Version applicable as of 04.03.2025
BANCA TRANSILVANIA – Italy Branch (hereinafter "the Bank", "BT Italia", "we") a credit institution, a Romanian legal entity, whose identification and contact details are set out in section III - General privacy notice on the processing and protection of the personal data of the clients of Banca Transilvania – Italy Branch (hereinafter the "general privacy notice") - which is provided to you in the flow for opening the business relationship with the Bank via BT Pay, being part of the set of contractual documents - offers natural persons of full age, resident in Italy, who do not have a current account opened with the Bank, the possibility of applying exclusively online, through the BT Pay mobile application, for the opening of a business relationship with the Bank ("current account"), for the contracting of certain products/services through which transactions may be carried out on this account ("transactional products"), as well as of expressing their options in relation to the processing of their personal data for advertising purposes and for market research during the business relationship ("marketing and market research options").
This process is dedicated exclusively to natural persons resident in Italy, of full age (at least 18 years old), with tax residence in Italy and who do not already have a current account opened with BT in their name.
Natural persons who already have a current account opened with BT Italia must follow the registration/authentication process in BT Pay. If, even though you already have a current account with BT Italia, you start the process for persons who do not have a business relationship with us, following the checks described in section A, we will identify you as a client who already has a current account and you will be directed in the app towards the process dedicated to current account holders who wish to register in BT Pay.
If you start the application process for the opening of a current account via BT Pay, we process various types of personal data, on our own, as sole data controller or, where necessary, together with other controllers associated with us, as we inform you through this specific privacy notice. You are the data subject of this processing.
In the general privacy notice indicated above, you will also find information on the rights you have in relation to the processing of your personal data, on the ways in which you can exercise these rights or on how you can contact the data protection officer appointed by BT (BT DPO).
Persons for whom a current account is opened following the application via BT Pay become BT clients, natural persons holding an account, and users of the BT Pay application. After the opening of the current account, when you access/use the BT Pay application, your personal data are processed as indicated in the Privacy notice on the processing by Banca Transilvania of the personal data of BT Italia clients within the BT PAY mobile application, as well as in the Google Pay and Apple Pay applications.
The personal data processing operations carried out while you proceed in BT Pay for the opening of the business relationship with BT Italia are based on the following grounds:
If you do not agree to the processing of biometric data, you will not be able to open the current account via BT Pay. In this case, you can become a BT client holding a current account by going to the BT Italia branch, without such sensitive data being processed. Moreover, when the law obliges us to carry out certain processing of personal data or when it is necessary for the conclusion of the contracts, if you refuse their processing, BT Italia will not be able to open the current account for you or to allow you to contract the transactional products available via BT Pay. On the other hand, if you do not wish to express your marketing or market research options, if you refuse to receive such messages or to be contacted for the purpose of offering support in BT Pay in order to complete the process, there are no consequences and you can continue/complete the process of opening the business relationship.
A. Personal data processed for identity verification
The legislation in the field of the prevention of money laundering obliges us to verify the identity of the persons who apply to open a current account (to establish a business relationship with the Bank) and to contract products/services. We also have a legitimate interest in making sure that we prevent attempts at fraud through identity theft, especially in the online environment, and in allowing only persons who meet the application requirements to proceed.
For this reason, we use a remote identification process by video means, compliant with the legislation applicable in this field, which involves the processing of the personal data present on your identity document and your contact details, as well as the biometric data of your face. We will not process your biometric data without your explicit consent. If you wish to express this agreement, please tick the box next to the text "I agree to the processing of biometric data" on the dedicated BT Pay screen. In the event that you do not agree to this processing, you can ask the BT Italia Branch to open the current account, where such special data will not be processed. Before freely deciding whether you wish to express your explicit consent for the processing of biometric data, here is how we will proceed with the remote identification in BT Pay:
1.You photograph your identity card or the electronic identity card issued by the Romanian or Italian authorities ("identity document"), front and back (requires access to the camera) - we process your identification data contained in it through optical character recognition (a process that allows the automatic extraction of letters and numbers from the photographed document). At this moment, we verify the date of birth and the type of identity document you have photographed, in order to make sure that you meet the conditions for proceeding in the BT Pay process.
