BT Pay Italia privacy notice

Privacy notice on the processing of the personal data of BT Italia clients by Banca Transilvania within the BT PAY mobile application, as well as in the Google Pay and Apple Pay applications

Version updated as at: 04.03.2025

General provisions

BANCA TRANSILVANIA – Italy Branch (hereinafter “the Bank”, “BT Italia”, “we”), whose identification and contact details are set out in Section III - General privacy notice on the processing and protection of the personal data of clients of Banca Transilvania – Italy Branch, available here.

This privacy notice relates exclusively to the processing of the personal data of BT Pay users who are clients of BT Italia and who are at least 18 years of age (“adult users”).

BT Pay is an application offered to BT Italia clients, under the conditions provided for in the “Summary document and general terms and conditions of the Internet Banking contract (mobile banking through the BT PAY software application) linked to the current account offered to consumer clients” which you should read before starting the registration procedure.

In addition, adult natural persons who are resident and who do not yet have a current account opened with BT Italia may initiate, through BT Pay, a contractual relationship with Banca Transilvania – Italy Branch. In this context, personal data are processed as set out in detail in the “General privacy notice on the processing and protection of the personal data of clients of Banca Transilvania – Italy Branch”, displayed separately at the start of the process of opening the relationship through the application.

BT may review this notice periodically, but will not create less favourable conditions for users of the BT Pay Application in terms of the processing and protection of personal data. We will inform you of such changes within the BT Pay application. The updated version of the notice and the date of its application will be available to users at all times. The provisions of the notice in force will apply to all BT Italia users of BT Pay. If, at any time, you consider that the way in which BT processes and/or protects personal data does not comply with the legal provisions and/or with your needs, you may report this to us at the contact address: dpo@btrl.ro and/or stop using BT Pay.

What types of personal data of BT Italia clients do we process, where applicable, within BT Pay?

To ensure the security of BT Pay/prevent fraud

In order to ensure the security of BT Pay, with a view to preventing fraud, in accordance with our legal obligation and our legitimate interest, we process personal data such as:

the identity of the device used (for example, device ID, model of the devices, type and version of the operating system, including their history) and whether it is protected by a password, fingerprint or another security method; in accordance with the legal provisions, the Bank will only verify the existence of the aforementioned security systems, but will not have access to the password, the fingerprint or the other security methods used, which will remain stored in the memory of the user's device.
the IP address/addresses of the devices with which you connect to BT Pay, which also indicate the geographical location from which you carry out the transaction through the Application.
Whether the device with which you connect contains malware, including applications that allow remote connection; while the application is in use we also check whether the device has been, or has recently been, used for conversations, without however becoming aware of the numbers/persons you have spoken to.
We process these data in order to protect the information in BT Pay and to prevent fraud. If you refuse the processing of these data, you will not be able to use the application.

For the same purpose, we process the data for setting/resetting/unlocking the PIN (security code), for authentication in BT Pay and those used to carry out transactions of significant value, as indicated in the Privacy notice on the processing of personal data for identification in BT Pay, and, in the context of online payments, we process the data relating to the device unlocking method. The data relating to the phone unlocking method you have chosen (for example, fingerprint, facial recognition, pattern, PIN, password, etc.) are not held by the Bank, but the Bank becomes aware of the result of the check (accepted/refused) by comparing the data used to authorise each payment transaction with the corresponding reference data stored on your phone.
Depending on the situation, in order to prevent fraud through/in BT Pay, the Bank may take the following measures: blocking the application until third-party applications that could compromise the confidentiality of the information in BT Pay are uninstalled, blocking potentially fraudulent transactions, contacting clients by the Bank, etc.

For the registration in BT Pay of new BT Italia clients holding current accounts

When you request the opening of a contractual relationship with BT Italia through the BT Pay application, we use a remote identification service by video means, which involves the processing of personal data in accordance with the legislation applicable in this field (for example, the personal data from the identity document, the contact details, as well as the so-called biometric data relating to facial recognition). In this process we also collect other personal data for other purposes, as described in the Privacy notice on the processing of personal data for the opening of the business relationship through BT Pay with Italia.

For the registration in BT PAY of existing BT Italia clients

If you opened your contractual relationship with BT Italia before the moment at which you wish to use the application, a strong authentication procedure must be applied for registration in BT Pay, as required by the legislation applicable in the field of payment services. To this end, we process personal data as indicated in the separate privacy notice, which will be shown to you in BT Pay, namely the Privacy notice on the processing of personal data for identification in BT Pay.

