Privacy Policy

**Last updated: 12 August 2026**

1. Who We Are

3for100.com is operated by Kristopher John Mckenzie, a sole trader trading as **3for100.com**.

For UK data-protection law, the operator is the controller of personal information collected through the Website.

**Business address:** [BUSINESS ADDRESS TO BE ADDED BEFORE LAUNCH]

**Privacy email: 3for100-privacy@proton.me

**Website:** https://3for100.com

2. What This Policy Covers

This Privacy Policy explains how we collect, use, store and share personal information when you:

* visit 3for100.com;

* create or use an account;

* enter a Competition through the paid or free postal route;

* make a payment;

* contact customer support;

* claim or receive a prize;

* subscribe to marketing; or

* otherwise interact with our services.

3. Information We Collect

### Account information

We may collect:

* full name;

* email address;

* telephone number;

* date of birth;

* residential address;

* account identifier;

* password in securely hashed form;

* communication preferences; and

* account restriction, suspension or closure status.

If you use an available social sign-in service, we may receive your name, email address and a unique account identifier from that provider, according to the permissions you approve.

### Competition information

We may collect:

* Competitions viewed or entered;

* qualifying-question answers and whether they were correct;

* attempt dates, times and restriction records;

* paid or postal entry route;

* ticket numbers;

* order amounts;

* monthly paid-spend and remaining-allowance records;

* payment, cancellation and refund status;

* Competition reference numbers;

* draw and winner records; and

* evidence relating to suspected duplicate accounts or misuse.

### Postal-entry information

When a physical postcard is received, we may record:

* the details written on the postcard;

* the date it was received;

* the Competition title and reference;

* the qualifying answer;

* whether the entry was accepted or rejected;

* the allocated ticket number;

* a unique postal-processing reference; and

* the authorised administrator who processed it.

Posting a postcard does not create an entry until it has been received, checked and accepted.

### Payment information

Payments are processed by an authorised third-party payment provider.

The payment provider collects and processes card or digital-wallet details. We do not intend to store complete payment-card numbers or security codes.

We may receive and retain limited payment information, such as:

* transaction reference;

* payment amount;

* date and time;

* payment status;

* refund or chargeback information; and

* limited payment-method information supplied by the processor.

### Identity and winner-verification information

Where reasonably necessary, we may collect documents or information confirming:

* identity;

* age;

* residential address;

* account ownership;

* eligibility;

* prize-delivery details; and

* payment-method ownership.

### Communications

We collect information contained in:

* customer-support requests;

* complaints;

* emails and contact forms;

* responsible-play requests;

* winner correspondence;

* marketing preferences; and

* other communications with us.

Please do not send passwords or complete payment-card details through email or contact forms.

### Technical and security information

We may automatically collect:

* IP address;

* browser and device type;

* operating system;

* pages viewed;

* approximate location derived from IP address;

* login and session information;

* cookie identifiers;

* error and performance logs;

* security events; and

* suspected fraud or misuse signals.

4. Where Information Comes From

We may receive personal information:

* directly from you;

* from physical postal entries;

* from payment providers;

* from social sign-in providers;

* from your browser or device;

* from identity or fraud-prevention providers where used;

* from delivery companies or prize suppliers; and

* from public authorities or professional advisers where lawful and necessary.

5. Why We Use Personal Information

We use personal information to:

* create and secure customer accounts;

* confirm age, identity, address and eligibility;

* administer paid and postal entries;

* check qualifying-question answers;

* enforce the one-attempt rule;

* enforce the £250 calendar-month paid-spend limit;

* allocate and display ticket numbers;

* process and reconcile payments and refunds;

* conduct and audit winner draws;

* contact and verify provisional winners;

* deliver prizes;

* answer questions and complaints;

* operate account suspensions and closures;

* prevent fraud, duplicate accounts and misuse;

* maintain Website security and performance;

* send essential service communications;

* send marketing where permitted;

* comply with accounting, tax, consumer-protection and legal obligations; and

* establish, exercise or defend legal claims.

6. Our Lawful Bases

Depending on the purpose, we rely on one or more of the following UK GDPR lawful bases:

### Contract

Processing is necessary to create an account, administer an entry, process a payment, allocate a ticket, conduct the Competition or provide a prize.

### Legal obligation

Processing is necessary to comply with applicable tax, accounting, consumer-protection, court, regulatory or other legal obligations.

### Legitimate interests

We have legitimate interests in:

* operating fair and secure Competitions;

* enforcing eligibility, one-attempt and spending restrictions;

* preventing fraud and duplicate accounts;

* investigating complaints and disputes;

* maintaining accurate draw and transaction records;

* protecting customers and the Website;

* demonstrating that valid prize awards took place; and

* improving our services.

We consider the impact on customers before relying on legitimate interests.

### Consent

We rely on consent where required for:

* non-essential cookies;

* certain marketing communications;

* optional winner photographs, videos or testimonials; and

* any other processing where consent is the appropriate lawful basis.

Consent may be withdrawn at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

7. Information Required to Use the Service

Certain information is required to:

* create and secure an account;

* confirm eligibility;

* administer an entry;

* process payment;

* comply with the one-attempt and £250 paid-spend restrictions;

* contact a winner; or

* deliver a prize.

If required information is not provided, we may be unable to create the account, accept an entry, complete a payment or award the prize.

8. Automated Rules and Decisions

The Website uses automated rules to:

* grade qualifying-question answers;

* prevent another attempt after an incorrect answer;

* enforce the £250 monthly paid-spend limit;

* check ticket availability;

* allocate ticket numbers;

* detect possible duplicate activity; and

* restrict transactions that do not meet the Competition Rules.

