Privacy Policy

Below is the revised policy for kris mckenzie, trading as 3for100.com, as a sole trader.

It includes:

Account registration and age checks

Competition entries and the one-attempt rule

£250 monthly entry-spend limit

Stripe payments

Resend transactional emails

Winner verification and publication

Web-push notifications

Security and audit records

Responsible Play restrictions

UK GDPR rights and ICO complaints

A privacy notice should identify the controller, explain what information is used, why it is used, the lawful bases, recipients, retention periods, international transfers and individual rights.

PRIVACY POLICY

Effective date: 01/08/2026

Last updated: 01/08/2026

1. Who We Are

3for100.com is operated by:

kris mckenzie, trading as 3for100.com

Business address: Forest hall, Newcastle upon tyne

Privacy email: 3for100@proton.me

General support email: 3for100@proton.me

In this Privacy Policy, “3for100.com”, “we”, “us” and “our” mean the sole trader identified above.

For the purposes of UK data-protection law, [YOUR FULL LEGAL NAME] is the data controller responsible for deciding how and why your personal information is used.

3for100.com is a trading name and is not a separate limited company or legal entity.

2. Scope of This Policy

This Privacy Policy explains how we collect, use, retain, disclose and protect personal information when you:

visit 3for100.com;

create or use an account;

enter a Competition;

answer a qualifying question;

make a payment;

receive an entry or payment confirmation;

enable browser notifications;

contact customer support;

make a complaint;

claim a prize;

request an account restriction or exclusion; or

otherwise interact with our services.

This policy should be read alongside our:

Terms and Conditions;

Competition Rules;

Responsible Play Policy; and

Cookie Policy.

3. Information We Collect

Depending on how you use 3for100.com, we may collect the following categories of personal information.

3.1 Account and identity information

This may include:

full name;

email address;

account identifier;

encrypted or hashed password;

date of birth or confirmation that you are aged 18 or over;

residential address;

telephone number, where provided;

account creation date;

login history;

account status; and

authentication-provider information where social sign-in is used.

We do not store passwords in readable form.

3.2 Competition-entry information

This may include:

Competitions entered;

qualifying questions presented;

answers submitted;

whether an answer was correct or incorrect;

one-attempt restriction records;

ticket quantities;

ticket numbers;

entry dates and times;

entry prices;

order and transaction references;

monthly entry-spend totals;

refunds and chargebacks;

winner-selection records; and

prize-claim status.

We retain a record of an incorrect answer where necessary to enforce the one-attempt rule for that Competition.

3.3 Payment information

Payments are processed by our payment-service provider, currently Stripe.

We do not intend to receive or store your complete payment-card number or card-security code.

We may receive limited payment information from Stripe, including:

payment status;

transaction identifier;

payment amount;

payment date and time;

payment method type;

limited card information such as card brand and last four digits;

billing details;

refund status;

dispute or chargeback information; and

fraud or risk indicators.

Stripe processes payment information under its own privacy terms and regulatory obligations.

3.4 Winner and prize information

If you are selected as a provisional winner, we may collect:

proof of identity;

proof of age;

proof of residential address;

payment-ownership confirmation;

bank details for a cash-prize payment;

delivery address;

prize correspondence;

claim documentation;

delivery or transfer confirmation;

winner photograph;

testimonial;

reaction video; and

publicity permissions.

We will only request information reasonably necessary to verify eligibility, prevent fraud and provide the prize.

3.5 Communications

We may retain:

customer-support messages;

complaint correspondence;

responsible-play requests;

account-closure requests;

email delivery records;

web-push delivery records;

notification preferences; and

records of consent or withdrawal.

3.6 Website and technical information

This may include:

IP address;

browser type and version;

device type;

operating system;

approximate location derived from an IP address;

pages visited;

referring website;

login and session information;

cookie identifiers;

security events;

error reports;

service-worker status;

push-subscription identifiers; and

dates and times of activity.

3.7 Fraud-prevention and audit information

We may collect or generate information used to protect customers and the platform, including:

suspected duplicate-account links;

device and session identifiers;

payment-risk signals;

failed login attempts;

unusual entry activity;

attempts to bypass entry limits;

attempts to obtain another qualifying-question attempt;

administrator actions;

draw-audit records; and

system-security logs.

We will not treat a shared IP address or device as conclusive proof that accounts are operated by the same person. Relevant information will be assessed proportionately.

4. How We Obtain Information

We may obtain personal information:

directly from you;

from activity performed through your account;

from Stripe;

from an authentication provider such as Google, where enabled;

from email-delivery providers such as Resend;

from your browser or device;

from fraud-prevention and security systems;

from our hosting and database providers;

from delivery providers where a physical prize is shipped; and

from publicly available sources where reasonably necessary to investigate fraud or verify a prize claim.