2.You move in front of the camera (requires access to the camera) - we use your moving image in order to make sure that you are a real person. In addition, we automatically compare features of your face from the selfie with the facial features present in the photographed identity document. The comparison is to be carried out biometrically, based on criteria such as: the colour, size and slant of the eyes, the position of and distance between the main elements of the face such as eyes, eyebrows, lips and nose. At the end of the comparison, the software solution will issue a result (accepted or rejected, as the case may be), indicating the probability that the face in the two images belongs to the same person. The data used for and the results of the comparison are biometric data, which identify you uniquely. If the score issued by the facial recognition tool is unsatisfactory, you will be able to repeat the application process at the BT Italia Branch.
3. If the result issued following the biometric comparison of the face is satisfactory, we will automatically extract the data from the photographed identity document (through optical character recognition) and we will use them to complete the application for the opening of the business relationship with the Bank and for the contracting of the transactional products.
4.We will also ask you for your contact details - telephone number and email address - which we will verify in order to make sure that they belong to you, since it is very important that they be correct and up to date. In addition, we will need you to declare the tax code issued in Italy, the country in which you must have your tax residence. In the event that you use an identity document issued in Romania, you will have to photograph and upload your employment contract in Italy, together with the document showing your Italian tax code.
If you successfully complete the opening of the current account, the contact details will be used:
The remote identification process by video means described above can be carried out only with your consent. By ticking the corresponding box next to the text "I agree to remote identification by video means" you express your explicit consent to proceed with the remote identification process for the purposes of applying the customer due diligence measures for the opening of the business relationship with Banca Transilvania – Italy Branch, as well as your consent to the taking of photographs and/or the capture of images of you and of your identity document.
The personal data mentioned in points 1-4, used for identification, we also process in order to allow you to carry out the initial setting of the security code (PIN) in the application.
We do not take the decision to open the business relationship with BT Italia on the basis of a fully automated processing of your personal data; instead, your application will be analysed by the Bank's employees (human intervention), who will decide on the approval or the refusal of the opening of the business relationship with BT Italia.
The personal data collected will be retained for 30 days if you do not complete the application for the opening of the current account started in BT Pay by applying the qualified electronic signature. In the event that you have signed the application for the opening of the current account via BT Pay and then have given up on the opening of the account or the opening of the account has been refused, as well as in the event that you have become a BT client holding an account following this process, the data retention periods indicated in the general privacy notice apply.
For identification in BT Pay, BT uses the services of Onfido and of some of its sub-processors. They process, only on behalf of and under the instructions of the Bank, the data of your identity document, your image (from the selfie/video taken in BT Pay) and the biometric data of your face, used for identification in BT Pay.
Some of these service providers are located in third countries for which the European Commission has recognised that an adequate level of protection of personal data exists (the United Kingdom), while others are located in third countries for which no such adequacy decision has been issued.
For this latter category of recipients, we have made sure that the transfer of the data takes place on the basis of appropriate safeguards, in accordance with the mechanisms and provisions of the GDPR, consisting of Standard Contractual Clauses approved by the European Commission, which you can find here: https://eur-lex.europa.eu/legal-content/IT/TXT/PDF/?uri=CELEX:32021D0915B. Personal data processed for the purposes of customer due diligence for the prevention of money laundering and terrorist financing, as well as for the conclusion and performance of the current account contracts and for the transactional products.
