Information regarding the Beneficiary Name Display Service (SANB)

Information regarding the Beneficiary Name Display Service (SANB)

Revolut Bank UAB acting through its Romanian Branch (Revolut Bank UAB Vilnius Bucharest Branch - ‘Revolut’) is providing this notice to inform you about an important update regarding how your personal data is handled when you use our services, specifically concerning the Beneficiary Name Display Service (SANB) within the interbank payment system. This service is designed to facilitate interbank payments, prevent fraud among customers (individuals or legal entities) making electronic payments, and reduce erroneous transactions caused by incorrect beneficiary account entries

Joint Controllership explained

Revolut and Societatea de Transfer de Fonduri și Decontări - TRANSFOND S.A. (‘Transfond’) are "Joint Controllers" of your personal data for specific processing activities related to SANB. This means we both jointly determine the purposes and means of processing your personal data for this service, in compliance with GDPR Article 26.

What personal data is processed and how is it processed

The specific personal data processed for SANB includes your IBAN code of your account, the initial of your last name, and your full first name/s (truncated according to the SANB Scheme algorithm).

The in-scope personal data of all Revolut's customers with active accounts (‘Data Subject’’) will be transferred by Revolut to Transfond, where it will be stored and updated whenever changes occur, until the Data Subject's relationship with Revolut ceases.

The transferred personal data will be displayed to the payer in the electronic payment order when it is being completed, after the IBAN code of the account to which the payment is to be made has been entered, by the banks participating in SANB from the Transfond system, when the Data Subject is the beneficiary of the payments.

Processing purposes and legal basis

Personal data processed by Revolut and Transfond as Joint Controllers for SANB is used exclusively for the following purposes:

• Enhancing Payment Security and Preventing Fraud: SANB provides a crucial anti-fraud control measure. When you initiate a payment, you'll see a truncated version of the beneficiary's name (first name/s and last name initial for individuals, or part of the company name for legal entities) before authorizing the transaction. This helps reduce the risk of sending funds to fraudulent beneficiaries and prevents errors from incorrect IBAN entries.

The legal basis for this processing is the legitimate interest of the participating banks to provide an effective fraud prevention instrument, to comply with regulatory requirements from the National Bank of Romania (BNR) regarding the prevention of fraud and undue payments

Your rights

Regardless of the specifics in our joint controllership agreement, you can exercise your rights under the GDPR with respect to either Revolut or Transfond. These rights include:

• Right to be informed (Articles 13 and 14 GDPR).
• Right of access (Article 15 GDPR).
• Right to rectification (Article 16 GDPR).
• Right to erasure ("right to be forgotten") (Article 17 GDPR).
• Right to restriction of processing (Article 18 GDPR).
• Right to data portability (Article 20 GDPR).
• Right to object (Article 21 GDPR).
• Rights in relation to automated decision-making and profiling (Article 22 GDPR).
• Right to make a complaint to Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), the Romanian supervisory authority for data protection issues.

Both Revolut and Transfond will inform each other regarding the Data Subject's request and will mutually support each other in formulating and communicating the response.

As for Revolut, Data Subjects can submit a request to exercise their rights at any time, by email to dpo@revolut.com

Additional information

Both Revolut and Transfond are committed to implementing appropriate technical and organizational measures to ensure the security and protection of your personal data.

More information on Revolut’s data processing activities can be found in Revolut’s Customer Privacy Notice. In particular:

• Information about the storage period of the personal data is provided in Section 14 of Revolut’s Customer Privacy Notice;
• Information about the recipients of the personal data is provided in Section 11 of Revolut’s Customer Privacy Notice;
• Information about international data transfers is provided in Section 12 of Revolut’s Customer Privacy Notice.

If you have any questions about this joint controllership arrangement or how your data is processed, please don't hesitate to contact us at dpo@revolut.com