Legal information
“Personal data” means any information about a natural person who is identified or identifiable by one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. Sometimes (depending on how the data is combined) personal data also includes the device’s IP address, location data, an online identifier and information collected through cookies and other similar technologies.
The Controller of personal data on the Website is My Funding Account P.S.A., Al. Wojciecha Korfantego 138A, 40-156 Katowice, Poland, KRS: 0001023771, NIP: 6343021306, REGON: 524681980.
Provider’s contact details: the e-mail address for contacting the Provider is support@mfatraders.com.
Personal data will be processed for the purposes of, and to the extent related to, the provision of services by and through the Provider. The Controller shall use its best endeavours to ensure that the personal data provided to it is protected against unauthorised access by third parties or unauthorised use, while at the same time ensuring the smooth functioning of the Website.
Scope, basis and purpose of the data processed
The Provider processes the following personal data:
Use of the Services:
• name, surname, date of birth, NIP, REGON, PESEL, bank account number, telephone number, e-mail address, address of residence / registered office;
• data necessary for Customer verification: biometric data, image, transaction history, connections with high-risk countries within the meaning of AML regulations.
Contact with the Controller: e-mail address and other data provided voluntarily in the body of the message.
The provision of personal data is voluntary, but some data is necessary in order to register on the Website and use the Services.
We process data on the following legal grounds:
• Art. 6(1)(b) GDPR – for the performance of the contract;
• Art. 6(1)(c) GDPR in connection with tax legislation and the Accounting Act – for the purpose of tax settlements, keeping accounting records and fulfilling AML obligations;
• Art. 6(1)(f) GDPR – for the purpose of establishing, pursuing and defending against claims and monitoring security on the Website;
• Art. 6(1)(a) GDPR – for the purpose of performing the Brokerage Service, providing the MFA Trader service and sharing the Customer’s data with trading partners.
As part of the Website, the Provider also requires a legal entity to indicate the person who will act on behalf of the Entrepreneur. In such a case, we process data such as: name and surname, place of work, job position and e-mail address. The legal basis for processing this data is Art. 6(1)(b) GDPR, i.e. the performance of the contract.
If your data has been provided to the Controller against your will, please contact the Controller immediately. If the User refuses to provide the necessary data, the Controller may refuse to provide the Services.
The personal data Controller is also an obliged institution within the meaning of the Act on Counteracting Money Laundering and Terrorist Financing (AML) and processes personal data to the extent indicated therein. It is mandatory for the Customer to undergo AML verification (and provide the required data). Depending on the situation, the scope of required data may increase (if any risk factors are identified).
The data stored within the Customer Section will be processed until the Account is deleted (either by the Customer or by the Controller 6 years after the last login).
Data processed for tax settlement purposes is processed for the period required by the laws obliging the Controller to keep tax records (until the expiry of the limitation period for the tax liability, unless tax laws provide otherwise) or accounting records (usually 6 years from the date of purchase).
Data processed in connection with the legitimate interest of the Controller is processed for as long as the legitimate interest pursued by the Controller exists, but no longer than the limitation period for claims against the data subject, unless legal proceedings are initiated within this period. The limitation period for claims is determined by law, in particular the Polish Civil Code.
Data processed on the basis of consent is processed until consent is withdrawn, unless, despite the withdrawal of consent, the Provider has another legal basis for processing the data.
The User may request the deletion of their data if it is no longer necessary for the performance of the concluded and executed contracts and its further storage is not justified by the Controller’s rights under the applicable legislation. A request for deletion of data also means a request for deletion of the Customer Section. Deletion of the Customer Section does not mean permanent and complete deletion of the Customer’s data – due to legal requirements, the Controller retains some of the Customer’s personal data in its resources.
With regard to data subject to AML regulations, the Controller is required to keep the data for 5 years from the first day of the year following the year in which the transactions or business relationship with the Customer ended. This period may be extended by a further 5 years at the request of the competent authority.
Profiling
The Controller may use profiling for marketing purposes, to serve Customers more efficiently, to improve the functionality of the Website and for statistical purposes. Decisions taken by the Controller on the basis of profiling do not concern the conclusion or refusal to conclude a contract or the possibility of using the services, unless the Customer consents to automated decision-making based on profiling. Consenting to automated decision-making based on profiling means that the Customer may receive a special offer, a discount, an additional service, a reminder about unfinished purchases or a reminder about deposits.