5. Why We Use Personal Information

We use personal information only where we have an appropriate lawful basis.

5.1 Creating and operating your account

We use account information to:

register your account;

authenticate you;

maintain account security;

provide account features;

display your entries;

manage your preferences; and

respond to account requests.

Lawful basis: Performance of our contract with you and our legitimate interests in operating a secure service.

5.2 Confirming age and eligibility

We use relevant information to:

confirm that entrants are aged 18 or over;

confirm permitted residency;

enforce account and eligibility rules;

verify provisional winners; and

prevent ineligible participation.

Lawful basis: Performance of our contract, compliance with applicable legal obligations and our legitimate interests in operating lawful and fair Competitions.

5.3 Administering Competition entries

We use entry information to:

present qualifying questions;

record submitted answers;

determine whether an answer is correct;

enforce one attempt per person per Competition;

allocate tickets;

record entries;

apply Competition-specific limits;

apply the £250 monthly entry-spend limit;

process refunds;

select winners; and

maintain Competition and draw records.

Lawful basis: Performance of our contract with you and our legitimate interests in administering Competitions fairly, consistently and securely.

5.4 Processing payments

We use payment and transaction information to:

request and confirm payments;

issue refunds;

reconcile financial records;

investigate disputes and chargebacks;

prevent unauthorised transactions; and

maintain accounting and tax records.

Lawful basis: Performance of our contract, compliance with legal obligations and our legitimate interests in preventing payment fraud and maintaining accurate financial records.

5.5 Selecting and verifying winners

We use entry, identity and contact information to:

conduct a draw;

identify the provisional winner;

contact the winner;

verify eligibility;

investigate suspected breaches;

deliver or pay the prize;

preserve a draw audit trail; and

conduct a redraw where permitted.

Lawful basis: Performance of our contract, compliance with applicable obligations and our legitimate interests in protecting the integrity and transparency of each Competition.

5.6 Sending essential emails

We may use Resend or another approved email provider to send service-related emails, including:

account registration or email confirmation;

password reset messages;

security alerts;

successful entry receipts;

payment or refund information;

provisional-winner notification;

prize-claim instructions;

complaint correspondence; and

important changes affecting an existing entry.

These communications are operational rather than general advertising.

Lawful basis: Performance of our contract, compliance with legal obligations and our legitimate interests in communicating essential service information.

5.7 Web-push notifications

Where web push is available and you enable it, we may process a browser-generated push subscription.

A push subscription may include:

a push-service endpoint;

browser-generated encryption keys;

browser and device information;

subscription status;

notification preferences; and

delivery and failure records.

We may offer separate preferences for:

Winner announcements for Competitions you entered.

Winner announcements for all 3for100 Competitions.

Other promotional notifications, where separately offered.

You can disable web push through your 3for100 notification settings, your browser settings or your device settings.

General winner announcements for Competitions you did not enter and other promotional messages will be optional and will not be enabled merely because you registered.

Electronic direct marketing directed at individuals will generally require appropriate consent unless a specific legal exception applies. Consent must also be capable of being withdrawn.

Lawful basis:

Entered-Competition result notifications: performance of our contract and/or legitimate interests in providing Competition results, where the message is strictly operational.

All-winner or promotional notifications: consent.

5.8 Winner publication

To demonstrate that a Competition was completed and a prize was awarded, we may publish limited winner information such as:

first name;

surname initial;

town, city or county;

prize won;

winning ticket number; and

draw date.

We will not ordinarily publish a winner’s full residential address, complete date of birth, identity documents, bank details, telephone number or private email address.

Winner photographs, testimonials, interviews and reaction videos will only be published where an appropriate permission or other lawful basis exists.

Lawful basis: Our legitimate interests in Competition transparency and demonstrating that prizes are awarded. Additional promotional content such as photographs and videos will normally be based on consent.

5.9 Customer support and complaints

We use information to:

respond to enquiries;

investigate complaints;

correct errors;

resolve payment disputes;

enforce customer rights; and

preserve evidence of how a matter was handled.

Lawful basis: Performance of our contract, compliance with legal obligations and legitimate interests in managing disputes and improving our service.

5.10 Responsible Play and account restrictions

We use minimal account information to:

apply voluntary restrictions;

close accounts;

enforce exclusions;

prevent attempts to bypass restrictions; and

stop promotional communications where requested.

You do not need to provide medical information or explain why you are requesting a restriction.

Please do not send health or medical information unless it is genuinely necessary. Where such information is voluntarily provided, we will restrict access and determine an appropriate lawful basis before using it.

Lawful basis: Legitimate interests in customer protection, platform safety and enforcing your request.

