Information note on the processing of personal data for obtaining / increasing an overdraft exclusively online, exclusively online

When the law obliges us to carry out some processing of personal data or when they are necessary for the conclusion of the overdraft contract, if you refuse to process them, BT will not be able to analyze your request or, as the case may be, you will not be able to contract the overdraft.

For processing based on the legitimate interest of BT or third parties, refusal to process your data may make it impossible for you to submit or for us to consider your application or to obtain/increase the overdraft.

If the processing of personal data is based on your consent (e.g. income interrogation in ANAF, processing of biometric data), we will ask you for this agreement at the right time on the online stream, so that the whole process is as transparent as possible towards you. If you refuse to give us this consent, you can't get the overdraft exclusively online, but you can apply to a BT unit.

We will automatically retrieve the data from the photographed CI (through optical character recognition), which we will compare with the corresponding data from the copy of your identity document already recorded in our records. If they match, you can move on to the stream. Otherwise, you will first need to update your data in BT records.

The data taken from your ID will also be used for the overdraft request you make online.

We will also ask for your contact details - phone number and email address - which we will check to make sure they belong to you, as they are very important in the process of electronically signing the documentation for obtaining/upgrading the overdraft online. If we notice that you have not completed the application flow, we may use these contact details to see if you need support in completing the application, but also to get your opinion on the BT Pay flow for obtaining an overdraft/enhancing the credit line of a previously obtained overdraft.

1. Identification data of the controllers

Banca Transilvania and Societatea Biroul de Credit S.A., a legal person Romanian based in Bucharest, str. Sfânta Vineri, nr. 29, 4th floor, sector 3, as joint controllers, processes your personal data, in good faith, in a fair and transparent manner, for specified and legitimate purposes, according to the provisions of Regulation (EU) No. 679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the Regulation).

Credit Bureau SA is the private law entity that manages the Credit Bureau System, in which personal data are processed in connection with the lending activity carried out by the Participants.

The participants in the Credit Bureau System are credit institutions, non-banking financial institutions, insurance companies and debt collection companies, which have signed a Participation Agreement with the Credit Bureau.

2. Legal basis and purpose of the processing

Banca Transilvania S.A. and the Credit Bureau processes your personal data based on the legitimate interest of the Participants and the Credit Bureau for carrying out a responsible crediting activity, under the conditions of protecting, facilitating access to credit and preventing excessive indebtedness of the data subjects, observing the legal framework regarding the creditworthiness assessment and credit risk reduction, as well as preventing the use of the financial-banking system to carry out activities contrary to the law.

Banca Transilvania S.A. has the obligation, according to the legal regulations in force, to assess your ability to repay the loan, before concluding a credit agreement and during its performance. For this purpose, Banca Transilvania S.A. processes the information indicated in point (4), registered on your name in its own records and transmits them to the Credit Bureau for processing by this institution and consulting them by any Participant, in order to initiate or carry out a credit relationship, as well as to ensure credit products.

3. Obligation to provide data and consequences of non-compliance

The provision of your personal data is necessary for the purpose mentioned in point (2). The refusal to provide your personal data, necessary to achieve the purpose mentioned above, will lead to the impossibility of Banca Transilvania S.A. to fulfill its legal obligations in connection with the granting of the loan.

4. Categories of personal data processed in the Credit Bureau System

• identification data of the data subject: name, surname, personal identification number or CUI for authorized natural persons or CIF for natural persons carrying out liberal professions or country code and passport series / number for non-resident persons, home address / residence, telephone number, date of birth;
• data relating to the employer: address of the employer, date of registration of this information, CUI;
• data regarding the requested/granted credit products: type and name of the Participant, type of product, product/account status, date of granting, account duration, amounts granted, amounts due, update date, currency, frequency of payments, amount paid, monthly installment, outstanding amounts, number of days of delay, date of the first outstanding, category of delay, date of last payment;
• data regarding events that occur during the development of the credit product, such as those related to the restructuring / refinancing, payment, assignment of the credit agreement, assignment of the claim;
• data relating to relations with other accounts: information relating to credit products to which the data subject is a co-debtor and/or guarantor;
• insolvency data: information on data subjects against whom insolvency proceedings have been opened;
• number of queries: indicates the number of Credit Reports issued by the Credit Bureau, at the request of one or more Participants.