For the prevention of money laundering and terrorist financing, the Bank applies customer due diligence measures to all persons who wish to open a current account. For the purposes of applying these measures, the Bank has the legal obligation to collect, update during the business relationship and retain (including after the termination of the business relationship) at least the following categories of personal data on the person who applies for the opening of the current account: first name, surname, pseudonym, date and place of birth, sex, information contained in the identity card, personal numeric code assigned by the Romanian authorities or another similar unique identification element (e.g. Italian tax code), citizenship, domicile, residence, correspondence address, country of tax residence, telephone number, email address, occupation, name of the employer or nature of the self-employed activity, information relating to the activity carried out, country in which the main activity is carried out, purpose and nature of the business relationship with the Bank, gross annual income, origin of the funds that will be used in the business relationship, estimated level of daily transactions, average value of the transactions, frequency of the transactions, destination of the transactions (EU/non-EU countries), inclusion in/exclusion from the category of politically exposed persons (PEP), origin of the assets and important public function held (only in the case of PEPs), as well as the details and the copy of the identity document and, where applicable, of the document relating to the Italian tax code and of the employment contract.
The data indicated, together with all the records obtained through the application of the customer due diligence measures imposed by the legislation - such as the monitoring and the checks carried out by the Bank, the supporting documents and the records of the transactions, including the results of any analysis carried out in relation to you, as a client, determine your risk profile and will be retained for a period of 10 years after the termination of the business relationship with the Bank. Upon the expiry of the retention period provided for by this legislation, the Bank will delete or anonymise these data, except in the cases in which other legal provisions require their further retention.
In addition, the Bank will assign you identifiers such as, but not limited to: client code (BT CIF), IBAN codes relating to the accounts opened with the Bank, numbers relating to the bank cards, on the basis of which you will be able to be identified in the Bank's systems.
In the situations in which it is mandatory or necessary, your personal data, in your capacity as a client, will be disclosed/transferred to various categories of recipients (e.g. to the national bank of Italy - Banca D'Italia), including entities that are part of the BT Financial Group, for legitimate purposes and under conditions that ensure their security. For all the details relating to the processing of the data of BT Italia clients, we invite you to read in full the General privacy notice on the processing and protection of the personal data of the clients of Banca Transilvania – Italy Branch, which this specific privacy notice supplements.C. For the collection of the preferences relating to the processing of personal data for advertising purposes (marketing messages), for the purpose of assessing and improving the services offered (market research), regarding telephone contact in order to provide support and for the sending of push notifications in BT Pay.
Collection of the marketing and market research options
The Bank has a legitimate interest in collecting the preferences of the persons who wish to open a current account regarding the processing of their personal data for marketing purposes and for market research. You are not obliged to express this preference. However, if you decide to express it, you can choose to allow us to process your data for advertising purposes and for market research or to refuse. Only if you give your consent will we send marketing and market research messages.
Before freely deciding whether you wish to receive such messages, please consider the following: The expression of consent to the processing of your data for the purposes of receiving advertising and market research messages is optional. The refusal to give this consent will not affect your right to become a client of BT Italia.
The personal data commonly processed in order to send clients advertising and market research messages include: first name, surname, telephone number, email address and correspondence address declared to the Bank for the business relationship with BT Italia or, where applicable, for the capacity of representative/authorised person of a client of the Bank. We will send the marketing and market research messages only on the communication channels for which you express your consent to receive them.
If you choose to receive marketing and market research messages, in order to make sure that they are relevant, we will also use other information that we learn about you when you use our services/products (e.g. transaction data, age, location, income bracket, etc.). We will automatically study these data (profiling) in order to form an opinion on the products/services/events that could be suitable for you, as well as on the products/services regarding which your opinion would be relevant.
In the event that you express your consent to receive advertising and market research messages, this will be valid until you withdraw/modify it or, failing that, until the termination of the business relationship/of the capacity of representative/authorised person that you have established with BT Italia.
If you wish to be contacted for advertising purposes and for the purpose of assessing the improvement of the services offered by BT Italia, for the actual transmission of the messages your data will be disclosed by BT Italia to providers acting under the instructions of Banca Transilvania S.A. – the parent company of the Banca Transilvania Financial Group. The channels that we use are the following: by telephone call, SMS, e-mail and post. You will be able to choose one or more of the channels listed above on which you wish to receive our marketing and market research messages.
