About this Privacy Notice

This privacy notice explains the kinds of information we may obtain from or about you as a subscriber to the 3Extra Service (“3Extra”); how we may use that information (together with information provided offline or via othermeans); and who we may share that information with.

Where you do not agree to any of the provisions of this Privacy Notice please do not register for or use the 3Extra Service. By signing up for and using the 3Extra Service you agree that you have read and understood this Privacy Notice. You can opt-out of 3Extra marketing communications (in which case you might still receive messages relevant to the 3Extra service) and you can opt-out of 3Extra entirely, see options under Manage Your Privacy below.

This Privacy Notice relates solely to processing of information for the 3Extra Service.

Main Privacy Statement Reference

This Privacy Notice is subsidiary, and in addition, to the Three Privacy Statement, and other relevant Privacy Notices, available on the Privacy Centre section of the Three website (https://www.three.ie/legal/privacy/ ).

Data Controller

Depending on whether you are a customer of Three Ireland (Hutchison) Limited, or Three Ireland Services (Hutchison) Limited (formerly O2), one or both of those companies is the “Data Controller” in respect of this data. This Privacy Notice applies to both companies, and collectively refers to them as “Three”.

You can contact Three in a number of ways, which are set out on the contact page of our website (https://www.three.ie/contact-us.html)

In accordance with Article 37 of the GDPR, Three has appointed a Data Protection Officer. If you wish to contact our Data Protection Officer in relation to the processing of your personal data by Three, you can do so by e-mailing: privacy@three.ie

About Data Protection

Three processes personal data in accordance with the requirements of Data Protection law. This law includes the Irish Data Protection Acts and the EU General Data Protection Regulation (“GDPR”).

Under Data Protection law, you are the “Data Subject” in respect of any personal data relating to you. “Personal Data” is any information which relates to an identifiable natural person. It does not include information relating to a company or other legal entity.

Three may engage third parties (other than its own employees) to provide services to it. Any of those third parties who process personal data on our behalf is a “Data Processor”.

“Processing” means any action performed on personal data, including collection, storage, copying, consulting, disclosure or destruction.

Processing of Your Data

We have extensive controls in place to maintain the security of our information and information systems. Client files are protected with safeguards according to the sensitivity of the relevant information. Appropriate controls (such as restricted access) are placed on our computer systems. Physical access to areas where Personal Data is gathered, processed or stored is limited to authorised employees.

As a condition of employment, Three employees are required to follow all applicable laws and regulations, including in relation to data protection law. Access to sensitive Personal Data is limited to those employees who need it to perform their roles. Unauthorised use or disclosure of confidential client information by a Three employee is prohibited and may result in disciplinary measures.

When you contact a Three employee about your Personal Information, you may be asked for some Personal Data to validate your identity. This type of safeguard is designed to ensure that only you, or someone authorised by you, has access to your file.

Processing of Children’s Data

Our Service is not intended for individuals under the age of 16 without the permission of their parents or guardians. We do not knowingly collect or solicit information from anyone under the age of 16. In the event that we learn that we have inadvertently collected personal information from a child under the age of 16, we will delete that information as quickly as possible. If you believe that we might have information from a child under 16, please contact us. Protecting the privacy of children is very important to us. Thus, if we obtain actual knowledge that a user is under 16 and does not have parental permission to use our services, we will take steps to remove that user's Personal Information from our databases. We require that anyone under the age of 16 obtain their parent or guardian's permission before submitting their information to us.

 

How Three Processes Your Data

Our Use of your Personal Data:

When you register for and use the 3Extra Service, we and our service providers will use your personal data in the following way:

Contact information

We use your:  

Email address and mobile phone number are used to send you offers from our partners and marketing information. We use your phone number to verify you are a Three customer and to send you information about the 3Extra service, for example any change in terms and conditions. We may also email you information. We do not provide our partners with your personal data.

Lawful purpose:          

We send you offers and marketing only where you have consented to this. We also have a legitimate interest to use your contact details to communicate certain information to you, particularly to send you important regulatory updates and changes to your terms.

Length of time:           

We process this data for as long as you are a Three or a 3Extra customer or until you object or ‘opt-out’, whichever happens sooner.

Information used to determine what adverts and offers you might like

What we use: 

Age and gender to determine appropriateness of advertising and as a factor in determining what adverts and offers you might like. This information is provided by you, for example when you register your details with us or where you join 3Plus. Three also looks at your type of device and preferences you chose when registering, to assess your interests.

Lawful basis:   

We process this data based on our legitimate interests to send you relevant marketing and to ensure appropriateness of content.

How long:       

For a maximum of your time with Three as a customer or two years thereafter.

