Information note on the processing of personal data for obtaining / increasing the credit line related to a BT credit card, exclusively online

When the law obliges us to carry out some personal data processing or when they are necessary for the conclusion of the credit card agreement, if you refuse to process them, BT will not be able to analyze your request or, as the case may be, you will not be able to contract the BT card.

For processing based on the legitimate interest of BT or third parties, refusal to process your data may make it impossible for you to submit or for us to review your application or obtain your BT credit card.

If the processing of personal data is based on your consent (e.g. income interrogation in ANAF, processing of biometric data), we will ask you for this agreement at the right time on the online feed, so that the whole process is as transparent as possible to you. If you refuse to give us this consent, you cannot obtain your credit card exclusively online, but you have the possibility to apply in a BT unit.

We will automatically retrieve the data from the id being photographed (through optical character recognition), which we will compare with the corresponding data from the copy of your identity document already registered in our records.

If they match, you can move on to the stream. Otherwise, you'll first need to update your data in BT's records.

The data taken from the identity card will also be used for the credit card application you make online.

We will also ask for your contact details - phone number and email address - which we will check to make sure they belong to you, as they are very important in the process of electronically signing the documentation for obtaining your BT credit card online. If we notice that you have not completed the application process, we may use these contact details to see if you need support in completing the application, and to get your opinion on the BT Pay online credit card/ credit line increase process for a previously obtained card.

1. Identification data of the controllers

Banca Transilvania S.A. and the Company Biroul de Credit S.A., a legal person Romanian based in Bucharest, str. Sfânta Vineri, nr. 29, 4th floor, sector 3, as joint controllers, processes your personal data, in good faith, in a fair and transparent manner, for specified and legitimate purposes, according to the provisions of Regulation (EU) No 4, 3. 679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the Regulation).

Credit Bureau SA is the private law entity that manages the Credit Bureau System, in which personal data are processed in connection with the lending activity carried out by the Participants.

The participants in the Credit Bureau System are credit institutions, non-banking financial institutions, insurance companies and debt collection companies, which have signed a Participation Agreement with the Credit Bureau.

2. Legal basis and purpose of the processing

Banca Transilvania S.A. and the Credit Bureau processes your personal data based on the legitimate interest of the Participants and of the Credit Bureau for carrying out a responsible lending activity, under the conditions of protecting, facilitating access to credit and preventing excessive indebtedness of the data subjects, compliance with the legal framework regarding the assessment of creditworthiness and the reduction of credit risk, as well as the prevention of the use of the financial-banking system to carry out activities contrary to the law.

Banca Transilvania S.A. has the obligation, according to the legal regulations in force, to assess your ability to repay the loan, before concluding a credit agreement and during its performance. For this purpose, Banca Transilvania S.A. processes the information indicated in point (4), registered on your name in its own records and transmits them to the Credit Bureau for processing by this institution and consulting them by any Participant, in order to initiate or carry out a credit relationship, as well as to ensure credit products.

3. Obligation to provide data and consequences of non-compliance

The provision of your personal data is necessary for the purpose mentioned in point (2). The refusal to provide your personal data, necessary to achieve the above-mentioned purpose, will lead to the impossibility of Banca Transilvania S.A. to fulfill its legal obligations in connection with the granting of the loan.

4. Categories of personal data processed in the Credit Bureau System

• identification data of the data subject:name, surname, personal identification number or FISCAL code for authorized natural persons or CIF for individuals carrying out liberal professions or country code and series / passport number for non-residents, home address / residence, telephone number, date of birth;;
• employer data:employer address, date of registration of this information, CUI;
• data regarding the credit products requested/granted:the type and name of the Participant, the type of product, the status of the product/account, the date of granting, the duration of the account, the amounts granted, the amounts due, the date of update, currency, the frequency of payments, the amount paid, the monthly installment, the outstanding amounts, the number of days of delay, the date of the outstanding premium, the category of delay, the date of the last payment;
• data on events occurring during the period of the credit product,such as those relating to restructuring/refinancing, giving into payment, assignment of the credit agreement, assignment of the claim;
• data regarding the relations with other accounts:information regarding credit products in which the data subject has the capacity of co-debtor and /or guarantor;
• insolvency data:information relating to data subjects against whom insolvency proceedings have been opened;
• number of interrogations:indicates the number of Credit Reports issued by the Credit Bureau, at the request of one or more Participants.

