This privacy notice explains how Three Ireland (Hutchison) Limited of 28-29 Sir John Rogerson’s Quay, Dublin 2 (“Three” or “we”) uses your information in order to provide the 3Extra Service.
As a Three customer we already use your information in accordance with our ‘Three’ Privacy Notice available at www.three.ie/legal/privacy/privacy-policy. Therefore, this privacy notice explains what additional processing is done to provide the 3Extra service.
When we talk about ‘processing’ we mean anything that we might do with your personal information including storing it, transferring it, viewing it, analysing it and even deleting it.
Whenever we process your information, we must have a lawful basis on which to process it. There are six lawful bases; contract; vital interests; public interest; consent; legitimate interest and lawful obligation. This document discusses what information we process, why, what our lawful basis is, what length of time we keep it, who we disclose it to and what your privacy rights are.
|We use your:||
Email address and mobile phone number are used to send you offers from our partners and marketing information. We use your phone number to verify you are a Three customer and to send you information about the 3Extra service, for example any change in terms and conditions. We may also email you information. We do not provide our partners with your personal data.
We send you offers and marketing only where you have consented to this. We also have a legitimate interest to use your contact details to communicate certain information to you, particularly to send you important regulatory updates and changes to your terms.
|Length of time:||
We process this data for as long as you are a Three or a 3Extra customer or until you object or ‘opt-out’, whichever happens sooner.
Information used to determine what adverts and offers you might like
|What we use:||
Age and gender to determine appropriateness of advertising and as a factor in determining what adverts and offers you might like. This information is provided by you, for example when you register your details with us or where you join 3Plus. Three also looks at your type of device and preferences you chose when registering, to assess your interests.
We process this data based on our legitimate interests to send you relevant marketing and to ensure appropriateness of content.
For a maximum of your time with Three as a customer or two years thereafter.
|What we use:||
We use information about the geographic location of your mobile device (i.e. your location data) to better understand your interests. For example, information indicating your approximate geographic location while making or receiving a call can be used to indicate whether you have visited universities, music or sporting events and this information will then be used to send you deals or information related to those interests / events. Depending on how many or few masts are in your area this could be quite a general location.
Certain messages we send to you as part of the 3Extra Service therefore may be location-specific i.e. we will use your device’s real-time location in order to send you a tailored message.
We use your location for 3Extra services based on your consent. It is entirely your choice whether you allow us to process your location in the above way. You actively provide your consent by way of an ‘opt-in’ tick box at registration. If you no longer wish to consent to the processing of your location data in the above way; then please use the below opt-out or email email@example.com
|Length of time||
We process your location data for no longer than 3 months for this purpose or until you opt-out, whichever is sooner.
|What we use:||
We use data on your usage of our network, otherwise known as behavioural data, this includes information about your spending, when you make and receive communications, whether you are roaming, what kinds of public numbers you call (we don’t look at your private or ‘peer to peer’ call details for this purpose). For example, if one of our partners is a financial service provider and you phone the category of financial institutions regularly you may wish to be served with adverts or offers from that partner.
We process your behavioural data solely on your consent. It is entirely your choice whether you allow us to process your behavioural data in the above way. You actively provide your consent by way of an ‘opt-in’ tick box at registration. If you no longer wish to consent to the processing of your behavioural data; then please use the below opt-out or email firstname.lastname@example.org
|What we use||
Your use of the 3Extra service, what offers you like and how you interact with the 3Extra service.
We have a legitimate interest to analyse the effectiveness of the 3Extra service and to use that to improve the service.
|Length of time||
We use this data for as long as you use the 3Extra service.
Opting out is straightforward so please see https://www.3extra.ie/ or call Customer Care on 1913 for further details. Alternatively, the option to opt-out of marketing will be contained in each marketing message sent to you.
Who do we disclose your data to?
In order to provide the above services 3Extra sometimes needs specialist assistance from third party service providers. Where those service providers process any personal data on our behalf, we ensure that they have provided us with the necessary guarantees as to their security of processing and that they are bound to a contract regarding the processing.
Use of Data Aggregators for Targeted Advertising
In order that you are served with relevant advertising, 3Extra provides your personal data including; phone number (as identifier), gender, home county, segment, customer type, age band, handset type, preferences and whether you have roamed in past 3 months to a Data Aggregator. The Aggregator creates an audience profile using the data received which they match to your online identifier or Cookie ID. Real-time auctions take place at digital marketplaces called ad exchanges where publishers connect to exchanges through Supply Side Platforms (SSPs) and advertisers through Demand Side Platforms (DSPs). The exchanges effectively allow advertisers to bid for their creative content to be published to their target audience. The linking of a profile to your online identifier is how you are shown marketing content, when using your phone which should be relevant to you, without sending it directly to your email or phone number. Three offers you the option of opting out of this marketing by following the below opt out. Further information on controlling your privacy is set out below. Three have a legitimate interest in processing this data in order that we provide the 3Extra service to you in the most effective way. Data is retained for no longer than 30 days by the Aggregator.
