A. Personal data processed for identity verification and, where applicable, for confirmation of BT Customer status
The anti-money laundering legislation applicable to us obliges us to verify the identity of the persons with whom we are going to conclude various contracts/transactions. We also have a legitimate interest in ensuring that we prevent identity theft fraud attempts, especially online.
When a person applies to open a bank account or to take out certain banking products at a BT establishment, their identity and whether they are a BT customer is verified on the basis of their original identity card.
Online we don't have that possibility, so we're going to do things a little differently. We've chosen a method that gives us assurance about who the person is who wants to go through the flow (including whether they're already a BT customer), so that we can prevent potential fraud attempts and fulfill our legal obligations to verify their identity. This method uses the latest technology, processing so-called biometric data. However, we will not be able to use this data without your explicit consent. If you choose to give your explicit consent, please check the box next to the text "I agree to the processing of my biometric data" on the platform. If you don't agree, you can apply at a BT establishment.
Before you decide freely whether you want to give your explicit consent, here is what the use of your biometric data entails:
1. you will need to upload a copy of your identity card ("CI") or take a photo of it on the spot, which also contains your photo/picture. The picture will be automatically taken from the CI (requires access to the camera);
2. then take a selfie on the platform (requires camera access);
3. a facial recognition tool will first make sure that you are a real person and then, it will detect your face in the picture in the CI and in the selfie taken, identify in the two images - by automatic means - features such as: estimated age, emotions, gender, attitude, smile, and other facial features, which it will compare and check the probability that the two faces belong to the same person. Following the automatic comparison process, the facial recognition tool will issue a "confidence" score. The higher this score, the higher the probability that the faces in the two images belong to the same person;
4. We do not make the decision to open your business relationship or allow you to contract a transactional product solely on the basis of this automated processing of your data, but you will enter into an audio-video call with a BT employee, who will verify this data and collect other necessary information to ensure that there are no impediments to closing the contracts. The video call will be recorded and will require access to your device's camera and microphone to record and play back the image and voice
If the score issued by the facial recognition tool is unsatisfactory, you will be able to resume the application process in a BT unit. If the confidence score is satisfactory, we will continue verifying your identity and, if applicable, your customer status in this way:
We will automatically retrieve the data from the photographed ID (through optical character recognition) and based on it we will check if you are already a BT customer and if you meet the conditions to apply (major and resident). The data retrieved from the CI will also be used to complete the application to open a business relationship with the bank and to contract transactional products, if applicable.
We will also ask for your contact details - phone number and email address - which we will check to make sure they belong to you, as it is very important that they are accurate and up to date. They will be used to send you messages of particular or general interest related to your status as a customer of the bank or answers to various requests / complaints that you send us. Also, unless you choose to give your consent to the processing of your data for advertising purposes, these contact data will also be used to send you such marketing messages.
B. Personal data processed for KYC purposes for the prevention of money laundering and terrorist financing, as well as for the conclusion and performance of current account contracts and transactional products
In order to prevent money laundering and terrorist financing, the bank applies know-your-customer measures to all persons wishing to become its customers, as well as to those who are already customers, account holders or non-account holders (persons who represent account holders, have trading rights on their accounts or are their beneficial owners). For the purposes of these measures, the bank is legally obliged to collect, update and store at least the following categories of personal data about the account holder customer (as applicable): name, surname, pseudonym, date and place of birth, personal identification number or similar unique identifier, nationality, domicile, residence, address where he/she lives and its legal status, telephone number, fax number, e-mail address, occupation, employer's name or nature of business, the purpose and nature of the business relationship with the bank, the source of funds to be used in the business relationship, the estimated level of daily transactions, whether or not the person is a publicly exposed person (PEP), the source of wealth and the important public position held (only in the case of PEPs), and details and copy of ID. Part of these categories of data are processed for the same purpose and on the same legal basis including non-account holder customers (representatives, account proxies and beneficial owner of the account holder customer).
This data, together with all records obtained through the application of the customer due diligence measures required by law - such as monitoring and checks carried out by the bank, supporting documents and records of transactions, including the results of any analysis carried out in relation to the customer determines the customer's risk profile and will be kept for a period of 5 years after the termination of the account holder's business relationship with the bank. This statutory retention period may be extended under the same legislation. Upon expiry of the retention period under this legislation, the bank will delete or anonymise these data, unless other legal provisions require their continued retention. In accordance with the legal obligation imposed on the bank by the Tax Procedure Code, part of the aforementioned data is also processed for the purpose of the reporting that BT must send daily to ANAF on account holders, their representatives, persons with the right to sign on accounts and beneficial owners. The legal retention period of this data is 10 years from the termination of the business relationship.
At the same time, the bank assigns identifiers to the customer, such as, but not limited to: customer code (CIF BT), IBAN codes related to accounts opened with the Bank, bank card numbers, based on which the customer can be identified in the bank's systems.
Where mandatory or necessary, customer personal data will be disclosed/transferred to different categories of recipients (e.g. To ANAF - in accordance with tax legislation, to other banks and their customers to/from which BT transfers/collects amounts to/from BT accounts, to service providers used by the bank), including to entities that are part of the BT Financial Group, for legitimate purposes and under conditions that ensure their security. For full details of the processing of BT customer data, please read the full General information notice on the processing and protection of BT Customers' personal data.
C. For the collection of data subjects' choices in relation to the processing of their personal data (consent, opt-in, opt-out, opt-out where applicable) for advertising purposes and in relation to contacting for support
Collection of marketing options
The bank has a legitimate interest in collecting the choices of customers/people who wish to become customers in relation to the processing of their personal data for advertising purposes. You are not obliged to express this option. However, if you choose to do so, you can choose to have your data processed for advertising purposes or to opt-out. Only if you give your consent will we send you advertising messages.