In the process of analyzing your loan application, Banca Transilvania S.A. will ask the Credit Bureau to issue a Credit Report, with or without FICO® Score, in order to verify that you are within the indebtedness degree established by law and if you have the capacity to repay the loan. In order to obtain the Credit Report, Banca Transilvania S.A.va send to the Credit Bureau the name, surname and personal identification number.

After granting the loan, Banca Transilvania S.A. will send to the Credit Bureau your personal data provided for in points a)-f). This information shall be shared with the other Participants within the Credit Bureau System and shall be used for the purpose referred to in point 2.

Your ability to repay debts at maturity can be checked periodically, after the loan is granted, including by obtaining Credit Reports or by using *The Alerts Service.

If, during the loan period, you will delay the payment of the installments more than 30 calendar days from the due date, Banca Transilvania S.A. will send to the Credit Bureau information on the outstanding amounts, the category of delay, given to the first arrears and/or, as the case may be, information regarding the opening of the procedure of giving in payment, only after your notification, at least 15 calendar days before, made in writing, by phone, SMS, e-mail or other means of electronic communication.

* The Alerts service is used by the Participants to identify and/or reduce the credit risk in due time, by generating an alert to a Participant when an event is registered for its own debtor (opening / closing the account, entry / exit from the arrears, correction of the account, registration / deletion of the guarantor / co-debtor status, account query, change employer name / phone number) at another Participant.

5. FICO® Score from credit bureau

The personal data referred to in point (4) may be processed by the Credit Bureau, including to calculate, at the request of the Participants, fico® score from the Credit Bureau.

Participants can use FICO® Score from the Credit Bureau in order to reduce the credit risk associated with a debtor/potential borrower.

FICO® Score from the Credit Bureau is between 300 and 850, obtained from the statistical process that processes the information recorded by the Participants in the Credit Bureau System and indicates the probability that the person concerned will pay his installments on time in the future. The main causes that caused the decrease in FICO® Score from the Credit Bureau are displayed in the form of reason codes.

FICO® Score from the Credit Bureau takes into account the following elements that confer predictability: payment history, current debt, duration of the credit account(s) (average number of months since the loans were granted), the application for new loans (the number of queries and loans granted in the last 6 months), the credit mix (types of loans granted), the age of the person concerned. The influence of these items on the value of fico® score from the Credit Bureau may vary depending on the information recorded with the Credit Bureau for each person concerned.

FICO® Score from the Credit Bureau is a highly predictable analysis tool that, in line with the data from the Credit Report and the information obtained by the Participants from other sources, competes in the correct assessment of the creditworthiness of the data subject in order to conclude / carry out the credit agreement.

6. Recipients of the data

Personal data recorded in the Credit Bureau System shall be disclosed to Participants, upon request, for the purpose referred to in point (2).

The personal data processed in the Credit Bureau System will not be disclosed to third parties, except for public authorities and institutions, according to their competences and applicable legislation, such as the National Supervisory Authority for Personal Data Processing, the National Bank of Romania, the National Integrity Authority, the courts, notaries public, bailiffs, criminal investigation bodies.

7. Storage period

Personal Data is stored at the Credit Bureau and disclosed to Participants for 4 years from the date of update, except for the data of credit seekers who have waived their credit application or who have not been granted credit, which are protected and disclosed to Participants for a period of 6 months.