During the registration process, you will need to provide the card data requested from you, as well as a chosen user name (nickname), which will correspond to your account in BT PAY. In order to complete the registration of the payment cards in BT Pay, we will also process the information relating to the telephone number declared to BT Italia by the cardholder (hereinafter referred to as the "telephone number declared to BT Italia"), to which we will send an SMS-OTP.

When you use BT PAY

Below we inform you how we process personal data, separately for each functionality of the Application:

I. "Payment cards" functionality

II. „Accounts” functionality

III. „Savings” functionality

IV. Other BT Pay functionalities

I. "Payment cards" functionality

Card payments at merchants

If you have a device with an Android operating system and built-in NFC technology, with BT Pay you can make payments at merchants using the BT cards held in the application. In this case, we will indirectly obtain data about you, such as the checks required for the execution of the transaction (for example, entering the password to unlock the phone), the data of the transactions carried out, the data of the card used to make the payment, the data of the account associated with the card, including data relating to the date, time and amount paid, data relating to the location where you made the payment and those entered in the payment description.

In order to make payments at merchants with BT Pay installed on devices with an Android operating system, the NFC (Near Field Communication) function must be enabled. If this function is not enabled, BT Pay will have access to this function in order to direct you to the NFC settings.

Where the BT Pay application is installed on devices with an Android operating system that do not support the NFC function, the BT Pay application cannot be used for payments at merchants, but the other functionalities will still be available.

In order to facilitate the enrolment of the cards already registered through BT Pay into Google Pay or, where applicable, into Apple Pay, the application will check whether you use the Android or the iOS operating system and will display dedicated buttons that facilitate the enrolment of the cards in these applications. If you choose this type of registration in Google Pay/Apple Pay, as well as in the context of the use of these third-party payment applications, the Bank will process, including by disclosing to the providers of these applications, the following personal data: BT client code (CIF BT), Device ID, Wallet ID, as well as other personal data, as detailed below:

For the registration of the cards in Google Pay/Apple Pay it will be necessary to process, where applicable, personal data concerning: the type of card (credit/debit), the card number, the expiry date of the card, the name of the cardholder as shown on the card, the CVV code, the postal address.
For the verification/validation of the identity of the persons authorised to request the registration of BT cards in Google Pay/Apple Pay in the event of activation through the Call Center, during the call to the BT Contact Center service we will request the identity data that you have declared to the Bank and/or, where applicable, the data relating to transactions or BT products/services that you use, in order to make sure that you are the person authorised to request the registration of a particular BT card in Google Pay/Apple Pay.
In order to contact you in relation to the BT cards registered in Google Pay/Apple Pay, we will use the contact details that you have declared to BT Italia within the ongoing contractual relationship.
In order to be able to make payments with the BT cards in Google Pay/Apple Pay, your identification and contact data, the details of the payment cards and of the associated accounts, as well as the details of the transactions (including amounts, other details, date, etc.) must be disclosed by BT to Google, the provider of the Google Pay solution, and to Apple, the provider of the Apple Pay solution, respectively.

The processing of your personal data by Google, where they are used for payment with the BT cards in Google Pay, is also subject to the Google Pay privacy policy, which we invite you to read here: https://policies.google.com/privacy

The processing of your personal data by Apple, where they are used for payment with the BT cards in Apple Pay, is subject to the Apple privacy policy, which we invite you to read here: 🔗 https://www.apple.com/legal/privacy/data/en/apple-pay/

Banca Transilvania assumes no responsibility for the manner in which Apple or Google decide to process the personal data of holders of BT cards registered in Google Pay/Apple Pay.

For "Pay With BT Pay" users who choose "BT Pay" as the payment method on the merchant's website, it will be possible to authorise the transaction using the BT PAY application, by selecting the card with which the transaction is to be carried out and confirming it.

2. Transfers made on the basis of the telephone number or IBAN

With BT Pay you can make transfers in EURO and LEI between a payment card issued by BT and any other BT card in the application, or send or request money to/from persons in your contact list, as well as to/from any other BT Pay user, provided that the amount of the transfer is accepted on a BT card or that you can choose a main/preferred card for collection. In order to make such transfers (referred to as "P2P transfers") to users of the app in your phone address book, BT Pay will ask you for access to the contact list of the phone. If you choose not to grant such access, or if you do not have the telephone number of the BT Pay user in your address book, you will have to enter this number manually. If you choose a preferred card for the collection of P2P transfers, we will use the data of the card chosen for collection and we will send you a collection notification.

