Information notice on the processing of personal data of those who register and/or participate in the #mentoratpebune event

We're glad you want to participate in our #mentoratpebune event. In this capacity some personal data will be processed, about which we tell you more below.

Please note that this information note only concerns the processing of your personal data as a possible participant and/or attendee of the #mentorpebune event.

Details on the processing of personal data of Banca Transilvania's clients can be found in General information note on the processing and protection of personal data of BT customers in the Privacy Policy on the website www.bancatransilvania.ro.

Who are the controllers processing your data?

Those processing your data are, as appropriate:

Banca Transilvania SA (BT)

Showcase Felix Media S.A.

Details of who BT is can be found in the BT Privacy Policy under section B and about Vitrina Felix Media can be found on their website www.vitrina.ro.

For what purposes are your data processed as a potential participant and/or participant?

BT has entered into an agreement with Vitrina Felix Media whereby we set out how your data will be used and protected. The common purposes for processing your data are as follows:

• related to the event you have registered for (such as, but not limited to: confirmation of your place on event registration, reminders about the event you have registered for, sending of presentation materials, support, rewards for the event you are attending)
• of particular interest (e.g. information about changes to the date/time of the event you have registered for)

What personal data do we process and where do we get it from?

For the purposes indicated above, the following categories of personal data are processed in your capacity as a possible participant/participant in the event:

• first name, surname - we need these details to identify you with confirmation of your place and entry to the event,
• contact details - we use your telephone number and e-mail address to confirm the venue and send information about the smooth running of the event,
• image - used if you agree to be photographed/video recorded at the event,
• opinions you express at the event.

We have this data from you because you provided it to us in the event registration form on the BT Blog or when you attend the event.

What are the legal grounds on which we process your data and what happens if you do not want your data to be processed?

The grounds on which BT alone or together with Vitrina Felix Media S.A. processes your data are, as the case may be:

• your consent (e.g. for taking photos and/or filming at the event).
• the legitimate interest of the bank such as: ensuring access to the event, the interest of the event to take place in optimal conditions, etc.

If the processing of your personal data is based on consent, we will only do so if you give your consent. We will ask for your consent when you register for the event and ask you if you consent to us using your image. You are not obliged to give your consent, and if you decide to give your consent you will have the right to withdraw it at any time, without this withdrawal affecting the lawfulness of the processing previously carried out.

Where the processing of your data is based on our legitimate interests mentioned above, you have the right to object to such processing. We will be able to accommodate some of your objection requests (e.g. if you object to us contacting you to send you messages of general interest), but if you object to other processing (e.g. if you do not wish to provide us with the data required for event registration), we will not be able to facilitate your access to the event.

The grounds mentioned above refer exclusively to the processing carried out by BT and Vitrina Felix Media S.A. The grounds on which the bank or Vitrina Felix Media S.A. processes your personal data when you are/are preparing to become their customer is not the subject of this section, but is subject to the processing grounds set out in the personal data processing policies of each of these entities.   

To whom are we likely to disclose your data? (recipients of data, including from third countries)

Your data related to your participation in the Mentoring for Good event may be disclosed/transferred, depending on the situation, to certain categories of recipients:

• contractual partners (service providers) used to run the event, such as but not limited to: IT services (maintenance, software development), event services, SMS/e-mail services, etc.
• public authorities and institutions
• other natural or legal persons to whom we disclose your data because we have a legal obligation, a legitimate interest or if you have given your consent

We will disclose or transfer your data to these categories of recipients only when necessary for the purposes of the processing, only in accordance with the provisions of the General Data Protection Regulation ("GDPR"), on the legal grounds applicable to the situation and only under conditions that ensure data security.

Some of these data recipients are located in third countries for which the European Commission has recognised that there is an adequate level of protection of personal data, while others are located in third countries for which no such adequacy decision has been issued. To the latter category of recipients we have ensured that the transfer of data is carried out on the basis of adequate safeguards in accordance with the mechanisms provided for by the GDPR consisting of Standard Contractual Clauses approved by the European Commission which you can find here: https://eur-lex.europa.eu/legal-content/RO/TXT/PDF/?uri=CELEX:32021D0915&from=EN

We do not transfer your data to international organisations.

How long we process your data as a participant of the Mentoring for Good event?

We will process your data as an event participant for the duration of the event and for another 5 days after the event, after which we will delete it from our records. In the same way, we will also request their deletion from Vitrina Felix Media S.A.

If the data is processed on the basis of your consent and you withdraw that consent, that data will be deleted from the records if it is no longer necessary for the fulfilment of other purposes of the processing and/or if there is no other basis for its further processing.

What rights do you have in relation to the processing of your data?

You are guaranteed the exercise of the following rights under the GDPR: a) the right of access, b) the right to rectify data, c) the right to erasure, d) the right to withdraw consent, e) the right to object, f) the right to restrict processing, g) the right to data portability, h) the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing. If you decide to exercise them, your requests will be analysed and resolved on a case-by-case basis, in relation to the time and the basis on which your personal data for which you are exercising your rights are processed.

a) right of access: you can obtain confirmation that your personal data are being processed and information on the specifics of the processing. This right also allows you to obtain a copy of the personal data processed.

b) the right to rectification of data: you can request that data that is incorrect be amended or, where appropriate, that incomplete data be completed.

c) the right to erasure: you can request the erasure of their personal data when: they are no longer necessary for the purposes for which we have collected and process them; you have withdrawn your consent to the processing of the data and there are no other grounds on which we process them; the data are processed unlawfully; the data must be erased in accordance with the relevant legislation.

d) the right to withdraw consent: for processing of your data based on consent, you can withdraw your consent/agreement at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to this time.

e) the right to object: you may object to the processing of your data based on legitimate interest, for reasons relating to your specific situation.

f) the right to restrict processing: you can request restriction of the processing of your data if: you dispute the accuracy of the data, for a period that allows us to verify its accuracy; the processing is unlawful and you object to its erasure, requesting instead the restriction of its use; the data is no longer necessary for us to process, but you request it for a legal action; if you have been processed, for the period of time during which it is verified whether the legitimate rights of BT and/or other entities involved in the Mentoring for Good Operators event prevail over your rights.

g) the right to data portability: you may request, under the law, that we provide you with certain personal data in a structured, frequently used and machine-readable form. If you request, we may transmit that data to another entity if technically feasible.

h) the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing: you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing if you consider that your rights have been violated: National Authority for the Supervision of Personal Data Processing, B-dul G-ral. Gheorghe Magheru 28-30 Sector 1, postal code 010336 Bucharest, Romania anspdcp@dataprotection.ro

In order to exercise the rights referred to in points a) - g) above in relation to data processed by BT as an independent controller or associated with other entities involved in the organisation of the Mentoring for Good event, you can send your request to the contact details of the BT Data Protection Officer as follows:

• by post to the address in mun. Calea Dorobantilor, 30-36, Cluj-Napoca, jud. Cluj, with the mention "for the attention of the Data Protection Officer".
• to the e-mail address dpo@btrl.ro