5.11 Fraud prevention and security

We use relevant account, payment, device and activity information to:

secure accounts;

detect unauthorised access;

prevent payment fraud;

identify duplicate accounts;

prevent manipulation of questions, entries or draws;

investigate technical attacks;

enforce Competition limits; and

protect our legal rights.

Lawful basis: Legitimate interests in fraud prevention, security and protecting customers, together with legal obligations where applicable.

5.12 Legal and regulatory purposes

We may process or disclose information where reasonably necessary to:

maintain tax and accounting records;

respond to lawful requests;

establish, exercise or defend legal claims;

investigate suspected criminal conduct;

comply with court orders;

protect customers or other people; or

comply with applicable law.

Lawful basis: Legal obligation and legitimate interests in protecting our legal rights.

6. Automated Checks and Decisions

Parts of the Competition process operate automatically.

These may include:

checking whether a qualifying answer matches the accepted answer;

blocking another attempt following an incorrect answer;

calculating monthly entry spend;

preventing a purchase that would exceed a limit;

allocating ticket numbers;

detecting duplicate requests;

identifying suspicious account activity; and

selecting a winning entry through an electronic random process.

The winner-selection system does not assess personality, behaviour or personal characteristics. It selects from the eligible entry pool using the stated draw method.

If you believe an automated rule was applied incorrectly because of a technical or factual error, contact [INSERT SUPPORT EMAIL]. We will investigate and, where appropriate, arrange human review.

7. Who We Share Information With

We may share personal information with carefully selected service providers where necessary to operate 3for100.com.

These may include:

7.1 Payment providers

Stripe processes payments, refunds, disputes and payment-risk information.

7.2 Email providers

Resend processes email addresses and message-delivery information for transactional emails.

7.3 Hosting and infrastructure providers

Our hosting, database, storage, backup, monitoring and deployment providers may process information needed to operate and secure the platform.

The current provider list should be confirmed before this policy is published:

Application hosting: [CONFIRM PROVIDER]

Database hosting: [CONFIRM PROVIDER]

File and image storage: [CONFIRM PROVIDER]

Backup storage: [CONFIRM PROVIDER]

Error monitoring or analytics: [CONFIRM PROVIDER]

7.4 Authentication providers

Where social sign-in is enabled, providers such as Google may confirm account identity and share limited profile information according to the permissions displayed during sign-in.

7.5 Push-service providers

Web-push notifications are routed through the push service used by the customer’s browser or operating system. Depending on the device, this may involve services operated by browser or platform providers.

7.6 Prize and delivery providers

We may share a winner’s name, contact information and delivery address with:

couriers;

fulfilment providers;

prize retailers;

banks or payment providers; and

professional advisers involved in prize delivery.

Only information reasonably necessary to provide the prize will be shared.

7.7 Professional advisers and authorities

Information may be shared with:

accountants;

solicitors;

insurers;

cybersecurity specialists;

fraud-prevention providers;

law-enforcement authorities;

courts;

regulators; and

tax authorities,

where reasonably necessary and lawful.

Our processors must be subject to appropriate contractual requirements concerning confidentiality, security and permitted use of personal information.

8. We Do Not Sell Personal Information

We do not sell customer personal information to advertisers, data brokers or unrelated third parties.

We do not permit service providers to use personal information for their own unrelated advertising purposes merely because they provide a service to us.

9. International Transfers

Some service providers may process information outside the United Kingdom.

Where a restricted international transfer occurs, we will take reasonable steps to ensure that an appropriate transfer mechanism is in place. This may include:

UK adequacy regulations;

the UK International Data Transfer Agreement;

the UK Addendum to approved standard contractual clauses; or

another lawful safeguard.

International transfers require an appropriate legal mechanism and may require additional contractual and risk-assessment measures.

You may contact us for more information about the safeguards relevant to your information.

10. How Long We Retain Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

Our intended retention periods are:

Information Intended retention period

Active account information While the account remains active

Closed account information Normally up to 6 years after closure or the final transaction

Competition entries, orders and payment records Normally 6 years after the relevant transaction

Winner and draw-audit records Normally at least 6 years after completion of the Competition

Identity documents used for winner verification Deleted or securely minimised as soon as verification and any necessary dispute period are complete

Prize delivery/payment evidence Normally 6 years

Incorrect-answer and one-attempt records For the duration of the relevant Competition, plus a reasonable audit period

Monthly-spend records As part of the relevant transaction and accounting records

Customer-support and complaint records Normally up to 6 years after resolution where needed for legal or dispute purposes

Security and access logs Normally 12–24 months, unless required longer for an investigation

Web-push subscription Until unsubscribed, expired or no longer valid

Push delivery logs Normally up to 12 months

Marketing and notification consent records While consent remains active and for a reasonable period afterwards to demonstrate the customer’s preference

Exclusion or restriction record For the period necessary to enforce the restriction and maintain an appropriate audit record

Failed or incomplete registration data Normally deleted or anonymised within a reasonable period

Different periods may apply where:

the law requires longer retention;

a complaint, chargeback or legal dispute remains open;

fraud or security activity is being investigated;

a prize remains unclaimed;

information has been anonymised so it no longer identifies anyone; or

earlier deletion is appropriate.

