Information notice on the processing of personal data of participants in events organized by Banca Transilvania

We are glad you want to participate at the event organized by Bank Transilvania (referred to in hereinafter "BT Event").

Before you sign up, we informyou how we will process personal data as possibly participant (in hereinafter "participant") at this event.

For the processing of personal data from from the perspective of other qualities on which e possible to have in relation to BT (e.g. customer, visitor of BT offices, websites and pages social media pages, etc.) you can find details in the PrivacyPolicy on the website-website www.bancatransilvania.ro.

Who is the controller processing your data?

Banca Transilvania S.A. ("BT") is the controller of the personal data of BT event participants.

Details of who BT is can be found in the BT Privacy Policy under section B.

For what purposes are your data processed as a BT event participant?

We process your data to:

• we sign you up for the BT event;
• we send you information confirming your registration and, if applicable, information about possible changes to the date/time of the BT event;
• promote the bank's image (only if you give us your consent to do so, on a separate form, which will be made available to you when/if you attend the BT event).

What categories of personal data do we process and where do we get it from?

For the purposes indicated in point 2, we would process the following categories of personal data:

• first name, surname - we need these details to identify you with confirmation of your place and entry to the event;
• contact details - we use your phone number and email address to confirm your place at the event and send you information to ensure the BT event runs smoothly;
• the image, voice, opinions you express at the BT event (only if you give your consent, on the separate form you will receive at the BT event, for these personal data of yours to be processed for the promotion of the BT image).

We collect this data from you when you complete the BT event registration form or when you participate in the BT event.

What are the legal grounds on which we process your data and what happens if you do not want your data to be processed?

The grounds on which BT processes your data as a BT event participant are, as applicable:

• the bank's legitimate interest in being able to organise the logistics of the BT event and ensure that it takes place in optimal conditions;
• your consent (e.g. for the production and distribution of your image/voice/opinions for the purpose of promoting BT's image)

Where we need your consent to process your data, we will only process it if you give us your consent (on the form you will receive when/if you turn up to the BT event). If you do not wish to give your consent, you can attend the BT event, but you will be placed in an area of the hall where no photography/filming will take place. If you decide to express your consent, you will have the right to withdraw it at any time, without this withdrawal affecting the lawfulness of the processing previously carried out.

Where the processing of your data is based on our legitimate interests mentioned above, you have the right to object to such processing. We will be able to accommodate some of your objection requests (e.g. if you object to us contacting you to send you information) but if you object to other processing (e.g. if you do not wish to provide us with data required for event registration) we will not be able to make it easier for you to access the event.

To whom are we likely to disclose your data? (recipients of data, including from third countries)

Your data may be disclosed/transferred, depending on the situation, to certain categories of recipients:

• the bank's contractual partners (service providers) used to ensure the registration and running of the BT event, such as but not limited to: IT service providers (maintenance, hosting), event services, SMS/e-mail services, etc.
• the general public (only if you agree to the distribution of your image/voice/opinions taken at the BT event for the purpose of promoting the bank's image)
• taken at the BT event to promote the bank's image)

We will disclose or transfer your data to these categories of recipients only when necessary for the purposes of the processing, only in accordance with the provisions of the General Data Protection Regulation ("GDPR"), on the legal grounds applicable to the situation and only under conditions that ensure data security.

Some of these data recipients are located in third countries for which the European Commission has recognised that there is an adequate level of protection of personal data, while others are located in third countries for which no such adequacy decision has been issued. To the latter category of recipients we have ensured that the transfer of data is carried out on the basis of adequate safeguards in accordance with the mechanisms provided for by the GDPR consisting of Standard Contractual Clauses approved by the European Commission which you can find here: https://eur-lex.europa.eu/legal-content/RO/TXT/PDF/?uri=CELEX:32021D0915&from=EN

We do not transfer your data to international organisations.

Making profiles 

We do not use your data for profiling purposes.

How long we process your data as a participant?

We will process your data as an attendee for up to 60 days after the BT event takes place, unless you agree to us also using it for the purpose of promoting BT's image, in which case the periods mentioned in the separate form you will receive when/if you attend the event will apply.

What rights do you have in relation to the processing of your data?

You are guaranteed the exercise of the following rights under the GDPR: a) the right of access to your data, b) the right to rectification of data, c) the right to erasure of data, d) the right to withdraw consent, e) the right to object, f) the right to restriction of processing, g) the right to data portability, h) the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing. If you decide to exercise them, your requests will be analysed and resolved on a case-by-case basis, in relation to the time and the basis on which your personal data for which you are exercising your rights are processed.

To exercise the rights mentioned in points a) - g), you can send your request to the contact details of the BT Data Protection Officer as follows:

• by post to the address in mun. Calea Dorobantilor, 30-36, Cluj-Napoca, jud. Cluj, with the mention "for the attention of the Data Protection Officer".
• to the e-mail address: dpo@btrl.ro