Customers subject to AML verification may be profiled and, in certain situations, decisions regarding the verification of a particular Customer may be made by automated means. However, it is possible to appeal against a decision made in this way and request verification by a human.
Rights of the data subject
The Customer has the right to:
1) access their personal data, i.e. to obtain confirmation from the Controller as to whether their personal data is being processed, and information about such processing;
2) rectification of data, if the data processed by the Controller is incorrect or incomplete;
3) request the Controller to delete the data, whereby the Controller may refuse to delete the data if it has further grounds for processing it;
4) request the Controller to restrict data processing, whereby the Controller may refuse to restrict processing if it has further grounds for processing the data;
5) data portability, i.e. the right to receive the personal data provided to the Controller and transmit it to another controller;
6) object to the processing of data based on the legitimate interest of the Controller or to the processing of data for direct marketing purposes;
7) lodge a complaint with the Polish supervisory authority or with the supervisory authority of another Member State of the European Union competent for the data subject’s place of habitual residence or work, or for the place of the alleged infringement of the GDPR. In the Republic of Poland, the supervisory authority is the President of the Personal Data Protection Office;
8) withdraw consent given in relation to data processing at any time (without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal).
To exercise their rights, the Customer should contact the Controller at the e-mail address indicated at the top of this Privacy Policy.
The Controller will respond to all requests without undue delay and no later than 30 days after receiving the request. Where a response requires a longer analysis, the Controller will inform the Customer of the extension and the reasons for the delay.
Transfer of data outside the EEA
The Controller transfers personal data outside the European Economic Area (EEA).
Recipients located outside the EEA are identified above in the “Recipients of the data” section.
The European Commission has formally confirmed that the United Kingdom of Great Britain and Northern Ireland provides an adequate level of protection of personal data.
Data is also transferred to the United States. Most of our recipients have servers in the EU; however, due to the nature of the Website’s operation, we cannot rule out that Customer data will be transferred outside the EEA. This may involve the risk of data loss, unauthorised modification, breach of confidentiality or identity theft.
The entities whose services we use operate globally and declare compliance with the GDPR and ensuring the security of personal data.
Cookie policy
The Portal does not automatically collect any information except that contained in cookies. Cookies are information stored in the form of text files, sent by a server and saved on the device of the person visiting the Portal website, e.g. on the hard drive of a computer or laptop or on the memory card of a mobile phone. Cookies usually contain the name of the website they come from, how long they are stored on the end device and a unique number.
Cookies are used to:
a) adapt the content of the Portal’s web pages to the Customer’s preferences;
b) create statistics that help us understand how Portal Customers use the websites, so that we can improve their structure and content;
c) maintain the Website Customer’s session (after logging in), so that the Customer does not have to re-enter their login and password on each sub-page of the Portal.
The Website uses two basic types of cookies: “session” cookies and “persistent” cookies. “Session” cookies are temporary files stored on the User’s end device until logging out, leaving the website or closing the software (web browser). “Persistent” cookies are stored on the Customer’s end device for the time specified in the cookie parameters or until they are deleted by the Customer.
The Website uses the following types of cookies:
a) “essential” cookies, enabling the use of services available on the Website, e.g. authentication cookies used for services that require authentication on the Website;
b) cookies used for security purposes, e.g. to detect authentication abuse on the Website;
c) “performance” cookies, enabling the collection of information on how the Website’s pages are used;
d) “functional” cookies, enabling the Website to “remember” the settings selected by the Customer and personalise the Customer’s interface, e.g. with regard to the chosen language or region of origin, font size, website appearance, etc.;
e) “advertising” cookies, enabling the delivery of advertising content more tailored to Customers’ interests.
In many cases, web browsers allow cookies to be stored on the Customer’s end device by default. Customers may change their cookie settings at any time. Detailed information on the possibilities and methods of handling cookies is available in the web browser settings. A Customer visiting the Website for the first time will be asked which cookies they would like to accept and which they do not consent to.
Restricting the use of cookies may affect some of the functionality available on the websites. Cookies placed on the Website Customer’s end device may also be used by advertisers and partners cooperating with the operator.
Changes to the Privacy Policy
The Controller reserves the right to change the content of the Privacy Policy at any time. The new content of the document will then be posted under the Privacy Policy tab on the Website, and the previously applicable content will be posted below as a downloadable document, indicating the date until which it was applicable.