11. Cookies and Similar Technologies

We use cookies and similar technologies for purposes including:

maintaining secure sessions;

remembering essential settings;

protecting against fraud;

processing authentication;

measuring site performance; and

operating permitted analytics or marketing tools.

Strictly necessary technologies may operate without optional consent where the relevant legal exemption applies.

Non-essential analytics, advertising or tracking technologies must not be activated until the required consent has been obtained.

PECR applies to cookies and similar technologies, including technologies that do not directly process identifiable personal information.

Further details should be provided in our separate Cookie Policy and cookie-preference centre.

12. Security

We use reasonable technical and organisational safeguards designed to protect personal information.

These may include:

encrypted connections;

hashed passwords;

restricted administrative access;

role-based permissions;

authentication controls;

security headers;

payment processing through a specialist provider;

audit logging;

backups;

access monitoring;

vulnerability management;

secret-key protection;

fraud detection; and

incident-response procedures.

No website, database or internet transmission can be guaranteed completely secure. Customers must protect their login details and notify us promptly if they suspect unauthorised account access.

13. Your Data-Protection Rights

Depending on the circumstances, you may have the right to:

be informed about how your information is used;

request access to your personal information;

request correction of inaccurate or incomplete information;

request deletion of information;

request restriction of processing;

receive certain information in a portable format;

object to certain processing;

object to direct marketing;

withdraw consent;

challenge certain solely automated decisions; and

complain to the Information Commissioner’s Office.

These rights are not absolute. For example, we may need to retain transaction or Competition records for legal, fraud-prevention, accounting or dispute-resolution purposes. The right to erasure applies only in certain circumstances.

To exercise a right, contact:

Privacy email: [INSERT PRIVACY EMAIL]

We may request reasonable proof of identity before disclosing or changing personal information.

We will not request more identity information than is reasonably necessary.

14. Withdrawing Consent and Changing Preferences

Where processing is based on consent, you may withdraw that consent at any time.

You can:

change web-push settings through your account;

block notifications through your browser or device;

untick optional notification preferences;

use an unsubscribe mechanism where provided; or

contact us directly.

Withdrawing consent does not make processing carried out before withdrawal unlawful.

Essential service messages relating to account security, an existing entry, a refund, a complaint or a prize claim may still be sent where necessary.

15. Children

3for100.com is intended only for people aged 18 or over.

People under 18 must not:

create an account;

submit a Competition answer;

purchase an entry; or

claim a prize.

If we reasonably believe an account belongs to a person under 18, we may suspend the account and request age verification.

If you believe a person under 18 has supplied personal information, contact [INSERT PRIVACY EMAIL].

16. Account Closure and Deletion

You may ask us to close your account.

Closing an account does not necessarily result in immediate deletion of all information. We may retain limited information where necessary to:

complete an existing Competition;

process a refund;

provide or verify a prize;

maintain transaction and tax records;

investigate fraud;

enforce an exclusion;

handle a complaint or legal claim; or

comply with applicable law.

Information that is no longer required will be deleted, anonymised or securely restricted.

17. Data Breaches

If a personal-data breach occurs, we will:

investigate the incident;

take reasonable steps to contain it;

assess the likely risk to affected people;

maintain an incident record;

notify the ICO where legally required; and

notify affected people where the breach is likely to create a sufficiently high risk to their rights and freedoms.

18. Complaints

Please contact us first if you have concerns about how we use personal information:

Operator: [YOUR FULL LEGAL NAME], trading as 3for100.com

Privacy email: [INSERT PRIVACY EMAIL]

Address: [INSERT GEOGRAPHIC BUSINESS ADDRESS]

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

The ICO recommends that UK privacy notices tell individuals about their right to complain and provide the relevant supervisory-authority details.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

changes to the platform;

new service providers;

new communication methods;

security improvements;

legal or regulatory developments; or

changes to how information is used.

The latest version will be published on 3for100.com with an updated revision date.

Where a change materially affects how existing personal information is used, we will provide an appropriate notice and obtain consent where legally required.

20. Contact Details

Data controller: kris mckenzie

Trading name: 3for100.com

Business address: Forest hall, Newcastle upon tyne

Privacy email: 3for100@proton.me

Support email: 3for100@proton.me

Website: 3for100.com