In order to facilitate P2P transfers by telephone number, at the moment such a transfer is initiated the BT Pay application will show whether the BT Pay app is installed on the selected telephone number (whether or not it belongs to a person in the contact list). Therefore, if the telephone number on which the BT Pay app is installed is selected or entered by another BT Pay user in order to make a P2P transfer, that user will be informed that the BT Pay app is installed on that telephone number.

In addition, with BT Pay it will be possible to initiate transfers from BT cards by IBAN code.

In the case of bank transfers, the data relating to the transaction (amount, description, date, etc.) will also be processed, as well as those of the recipient of the funds transfer, that is to say the person to whom the amount was sent (first name, surname, IBAN of the account to or from which the transfer is made).

You will be able to send the proof of the entry of the bank transfer order to an e-mail address entered in a dedicated field, which we will retain in order to demonstrate that we sent the proof of the transfer in accordance with your request.

3. Setting transaction limits and/or blocking cards

Through BT Pay it is possible to set transaction limits on the BT cards registered in the application, to block these cards temporarily or permanently and to request the unblocking of temporarily blocked cards.

Access to these settings is permitted only after validation of the user's right to access them. To this end, for each card concerned, the use of these functionalities will be available (both for the card in digital and in physical format) only after confirmation of the SMS-OTP sent to the telephone number declared to BT Italia.

4. Viewing the card details in the app

Through the BT Pay app it will be possible to view and copy the card data, such as the card number and the CVV code (the 3-digit code on the back of the card), in order to facilitate its use for online payments.

In certain cases, access to this functionality is permitted only after validation of the user's right to use it. To this end, for each card concerned, an SMS-OTP will be sent to the telephone number declared to BT Italia. By entering the code received by SMS on this telephone number, it will be possible to obtain this information for the specific card until the moment at which it is deleted from the BT Pay app.5. Authorisation/confirmation of the transfers made with BT Pay

Online transactions (payments made on merchants' websites) initiated with the BT cards registered in BT Pay and in 3D Secure may be authorised or refused exclusively through the application.

The notification concerning the authorisation/refusal of an online payment will be sent through the "general" channel in the app. Disabling the notifications sent through the "general" channel will prevent the receipt of the notification for the authorisation/refusal of the online payment.

In the case of devices with an Android operating system, with the user's permission, it will be possible to display the payment confirmation screen automatically, without having to access the notification or the application manually. The user will be able to confirm or cancel the payment using the authentication method. This permission will be requested after the first confirmation of an online payment, or it may be configured in the advanced settings of the phone – applications section – BT Pay application.

In the payment authorisation/refusal message, the following information will be displayed to the user: the card from which the transaction was initiated (the image of the card and the last 4 digits of the card, as they also appear in the app), the name of the merchant to whom the payment is to be made, the amount of the transaction, the maximum time required for the authorisation of the transaction and the status of the authorisation of the transaction.

Upon receipt of the message relating to the online payment initiated, BT Pay will save the transaction identifier on the telephone device, so that the message can be displayed the next time BT PAY is opened, for its authorisation/refusal. The transaction identifier will remain stored on the phone used until the online payment is authorised or refused, as the case may be.

6. The “add money” option

When you use this functionality, we process personal data as follows: the amounts that you transfer to the account associated with the BT card and the frequency with which you make the transfers, the data of the cards involved in the recurring transfer and the banking institution from which you transfer the amounts.

7. The option "Card saved with merchants"
When you use this option, we process personal data as follows: identification data (name, e-mail address), card data, information on active subscriptions, details of the recurring payments (amount, frequency, date) and the websites where the card data have been saved.

In the case of access to the "Accounts" functionality, Banca Transilvania will process, where necessary, the following information/personal data relating to you: the IBANs associated with the accounts added, the cards linked to each account, the transaction history, the currency of the accounts, the balance, the recurring payments and the predefined beneficiaries set up in BT Pay.

In the case of transfers, the data relating to the transaction (amount, explanations, date, etc.) will also be processed, as well as those of the recipient of the transfer to whom you have sent a sum of money. In the case of exchanges and payments in foreign currency, the currencies between which you carry out the exchange and the exchange rate, as well as the currency in which you make the payment, will also be processed, where necessary.

You will be able to send the proof of the sending of the transfer to an e-mail address entered in a dedicated field, which we will retain in order to demonstrate that we sent the proof of payment as requested.

In this section, when you access the account statements functionality, BT will process, where necessary, the following information/personal data relating to you: data relating to the transactions, the IBAN of the account, the balance of the accounts, the transactions, the instalments on credit products and the points available in the case of the accounts of credit cards held with BT.

