Three+ Privacy Notice

1. Introduction

1.1        Three+ is an offers and rewards app brought to you by Hutchison 3G UK Limited ("Three", "us" or "we"). Our registered company number is 03885486 and our registered address is 450 Longwater Avenue, Green Park, Reading, Berkshire, RG2 6GF.

1.2        We have launched Three+ as a loyalty program to bring you a series of offers and rewards from our partners and third-party brands.

1.3        We act as the "Data Controller" of the information you provide to us or that we know about you through your use of Three+ for the purposes of data protection law.

1.4        This notice sets out in clear and plain terms how we collect, store, use, and share your information as a Three+ user.

1.5        Please feel free to contact us using the contact details below if you have any questions about this notice, or if you wish to exercise any of the rights detailed in the ‘Your Rights’ section.

2. Updates to this notice

2.1        If we change this notice, we will post the amended policy on our website and/or on the app so that you are always aware of how we collect, use and disclose your personal information.

This notice was last updated on 19 June 2023.

3. Privacy commitment

3.1        At Three, we respect your right to privacy and value you as our customer. We rely on a set of principles that underpin how we use your personal information:

·       We will keep your personal information secure and confidential.
·       We will only collect, store, use, and share personal information about you with your awareness.
·       We will provide you with the information required to control, access, and update your personal information.

3.2        For more information on the collection of personal information through your use of our network services, please visit our Privacy Portal.

4. Children

4.1        You must be 18 years of age or older to register for Three+. We do not knowingly collect personal information of individuals under the age of 18. If you have any questions regarding this, please contact us using the details in the ‘Contact us’ section.

5. Use of Your Personal Information

5.1        As part of the Three+ program, your personal information may be used by us, our employees, our service providers, and disclosed to third parties in the ways and for the purposes described below.

5.2        There are various reasons why your personal data may be processed as part of your membership of Three+. We identify below the type of personal data that may be relevant to you, how it might be processed and on what lawful basis.  In some instances, we shall specifically ask for your consent.  Where we rely on the lawful basis of legitimate interests, we assess our business interests to make sure that these do not override your rights. Additionally, in some cases you have the right to object to this processing. For more information visit the Your rights section of this notice.

REASONS

5.2.1     Your interests

Purpose for data processing:  When you join Three+, we’ll create a unique profile of you and your interests. We create this profile to bring you a better digital customer experience, including intelligent and personalised offers, rewards, and discounts from the partners that we work with. We collect personal information directly from you when you register for Three+ as well as other information that we hold about your Three account. This will include the details you provide us when you register, including your name, email address, and telephone number. Once you have registered, you have the option to complete your profile and provide us with additional personal data; this will include your date of birth, and county.

Legal Basis: The processing is carried out with your consent or for our legitimate business interests

5.2.2     Emails & SMS

Purpose for data processing: We send you emails and SMS messages for two purposes:

a)    To send you important service-related messages about Three+ (e.g. to notify you of updates to our terms or policies etc.). We call these “service messages”.

b)   Three+ is all about bringing you great offers, rewards, and content, often from third parties. We will send you emails, SMS and/or push notifications to keep you up-to-date on the latest and best offers, rewards and content available on Three+. We call these “marketing messages”.

Legal Basis:  For service messages, we rely on our legitimate interests.

For marketing messages, we rely on consent, which you can withdraw at any time by accessing your ‘Settings’ in Three+.

5.2.3     Queries & requests

Purpose for data processing: We will use your personal information to respond to your queries, requests, and complaints.

Legal Basis:  Our legitimate interests.

5.2.4     Fraud detection

Purpose for data processing:  We verify your identity to detect, monitor, and prevent your account and our business from fraud and other illegal activities.

Legal Basis:  Our legitimate interests.

5.2.5  Improving user experience

Purpose for data processing:  We will collect personal information about you when you use Three+. This will include details of your interaction with the Three+ service, e.g., information on the offers and content you view, save, use, or otherwise interact with. We will also use this information to manage and provide the service including identifying and monitoring any errors or issues in the user experience.

Legal Basis:  Our legitimate interests. We have a legitimate interest to better understand your appreciation and expectation of our Three+ program, so that we can serve your evolving needs, as well as optimise the service.

5.2.6     Enforcement

Purpose of data processing:  To enforce the Terms of Use and Privacy Notice from time to time.

Legal Basis:  Our legitimate interests.

5.2.7     Delivery of service

Purpose of data processing:  To maintain, develop, improve, operate, and deliver the Three+ app and services.

Legal Basis:  Our legitimate interests.

5.2.8     Prize Draws

Purpose of data processing:  We will share the name and email address of the winners of our prize draws with our third party fulfilment partner, Promoveritas Limited, for the purposes of winner management and prize fulfilment by them to you.  If you do not wish your data to be used in this way, please do not enter our prize draws.  Further information on how prize draws are run can be found at: three.co.uk/terms-conditions/threeplus-prizedraws.