Location Data

What we use: 

We use information about the geographic location of your mobile device (i.e. your location data) to better understand your interests. For example, information indicating your approximate geographic location while making or receiving a call can be used to indicate whether you have visited universities, music or sporting events and this information will then be used to send you deals or information related to those interests / events. Depending on how many or few masts are in your area this could be quite a general location.

Certain messages we send to you as part of the 3Extra Service therefore may be location-specific i.e. we will use your device’s real-time location in order to send you a tailored message.

Lawful basis:   

We use your location for 3Extra services based on your consent. It is entirely your choice whether you allow us to process your location in the above way. You actively provide your consent by way of an ‘opt-in’ tick box at registration.

Length of time

We process your location data for no longer than 3 months for this purpose or until you opt-out, whichever is sooner.

 

Behavioural Data

What we use: 

We use data on your usage of our network, this includes information about your spending, when you make and receive communications, whether you are roaming, what kinds of public numbers you call (we don’t look at your private or ‘peer to peer’ call details for this purpose). For example, if one of our partners is a financial service provider and you phone the category of financial institutions regularly you may wish to be served with adverts or offers from that partner.

Lawful basis:   

We process your behavioural data solely on your consent. It is entirely your choice whether you allow us to process your behavioural data in the above way. You actively provide your consent by way of an ‘opt-in’ tick box at registration.

Length of time

We process your location data for no longer than 3 months for this purpose or until you opt-out, whichever is sooner.

3Extra Usage Data

What we use  

Your use of the 3Extra service, what offers you like and how you interact with the 3Extra service.

Lawful basis    

We have a legitimate interest to analyse the effectiveness of the 3Extra service and to use that to improve the service.

Length of time

We use this data for as long as you use the 3Extra service.

Managing Your Information and Privacy Preferences

It is important that you keep your Personal Data with Three up to date. If you do not provide us with your current information, then we may not be able to provide our services, or elements thereof, to you; for example, if you don’t provide us with your current email we will not deliver you your bill by email, or you may not be able to access the My3 App.

You can access, view and change your privacy preferences, see your usage, manage your account, top up, and message us using the My3 App. ( https://www.three.ie/my3-app.html )

• You can opt out of 3Extra services by texting STOP to 50407

For information on changing your privacy settings when using Apple platforms see https://support.apple.com/en-ie/HT205223

For information on changing your privacy settings when using Google platforms see https://support.google.com/accounts/answer/6304920?co=GENIE.Platform%3DDesktop&hl=en

Alternatively check out your Browser’s settings where you can control the privacy settings.

To reset your advertising ID:

• on your android phone click settings, google, ads, reset advertising ID and click ok
• on your ios (Apple) phone click settings, privacy, advertising, reset advertising

 

Anonymised Data Sharing

Three anonymises and aggregates your data on an ongoing basis. The data is 'de-identified' using established data processing techniques to a point where the data subject is no longer identifiable or capable of being 'Singled-Out'. Such anonymised data includes traffic, billing, and location data. The anonymised data may then be statistically analysed in an aggregate format by Three in order to generate data insights to carry out research on, or profile, use of our products and services. Three may share these insights with affiliates and third parties for review, planning, public policy and commercial purposes, subject to strict rules to safeguard the data from deanonymisation.

Disclosure of Your Data to Others

Group Companies

We may disclose your information to other members of our group of companies, and to our or their partners, associates, agents or subcontractors and to possible successors to our business.

Data Processors

Three uses service providers to assist in providing services to you, and some of these process your personal data on our behalf. These Data Processors provide a range of services to Three, including deliveries, cloud computing, data storage, document shredding, outsourced IT services, outsourced customer services, repairs of hardware, franchise store operators, security providers, consultants and professional advisors. Where we use Data Processors, we require them by contract to only process data in accordance with our instructions.

Data Aggregators and Direct Marketing Campaign Providers

We use specific marketing related data processors such as Data Aggregators to assist with targeted marketing and Direct Marketing Campaign Providers to assist us by sending direct marketing messages to you or targeting directed advertising towards, or away from, you.

We also use location based service solution providers, who may be provided with your location, where you have consented to your location being accessed for marketing purposes and are then able to trigger marketing messages to be sent by our Direct Marketing Campaign Providers to You depending on your general location.

Legal Disclosure

Other Personal Data may be disclosed where required for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other moneys owed or payable to the State, a local authority or a health board, in any case in which the application of those restrictions would be likely to prejudice any of the matters aforesaid. In such cases, we will not disclose your data without first taking into account your fundamental right to Data Protection.

We may disclose Personal Data to Law enforcement agencies, government bodies, regulatory organisations, mediator/arbitrator, courts or other public authorities if we have to, or are authorised to by law. Similarly, we may disclose Personal Data to a third party or body where such disclosure is required to satisfy any applicable law, or other legal or regulatory requirement;

Partner Organisations

We may disclose, subject to choices you make, Personal Data to third parties for joint promotions with that third party. The third parties will be responsible for their own compliance with applicable privacy laws. These third party organisations, which we have carefully chosen, may contact you about their products and services (which may or may not include Three products and services).

