🏦 Personal Data Controller
Banca Transilvania S.A., headquartered in Cluj-Napoca, Calea Dorobanților no. 30–36, registered with the Trade Registry under no. J1993004155124, VAT no. RO5022670 (hereinafter referred to as “BT”), informs you about how it will process, as data controller, your personal data within the BT Pay mobile application (“the Application” or “BT Pay”).
Specific situations where BT is not the data controller are mentioned in this privacy notice.
BT Pay is offered to BT customers in accordance with the Terms and Conditions for using the BT Pay mobile application.
👤 Data Subjects
This privacy notice applies exclusively to the processing of personal data belonging to BT Pay users who are at least 18 years old (“adult users”).
👦 Information for minor users
Minors aged 14+, with their own BT card and account:
Minors aged at least 14 who have an account opened with BT and use BT Pay with their own card, as well as their parents/legal guardians (“parent”), are invited to consult:
- The privacy notice regarding the processing of personal data in BT Pay for minor users aged 14+ with a BT account
- The privacy notice regarding the processing of personal data for identification purposes in BT Pay
Minors with a BT card linked to the parent’s account:
Minors aged between 8 and 18 who use BT Pay with a personal card linked to a parent’s account are invited to consult:
For minors under 14 years old, it is recommended that this notice be read together with the parent/legal guardian (“parent”).📄 Specific Privacy Notices
BT Pay offers various products and services that may involve the processing of personal data for specific purposes and based on specific legal grounds. Full details are available in the following privacy notices:
- for Alias Pay → Privacy Notice regarding the processing of personal data within the Alias Pay service
- for obtaining or increasing the credit limit of a credit card → Privacy Notice regarding the processing of personal data for the exclusive online issuance of a BT credit card
- for obtaining or increasing an overdraft facility → Privacy Notice regarding the processing of personal data for the exclusive online issuance of an overdraft
- for obtaining a personal loan → Privacy Notice regarding the processing of personal data for obtaining a 100% online BT personal loan
- for the Bill Payments Service → Privacy Notice regarding the processing of personal data within the Bill Payments service
- for updating personal data via BT Pay → Privacy Notice regarding the processing of personal data for updating customer information via BT Pay
- for the SANB Service – fraud prevention in interbank transactions → Privacy Notice regarding the processing of personal data within the Beneficiary Name Display Service (SANB)
BT will periodically update this privacy notice without imposing less favorable conditions regarding data processing and protection. Any changes will be communicated within the BT Pay application, and the updated version will always be available for consultation in BT Pay and on the BT website, in the Privacy Hub.
BT Pay customers are always subject to the version of the privacy notice in force at the time of use.
If you have any questions or concerns regarding how BT processes personal data, you may contact us at dpo@btrl.ro.
🗂️ Personal Data Processed in BT Pay,🎯Purposes and ⚖️ Legal Bases of Processing
🛡️ 1. Ensuring security in BT Pay / fraud prevention
To ensure data security in BT Pay and prevent fraud, we process the following data based on legal obligations and our legitimate interest:
📱 Device data: ID, model, operating system type/version, presence of a security method (e.g., password, fingerprint – BT does not access these methods, it only verifies their existence), information regarding recent use of the device for calls (without access to their content or to dialed/received phone numbers)
📡 IP address and location based on IP
📦 Presence of potentially harmful applications (e.g., malware, remote control apps)
These data are essential for the security of the application. If not accepted, BT Pay cannot be used.
Additionally, for protecting the application and preventing fraud, we process data necessary for: PIN setup/reset/unlock, app authentication, transaction authorization, as detailed in the Privacy Notice regarding the processing of personal data for identification purposes in BT Pay.
Depending on the fraud risk, based on the processing of these data, the bank may: block the application until unsafe third-party apps are removed, block suspicious transactions, or contact the user.
🆕 2. Registering new BT customers in BT Pay (current account holders)
When initiating a business relationship via BT Pay, we use remote video identification, which involves processing identity document data, contact details, and biometric data (facial recognition), in accordance with applicable legislation.
Details are provided in the Privacy Notice regarding the processing of personal data for opening a business relationship with Banca Transilvania via BT Pay.