8. Rights of data subjects regarding the processing of personal data

As a data subject, you can exercise your rights under the Regulation, as follows:

a) the right of access to data may be exercised:

• by a written, signed request sent by post to the Credit Bureau, or
• by securely accessing the Credit Bureau's website(www.birouldecredit.ro),or
• personally or electronically, to the Participant who holds the status of creditor/potential creditor of you.

At the same time, you have the right to obtain, upon request, at the time of communication of the credit decision, a copy of the Credit Report issued by the Credit Bureau, which was used by Banca Transilvania S.A. in the analysis of the loan application.

b) the right to rectify the data,

c) the right to delete the data,

d) the right to restriction of data,

e) the right to oppose the processing,including the individual automated decision-making process,

may be exercised:

• by securely accessing the Credit Bureau's website(www.birouldecredit.ro),or
• personally or electronically, to the Participant who holds the capacity of creditor/potential creditor of the data subject.

f) the right to address the National Authority for the Supervision of Personal Data Processing and justice.

9. The contact details of the Data Protection Officers are:

• For Banca Transilvania S.A. – e-mail address dpo@btrl.ro
• For the Credit Bureau - e-mail address: rpd@birouldecredit.ro

This is a specific information note, regarding the processing of personal data for the purpose of analyzing the credit application addressed to BT. The provisions of this note are completed with the General Information Note on the processing and protection of personal data belonging to BT Clients,in which you can find in detail all the other purposes for which your data is processed. The General Information Note is an integral part of BT's Privacy Policy, found on Banca Transilvania's website and can be obtained upon request in any BT unit.

1. Identity of the operator

Banca Transilvania S.A. processes as controller your personal data for the purpose of re-processing and, where appropriate, of analyzing the credit application made.

2. Legal basis and purpose of the processing

For the purpose of payment and, as the case may be, of analyzing the loan application made, in accordance with the need to carry out a responsible lending activity, in addition to the processing of your personal data in the system of the Credit Bureau S.A. - about which you were informed in point A. I. of the presence of information - Banca Transilvania S.A. processes in its own records such data, on the basis of the legal obligations it must comply with, the conclusion of the credit agreement and on the basis of its legitimate interest.

The Bank will process any of the contact details provided within the formulated loan application, in order to notify the loan applicant in writing about the decision to approve / reject it, in accordance with the applicable legal provisions. If the applicant wishes to use another form for the communication of the decision, he may address an express request to the bank to that effect.

3. Obligation to provide data and consequences of non-compliance

The provision of your personal data is necessary for the purpose mentioned in point I. (2). The refusal to provide your personal data, necessary to achieve the above-mentioned purpose, will lead to the impossibility of Banca Transilvania S.A. to fulfill its legal obligations in connection with the granting of the loan, following that the loan application cannot be analyzed.

4. Categories of personal data processed within Banca Transilvania S.A.

The personal data mentioned in the framework of the information provided in point A of the Annex to this point. I. (4), ÎI. (5), as well as other categories of such data collected in the fields of the credit application are processed by Banca Transilvania S.A. within the process of analyzing the credit application formulated, both in the system of the Credit Bureau S.A., and in its own records, being also verified (name, surname and/or CNP) - as the case may be - in public databases such as the websites - the portal of the courts of law, ONRC, etc.

5. Existence of an automated decision-making process, including the creation of profiles made through the BT scoring application

In order to objectively verify the fulfillment of the eligibility conditions for the payment and, where appropriate, to analyze the credit application, BT processes your personal data in its own automated system ("BT scoring application"), in order to carry out the necessary steps to conclude the credit agreement at your request, as well as on the basis of our legitimate interest in effectively managing the credit risk.