In the process of analyzing your loan application, Banca Transilvania S.A. will request the Credit Bureau to issue a Credit Report, with or without FICO® Score, in order to verify whether you are within the degree of indebtedness established by law and if you have the ability to repay the loan. In order to obtain the Credit Report, Banca Transilvania S.A.va sent to the Credit Bureau the name, surname and personal identification number.

After granting the loan, Banca Transilvania S.A. will send to the Credit Bureau your personal data provided for in points a)-f). This information shall be shared with the other Participants within the Credit Bureau System and shall be used for the purpose referred to in point 2.

Your ability to repay debts at maturity can be checked periodically, after the loan is granted, including by obtaining Credit Reports or by using *The Alerts Service.

If, during the period of the loan granted, you are late in the payment of the installments for more than 30 calendar days from the due date, Banca Transilvania S.A. will send to the Credit Bureau information on the outstanding amounts, the category of delay, the date of the first arrears and/or, as the case may be, information regarding the opening of the procedure of giving in payment, only after your notification, at least 15 calendar days in advance, made in writing, by phone, SMS, e-mail or other means of electronic communication.

* The Alerts service is used by the Participants to identify and/or reduce the credit risk in a timely manner, by generating an alert to a Participant when an event is registered for an individual debtor (account opening/closing, entry/exit from arrears, account correction, registration/deletion of the guarantor/co-debtor status, account query, change employer name/phone number) with another Participant.

5. FICO® Score from credit bureau

The personal data referred to in point (4) may be processed by the Credit Bureau, including to calculate, at the request of the Participants, fico® score from the Credit Bureau.

Participants can use FICO® Score from the Credit Bureau in order to reduce the credit risk associated with a debtor/potential borrower.

The FICO® Score from the Credit Bureau is a number between 300 and 850, obtained from the statistical process that processes the information recorded by the Participants in the Credit Bureau System and indicates the probability that the data subject will pay his/her installments on time in the future. The main causes that caused the decrease of fico® score from the Credit Bureau are displayed in the form of reason codes.

FICO® Score from the Credit Bureau takes into account the following elements that confer predictability: payment history, current debt, duration of the credit account(s) (average number of months after granting the loans), the application for new loans (number of queries and credits granted in the last 6 months), the credit mix (types of loans granted), the age of the data subject. The influence of these elements on the value of the FICO® Score from the Credit Bureau may vary depending on the information recorded with the Credit Bureau for each data subject.

Fico® Score from the Credit Bureau is a tool of analysis with a high degree of predictability that, in addition to the data from the Credit Report and the information obtained by the Participants from other sources, competes to correctly assess the creditworthiness of the data subject in order to conclude / carry out the credit agreement.

6. Recipients of the data

Personal data recorded in the Credit Bureau System shall be disclosed to Participants, upon request, for the purpose referred to in point (2).

The personal data processed in the Credit Bureau System will not be disclosed to third parties, except for public authorities and institutions, according to their competences and applicable legislation, such as the National Supervisory Authority for Personal Data Processing, the National Bank of Romania, the National Integrity Authority, the courts, notaries public, bailiffs, criminal investigation bodies.

7. Storage period

Personal data is stored at the Credit Bureau and disclosed to Participants for 4 years from the date of update, except for the data of credit applicants who have waived the credit application or who have not been granted credit, which are stored and disclosed to the Participants for a period of 6 months.

8. Rights of data subjects regarding the processing of personal data

As a data subject, you can exercise the rights provided by the Regulation, as follows:

a) the right of access to data may be exercised:

• by a signed written request sent by mail to the Credit Bureau, or
• by securely accessing the Credit Bureau's website(www.birouldecredit.ro),or
• personally or electronically, to the Participant who holds the status of creditor/potential creditor of you.

At the same time, you have the right to obtain, upon request, at the time of communication of the credit decision, a copy of the Credit Report issued by the Credit Bureau, which was used by Banca Transilvania S.A. in the analysis of the loan application.

b) the right to rectify the data,

c) the right to delete the data,

d) the right to restriction of data,

e) the right to oppose the processing,including the individual automated decision-making process, 

may be exercised: 

• by securely accessing the Credit Bureau's website(www.birouldecredit.ro),or
• personally or electronically, to the Participant who holds the capacity of creditor/potential creditor of the data subject.

f) the right to address to the National Authority for the Supervision of Personal Data Processing and Justice.