💳 3. Registering Existing BT Customers in BT Pay
If you already have a business relationship with BT and wish to register in BT Pay, you must undergo a strong customer authentication process, in accordance with applicable payment services legislation. For this purpose, we process personal data as detailed in the Privacy Notice regarding the processing of personal data for identification purposes in BT Pay, available in the “Specific Privacy Notices” section of this privacy notice.
For registration in BT Pay, based on the conclusion and execution of the contract related to the Application, we process the following personal data: Username (nickname); Application identifier (wallet ID); Card data (card number, expiration date, CVV/CVC code, and name on the card) for cards held with BT, BT Direct, or non-BT cards registered in BT Pay; Phone number declared with BT or BT Direct; For non-BT cards, confirmation of 3D Secure verification by the issuing institution (BT does not have access to the data used in this verification, nor does it know the method or personal data used by the card issuer)
🧭 4. Using BT Pay
To execute the contract related to BT Pay to which you are a party, to fulfill the bank’s legal obligations, based on our legitimate interest and, where applicable, your consent, we process personal data as follows:
I. “Cards” Functionality
1. Payments with card at merchants
With Android devices that have NFC enabled, you can make payments using BT cards registered in BT Pay. In this case, we process: Device data (operating system and version, NFC capability and status); Authentication data (e.g., phone unlock); Transaction details (amount, date, location); Card and account data used for the transaction
For enrolling cards in Google Pay, the application will display the option if you use Android and have BT cards not yet enrolled. In this case, BT securely transmits to Google: Card data (card number, expiration date, name); BT customer code (CIF BT); Device ID and Wallet ID
On iOS devices, NFC payments require card enrollment in Apple Pay, in accordance with Apple’s terms. BT Pay will display the quick enrollment option and process: Device data (operating system and version); Card data (PAN, expiration date, name, BIN, and card type), which are securely transmitted to Apple;
To authorize online payments with “Pay with BT Pay”, we process: Selected card data; Authorization method
2. Transfers via phone number (P2P) or IBAN
With BT Pay, you can: Send/request money to/from contacts or other BT Pay users via phone number (P2P); Make transfers based on IBAN; Transfer funds between your own cards registered in BT Pay
For P2P transfers, the app may access your phone’s contact list (only with your consent) to facilitate the transfer. If access is not granted, you will need to manually enter the recipient’s phone number.
During P2P initiation, the app will indicate whether the entered phone number is associated with a BT Pay account. Therefore, if your phone number with BT Pay installed is selected or entered by another BT Pay user for a P2P transfer, that user will learn that BT Pay is installed on that number.
To perform P2P transfers, we process: Card data (including the preferred card for receiving P2P transfers, if selected); Transaction data (amount, date, description, IBAN, name of payer/payee); Phone numbers (yours and the other BT Pay user’s);
For IBAN-based transfers, we process: Your card and account data; Transaction data (similar to P2P); Beneficiary data (name, surname, IBAN)
You may send proof of P2P or IBAN transfers to an email address.
For transfers between your own cards registered in BT Pay, we process: Card data involved in the transfer; BT account data linked to those cards; Transaction data
Within the “Cards” functionality, BT Pay also allows customers to perform other banking operations, such as: Cash withdrawals (via code or contactless); Setting transaction limits and blocking cards; Viewing card details; Authenticating online payments; Paying bills; Enrolling in Open Banking; Issuing cards (including for additional users); Transferring money to BT; Saving cards at merchants; Viewing credit limits and transaction breakdowns by merchant category (for credit cards). For each functionality, Banca Transilvania processes relevant personal data (e.g., card data, phone number, transactions).
Further details on these processing activities are provided below.
3. Cash withdrawal from BT ATM using a code
Through BT Pay, you can generate a temporary code for cash withdrawal from a BT ATM (available only for cards issued to individual customers). We process your phone number (selected from your contact list or manually entered) for sending the code, card and account data, and transaction details.
4. Contactless cash withdrawal from BT ATM
Using BT Pay, the customer can withdraw cash contactlessly from a BT ATM. This operation is only possible by entering the PIN code associated with the respective card.
5. Setting transaction limits and/or blocking cards
Through BT Pay, you can set transaction limits for BT cards registered in the application, temporarily or permanently block these cards, and request the unblocking of temporarily blocked cards. We process information about the set limits, card status, and card data, as well as the phone number declared with BT (these operations are permitted only based on an OTP code sent via SMS).
