable.

We will also ask for your contact details - phone number and email address - which we will check to make sure they belong to you, as it is very important that they are accurate and up to date. They will be used to send you messages of particular or general interest related to your status as a customer of the bank or answers to various requests / complaints that you send us. Also, unless you choose to give your consent to the processing of your data for advertising purposes, these contact data will also be used to send you such marketing messages.

B. Personal data processed for the purpose of customer due diligence to prevent money laundering and the financing of terrorism, and for the purpose of concluding and carrying out current account contracts and for transactional products

In order to prevent money laundering and terrorist financing, the bank applies know-your-customer measures to all persons wishing to become its customers, as well as to those who are already customers, account holders or non-account holders (persons who represent account holders, have trading rights on their accounts or are their beneficial owners). For the purposes of these measures, the bank is legally obliged to collect, update and store at least the following categories of personal data about the account holder customer (as applicable): name, surname, pseudonym, date and place of birth, personal identification number or similar unique identifier, nationality, domicile, residence, address where he/she lives and its legal status, telephone number, fax number, e-mail address, occupation, employer's name or nature of business, the purpose and nature of the business relationship with the bank, the source of funds to be used in the business relationship, the estimated level of daily transactions, whether or not the person is a publicly exposed person (PEP), the source of wealth and the important public position held (only in the case of PEPs), and details and copy of ID. Part of these categories of data are processed for the same purpose and on the same legal basis including non-account holder customers (representatives, account proxies and beneficial owner of the account holder customer).

This data, together with all records obtained through the application of the customer due diligence measures required by law - such as monitoring and checks carried out by the bank, supporting documents and records of transactions, including the results of any analysis carried out in relation to the customer determines the customer's risk profile and will be kept for a period of 5 years after the termination of the account holder's business relationship with the bank. This statutory retention period may be extended under the same legislation. Upon expiry of the retention period under this legislation, the bank will delete or anonymise these data, unless other legal provisions require their continued retention. In accordance with the legal obligation imposed on the bank by the Tax Procedure Code, part of the aforementioned data is also processed for the purpose of the reporting that BT must send daily to ANAF on account holders, their representatives, persons with the right to sign on accounts and beneficial owners. The legal retention period of this data is 10 years from the termination of the business relationship.

At the same time, the bank assigns identifiers to the customer, such as, but not limited to: customer code (CIF BT), IBAN codes related to accounts opened with the Bank, bank card numbers, based on which the customer can be identified in the bank's systems.

Where required or necessary, customer personal data will be disclosed/transferred to different categories of recipients (e.g. to ANAF - according to tax legislation, to other banks and their customers to whom/ from whom BT customers transfer/ collect amounts to/from BT accounts, to service providers used by the bank), including to entities that are part of the BT Financial Group, for legitimate purposes and under conditions that ensure their security. For full details of the processing of BT customer data, please read in full Note of general information notice on the processing and protection of personal data belonging to BT Customers.

C. For the collection of data subjects' choices in relation to the processing of their data personal data (where applicable, consent, refusal, opt-out) for advertising purposes and on contact for support purposes

Collection of marketing options

The bank has a legitimate interest in collecting the choices of customers/people who wish to become customers in relation to the processing of their personal data for advertising purposes. You are not obliged to express this option. However, if you choose to do so, you can choose to have your data processed for advertising purposes or to opt-out. Only if you give your consent will we send you advertising messages.

Before you decide freely whether you want to receive such messages, please consider the following: Expressing your consent to the processing of your data for the purpose of receiving advertising messages is optional. Refusal to give your consent does not affect your right to become/ remain a BT customer.

The personal data commonly processed to send advertising messages to customers are: name, surname, telephone number, e-mail and correspondence address declared to the bank for the business relationship established with the bank or, where applicable, for the capacity of representative/agent with BT.

If you opt-in to receive advertising messages, to ensure they are relevant, we will also use other information we learn about you when you use our services/products (e.g. transaction data, age, location, income range, etc.). We will study this data automatically(profiling) to make an opinion about which products/services/events would suit you.