9. The contact details of the Data Protection Officers are:

• For Banca Transilvania S.A. – e-mail address dpo@btrl.ro 
• For the Credit Bureau - e-mail address: rpd@birouldecredit.ro

This is a specific information note, regarding the processing of personal data for the purpose of analyzing the credit application addressed to BT. The provisions of this note are completed with the General Information Note on the processing and protection of personal data belonging to BT Clients, in which you find detailed all the other purposes for which your data is processed. The general information note is an integral part of the BT Privacy Policy, found on the Website of Banca Transilvania and can be obtained on request in any BT unit.

1. Identity of the operator

Banca Transilvania S.A. process as operator your personal data for the purpose of providing and, where appropriate, analyzing the credit application.

2. Legal basis and purpose of the processing

For the purpose of publishing and, as the case may be, analyzing the loan application formulated, in accordance with the need to carry out a responsible crediting activity, in addition to processing your personal data in the system of the Credit Bureau S.A.- about which you were informed in point A. I. of this information - Banca Transilvania S.A. processes in its own records such data, on the basis of the legal obligations it must comply with, the conclusion of the credit agreement and on the basis of its legitimate interest.

The bank will process any of the contact details provided within the formulated loan application, for the purpose of notifying the loan applicant in written form of the decision to approve / reject it, in accordance with the applicable legal provisions. If the applicant wishes to use another form for the communication of the decision, he/she may address an express request to the bank to that effect.

3. Obligation to provide data and consequences of non-compliance

The provision of your personal data is necessary for the purpose mentioned in point II. (2). The refusal to provide your personal data, necessary to achieve the purpose mentioned above, will lead to the impossibility of Banca Transilvania S.A. to fulfill its legal obligations in connection with the granting of the loan, following that the loan application cannot be analyzed.

4. Categories of personal data processed within Banca Transilvania S.A.

Personal data mentioned in the presence of information in point I. (4), II. (5), as well as other categories of such data collected in the fields of the loan application are processed by Banca Transilvania S.A. within the process of analyzing the credit application formulated, both in the credit bureau system S.A., and in its own records, being also verified (name, surname and / or CNP) - as the case may be - in public databases such as websites - the portal of the courts of law, ONRC, etc.

5. Existence of an automated decision-making process, including the creation of profiles made through the BT scoring application

In order to objectively verify the fulfillment of the eligibility conditions for the payment and, where appropriate, to analyze the credit application, BT processes your personal data in its own automated system ("BT scoring application"), in order to carry out the necessary steps to conclude the credit agreement at your request, as well as on the basis of our legitimate interest in effectively managing the credit risk.

In the BT scoring application are entered and processed automatically some of the personal data that we request from you within the credit application / precersion, together with information resulting from checks made in the bank's own records or in those of the Credit Bureau S.A., such as (for information purposes but not limited to them) as the case may be - information related to the quality of BT customer, income level, professional and personal information, level of monthly payment obligations, payment history on other loans. After analyzing all the information and the result of consulting the records of the Credit Bureau S.A., the BT scoring application issues a score that establishes a profile of the debtor / potential debtor based on the information presented in the previous rows, which will be taken into account in the analysis process and which takes into account the probability of paying the monthly payment obligations.

Based on the score issued by the BT scoring application, which is joined by the result of the verification of the applicant's situation in public databases such as websites - court portal, ONRC, etc. - Banca Transilvania S.A. determines whether the eligibility conditions established by its internal regulations are met and will take the decision to admit or reject the loan application.

We will make the decision to approve/reject the credit application by exclusively automated means because the application is made online and it is essential to provide you with a response within a very short timeframe. In such cases, the decision is necessary in order to be able to analyse the application quickly and, if necessary, to conclude the credit agreement. However, you are guaranteed the right to request human intervention, i.e. to have your credit application examined by a bank employee, to express your point of view and to contest the decision.

6. Recipients of the data

In addition to the destinations mentioned in point A. I.(6) of the presence of information, personal data processed for the purpose indicated in point II. (2) are disclosed, as the case may be, to the following recipients: ANAF (for consulting the database of the Ministry of Public Finance, if you have expressed your consent in this regard on the dedicated form), Credit Bureau S.A. (to consult your situation in the records of this institution), insurance companies, appraisers (in the case of loans for which an assessment of the goods brought under guarantee is made), FNGCIMM (in the case of First Home, New Home or First Car loans), suppliers of the BT scoring application or of other services used by Banca Transilvania S.A. within the process of analyzing the loan application and/or in other processes specific to its object of activity.