These rules use information such as the account, Competition, answer, entry history, monthly spending and available ticket capacity.

If you believe an automated restriction was applied incorrectly, contact us and request a human review.

9. Who We Share Information With

We may share only the information reasonably necessary with:

* Website hosting and database providers;

* payment processors and acquiring banks;

* email and communication providers;

* authentication and social sign-in providers;

* identity-verification and fraud-prevention providers;

* analytics providers where optional cookies have been accepted;

* delivery companies and prize suppliers;

* accountants, insurers, legal advisers and other professional advisers;

* regulators, courts, law-enforcement agencies or public authorities where required or permitted by law; and

* a purchaser or successor if the business is sold or reorganised, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal information.

Service providers acting on our behalf must process personal information only for authorised purposes and under appropriate contractual protections.

10. International Transfers

Some service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we will use a lawful transfer mechanism, such as:

* UK adequacy regulations;

* the UK International Data Transfer Agreement;

* the UK Addendum to approved standard contractual clauses; or

* another lawful safeguard or exception.

You may contact us for further information about the safeguards applying to relevant transfers.

11. Marketing

We may send promotional messages where you have consented or where another lawful marketing permission applies.

Every marketing email will provide an unsubscribe method.

You can object to direct marketing or withdraw marketing consent at any time. We will stop using your information for that purpose and may retain a minimal suppression record to ensure that your preference is respected.

Essential messages—including account-security notices, entry confirmations, payment information, Competition updates and winner notifications—are service communications rather than marketing and may still be sent when necessary.

Promotional marketing will be stopped during a responsible-play account suspension.

12. Cookies

The Website uses necessary cookies for functions such as:

* account login;

* security;

* session management;

* fraud prevention; and

* remembering privacy choices.

Non-essential analytics or advertising cookies will be used only where the required permission has been obtained.

More information is available in our Cookie Policy.

13. Winner Information

To demonstrate that a valid award took place, we may publish or make available:

* the winner’s surname;

* the winner’s county; and

* the winning ticket number.

A winner may object to publication or ask us to reduce the amount of information published.

We may still provide relevant information privately to the Advertising Standards Authority if required.

Winner photographs, videos, interviews and testimonials will require separate agreement.

14. How Long We Keep Information

We retain information only for as long as reasonably necessary for the purpose for which it was collected.

Our expected retention periods are:

* **Account information:** while the account remains active and normally for six years after closure or the last completed transaction;

* **Entry, payment, refund, draw and prize records:** normally for six years after the relevant Competition ends;

* **Qualifying-attempt and spending-limit records:** for as long as required to enforce the applicable restriction and normally within the associated Competition and transaction records;

* **Physical postcards:** until the Competition, winner confirmation and any relevant complaint period have concluded, then securely destroyed, normally within 12 months;

* **Identity documents:** only for the verification period and then securely deleted unless longer retention is necessary for fraud prevention, a dispute or a legal obligation;

* **Customer-support and complaint records:** normally for up to six years after the matter is resolved where required for legal or dispute purposes;

* **Technical and security logs:** normally for up to 12 months, unless required longer to investigate security incidents, fraud or legal claims;

* **Marketing records:** while marketing continues, with minimal suppression information retained after an opt-out to respect that request; and

* **Optional cookie information:** for the periods stated in the Cookie Policy or cookie-consent tool.

Information may be retained longer where required by law, a court, a regulator, an active complaint, fraud investigation or legal claim.

When information is no longer required, it will be deleted, anonymised or securely destroyed.

15. Security

We use reasonable technical and organisational measures intended to protect personal information, including:

* restricted administrative access;

* authentication and access controls;

* secure transmission;

* password hashing;

* security logging;

* data minimisation; and

* controlled access by service providers.

No internet service can guarantee absolute security. Customers must protect their passwords, devices and account access and should contact us immediately if they suspect unauthorised activity.

16. Your Data-Protection Rights

Depending on the circumstances, you may have the right to:

* be informed about how your information is used;

* request access to your personal information;

* correct inaccurate or incomplete information;

* request deletion of information;

* request restriction of processing;

* receive certain information in a portable format;

* object to processing based on legitimate interests;

* object to direct marketing;

* withdraw consent;

* request human review of certain automated decisions; and

* complain to the Information Commissioner’s Office.

These rights are not always absolute. We may need to retain information to comply with legal obligations, administer existing entries, prevent fraud or establish, exercise or defend legal claims.

We may request reasonable identification before responding to a rights request.

17. Children

3for100.com is not intended for anyone under 18.

We do not knowingly accept accounts or Competition entries from children. If we discover that an account holder is under 18, the account will be restricted and the information reviewed for appropriate deletion and legal retention.

18. Third-Party Websites

The Website may link to external websites or services.

Those organisations control their own privacy practices. You should read their privacy policies before providing personal information to them.

19. Changes to This Policy

We may update this Privacy Policy to reflect changes in law, service providers, Website features or business operations.

The latest version and its effective date will be displayed on this page.

Material changes will be communicated where reasonably necessary.

20. Contact Us

To ask a privacy question or exercise a data-protection right, contact:

**Operator:** Kristopher John Mckenzie, trading as 3for100.com

**Address:** [BUSINESS ADDRESS TO BE ADDED BEFORE LAUNCH]

**Email: 3for100-privacy@proton.me

21. Complaints to the ICO

Please contact us first so that we have an opportunity to investigate your concern.

You also have the right to complain to:

**Information Commissioner’s Office**

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

**Telephone:** 0303 123 1113

**Website:** www.ico.org.uk