6. Displaying card details in the application
Through the BT Pay application, you can view card details – card number and CVV/CVC code – to facilitate and enable online payments, as well as the PIN code set for the card. We process these data and, where applicable, the phone number declared with BT (when display is permitted only based on an OTP code sent via SMS).
7. Authentication/confirmation of online payments via BT Pay
Online payments (payments made on merchant websites) initiated with BT cards registered in BT Pay, including 3D Secure transactions, can be authenticated or rejected exclusively through the application. We process card data and transaction details (including the merchant name and transaction identifier, which will be stored on the device you use from the moment the payment is initiated until it is authenticated or rejected, as applicable).
The notification regarding the authentication/rejection of such online payments will be sent via the “general” channel in the Application. If notifications on the “general” channel are not activated, you will not receive the authentication/rejection notification. On Android phones, with your consent, BT Pay may automatically display the payment confirmation screen without manually opening the app or the notification. Permission is requested after the first online payment or can be enabled from the phone settings, under the BT Pay app section.
8. Activation and use of the Bill Payments service
Personal data for the activation and use of this service are processed in accordance with the specific privacy notice, accessible in the “Specific Privacy Notices” section of this privacy notice.
9. Enrollment in Open Banking
To use the Open Banking functionality (available for non-BT cards added to BT Pay), BT processes the following information, which may constitute personal data: IBAN, balance of the non-BT card/account, and transaction history/data from non-BT accounts (date, amount, transaction details, counterparty involved in the transaction).
10. Issuance/reissuance of a card
Through BT Pay, you may request the issuance/reissuance of a card for yourself (including virtual cards) or for a person you designate as an additional card user. In this case, we process, as applicable, personal data of yourself and/or the additional card user: data of the issued/reissued card, IBAN of the account to which it will be linked, card delivery address, national identification number (CNP), and phone number of the additional card user. If the additional card user is not yet identified in BT Pay at the time of designation, we will also process their personal data for identification in BT Pay, as provided in the Privacy Notice regarding the processing of personal data for identification purposes in BT Pay, accessible in the “Specific Privacy Notices” section of this privacy notice.
11. “Move your money to BT” option
When using this functionality, we process personal data as follows: transaction data (amounts, transfer recurrence, bank from which the transfer is made), card and account data.
12. “Saved card at merchants” option
When using this option, we process: name, surname, email address, card data, information about active subscriptions, details of recurring payments (amount, frequency, date), and the websites where the card data were saved.
13. Credit info and expense categorization
For credit cards, you can view information about your credit line/limit, minimum payment obligation and amount paid, any insurance linked to the credit line, transactions posted in installments, accumulated Star points, activate/deactivate monthly automatic payments and their amount, and view expense categorization based on merchant categories where payments were made (this does not involve analysis or evaluation of payment behavior). We process these personal data to help you manage your financial resources (financial education purpose).
II. “Accounts” and “Savings” functionalities
To view, use, and manage current accounts, savings accounts, deposits, and associated services (such as Round Up, statements, transfers, or payments) in BT Pay, BT processes the following categories of personal data, as applicable: IBANs, balances, currencies, cards linked to accounts, transaction history, recurring payments, predefined beneficiaries, authorization relationships, transaction data (amount, description, date, exchange rate), recipient data (name, surname, IBAN, phone number), amounts and settings related to the Round Up service, data regarding the creation and management of deposits and savings accounts (amounts, start/end dates, transfer frequency), as well as information regarding interest and related taxes.
If proof of payment is sent via email, the email address entered by the user will also be processed.
III. “Loans” functionality
When accessing the “Loans” functionality, the Bank will process personal data related to non-card lending products you hold with BT (IBAN of the loan account and the current account from which the monthly installment is debited, contract number, loan account balance, contracted loan amount, start and end dates of the loan, monthly installment amount, any overdue payments, repayment schedule, loan-related insurance policies and their status).