 

Transfer of Data to Third Countries

Some of the Data Processors we use are based outside the European Economic Area (the ‘EEA’) which consists of the European Union Member States together with Iceland, Liechtenstein and Norway. When we transfer to or allow access to personal data from such countries, we ensure that adequate contractual and technical safeguards to carry out these transfers in accordance with applicable data protection law are in place to protect your information.

Retention Periods

We retain your personal data for as long as necessary for the purposes for which it was collected and to provide you with our services, to secure the legitimate interests of our business or where otherwise required by law. Generally, unless otherwise stated herein, we will retain your data for the lifetime of your account with us and for a 2 year period thereafter in accordance with our information retention policy, a copy of which, with information relevant to You, is available on request.

Your Rights regarding Your Personal Data

You have certain rights relating to processing of your personal data by Three arising from Chapter 3 of the General Data Processing Regulation. These rights include:

Right to Information

You have the right to certain information relating to processing of your personal data by Three. This Privacy Statement, along with other relevant publicly available documents, provides this information.

Right of Access

You have the right to obtain a copy of personal data which we may hold about you. Depending on your customer type and duration of tenure as customer, and on whether you were a customer of Three or of O2, different information may be held by us, and there may be “gaps” our records due to changes to our purging processes over the years. Accordingly, we will provide you, as required by law, with all data which we hold relating to you, but we may no longer have a copy of the particular record or document you are seeking.

Right to Rectification

You have the right to have any inaccurate personal data corrected or updated.

Right to Erasure (“The Right to be Forgotten”)

You have the right to have your data deleted when it is no longer required by us for a lawful purpose. Three already automatically deletes this data.

In this way, Three complies with your “Right to be Forgotten” without you having to make a request to us. Where data still needs to be kept, e.g., for a legal obligation or for legitimate business purposes we will automatically delete it as soon as this retention period ends.

Right to Restriction of Processing

You have the right to have processing of data restricted;

• While we verify the accuracy of your data or correct it if necessary;
• If the processing is unlawful and you request restriction of the processing rather than erasure of the personal data;
•  If we no longer need the personal data for the purposes of the processing, but you require us to retain it for the establishment, exercise or defence of legal claims; and
• While we consider an objection made by you under your Right to Object.

Right to Data Portability

You have the right to obtain a copy of certain personal data in a commonly used, machine readable format. This right is limited to data which;

• Was provided to us by you;
• Is processed by us on the basis of consent or a contract; and
• Is processed by automated means.

Three provides such information in Excel Spreadsheet format.

Right to Object

You have the right to object to the processing of your personal data which is done for the purposes of a legitimate interest or in the public interest or in exercise of official authority vested in Three as data controller. Where you object, Three shall demonstrate compelling legitimate grounds for the processing, or cease it.

You have the right to object to processing for direct marketing purposes. This right can be exercised by opting out of direct marketing using the means provided.

Right regarding Automated Decision Making

Certain decisions relating to credit scoring are based solely on the automatic processing of personal data which you provide to us as part of your application. Where such a decision is made in respect of your application, you will be notified of the outcome and given the opportunity to obtain human intervention by Three, to express your point of view and to contest the decision.

Exercise of your Personal Data Rights

To exercise your rights regarding your personal data please contact the office of the Three Data Protection Officer at privacy@three.ie

We may ask you to complete a form to help us identify the data you require. We may request that you provide additional information necessary to confirm your identity as the Data Subject. In the case of certain manifestly unfounded or excessive requests, we reserve the right to decline a request or to charge a reasonable administrative fee.

We will provide, if requested, your data to you within 30 days of receiving your request, except for requests which by reason of their complexity or number may take up to three months. In such cases we will notify you of any such delay within one month of receipt of the request, together with the reasons for the delay.

You should note that Three is bound to retain data for no longer than is necessary, and that certain data may therefore have been deleted by the time a request for access is made, in line with our retention rules outlined above.

 

The Right to Lodge a Complaint

If you are unsatisfied with any aspect of Three’s processing of your data, you have the right to lodge a complaint with a supervisory authority. The supervisory authority for Ireland is the Office of the Data Protection Commissioner. ( https://www.dataprotection.ie/ )

Relevant Terms and Conditions

You should read this Privacy Notice in conjunction with the Terms and Conditions for 3Extra (https://www.three.ie/three-extra/terms-and-conditions.html).

Changes to our Privacy Documentation

This Data Protection Notice is kept under regular review and is therefore subject to change. Amended versions of this document shall be notified through publication in the Privacy Centre on the Three website ( https://www.three.ie/legal/privacy.html ). This document was last reviewed on the 12th of April 2021.