In the BT scoring application are automatically entered and processed some of the personal data that we request in the framework of the loan application / request, together with information resulting from checks carried out in the bank's own records or in those of the Credit Bureau S.A., such as (for information purposes but not limited to them) as the case may be - information related to the quality of BT client, level of income, information of a professional and personal nature, level of monthly payment obligations, payment history on other credits. After analyzing all the information and the result of consulting the records of the Credit Bureau S.A., the BT scoring application issues a score that establishes a profile of the debtor / potential debtor based on the information presented in the previous rows, which will be taken into account in the analysis process and which takes into account the probability of paying the monthly payment obligations.

Based on the score issued by the BT scoring application, which is joined by the result of the verification of the applicant's situation in public databases such as websites - portal of the courts, ONRC, etc. - Banca Transilvania S.A. determines whether the eligibility conditions established by its internal regulations are met and will take the decision to admit or reject the loan application.

We will take by exclusively automated means the decision to approve / reject the loan application because the application is made in the online environment and it is essential to provide you with the answer to this in a very short time. In such situations, the decision to be taken by means of such a mijoace is necessary in order to be able to quickly analyse the application and, where appropriate, to conclude the credit agreement. However, you are guaranteed the right to request human intervention, i.e. the analysis of the loan application by a bank employee, to express your point of view and to challenge the decision.

6. Recipients of the data

In addition to the destinies mentioned in point A. I.(6) of the presence of information, personal data processed for the purpose indicated in point II. (2) are disclosed, as the case may be, to the following recipients: ANAF (for consulting the database of the Ministry of Public Finance, if you have expressed your agreement to do so on the dedicated form), Credit Bureau S.A. (to consult your situation in the records of this institution), insurance companies, evaluators (in the case of loans for which an assessment of the assets brought under guarantee is made), FNGCIMM (in the case of first house, new house or first hand loans), suppliers of the BT scoring application or of other services used by Banca Transilvania S.A. in the process of analyzing the loan application and / or in other processes specific to its object of activity.

7. Storage period

The personal data filled in in the loan application are kept in the records of Banca Transilvania for limited periods established legally (e.g. according to the legislation in the financial accounting field) or internally.

8. Rights of data subjects regarding the processing of personal data

For the exercise of the rights (the right of access to data, the right to rectify the data, the right to delete the data, the right to restrict the data, the right to oppose the processing) provided by the Regulation in connection with the processing of your personal data in the system of the Credit Bureau S.A. in relation to Banca Transilvania S.A. you can use any of the modalities indicated in item I.(8).

If you intend to exercise these rights at Banca Transilvania S.A. (both for the processing of personal data in the Credit Bureau S.A. system and within Banca Transilvania S.A.), you will be able to address your written request to the address in Cluj-Napoca, str. Calea Dorobanților, nr. 30-36, jud. Cluj, with the mention – "to the attention of the Data Protection Officer (DPO)" or electronically at the e-mail address dpo@btrl.ro. You also have the right to apply to the National Authority for the Supervision of Personal Data Processing and justice.

You should know that BT, in its capacity as a credit institution, is subject to legal obligations to establish and analyze its exposure to the groups of connected clients, as part of the credit risk analysis. For this purpose it is necessary to collect from you, as a loan applicant and, as the case may be, from other public or internal sources, information about people with whom you form the same group of connected customers.

Your spouse is always someone in touch with you. If you are married, you will need to provide us with your name, surname and CNP or.

As the reporting person, BT will report these exposures and component to the debtor groups of clients related to the NBR, Central to Credit Risk (only where applicable).

The persons in your group can find out information about the processing of their data from section C point 3 of the BT Privacy Policy,found on the website of Banca Transilvania.

This data is necessary for BT to be able to proceed with the analysis of your loan application and your refusal to provide it may cause BT to be unable to review the application and/or approve the loan.

The personal data belonging to these categories of individuals shall be transmitted to the Central Credit Risk Within the NBR, as well as, where appropriate, in compliance with the principle of the need to know, to the entities of the Banca Transilvania Financial Group and service providers used by BT in the process of analyzing the loan application.