7. Storage period

The personal data filled in in the loan application are kept in the records of Banca Transilvania for limited periods established legally (e.g. according to the legislation in the financial accounting field) or internally.

8. Rights of data subjects regarding the processing of personal data

For the exercise of the rights (the right of access to data, the right to rectify the data, the right to delete the data, the right to restrict the data, the right to oppose the processing) provided by the Regulation in connection with the processing of your personal data in the system of the Credit Bureau S.A. in relation to Banca Transilvania S.A. you can use any of the modalities indicated in item I.(8).

If you intend to exercise these rights at Banca Transilvania S.A. (both for the processing of personal data in the Credit Bureau S.A. system and within Banca Transilvania S.A.), you will be able to address your written request to the address in Cluj-Napoca, str. Calea Dorobanților, nr. 30-36, jud. Cluj, with the mention – "to the attention of the Data Protection Officer (DPO)" or electronically at the e-mail address dpo@btrl.ro. You also have the right to address to the National Authority for the Supervision of Personal Data Processing and justice.

As a reporting person, BT will report these exposures and the component of the debtor groups of clients related to the NBR, Central Credit Risk (only where applicable).

The persons in your group can find out information about the processing of their data from section C, item 3 of the BT Privacy Policy, found on the website of Banca Transilvania.

This data is necessary for BT to be able to proceed to the analysis of your loan application and your refusal to provide it may cause BT to be unable to analyze the application and/or approve the loan.

The personal data belonging to these categories of individuals are transmitted to the Credit Risk Central Office within the NBR, as well as, as the case may be, in compliance with the need to know principle, to entities from the Banca Transilvania Financial Group and service providers used by BT in the process of analyzing the loan application.

The period of keeping the data of these persons in BT records is equal to that of the existence of a group(s) of connected customers to which they belong.

If you agree to consult your income in the ANAF records, we will be able to carry out the consultation for a maximum of 5 working days from the date when you express your consent. The form by which you express your consent or refusal we will usually keep it for 8 years, in order to prove that we have fulfilled our obligation to inform you properly and to request your consent.

If you wish to express your disagreement (answer NO), you will not be able to continue the application process online, but you can apply for an overdraft at any BT branch, where you will be shown other ways to prove your income.

We would consult in the records of the Ministry of Public Finance, the National Agency for Fiscal Administration (ANAF) the personal data recorded on your name indicated below* (*please keep in mind that the query agreement form that will be displayed to you for signing during the online application process is a standard one, being used both in the case of querying the data of individuals, as well as the legal ones. However, the process you go through is dedicated only to individuals, so we display in this information note only the categories of data processed in case of querying the income of individuals).

• identification data: name and surname, personal identification number / tax identification number, IP and signature;
• the name of the form of exercising the profession / of achieving income, the tax identification code of the form of exercising the profession / of income realization, the address / headquarters of the form of exercising the profession / of achieving income;
• income from any kind of activities (salary, authorized/ independent, pensions, social insurance, rentals, etc.);

The purpose(s) of the processing of these data is, as the case may be, that of (i) initiating or carrying out contractual relations specific to BT's activity (ii) achieving the legitimate interests of BT and/or (iii) fulfilling the legal obligations incumbent on BT, including those regarding risk management or those deriving from administrative acts issued by the competent authorities in application of the law:

If you agree, you have the right to withdraw it at any time, within the 5-day period. In this case, once it has received the notification, BT will no longer process your personal data for the purpose/purposes mentioned above, unless there is another legal basis in this regard. In order to exercise the right of withdrawal of the agreement, you will have to address to BT a written, dated and signed request, to the address of the bank's headquarters - with the mention "to the attention of the DPO" - or to the e-mail address dpo@btrl.ro, in which you will have to state that you withdraw your consent expressed by the agreement.

You are also guaranteed the exercise of the other rights provided by the GDPR, which you can find detailed in the BT Privacy Policy on the www.bancatransilvania.ro/ website. You will have to exercise them in the ways that you will have expressly indicated in the ANAF query agreement that you will sign during the online application process.

Presence is a specific information note, regarding the processing of personal data for the purpose of concluding and carrying out a credit agreement. The provisions of this note are completed with a General Information Note on the processing and protection of personal data belonging to BT Clients, in which you find detailed all the other purposes for which your data is processed. The general information note is an integral part of the BT Privacy Policy, found on Banca Transilvania's website and can be obtained upon request in any BT unit.