IV. “Investments” functionality
The products in this BT Pay section are offered by the Bank’s subsidiaries (entities that are part of the BT Financial Group). In this case, Banca Transilvania processes your data as a data processor, while the subsidiary acts as the data controller. Your data from the Bank’s records, necessary for the conclusion/execution of the contract you enter into with the subsidiary, will be sent to the respective subsidiary, which will process them in accordance with its own Privacy Policy. Details are provided below:
To purchase and manage units in the funds administered by the Bank’s subsidiary – BT Asset Management SAI (BTAM) – through BT Pay, you can become an investor in the funds managed by BTAM by signing an intermediation contract with BT, and buy/sell and manage fund units (UF) in the fund of your choice. The data controller BTAM will process personal data such as: name, surname, national identification number (CNP), BTAM client ID, investment account number, transaction history, balance held in BTAM-managed investment funds, information regarding gains/losses and withheld tax at source. You will become a BTAM customer. Details about the processing of personal data by BTAM are available in the BTAM Privacy Policy, accessible on the website www.btassetmanagement.ro.
To become a participant in the voluntary pension funds administered by the Bank’s subsidiary – BT Pensii SAFPF SA (BT Pensii) – by signing the membership agreement for a voluntary pension fund administered by BT Pensii, you become a participant in that fund (BT Pensii customer). You will be able to set and manage your contribution to the fund, including express preferences regarding communication with BT Pensii. Details about the processing of personal data by BT Pensii are available in the BT Pensii Privacy Policy, accessible on the website www.btpensii.ro.
V. “Kiddo” functionality
1. BT Pay Kiddo – for minors aged 14+, with their own BT card and account
If, as a parent, you initiate the connection of a minor through this section of BT Pay Kiddo, we will verify whether you meet the conditions set out in the BT Pay Kiddo Terms. For this purpose, we will process the following personal data: name, surname, CNP, age, and your status as the minor’s parent and authorized person on their account.
2. BT Pay Kiddo – for minors with their own BT card linked to the parent’s account
If, as a parent, you initiate the connection of a minor through this section of BT Pay Kiddo, we will verify whether you meet the conditions set out in the BT Pay Kiddo Terms for minors linked to the parent’s account. For this purpose, we will process the following personal data: name, surname, CNP, age, and implicitly the personal data reflecting the relationship between you and the respective minor.
VI. Other BT Pay functionalities
1. Identification via BT Pay during calls or in BT branches
If you choose identification via BT Pay during a call with a BT call center agent or in a BT branch, we will process your personal data: your status as a BT customer and BT Pay user, phone number, authentication method (PIN, biometrics, phone unlock), and application version.
2. Beneficiary Name Display Service (SANB) for fraud prevention
We have a legal obligation and a legitimate interest to prevent banking fraud. To protect you in the case of interbank transactions (payments to accounts held at other banks), BT, together with other joint controllers, processes your personal data in accordance with the details provided in the Privacy Notice regarding the processing of personal data within the Beneficiary Name Display Service (SANB), available in the “Specific Privacy Notices” section of this privacy notice.
In the case of intrabank transactions (payments to BT accounts), BT processes the same categories of personal data independently, as used in SANB. The legal basis for processing your data is BT’s legitimate interest in preventing fraud in intrabank payments (BT-BT). Your full first name(s) and the initial of your last name registered with BT will be displayed to other BT customers who initiate a payment to your BT account from a BT application, regardless of whether the payment is completed or not.
3. Updating personal data
Through this functionality, you can update certain personal data held by the bank. Details regarding the processing of personal data are available in the specific privacy notice found in the “Specific Privacy Notices” section of this privacy notice.
4. RCA Insurance
Through the “RCA Insurance” section in BT Pay, you can obtain offers or conclude RCA insurance policies. For displaying offers, personal data are processed by Timesafe SRL and Renomia-SRBA, in accordance with their respective privacy policies, available in the application. BT processes the data as a data processor on behalf of the controller.
5. Travel Insurance
Through BT Pay, you can obtain travel insurance offers and conclude travel insurance policies from Groupama Asigurări. For this functionality, BT processes personal data as a data processor on behalf of Groupama. Details regarding the processing of personal data by Groupama are accessible directly in the application, in the “Travel Insurance” section.
6. Mobile top-up
When using this option, we process: the phone number for which the top-up is made, card data, and the account balance from which the top-up is performed.