The period of retention of these persons' data in BT's records is equal to that of the existence of a group of some groups of related customers to which they belong.

When we review your credit claim we have a legal obligation and legitimate interest to determine your indebtedness and your ability to repay the requested credit. For this it is necessary to know the exact situation of your income. For everything to go quickly, when you apply for a BT credit card exclusively online, we want to find out your income from the ANAF records. However, we will not consult them without you expressing your express consent. We would like to inform you that the fiscal information consulted by BT in the ANAF records can also be made available to you directly through the virtual private space managed by ANAF.

If you agree to consult your income in the ANAF records, we will be able to carry out the consultation for a maximum of 5 working days from the date when you express your consent. The form by which you express your consent or refusal we will keep it for at least 8 years, in order to prove that we have fulfilled our obligation to inform you properly and to request your consent.

If you want to express your disagreement (no answer), you will not be able to continue the application process online, but you can apply for the credit card you want in any BT unit, where you will be presented with other ways to prove your income.

We would consult in the records of the Ministry of Finance, the National Agency for Fiscal Administration (ANAF) the personal data recorded on your name indicated below* (*please note that the query agreement form that will be displayed for signing during the online application process is a standard one, being used both in the case of querying the data of individuals, as well as the legal ones. However, the process you go through is dedicated only to individuals, so we show you in this information note only the categories of data processed in case of querying the income of individuals).

• identification data: name and surname, personal identification number / tax identification number, IP and signature;
• the name of the form of exercising the profession / of achieving income, the tax identification code of the form of exercising the profession / of income realization, the address / headquarters of the form of exercising the profession / of achieving income;
• income from any kind of activities (salary, authorized/ independent, pensions, social insurance, rentals, etc.);

The purpose(s) of the processing of these data is, as the case may be, that of (i) initiating or carrying out contractual relations specific to BT's activity (ii) achieving the legitimate interests of BT and/or (iii) fulfilling the legal obligations incumbent on BT, including those regarding risk management or those deriving from administrative acts issued by the competent authorities in application of the law:

If you agree, you have the right to withdraw it at any time, within the 5-day period. In this case, once it has received the notification, BT will no longer process your personal data for the purpose/purposes mentioned above, unless there is another legal basis in this regard. In order to exercise the right of withdrawal of the agreement, you will have to address to BT a request drawn up in written form, dated and signed, to the address of the bank's headquarters - with the mention "to the attention of the DPO" - or to the e-mail address dpo@btrl.ro, in which you will have to mention that you withdraw your consent expressed by the agreement.

You are also guaranteed the exercise of the other rights provided by the GDPR, which you can find detailed in the BT Privacy Policy on the www.bancatransilvania.ro/ website. You will have to exercise them in the ways that you will have expressly indicated in the ANAF query agreement that you will sign during the online application process.

The presence is a specific information note, regarding the processing of personal data for the purpose of concluding and carrying out a credit agreement. The provisions of this note are completed with a General Information Note on the processing and protection of personal data belonging to BT Customers, in which you can find in detail all the other purposes for which your data is processed. The General Information Note is an integral part of BT's Privacy Policy, found on Banca Transilvania's website and can be obtained upon request in any BT unit.

1. Identity of the operator

Banca Transilvania S.A. processes as operator your personal data for the conclusion and performance of the credit agreement concluded with the bank and, where appropriate, of the guarantee contract - accessory to the credit agreement.

2. Legal basis and purpose of the processing

For the conclusion and performance of credit agreements and, where appropriate, of the guarantee contracts related to them, the Bank processes the categories of personal data mentioned in this section in point (4), on the basis of its legal obligations, the conclusion and execution of the contract and on the basis of its legitimate interest.

The Bank will use any of the contact details provided by the borrower for the development of the contractual relationship with the bank for the purpose of informing about the maturity of each installment, as well as, where appropriate, for sending notifications about the expiry of insurance policies, for the recovery of debts to the contracted loan and for other events produced in connection with it.