1. Identity of the operator

Banca Transilvania S.A processes as operator your personal data for the conclusion and performance of the credit agreement concluded with the bank and, as the case may be, of the guarantee contract - accessory of the credit agreement.

2. Legal basis and purpose of the processing

For the conclusion and performance of credit agreements and, where appropriate, of the guarantee contracts related to them, the Bank processes the categories of personal data mentioned in this section in point (4), on the basis of its legal obligations, the conclusion and execution of the contract and on the basis of its legitimate interest.

The Bank will use any of the contact details provided by the borrower for the development of the contractual relationship with the bank for the purpose of informing about the maturity of each installment, as well as, where appropriate, for sending notifications about the expiry of insurance policies, for the recovery of debts to the contracted loan and for other events produced in connection with it.

3. Obligation to provide data and consequences of non-compliance

The provision of your personal data is necessary for the purpose mentioned in point (2). The refusal to have the personal data necessary to achieve the mentioned purpose processed will lead to the impossibility of the bank to provide you with the requested credit.

4. Categories of personal data processed

The personal data processed by the bank for the purpose mentioned in point (2) are those that you have become aware of are processed during the stage of re-processing / analysis of the loan application (detailed in letter .B item. I, II and III of this information note) to which are added other such data that are received from you on the occasion/for the conclusion of the credit agreement, together with its accessories. On the occasion of the conclusion of the contract, the IBAN of the current account will also be processed in which the amount related to the overdraft will be made available to you.

To send you the credit agreement, we will also use the email address we have requested from you and have verified that you are using it.

5. Recipients of the data

Personal data processed for the purpose referred to in point (2) are disclosed or transferred in accordance with the applicable legal grounds, depending on the situation and only under conditions that ensure full confidentiality and data security, to the following categories of recipients - Credit Bureau S.A. and Participants in this system, insurance companies, valuation companies, service providers used by the Bank in the lending process, debt recovery companies, OCPI, the National Register of Mobile Advertising (RNPM), public authorities and institutions, notaries public, lawyers, bailiffs, Central Credit Risk*, companies (funds) guaranteeing various types of credit products.

* The Bank has the legal obligation to report to the Central Credit Risks Central (CRC) the credit risk information for each debtor who meets the condition of being reported (includes the identification data of a debtor, individual or non-banking legal person, and the operations in RON and in foreign currency through which the Bank exposes itself to risk towards that debtor), respectively to have registered an individual risk towards him, as well as the information about the card frauds found.

** The Bank has the legitimate interest to report in the Credit Bureau System, to which the other Participants (mainly credit institutions and non-banking financial institutions) have access to your personal data in case you will experience delays in the payment of the loan of at least 30 days, after your prior notification in this regard at least 15 days before the reporting date.

6. Duration of storage of personal data

The personal data processed for the purpose indicated in point (2) are stored in the bank's records for limited periods legally established (e.g. according to the legislation in the financial accounting field) or internally. Those personal data that are processed in the Credit Bureau system and disclosed to the Participants in this system shall be stored in the records of this institution for 4 years from the date of the update. In the records of the Central Credit Risk Register, the data reported under the legal obligation that the Bank has, respectively the credit risk information and the information about card frauds are maintained for a period of 7 years from the date of registration.

7. Rights of data subjects regarding the processing of personal data

As a data subject, you can exercise your rights under EU Regulation 679/2016 - General Data Protection Regulation: the right of access, the right to rectify data, the right to delete data, the right to restrict data, the right to object to processing.

These rights may be exercised as follows:

• to the Bank, by sending a written request to the bank's address in Mun. Calea Dorobantilor, no. 30-36, Cluj-Napoca, jud. Cluj, with the mention - "for the attention of the Data Protection Officer (DPO)" or electronically at the e-mail address dpo@btrl.ro.
• by accessing the Credit Bureau's websitein a secure manner, in the case of data processed in the Credit Bureau System, as well as the right to address the National Authority for the Supervision of Personal Data Processing and justice.

1. Controllers of personal data

Pursuant to Articles 13-14 of EU Regulation 679/2016 - General Data Protection Regulation ("GDPR"), Alfatrust Certification S.A. ("Alfatrust") and Banca Transilvania SĂ ("BT"), inform you about the processing of your personal data as a User ("data subject") that they carry out as associated controllers for the purposes mentioned in letter b of this information.

2. Purpose and basis of personal data processing

The purpose for which the associated operators process the User's data is to issue and manage the Qualified Digital Certificate (the "Certificate").

BT is the operator that identifies the User, respectively collects from him the personal data necessary for the issuance of the Qualified Digital Certificate, and transmits them to Alfatrust for this operator to issue the certificate.

The data that BT collects from Users are those processed by BT in its own records, in the context of the business relationship that is already established between the User and BT at the time of transmitting the data to Alfatrust.

During the period of validity of the certificate, personal data are processed by the associated controllers, as the case may be, as well as in situations where users request the suspension or revocation of the certificate in the ways detailed in the Terms and Conditions of Service Provision.

The grounds for the processing of personal data for the defined purpose are the legal obligation (Art. 6 para. 1 lit.c GDPR), the conclusion / execution of the contract (Art. 6 para. 1 lit.b GDPR) and the legitimate interest of the associated operators (Art.6 para. 1 lit. f GDPR).

Regarding the legal obligation, both BT - as a credit institution with which the User has established a business relationship, and Alfatrust - as an accredited certification service provider from which the User wishes to obtain a certificate, are subject to the applicable legal provisions in the field of prevention of money laundering and terrorist financing according to which it must collect from customers a series of personal data. These data are also necessary for the conclusion / execution of the contract based on which the User is awarded the use of the certificate for signing the documentation in relation to BT.

In order to support users who wish to make a request for suspension or withdrawal of the certificate, the joint operators justify a legitimate interest in offering them (who are also customers of BT) the possibility to submit these requests not only directly to Alfatrust, but also through BT. The settlement of these requests involves the exchange of the Personal Data of the Users between the two joint controllers.

Contact details - telephone number, and home address will be processed by any of the associated operators, whenever it will be necessary to contact the end user for the proper performance of the contractual relationship related to the qualified digital certificate.

3. Categories of personal data and persons whose personal data are processed

The personal data processed in order to fulfill the mentioned purpose are those provided by law as being mandatory to be collected by a credit institution, respectively by a provider of certification services for the prevention of money laundering and terrorism sanctions, namely: name, surname, CNP, address of domicile / residence, date of validity of the identity document, and phone number, copy of id. All this data, as made available by the user to BT, will be transmitted to Alfatrust for the issuance and management of the Qualified Digital Certificate.

The processing of these personal data is necessary for the generation of the Qualified Digital Certificate. The User's refusal to have this data processed leads to the impossibility of issuing the Qualified Digital Certificate.

The data subjects of this processing are only the Users, as defined in the Terms and Conditions of Use.

4. Recipients of personal data

With the exception of the associated controllers between whom an exchange of the personal data processed to fulfill the purpose of the processing will be carried out, the data shall be disclosed, where appropriate, to the providers of IT services, audit services, authorities and institutions entitled to know them.

5. Period of processing of personal data

Information on a Qualified Digital Certificate (including personal data) is processed by Alfatrust for a period of 10 years from the date of its termination of validity, in accordance with legally established deadlines.

At the BT level, the remote electronic signature, applied on the basis of the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is kept for the entire period during which a business relationship is carried out between the User and BT, to which are added the deadlines established in the applicable legislation.

6. Rights of data subjects for the processing of their personal data

Any User, in his capacity as a data subject, is guaranteed the exercise of the following rights with regard to the processing of his personal data, to any of the joint controllers: the right of access, the right to rectification, the right to restriction of processing, the right to delete data, the right to object to data processing, the right to data portability.

Users can exercise these rights or contact the data protection officers for any questions / requests regarding the processing of your personal data, as follows:

• at Banca Transilvania S.A. - by message sent to the e-mail address dpo@btrl.ro or by a request sent to the bank's address in Mun. Cluj-Napoca, str. Calea Dorobanților nr. 30-36, jud. Cluj, with the mention "to the attention of the Data Protection Officer (DPO)"
• at Alfatrust Certification S.A. - by message sent to the e-mail address suport@alfasign.ro or by a request sent to alfatrust headquarters, with the mention "to the attention of the data protection officer (DPO)"

Users also have the right to file a complaint with the supervisory authority - National Supervisory Authority for Personal Data Processing (ANSPDCP), based in Bucharest, sector 1, Bd. G-ral Gh. Magheru nr. 28-30.