7. Road tax vignette purchase
When purchasing or renewing a rovinieta (road tax vignette) for Romania via BT Pay, BT will process: vehicle data, card used, and available balance.
🔊 5. Communication with BT Pay users via the application
- Notifications
Through BT Pay, we send various types of notifications:
• Notifications related to card payments: confirmation/rejection of payments made with cards registered in the application, authentication/rejection of online payments initiated with BT cards enrolled in the application and in 3D Secure.
• Notifications related to transfers: acceptance/rejection of P2P transactions; confirmation of successful transaction completion.
• Notifications for identification via BT Pay: identification requests in the application (during a call with a BT call center agent or for identification via BT Pay in branches).
• Notifications for the Bill Payments service: messages dedicated to users of this service.
• General interest notifications/messages: relevant information about the BT Pay application, other than those related to the functionalities above.
• Specific interest notifications/messages: e.g., changes to the Bank’s General Business Terms, fee changes, updates to privacy notices regarding personal data processing; notifications for updating data in the Bank’s records.
• Advertising messages, if you have given BT your consent to process your data for advertising purposes via the dedicated form available in branches or online.
• Notifications about “Offers” in BT Pay: information about new offers added to the application; notifications about unlocked offers in the “Offers – Active Rewards” section. By accessing the “Offers” section in the application, you give your consent for BT to collect information about: offers accessed (saved, activated, or applied for), for the purpose of presenting relevant future offers and applying preferential conditions related to the activated or accessed offers.
🏃♀️ Active Rewards – BT Pay
To encourage an active lifestyle, BT Pay includes in the “Offers” section a subsection called “Active Rewards”, where users can unlock special offers from partners and the bank. Upon connecting a physical activity tracking app, BT Pay will request permission to access data such as: step count, distance walked, active minutes. These data are visible only to the user who connected them and are used exclusively for: verifying eligibility for offers, allocating rewards. The data are stored only for the duration necessary to fulfill these purposes.
Some offers may also include other parameters, such as card or app activity, clearly specified in each offer.
Accessing the “Active Rewards” section is optional and does not affect general use of BT Pay. If you have granted access to data from the tracking app, you can revoke it at any time from the settings of the respective app or your phone. Without access, you will not be eligible for offers in this category.
BT Pay will also request access to your device’s location, to display offers available in your area (e.g., for automatic display of Star partner offers for Star credit card holders, showing partner locations on the map). You are not required to allow location access and may manually select your city. If you deny access, other BT Pay functionalities remain fully usable.
You can enable/disable notifications from the Settings menu of the application. If notifications are not enabled (“on”), they will not be received as push notifications, but will be available in the Notifications section of the application.
b. Assistance and support via BT Pay chatbot
Through the BT Pay chatbot, you can chat in real time with a BT consultant. In this context, we process data such as: name, BT customer code (CIF), customer type, card names, application version, phone operating system, and language selected in the chat, for identification and support purposes.
📈 6. For performance analysis and improvement of BT Pay
To compile statistics that allow performance measurement of BT Pay and improve its functionality, we have a legitimate interest to collect the following information about the devices on which it is installed: device identifier (Device ID), phone type, operating system, operating system version, device name, device settings, and access permissions required for internet connectivity⏳Retention period of personal data processed in BT Pay
Except for the situations expressly mentioned in this privacy notice, your data, as a BT customer, as well as data related to transactions carried out through BT Pay, will be retained for a period of 5 years from the termination of your business relationship with the bank, in accordance with applicable legal provisions, except for data that must be retained for a period of 10 years, in accordance with financial, accounting, and tax legislation.