Before you decide freely whether you want to receive such messages, please consider the following: Expressing your consent to the processing of your data for the purpose of receiving advertising messages is optional. Refusal to give your consent does not affect your right to become/ remain a BT customer.
The personal data commonly processed to send advertising messages to customers are: name, surname, telephone number, e-mail and correspondence address declared to the bank for the business relationship established with the bank or, where applicable, for the capacity of representative/agent with BT.
If you opt-in to receive advertising messages, to ensure they are relevant, we will also use other information we learn about you when you use our services/products (e.g. transaction data, age, location, income range, etc.). We will study this data automatically(profiling) to make an opinion about which products/services/events would suit you.
If you agree to receive advertising messages, your consent will be valid until you withdraw/modify it or otherwise terminate your business relationship/representative/empowerment with BT. If you wish to be contacted for advertising purposes, depending on the categories from which you choose to receive advertising messages, your option/data will be communicated by BT, for the purpose of sending advertising messages, to:
- entities within Banca Transilvania Financial Group - BT Microfinanțare IFN SA, BT Asset Management S.A.I. S.A., BT Leasing Transilvania IFN S.A., BT Direct IFN S.A., BT Capital Partners S.S.I.F. S.A., BT Pensii Societate de Administrare a Fondurilor de Pensii Facultative SA, Fundația Clubul Întreprinzătorului Român, Fundaƫia Clujul has Suflet and other entities that may join this group in the future- ("BT subsidiaries"), unless you have made your choices on your own forms used by the Subsidiaries for the collection of the Marketing Agreement.
- current or future partners of BT and/or BT's subsidiaries whose products/services/events are related to BT's services/products ("partners"). The list of categories of current partners of BT and/or BT's subsidiaries can be accessed at the link https://www.bancatransilvania.ro/parteneri or, upon request, at any BT or BT Subsidiaries' premises.
For the effective delivery of advertising messages, your data will be disclosed to vendors - as authorised persons of BT, BT subsidiaries or their partners.
Please bear in mind that whatever options you choose:
- does not relate to messages of general or particular interest to customers, which are transmitted by BT based on its legitimate interests in the proper conduct of the business relationship or its legal obligations;
- are not applicable for commercial notifications/messages sent within BT's mobile applications, which have their own marketing options management system, available in the dedicated settings or privacy sections;
- does not influence the subscription/unsubscription of any e-mail address entered by you in forms available on BT websites to receive information in various areas of interest. Subscription to those newsletters is done via those online forms and unsubscription can be managed by following the unsubscribe link in the subscription messages you receive
In view of the above information, in the online process that you will follow you will have the opportunity to express your choices regarding the processing of your personal data for advertising purposes. You will be shown both the option not to receive advertising messages (opt-out) and the option to receive such messages (opt-in). The opt-in option will be divided into several categories from which you will be able to choose: products and services of BT and/or BT subsidiaries, events organised by BT and/or BT subsidiaries, products/services of partners, which are related to products/services of BT or BT subsidiaries, or events organised by BT partners.
If you are an existing BT customer who has previously given your marketing consent and you now select options that modify or withdraw your previously given consent, we will mark your new options in our records and honor them, but please note that it may take up to 5 business days for us to ensure that your data is removed from ongoing campaigns. During this time you may still receive advertising messages according to your previous choices.
With regard to the processing of your personal data for advertising purposes, you are guaranteed your rights under the General Data Protection Regulation (GDPR).
If you choose to express your consent to receive advertising messages, you can always withdraw/modify your consent and/or object to profiling for advertising purposes by doing so:
- by accessing the "Marketing options" on the bank's website - www.bancatransilvania.ro;
- by accessing the dedicated section of the NeoBT internet/mobile banking platform; through BT units, where you can ask our employees to update your personal data processing options for advertising purposes;
- by sending a request to this effect to BT's head office, marked "for the attention of the DPO";
Collecting the option to contact for support purposes
If you interrupt the online application flow at any time, we want to provide you with the necessary support to resume it, in case you have interrupted it due to technical difficulties. We will ask you during the online application process if you consent to us contacting you for support purposes and we will only call you if you give us your consent.
D. To evidence your requests/agreements/options in relation to, as appropriate: opening the business relationship, contracting transactional products, expressing marketing options.
In order for us to prove that we have fulfilled our legal obligation to implement know-your-customer measures, as well as that you have requested to open an account, to contract transactional products or to express certain marketing options, we need to record and store the audio-video interview you will have with one of our employees. The recording of your voice and image in the interview can only be done with your consent. By clicking on the link that takes you to the interview area you express this consent. If you do not wish to consent to the recording, you can come into a BT branch to request to open an account and/or contract products.
E. For the issuance and management of the Qualified Digital Certificate issued by Namirial S.p.a for the signing of documentation in relation with BT
To complete this online application process, you will need to sign the related documentation with a qualified electronic signature. The issuance and use of the digital certificate for signing does not imply any costs for you, but it is necessary that BT and Namirial S.p.a. - the qualified service provider - process for this purpose, as associated operators, personal data concerning you that are necessary for the issuance of this electronic signature. For this purpose, your name, surname, CNP, CI data (series and number, type of document, issuing authority, date of issue and expiry), country of residence and your telephone number will be transmitted by BT to Namirial S.p.a. This controller will process them mainly for the fulfilment of its purposes related to customer knowledge and for the issuance and management of the digital certificate, as well as for other purposes detailed in the information note on the processing of personal data that will be displayed to you during the online process on behalf of Namirial S.p.a.