Please note that the options that you choose, whatever they may be:
Considering the information presented above, in the process that you will follow in BT Pay for the opening of the current account you will have the possibility of expressing your options regarding the processing of your personal data for marketing and market research messages. You will be shown both the option of not receiving such messages (refusal) and the option of receiving marketing and market research messages (agreement). The agreement option will be divided into two categories from which you will be able to choose: products and services of BT Italia and/or Banca Transilvania S.A. and events organised by BT Italia and/or Banca Transilvania S.A.
If you had previously expressed your consent to marketing and to market research with BT Italia and you now select options that modify or withdraw the consent previously expressed, we will record your new options in our registers and we will comply with them, but we inform you that it may take up to 5 working days to ensure the removal of your data from the campaigns in progress. During this interval you might still receive marketing and market research messages in accordance with the previous options.
Moreover, if you had previously expressed your refusal to have your data processed for advertising purposes and, in the process of opening the current account in BT Pay, you express your consent, the option now expressed will be the valid one.
As regards the processing of your personal data for advertising purposes, you are guaranteed the rights provided for by the General Data Protection Regulation (GDPR).
If you choose to express your consent to receive advertising and market research messages, you can at any time subsequently withdraw/modify it and/or object to profiling for advertising purposes, in the following ways:
Collection of the option for telephone contact for the purpose of providing support in BT Pay
If at some point you interrupt the application flow for the opening of the business relationship via BTPay, we wish to offer you the support necessary to be able to resume it. At the beginning of the journey for the opening of the current account via BT Pay we will ask you whether you express your consent to being contacted for support purposes, and we will call you for this purpose only if you give us your consent.
Collection of the option for the sending of push notifications in BT Pay
Right from the beginning of the process, you will be asked whether you allow the receipt of push notifications in BT Pay. If you accept such notifications and you do not complete the application process within the time limit set after having set the PIN, we will send you notifications to remind you to resume the process. In this case, you will resume the process from where you had interrupted it. If you do not set the PIN or if you do not complete the process within the time limit set, you will have to start the process again from the beginning if you wish to open your current account via BT Pay.
D. For the conclusion of the contracts relating to the transactional products included in the subscription package that you will choose.
Depending on the type of subscription package that you will choose, we will process your personal data relating to the type of subscription package chosen and to the transactional products included in it (e.g. cards, internet banking), including for the setting of the fees applicable to the products included in the subscription package.
E. For the issuance and management of the Qualified Digital Certificate issued by Alfatrust Certification S.A. for the signing of the documentation in relation to Banca Transilvania, Rome Branch (Italy).
In order to complete the process of opening the BT current account via BT Pay, it will be necessary for you to sign, with a qualified electronic signature, the application for the opening of the contractual/business relationship and for the contracting of the transactional products included in the subscription package and, where applicable, the form with your options regarding the processing of your data for advertising purposes and for market research. The issuance and the use for signing of the digital certificate do not entail any costs for you; however, it is necessary that BT Italia and Alfatrust process together, in their capacity as joint controllers, the personal data concerning you for the issuance of this electronic signature, as we inform you below:
a. Controllers of the personal data Pursuant to Arts. 13-14 of Regulation (EU) 2016/679 - General Data Protection Regulation (“GDPR”), Alfatrust Certification S.A. (“Alfatrust”) and Banca Transilvania S.A. (“BT” or “the Bank”), with registered office in Cluj-Napoca (Romania) Calea Dorobantilor, nr. 30-36, CAP 400117, Rome Branch Via Baldo degli Ubaldi 184/B CAP 00167, entered in the register of Banks held by the Banca d'Italia cod.3437.1, tel. 06/88805262- Fax: 06/88805266; PEC: bancatransilvania@postecert.it, website: www.bancatransilvania.ro/it whose identification and contact details are indicated in the Contract for the provision of certification services for qualified digital certificates, inform you regarding the processing of your personal data, as a User (“data subject”), which is carried out in their capacity as joint controllers for the purpose mentioned in point b below.
b. Purpose and legal basis of the processing of the personal data The purpose for which the joint controllers process the User's data is the issuance and management of the Qualified Digital Certificate ("the Certificate"). BT is the controller that identifies the User, collecting from the latter the personal data necessary for the issuance of the Qualified Digital Certificate, and transmits them to Alfatrust so that this controller can issue the certificate. The data collected by BT from the Users are those processed by the Bank in its own registers, in the context of the business relationship that is established between the User and the Bank at the moment of the transmission of the data to Alfatrust. During the period of validity of the certificate, the personal data are processed by the joint controllers, as the case may be, also in the situations in which the Users request the suspension or the revocation of the certificate in the manner detailed in the Terms and Conditions for the provision of the services.