📤Recipients of personal data processed in BT Pay
Data provided directly by users of the application or that the Bank may become aware of in the context of installing, registering, enrolling, or using the Application may be disclosed by Banca Transilvania to certain categories of recipients, as follows:
• other BT customers who have the right and need to know (all BT Pay users are BT customers)
a. BT Pay users you have designated with operating rights on all your BT accounts, including in the application
If you have authorized individuals with sole signature rights on all BT accounts and have granted them access in the application, they will be able to view your banking data in the app (accounts, transactions, statements, identifiers, etc.). Authorized users can view accounts, perform transfers and currency exchanges, access statements and transaction history, share IBANs, configure recurring payments, and manage savings and deposits.
b. BT Pay users who have designated you with operating rights, including in BT Pay, on all their BT accounts
If other BT customers (individual account holders) have granted you sole signature rights on all their BT accounts and allowed access to them in the Application, we will disclose in the app your personal data: name, surname, and transactions you perform on their accounts.
c. Other BT customers who hold additional user cards linked to your accounts
If you have requested the issuance of additional cards on your account in the name of other card users, they may view your account balance in BT Pay.
d. Other BT customers whose account includes a supplementary card issued in your name
If you hold a supplementary card issued on another BT customer’s account, the account holder will be able to view in BT Pay details of transactions made with that card (amount, merchant, date, etc.).
e. Other BT customers who are BT Pay users and who see, via the icon displayed next to your phone number/contact in their device’s address book, that you are a BT Pay user (and implicitly a BT customer)
f. BT customers to whom you make payments via BT Pay
When you make transactions through BT Pay to accounts/phone numbers of other BT customers, the data related to those transactions (typically, your name and surname, amount, account number, payment description) will be accessible to the beneficiaries of those payments.
• Contractual partners of the bank
a. Service providers who assist us in delivering the Application and related activities (e.g., SMS/email transmission providers; trusted service providers for signing documentation in the app using advanced electronic signature, etc.); identification service providers (for identification in BT Pay involving photographing the identity document and/or face – selfie/video selfie – BT uses the services of Onfido and its subcontractors, who process, solely on behalf of and under the instructions of the bank, data from the identity document, image – including from the video selfie taken in BT Pay – and biometric facial data, used for identification in BT Pay. Data processing may, in some cases, occur in third countries. The transfer of personal data to these countries is based either on adequacy decisions issued by the European Commission (e.g., for the United Kingdom), or on other appropriate safeguards, in accordance with GDPR mechanisms, consisting of Standard Contractual Clauses (SCCs) approved by the European Commission, which you can find here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0914
b. Apple (Apple Pay solution), if you choose to enroll your card in this payment solution
c. Other entities within the BT Financial Group, whose services/products are accessible via BT Pay (e.g., fund unit distribution via BTAM, voluntary pension funds)
d. BT partners, whose services/products are accessible via BT Pay, including as described in the specific privacy notices (e.g., insurance companies)
The categories of recipients to whom personal data are disclosed in the context of registration or enrollment in/through BT Pay, as well as for the distinct services Alias Pay BT, Bill Payments, Overdraft, Credit Card and credit line increase exclusively online, 100% online personal loan, are mentioned in the specific privacy notices for personal data processing within these services.
The above list of recipients is supplemented by the one provided in the General Privacy Notice regarding the processing and protection of personal data belonging to BT customers, section VIII.
Links and third-party applications
The application contains links to websites belonging to partner merchants.
Additionally, the application allows users to access:
- third-party applications – for physical activity tracking – by logging in with the account credentials from the respective app via BT Pay, to unlock preferential offers in the Active Rewards section of BT Pay.
- through the Offers section, personalized links from partner merchants, where third parties may know that the person accessed the link via BT Pay, and thus implicitly that they are a BT customer.
🔒 Responsibility for personal data processing
The bank does not control or manage the information processed by partner merchant websites or third-party applications accessed via BT Pay. Therefore, it cannot guarantee that such data are handled in accordance with data protection legislation (e.g., GDPR, Law 506/2004, Law 190/2018). The bank also cannot verify the accuracy or currency of the data these platforms hold about you. Each site or third-party app has its own rules regarding data processing. We recommend reviewing their privacy policies to ensure they align with your interests.
✅ Rights related to the processing of personal data in BT Pay
The processing of your personal data within BT Pay is subject, in addition to this privacy notice, to the provisions of the General Privacy Notice regarding the processing and protection of personal data belonging to BT customers, which is an integral part of the BT Privacy Policy, available on the website www.bancatransilvania.ro, in the Privacy Hub section, or upon request at any BT branch.
Within the aforementioned General Privacy Notice, you will also find the rights you may exercise in relation to the processing of your personal data, the methods by which you can exercise them, as well as the contact details of the Data Protection Officer (DPO) and how to reach them.
