1. The Data Controller of your personal data is OANDA TMS Brokers S.A. with its seat in Warsaw, ul. Rondo Daszyńskiego 1, 00-843 Warsaw, NIP (tax ID): 526-275-91-31, for which the District Court for the capital city of Warsaw in Warsaw, XIII Commercial Department of the National Court Register maintains registration files under the number KRS: 0000204776, share capital PLN 3 537 560 (paid in full). The Data Protection Officer appointed by the Data Controller can be contacted by an e-mail: odo@tms.pl.
2. Your personal data will be processed in order to conclude and perform the Information and Educational Service Contract and Demo Account Contract between you and the Data Controller, including also in order to take steps at the request of the data subject prior to entering into these contracts, as well as to fulfill obligations arising from regulations regarding consent handling. Your personal data will also be processed for the purposes of the Data Controller's legitimate interests, such as the exercise of legitimate contractual claims arising out of the Demo Account Contract or Information and Educational Service Contract, security, fraud prevention or the Data Controller's direct marketing and contacting you in cases other than those specified above, where justified in particular by an inquiry received from you and the scope of the Data Controller's business activity. Your personal data may be also processed for the marketing purposes based on your consent granted to the Data Controller. Processing for purposes other than the above may be carried out: (i) on the basis of obtaining additional consent, (ii) on the basis of applicable law, or (iii) when it is compatible with the purpose for which the personal data were originally collected (Article 6 para. 4 of EP and Council Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, (hereinafter: ‘GDPR’). 
3. The legal basis for the processing of your personal data is: a. to the extent that the processing is necessary for the performance of the Information and Educational Service Contract of the Demo Account Contract and taking steps before conclusion of a contract - Article 6 para. 1 letter b of the GDPR; b. to the extent that the data processing is necessary for the Data Controller to perform legal obligations incumbent on him, in particular consisting in compliant handling - Article 6 para. 1 letter c of the GDPR; c. to the extent that the processing is necessary for the purposes arising from the legitimate interests of the Controller, such as making necessary settlements and asserting claims arising from the concluded Information and Educational Service Contract or Demo Account Contract, security, fraud prevention or direct marketing of the Dara Controller or contacting you, where justified in particular by an inquiry received from you and the scope of the Data Controller's business activity - Article 6 para. 1 letter f of the GDPR; d. to the extent that your personal data is processed of the marketing purposes of the Data Controller based on your consent - Article 6 para. 1 letter a of the GDPR. 
4. You have the right to access your personal data, the right to rectify it, delete it, and the right to limit data processing. To the extent that the processing is necessary for the implementation of the Information and Educational Service Contract or Demo Account Contract to which you are party or to take action on your request prior to their conclusion (Article 6 para. 1 letter b of the GDPR) you also have the right to transfer data. At any time, you have the right to object, on grounds relating to your particular situation, to the use of your personal data if the Data Controller processes your personal data based on its legitimate interest, e.g., in connection with the marketing of products and services. If your personal data is processed for marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling. If you object to processing for marketing purposes, we will no longer be able to process your personal data for such purposes. In cases where the processing of your personal data is based on consent, in particular granted for the marketing purposes of the Data Controller, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. If you believe that your data is being processed contrary to legal requirements, you can file a complaint with the competent supervisory authority with the President of the Office for Personal Data Protection in Poland.
5. Providing data is voluntary, but necessary for the conclusion of the Information and Educational Service Contract and Demo Account Contract. 
6. Your personal data can be transferred to the following categories of entities: banks, entities offering fast payments, companies from the capital group to which the Data Controller belongs, couriers, postal operators, supervisory authorities, financial information authorities, market data providers, fraud prevention and AML tools providers, entities managing investment funds, suppliers of tools, software and platforms for servicing transactions and financial operations performed in the course of implementing the Framework Agreement, as well as for sending commercial information by means of electronic communication, legal counsels, audit companies, consulting companies, WhatsApp application provider and entities providing servers and storing data.
7. Contact with the Controller via the WhatsApp application may be initiated by you, or by the Data Controller if it is necessary to contact you to complete the Account (live account) opening process. Consequently, your personal data may be transferred to the Data Controller (depending on your privacy settings in the WhatsApp application) in the form of your profile picture and phone number. The Data Controller may request you to provide other personal data only when it is necessary to respond to your inquiry or handle the matter to which the contact pertains. Depending on the situation, the legal basis for data processing will be the necessity of processing to take steps at the request of the data subject prior to entering into a contract or an Agreement concluded between you and the Data Controller pursuant to the Regulations of the Information and Educational Service (Art. 6 para. 1 letter b of the GDPR); and in other cases, the legitimate interest of the Data Controller (Art. 6 para. 1 letter f of the GDPR) consisting in the necessity to resolve the reported matter related to the business operations of the Data Controller (Art. 6 para. 1 letter f of the GDPR).

For security reasons, a conversation with the Data controller via the WhatsApp application may exclusively concern:

a) support during the Account opening process (explaining the steps comprising the onboarding procedure);
b) providing answers to clients' questions regarding the operations of OANDA.

A conversation with the Data controller via the WhatsApp application will never contain any links or attachments, nor will it concern, among other things:

a) the balance of your funds on the Cash Account;
b) any issues related to the execution of Transactions;
c) placing Orders or modifying them;
d) changing or updating the Client's personal data;
e) submitting instructions for the deposit or withdrawal of funds to/from the Cash Account.

8. In the case of transferring personal data to third countries, i.e to recipients established outside the European Economic Area or Switzerland, in countries that according to the European Commission do not provide sufficient data protection (third countries that do not provide an adequate level of protection), the Data Controller transfers them using mechanisms in accordance with applicable law, which include, among others EU "Standard Contractual Clauses".
9. Your personal data will be stored for the duration of the Information and Educational Service Contract or Demo Account Contract, as well as after its termination for the period of the statutory limitation period. To the extent that the processing of data is based on the legitimate interest of the Controller, the data will be processed for the time necessary for pursuing these legitimate interests (in particular, until the expiry of the limitation periods for claims under the applicable laws), but not beyond the time the objection is recognized. However, if the processing of your personal data is based on consent – until such consent is effectively withdrawn. 
10. The Controller will not use automated decision-making against you.

Date of the last update: March 4, 2026.