The legal bases for the processing of the personal data for the purpose defined are the legal obligation (Art. 6 paragraph 1 letter c of the GDPR), the conclusion/performance of the Contract (Art. 6 paragraph 1 letter b of the GDPR) and the legitimate interest of the joint controllers (Art. 6 paragraph 1 letter f of the GDPR).
As regards the legal obligation, both BT - in its capacity as the credit institution with which the User initiates a business relationship - and Alfatrust - in its capacity as the accredited certification service provider from which the User wishes to obtain a certificate - are subject to the legal provisions applicable in the field of the prevention of money laundering and terrorist financing, under which they must collect a series of personal data. These data are also necessary for the conclusion/performance of the Contract under which the User is allowed to use the certificate to sign the documentation in relation to BT.
In order to accommodate the Users who wish to submit a request for the suspension or the withdrawal of the certificate, the joint controllers justify a legitimate interest in offering them the possibility of transmitting these requests not only directly to Alfatrust, but also through the BT Call Center. The handling of these requests involves the exchange of the Users' personal data between the two joint controllers. The contact details - telephone number and address of domicile - will be processed by each of the joint controllers whenever it is necessary to contact the end user for the proper conduct of the contractual relationship relating to the qualified digital certificate.
c.Categories of personal data and of persons whose personal data are processed
The personal data processed in order to achieve the purpose indicated are those provided for by law as mandatory to be collected by a credit institution and by a certification service provider for the prevention of money laundering and the suppression of terrorism, namely: first name, surname, tax code (CNP), address of domicile/residence, date of validity of the identity document, telephone number and copy of the identity document. All these data, as collected by the Bank, will be made available to Alfatrust for the issuance and management of the Qualified Digital Certificate.
The processing of these personal data is necessary for the generation of the Qualified Digital Certificate. The refusal of the User to consent to the processing of these data entails the impossibility of issuing the Qualified Digital Certificate.d.Recipients of the personal data
With the exception of the joint controllers between which an exchange will take place of the personal data processed in order to achieve the purpose of the processing, the data are disclosed, as the case may be, to the employees of the joint controllers who need to know them, to the IT and audit service providers, as well as to the authorities and institutions entitled to become aware of them.
e.Period of processing of the personal data
The information relating to a Qualified Digital Certificate (including the personal data) is processed by Alfatrust for a period of 10 years from the date of the cessation of its validity, in accordance with the time limits established by law.
At the level of Banca Transilvania, the remote electronic signature, applied on the basis of the Qualified Digital Certificate issued by Alfatrust on the documentation signed in relation to BT, is retained for the entire period during which a business relationship exists between the Client User and BT, to which are added the time limits established by the applicable banking regulations, which are, as a rule, 10 years from the termination of the business relationship with the credit institution.
f.Rights of the data subjects whose personal data are processed for the purpose indicated
Each User, in their capacity as a data subject, is guaranteed the exercise of the following rights in relation to the processing of their personal data with each of the joint controllers: right of access, right to rectification, right to restriction of processing, right to erasure of the data, right to object to the processing of the data, right to data portability.
To consult the General privacy notice for BT Italia clients, please go to the website https://bancatransilvania.it/ in the "Transparency" section, and respectively to the website for the Alfatrust Privacy Policy https://alfasign.ro/Depozitar/InformazioniGDPR.pdf.
The Users can exercise these rights or contact the data protection officers for any question/request relating to the processing of personal data, in the following ways:
