Norfolk Southern Corp

1. The data controller of your personal data is OANDA TMS Brokers S.A. with its seat in Warsaw, ul. Złota 59, 00-120 Warsaw, NIP 526-275-91-31, for which the District Court for the capital city of Warsaw  in Warsaw, XII Commercial Department of the National Court Register maintains registration files under the number KRS 204776, share capital PLN 3 537 560 (paid in full). The Data Protection Officer appointed by the data controller can be contacted by an e-mail: odo@tms.pl or by telephone No.: +48 22 27 66 200.

2. Your personal data will be processed in order to conclude and execute the agreement of information and educational service. Your personal data will also be processed in order to implement the legitimate interests of the data controller, such as making necessary settlements and pursuing claims arising from the concluded agreement, security, anti-fraud or direct marketing of the data controller.

Data processing for purposes other than the above may take place: (i) based on obtaining additional consent, (ii) on the basis of applicable law, or (iii) when it is consistent with the purpose for which the personal data was originally collected (art. 6 par. 4 of EP and Council Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: "GDPR").

3. The legal basis for the processing of your personal data is:

1. to the extent that data processing is necessary for the implementation of the agreement of information and educational service - art. 6 par. 1 letter b of GDPR;
2. to the extent that data processing is necessary to achieve the objectives arising from the legitimate interests of the data controller, such as making the necessary settlements and pursuing claims under the concluded agreement of information and educational service, security, anti-fraud or direct marketing of the data controller - art. 6 par. 1 letter f of GDPR.

4. You have the right to access your personal data, the right to rectify it, delete it, and the right to limit data processing. To the extent that the processing is necessary for the implementation of the agreement of information and educational service to which you are party or to take action on your request prior to its conclusion (Article 6 (1) (b) of the GDPR) you also have the right to transfer data. If you believe that your data is being processed contrary to legal requirements, you can file a complaint with the competent supervisory authority with the President of the Office for Personal Data Protection in Poland.

5. Providing data is voluntary, but necessary for the conclusion of the agreement of information and educational service.

6. Your personal data can be transferred to the following categories of entities: companies from the capital group to which the data controller belongs, couriers, postal operators, supervisory authorities, financial information authorities, entities managing investment funds, suppliers of tools, software and platforms for sending commercial information by means of electronic communication, legal counsels and entities providing servers and storing data.

7. In the case of transferring personal data to third countries, i.e. to recipients established outside the European Economic Area or Switzerland, in countries that according to the European Commission do not provide sufficient data protection (third countries that do not provide an adequate level of protection), the data controller transfers them using mechanisms in accordance with applicable law, which include, among others EU “Standard Contractual Clauses".

8. Your personal data will be stored for the duration of the agreement of information and educational service, as well as after its termination, until the limitation period for claims arising from legal provisions. To the extent that the data processing is based on the legitimate interest of the data controller, the data will be processed for the time necessary for its implementation, but no longer than until the opposition is considered justified by your special situation, and where the legitimate interest is direct marketing of the data controller - until you express your objection.

9. To the extent that the data is processed for the purposes of direct marketing of the data controller, you have the right to object to the processing of data which does not require justification. If the processing is based on other legitimate interests of the data controller, exercising your right of objection requires justifying your special situation.

10. The data controller will not apply to you automated decision-making.