3. Obligation to provide data and consequences of non-compliance

The provision of your personal data is necessary for the purpose mentioned in point (2). The refusal to have the personal data necessary to achieve the mentioned purpose processed will lead to the impossibility of the bank to provide you with the requested credit.

4. Categories of personal data processed

The personal data processed by the bank for the purpose mentioned in point (2) are those that you are aware are processed within the stage of payment / analysis of the loan application (detailed in letter.B item. I, II and III of that information note) plus other such data which are received from the keep on the occasion/for the conclusion of the credit agreement, together with its accessories. On the occasion of the conclusion of the contract, you will be assigned an IBAN code related to the contracted loan, through which the payments related to it will be made. Also, the credit card will contain in addition to the holder's name and surname, the card number (PAN), as well as information related to the card's expiration date and CVV code.

To send you the credit agreement, we will also use the email address we have requested from you and have verified that you are using it.

5. Recipients of the data

Personal data processed for the purpose referred to in point (2) are disclosed or transferred in accordance with the applicable legal bases, depending on the situation and only under conditions that ensure full confidentiality and security of the data, to the following categories of recipients - Credit Bureau S.A. and Participants in this system, insurance companies, assessment companies, service providers used by the Bank in the lending process, debt recovery companies, OCPI, National Register of Mobile Advertising (RNPM), public authorities and institutions, notaries public, lawyers, bailiffs, Central Credit Risk*, companies (funds) guaranteeing various types of credit products, the Bank's partners - Rotary and Flying Blue, for credit cards issued in collaboration with them.

* The Bank has the legal obligation to report to the Central Credit Risks (CRC) the credit risk information for each debtor who meets the condition of being reported (it includes the identification data of a debtor, individual or non-banking legal person, and the operations in RON and foreign currency through which the Bank exposes itself to risk towards that debtor), respectively, to have registered an individual risk against him, as well as the information about the frauds with the cards found.

** The Bank has the legitimate interest to report in the Credit Bureau System, to which the other Participants (mainly credit institutions and non-banking financial institutions) have access to your personal data in case you will experience delays in the payment of the loan of at least 30 days, after your prior notification in this regard at least 15 days before the reporting date.

6. Duration of storage of personal data

Personal data processed for the purpose indicated in point (2) are stored in the bank's records for limited periods established legally (e.g. according to the legislation in the financial accounting field) or internally. Those personal data that are processed in the Credit Bureau system and disclosed to the Participants in this system are stored in the records of this institution for 4 years from the date of update. In the records of the Credit Risk Central, the data reported under the legal obligation that the Bank has, namely credit risk information and information about card frauds are maintained for a period of 7 years from the date of registration.

7. Rights of data subjects regarding the processing of personal data

As a data subject, you can exercise your rights under EU Regulation 679/2016 - General Data Protection Regulation: the right of access, the right to rectify data, the right to delete data, the right to restrict data, the right to object to processing.

These rights may be exercised as follows:

• at the Bank, by sending a written request to the address of the bank in Cluj-Napoca, str. Calea Dorobanților, nr. 30-36, jud. Cluj, with the mention – "to the attention of the Data Protection Officer (DPO)" or by electronic means at the e-mail address dpo@btrl.ro.
• by accessing the Credit Bureau's websitein a secure manner, in the case of data processed in the Credit Bureau System, as well as the right to address the National Authority for the Supervision of Personal Data Processing and justice.

1. Controllers of personal data

Pursuant to Articles 13-14 of EU Regulation 679/2016 - General Data Protection Regulation ("GDPR"), Alfatrust Certification S.A. ("Alfatrust") and Banca Transilvania SA ("BT"), inform you about the processing of personal data of the user of the user ("data subject") which he carries out as joint controllers for the purpose mentioned in letter .b of this information.

2. Purpose and basis of the processing of personal data

The purpose for which the associated operators process the User's data is to issue and manage the Qualified Digital Certificate (the "Certificate").