If you agree to receive advertising messages, your consent will be valid until you withdraw/modify it or otherwise terminate your business relationship/representative/empowerment with BT. If you wish to be contacted for advertising purposes, depending on the categories from which you choose to receive advertising messages, your option/data will be communicated by BT, for the purpose of sending advertising messages, to:

• entities within Banca Transilvania Financial Group - BT Microfinanțare IFN SA, BT Asset Management S.A.I. S.A., BT Leasing Transilvania IFN S.A., BT Direct IFN S.A., BT Capital Partners S.S.I.F. S.A., BT Pensii Societate de Administrare a Fondurilor de Pensii Facultative SA, Fundația Clubul Întreprinzătorului Român, Fundaƫia Clujul has Suflet and other entities that may join this group in the future- ("BT subsidiaries"), unless you have made your choices on your own forms used by the Subsidiaries for the collection of the Marketing Agreement.
• current or future partners of BT and/or BT's subsidiaries whose products/services/events are related to BT's services/products ("partners"). The list of categories of current partners of BT and/or BT's subsidiaries can be accessed at the link https://www.bancatransilvania.ro/parteneri or, upon request, at any BT or BT Subsidiaries' premises.

For the effective delivery of advertising messages, your data will be disclosed to vendors - as authorised persons of BT, BT subsidiaries or their partners.

Please bear in mind that whatever options you choose:

• does not relate to messages of general or particular interest to customers, which are transmitted by BT based on its legitimate interests in the proper conduct of the business relationship or its legal obligations;
• are not applicable for commercial notifications/messages sent within BT's mobile applications, which have their own marketing options management system, available in the dedicated settings or privacy sections;
• does not influence the subscription/unsubscription of any e-mail address entered by you in forms available on BT websites to receive information in various areas of interest. Subscription to those newsletters is done via those online forms and unsubscription can be managed by following the unsubscribe link in the subscription messages you receive

In view of the above information, in the online process that you will follow you will have the opportunity to express your choices regarding the processing of your personal data for advertising purposes. You will be shown both the option not to receive advertising messages (opt-out) and the option to receive such messages (opt-in). The opt-in option will be divided into several categories from which you will be able to choose: products and services of BT and/or BT subsidiaries, events organised by BT and/or BT subsidiaries, products/services of partners, which are related to products/services of BT or BT subsidiaries, or events organised by BT partners.

If you are an existing BT customer who has previously given your marketing consent and you now select options that modify or withdraw your previously given consent, we will mark your new options in our records and honor them, but please note that it may take up to 5 business days for us to ensure that your data is removed from ongoing campaigns. During this time you may still receive advertising messages according to your previous choices.

With regard to the processing of your personal data for advertising purposes, you are guaranteed your rights under the General Data Protection Regulation (GDPR).

If you choose to express your consent to receive advertising messages, you can always withdraw/modify your consent and/or object to profiling for advertising purposes by doing so:

• by accessing the "Marketing options" on the bank's website - www.bancatransilvania.ro;
• by accessing the dedicated section of the NeoBT internet/mobile banking platform; through BT units, where you can ask our employees to update your personal data processing options for advertising purposes;
• by sending a request to this effect to BT's head office, marked "for the attention of the DPO";

Collecting the option to contact for support purposes

If you interrupt the online application flow at any time, we want to provide you with the necessary support to resume it, in case you have interrupted it due to technical difficulties. We will ask you during the online application process if you consent to us contacting you for support purposes and we will only call you if you give us your consent.

D. To evidence your requests/agreements/options in relation to, as appropriate: opening the business relationship, contracting transactional products, expressing marketing options. 

In order for us to prove that we have fulfilled our legal obligation to implement know-your-customer measures, as well as that you have requested to open an account, to contract transactional products or to express certain marketing options, we need to record and store the audio-video interview you will have with one of our employees. The recording of your voice and image in the interview can only be done with your consent. By clicking on the link that takes you to the interview area you express this consent. If you do not wish to consent to the recording, you can come into a BT branch to request to open an account and/or contract products.

E. For the issuance and management of the Qualified Digital Certificate issued by Namirial S.p.a. for signing documentation in relation to BT

To complete this online application process, you will need to sign the related documentation with a qualified electronic signature. The issuance and use of the digital certificate for signing does not imply any costs for you, but it is necessary that BT and Namirial S.p.a. - the qualified service provider - process for this purpose, as associated operators, personal data concerning you that are necessary for the issuance of this electronic signature. For this purpose, your name, surname, CNP, CI data (series and number, type of document, issuing authority, date of issue and expiry), country of residence and your telephone number will be transmitted by BT to Namirial S.p.a. This controller will process them mainly for the fulfilment of its purposes related to customer knowledge and for the issuance and management of the digital certificate, as well as for other purposes detailed in the information note on the processing of personal data that will be displayed to you during the online process on behalf of Namirial S.p.a.