III. „Savings” functionality

Savings account and deposits in EURO through BT Pay

The Bank will process - where necessary - the following information/personal data relating to you: the IBAN of the current account from which the deposit is constituted, the balance of the current account, the IBAN of the deposit account or - where applicable - of the savings account constituted, the amount of the deposit, the start and end date of the deposit, the date chosen for the recurring transfers set for the savings accounts.

For identification through BT Pay during a call to the call centre

If you choose to be identified through BT Pay during a call to the BT call centre or in specific situations, we will process the information/personal data indicating that you are a BT client who is a natural person and a user of the Application, the telephone number on which you have installed BT Pay, the activation of the authentication method (application PIN, biometrics), the data relating to the version of the application installed.

For communication with BT Pay users

The application will send a series of notifications (for example, confirmation/refusal of the payments made through the cards registered in the application; for identification through BT Pay; for transfers, relating to the acceptance of the transfers by the beneficiary/payer, to the success of the transaction, to the refusal of the transaction by the payer; for the authentication/rejection of the online payments made with the BT cards registered in the application and in 3DSecure; general notifications, by which the user is informed of other relevant information relating to the BT Pay application, other than that relating to the functionalities referred to above; notifications of particular interest, by which the user is informed of important aspects relating to his or her contractual relationship with the Bank, such as changes to the fees, changes to the General privacy notice on the processing and protection of the personal data of clients of Banca Transilvania – Italy Branch; notifications on the need to update the data in the records of the Bank, notifications for identification through BT Pay, following the call to the BT call centre or, where applicable, for certain types of requests/transactions through the Call Center; notifications on offers, informing the user of the new offers added to the list of offers in the application).

You can disable all or some of these notifications from the Settings menu of the application. If you do not have the notifications set to "on", you will not receive push notifications, but you will find them in the Notifications section of the application.

By accessing the "offers" section in the application, you give your consent for BT to collect information relating to the offers that you have accessed (saved, activated or applied for), in order to present other offers that may be of interest to you in the future and in order to apply preferential conditions for the offers activated or applied for.

3. To view the categories of expenditure grouped according to the category of the merchants

Through the application you can view the expenditure made with the BT cards at merchants, broken down by categories of expenditure, shown according to the category to which the merchants at which you made the payments with the respective card belong. The breakdown of the expenditure does not involve the analysis or the assessment of your payment behaviour.

4. To analyse and improve the performance of BT Pay

In order to draw up statistics that make it possible to measure the performance of the BT Pay services with a view to improving the performance of the application, we have a legitimate interest in collecting the following information about the devices on which it is installed: the identification of the phone (Device ID), the type of phone, the operating system, the version of the operating system, the name of the device, the settings of the device, and the permissions necessary in order to have an Internet connection.

Retention period of the data provided/collected through BT Pay

Save in the cases expressly indicated in this notice, the data provided by the clients of BT Italia, as well as the data relating to the transactions carried out through BT Pay, will be retained for a period of 10 years from the termination of the business relationship with BT Italia, in accordance with the applicable legislation.

Recipients of the personal data processed through BT Pay

The data provided directly by the users of the application, or of which the Bank may become aware on the occasion of the installation, registration, activation/use of the application by the users, may be disclosed by Banca Transilvania to the service providers that assist us in providing the application and to Apple (Apple Pay solution), where you have chosen to register your card on BT Pay. In accordance with what is indicated in this notice, certain information will implicitly be shared with other BT Pay users.

Third-party links and software applications

The application contains links to the websites belonging to our merchant partners. In addition, the application offers users the possibility to access:

In the Offers section, links personalised by the partner merchants, access to which will let those third parties know that the person visited them through BT Pay, thereby implying that this is a BT client.

The Bank does not manage or control in any way the information that the owners of the websites of the partner merchants or the providers of third-party applications process in relation to users, and therefore cannot guarantee that such information is processed and/or protected in accordance with the legal provisions applicable to the processing and protection of personal data, such as, but not limited to, the General Data Protection Regulation (GDPR). In addition, the Bank cannot know and/or guarantee how up to date or how accurate the information that these websites/applications hold about you is.

Rights relating to the processing of personal data in BT Pay

The processing of your personal data within BT Pay is governed, in addition to this notice, by the provisions of the General privacy notice on the processing and protection of the personal data of BT Italia clients.

In the General privacy notice referred to above you will also find the rights that you can exercise in relation to the processing of your personal data, the ways in which you can exercise them, as well as the contact details of the data protection officer (DPO) and how you can contact him or her.