Legal Basis:  Performance of a contract: when you enter the prize draw, winners will be picked at random from all eligible entrants.  Your contact details will only be shared if you are selected as a winner.  Promoveritas Ltd will email selected winners and invite them to claim their prize.  Promoveritas will fulfil the prize to those who have accepted it.

5.2.9     Personalised advertisements on Meta platforms

Purpose of data processing:  In order to tailor the Three+ ads you see on Meta platforms (such as Facebook and Instagram), you will be asked if Three+ can access your unique device ID.  If you consent, we will share this with Meta so that your journey may be followed from clicking on a Three+ ad in a Meta platform to final redemption of the relevant offer.  This will help us to work with Meta to make the Three+ offers you see advertised on Meta platforms more relevant to you.

Legal Basis:  We rely on your consent.  You will be asked for consent via a pop up when you first interact with a Three+ ad on a Meta platform.  If you are an iOS user, you will only be asked the first time you do this and may withdraw your consent any time from your device by going to Settings/Privacy/Tracking and toggling off.  For Android users, you will be asked for consent each time you interact with an advert as the consent will only apply to that particular journey.

6. Managing Your Three+ consent preferences

6.1        Where our use of your personal information is based on your consent, you can easily withdraw your consent at any time, either within the ‘Settings’ page of the app, or by following the unsubscribe instructions in an email or an SMS, or in respect of following your customer journey from Meta, by accessing Settings/Privacy/Tracking in your device and toggling off.

7. Third parties

7.1        We occasionally share your personal information with our trusted partners and/or service providers who help us to maintain, operate, and improve Three+. We maintain control over your information and, where applicable, we will ensure that each partner and/or support team has implemented appropriate technical and organisational measures to protect your personal information.

 We ensure that they:

7.1.1     Act only on our instructions.
7.1.2     Use your personal information solely for clearly specified purposes.
7.1.3     Keep your personal information confidential and secure.
7.1.4     Delete your personal information once it is no longer required for the relevant purpose.

8. Partner organisations

8.1        Our partners may provide us with information on vouchers and offers that you redeem. We use this information to understand what vouchers and/or offers are popular with our customers and what rewards have been redeemed.

8.2        You may have to share your personal data directly with a Partner to redeem a reward (e.g. during checkout on their website). This will be in accordance with their applicable privacy notice. We are not responsible for the data that you provided to a partner directly. These organisations will be responsible for their own compliance with applicable data protection laws.

9. Transfers of your personal information

9.1        Third Countries: Your personal information will be processed and held primarily on servers located in the United Kingdom (UK) or within the European Economic Area (EEA).

9.2        However, we may transfer your personal information to service providers for processing in countries outside the UK or the EEA. If we do this, we ensure that we have implemented appropriate safeguards and security measures to ensure that your personal information receives the same protection as if it were being processed in the UK or the EEA.

10. How long we keep your information

10.1      We process your personal information for no longer than is necessary for the purpose(s) for which it was collected.  Please note that if you decide to deregister from the Three+ program, we will retain the personal information that has been collected from your use of Three+ for a period of 24 months.

11. Your rights

11.1      You have certain rights in relation to the personal information we hold about you. If you wish to exercise any of these rights, please contact us using the details in the ‘Contact us’ section below.

Please note that these rights do not apply in all circumstances.

a) Right of access: you have the right to access a copy of your personal information we hold about you.

b) Right to rectification: you have the right to correct personal information we hold about you if it is inaccurate, incomplete, or out of date. Please note that you can update your personal details within the ‘Settings’ page of the Three+ app.

c) Right to erasure: you have the right to request erasure of your personal information you have given to us.

d) Right to restriction: you have the right to request that our use of your personal information be restricted.

e) Right to portability: you have the right to request a copy of the personal information you have given to us, which we will send in a commonly used, and machine-readable format e.g., CSV file.

f) Right to object: you have the right to object to your personal information being processed on the basis of legitimate interests (see section entitled ‘Use of your personal information’).

g) Rights regarding automated decision making: you have the right not to be subject to a decision based solely on automated processing.

12. Contact Information

12.1      Contact us

If you have any questions about how Your Personal Information is kept or if you wish to exercise any of Your Rights in regards to personal information we keep on you, please contact our Data Protection Team at DPA.Officer@three.co.uk or write to us at:

FAO Data Protection Officer,
Hutchison 3G UK Limited,
450 Longwater Avenue,
Green Park, Reading,
Berkshire, RG2 6GF.

12.2      How to contact the regulator

You have the right to report any concern in relation to our information rights practices to the Information Commissioner’s Office. To learn more, please visit https://ico.org.uk/concerns, or call their helpline on 0303 123 1113.