You can opt out of 3Extra services by texting STOP to 50407
For information on changing your privacy settings when using Apple platforms see https://support.apple.com/en-ie/HT205223
For information on changing your privacy settings when using Google platforms see https://support.google.com/accounts/answer/6304920?co=GENIE.Platform%3DDesktop&hl=en
Alternatively check out your Browser’s settings where you can control the privacy settings.
Direct marketing campaign providers
These entities assist us by sending direct marketing messages to you.
Location based service solution providers
These entities see the traffic on our network where you have consented to your location being accessed for marketing purposes and then they trigger marketing messages to be sent by our campaign providers to people depending on what general location they are in. In effect this means you will be sent marketing which is relevant to your geolocation.
Consequences of not providing complete information
If you do not provide us with information requested that we are lawfully obliged to request, or which we need to fulfil the service, then we may not be able to provide the 3Extra service to you; for example, if you don’t give us your email we will not serve you with advertising by email. If we are not certain of your age, then we will also not serve you with certain offers that may be age specific.
What are your privacy rights?
Your privacy rights are described below, should you wish to make a request in respect of any of your rights please contact our customer care team by 1913 or email; email@example.com or alternatively you can write to; Data Protection Officer, Three, 28/29 Sir John Rogerson’s Quay, Dublin 2.
You have the right to certain information relating to the use of your information by Three. This includes; what data we use, how we use it, where it is sent, what lawful bases we have when using it, how long we keep it and what your rights are. This privacy notice addresses how your information is used for the 3Extra service.
You have the right to have any inaccurate personal data about you corrected or updated.
To know and intervene in automated decisions about you
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.
To be forgotten
You have the right to have your data deleted when it is no longer required by us for a lawful purpose. Three already automatically deletes this data.
In this way Three complies with your “Right to be Forgotten” without you having to make a request to us. Where data still needs to be kept, e.g. for a legal obligation or for legitimate business purposes we will automatically delete it as soon as this retention period ends.
Right to object
You have the right to object to the processing of your personal data, including profiling, which is done for the purposes of a legitimate interest. Where you object Three shall demonstrate compelling legitimate grounds for the processing or cease processing.
You have the right to object to direct marketing or profiling for direct marketing purposes. This right can be exercised by opting-out of direct marketing using the means provided.
Where we process your data based on your consent, you have a right to withdraw that consent at any time.
You have the right to have processing of data restricted;
- While we verify the accuracy of your data or correct it if necessary;
- If the processing is unlawful and you request restriction of the processing rather than erasure of the personal data;
- We no longer need the personal data for the purposes of the processing, but you require to retain it for the establishment, exercise or defense of legal claims;
- While we consider an objection made by you under your right to object.
You have the right to obtain a copy of personal data which we may hold about you free of charge and we have one month to provide you with this data either by post or by electronic means.
You have the right to obtain a copy of certain personal data in a commonly used, machine readable format. This right is limited to data which;
- Was provided to us by you;
- Is processed by us on the basis of consent or a contract;
- Is processed by automated means.
Three provides such information in Excel Spreadsheet format.
*Delivery of access and portability rights
We may ask you to complete a form to help us identify the data you require. We may request that you provide proof of your identity and residence. In the case of certain manifestly unfounded or excessive requests, we reserve the right to decline a request or to charge a reasonable administrative fee.
We will provide your data to you within 30 days of receiving your request, except for requests which by reason of their complexity or number may take up to three months. In such cases we will notify you of any such delay within one month of receipt of the request, together with the reasons for the delay.
You should note that Three is bound to retain data for no longer than is necessary, and that certain data may therefore have been deleted by the time a request for access is made, in line with our retention rules outlined above.
The right to lodge a complaint
If you are unsatisfied to with any aspect of Three’s processing of your data, you have the right to lodge a complaint with a supervisory authority. The supervisory authority for Ireland is the Office of the Data Protection Commission.
Want more information?
Please address your query to firstname.lastname@example.org or write to the DPO, Three, 28/29 Sir John Rogerson’s Quay, Dublin 2.