BT is the operator that identifies the User, respectively collects from him the personal data necessary for the issuance of the Qualified Digital Certificate, and transmits them to Alfatrust for this operator to issue the certificate.

The data that BT collects from Users are those processed by BT in its own records, in the context of the business relationship that is already established between the User and BT at the time of transmitting the data to Alfatrust.

During the period of validity of the certificate, personal data are processed by the associated controllers, as the case may be, as well as in situations where users request the suspension or revocation of the certificate in the ways detailed in the Terms and Conditions of Service Provision.

The grounds for the processing of personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit.c GDPR), the conclusion /execution of the contract (Art. 6 para. 1 lit.b GDPR) and the legitimate interest of the joint controllers (Art. 6 para. 1 lit. f GDPR).

Regarding the legal obligation, both BT - as a credit institution with which the User has established a business relationship, and Alfatrust - as an accredited certification service provider from which the User wants to obtain a certificate, are subject to the applicable legal provisions in the field of prevention of money laundering and terrorist financing according to which they must collect from customers a series of personal data. These data are also necessary for the conclusion / execution of the contract based on which the User is awarded the use of the certificate for signing the documentation in relation to BT.

In order to support users who wish to make a request for suspension or withdrawal of the certificate, the joint operators justify a legitimate interest in offering them (who are also customers of BT) the possibility to submit these requests not only directly to Alfatrust, but also through BT. The settlement of these requests involves the exchange of the Personal Data of the Users between the two joint controllers.

Contact details - telephone number, and home address will be processed by any of the associated operators, whenever it will be necessary to contact the end-user for the proper development of the contractual relationship related to the qualified digital certificate.

3. Categories of personal data and persons whose personal data are processed

The personal data processed in order to fulfill the mentioned purpose are those provided by law that it is mandatory to be collected by a credit institution, respectively by a provider of certification services for the prevention of money laundering and terrorism sanctions, respectively: name, surname, CNP, address of domicile / residence, date of validity of the identity document, and phone number, copy of id. All this data, as made available by the user to BT, will be transmitted to Alfatrust for the issuance and management of the Qualified Digital Certificate.

The processing of these personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate.

The data subjects of this processing are only the Users, as defined in the Terms and Conditions of Use.

4. Recipients of personal data

With the exception of the associated controllers between whom an exchange of the personal data processed to fulfill the purpose of the processing will be carried out, the data shall be disclosed, where appropriate, to the providers of IT services, audit services, authorities and institutions entitled to know them.

5. Period of processing of personal data

Information on a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its termination of validity, in accordance with legally established deadlines.

At the BT level, the remote electronic signature, applied on the basis of the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship is carried out between the User and BT, to which are added the terms established in the applicable legislation.

6. Rights of data subjects for the processing of their personal data

Any User, in his capacity as a data subject, is guaranteed the exercise of the following rights with regard to the processing of his personal data, to any of the joint controllers: the right of access, the right to rectification, the right to restriction of processing, the right to delete data, the right to object to data processing, the right to data portability.

Users can exercise these rights or contact the data protection officers for any questions / requests regarding the processing of your personal data, as follows:

• at Banca Transilvania S.A. - by message sent to the e-mail address dpo@btrl.ro or by a request sent to the address of the bank in Cluj-Napoca, str. Cale Dorobanților nr. 30-36, jud. Cluj, with the mention "to the attention of the Data Protection Officer (DPO)"
• at Alfatrust Certification S.A. - by message sent to the e-mail address suport@alfasign.roor by a request sent to Alfatrust headquarters, with the mention "to the attention of the Data Protection Officer (DPO)"

Users also have the right to file a complaint with the supervisory authority - The National Supervisory Authority for Personal Data Processing (ANSPDCP), based in Bucharest, sector 1, Bd. G-ral Gh. Magheru nr. 28-30.