Dapple

Privacy Policy

Last updated: 23 March 2026

Provided by: Send Something Ltd (trading as Dapple), registered in England and Wales (Company No. 15443608), 64 Tantallon Road, London, SW12 8DH, United Kingdom.

1. Introduction

Send Something Ltd (trading as Dapple) ("Dapple", "we", "our", or "us") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have in relation to it.

This policy applies to our website at www.dapplehq.com, the Dapple platform, and all associated services. It covers two types of people: our Customers (organisations and individuals who use Dapple to manage their submission programmes) and End Users (people who submit applications, entries, or other content through a Customer's programme).

If you are an End User, please be aware that the organisation running the programme you are applying to (our Customer) is the data controller for your submission data. Dapple processes that data on their behalf. If you have questions about how your submission data is used, you should contact the relevant organisation directly.

By using the Dapple Service, you acknowledge you have read and understood this Privacy Policy.

2. Definitions and Key Terms

• Cookie: a small amount of data generated by a website and saved by your web browser, used to identify your browser, provide analytics, and remember information such as your language preference or login details.
• Company / we / us / our: Send Something Ltd (trading as Dapple), 64 Tantallon Road, London, SW12 8DH, United Kingdom (Company No. 15443608).
• Country: the United Kingdom.
• Customer: a company, organisation, or individual that signs up to use the Dapple Service to manage a submission programme, open call, award, residency, or similar process.
• Device: any internet-connected device such as a phone, tablet, or computer that can be used to access the Dapple Service.
• End User: a person who submits an application, entry, or other content through a Customer's programme hosted on Dapple.
• IP Address: a unique number assigned to every device connected to the internet, which can indicate approximate geographic location.
• Personal Data: any information that directly or indirectly identifies a natural person, including name, email address, IP address, and other identifiers as defined under UK GDPR.
• Service: the Dapple submission management platform and all associated services, as described at www.dapplehq.com.
• Third-party service: any service, tool, or content provided by a party other than Dapple, including integrations, payment processors, and analytics providers.
• Website: www.dapplehq.com and its associated subdomains.
• You: a Customer or End User, as applicable in context.

3. What Personal Data Do We Collect?

3.1 From Customers

When you register for or use the Dapple Service as a Customer, we collect:

• Name and job title
• Email address and other contact details
• Organisation name and billing address
• Payment information (processed securely via our payment provider; Dapple does not store card details)
• Usage data and platform activity logs
• Communications you send to us (e.g. support requests, feedback)

3.2 From End Users

When you submit an application or entry through a Customer's programme on Dapple, the data collected depends on what the Customer has configured their form to collect. This may include name, email address, contact details, portfolio materials, and any other information requested by the programme. Dapple processes this data on behalf of the Customer.

3.3 Automatically Collected Data

When you visit our website or use the platform, we automatically collect certain technical data, including:

• IP address and approximate location derived from it
• Browser type and version
• Device type and operating system
• Pages visited and time spent on the platform
• Referral source (how you arrived at our site)
• Session data and cookies (see Section 9)

4. Lawful Basis for Processing

Under UK GDPR, we are required to identify a lawful basis for each type of processing we carry out. Our lawful bases are as follows:

• Contract: we process Customer data as necessary to perform our contract with you — i.e. to provide the Dapple Service you have signed up for, manage your account, and process payments.
• Legitimate interests: we process certain data (such as usage analytics and platform improvement) where it is in our legitimate interest to do so and that interest is not overridden by your rights. We also process data to detect and prevent fraud and abuse of the platform.
• Legal obligation: we may process and retain data where required to do so by applicable law, such as financial records for tax purposes.
• Consent: where we rely on consent (for example, for marketing emails), we will ask for it explicitly and you may withdraw it at any time.
• Data processor (End User data): where Dapple processes End User personal data on behalf of a Customer, we do so as a data processor acting on the Customer's instructions. The Customer is the data controller and is responsible for establishing the lawful basis for collecting End Users' data.

5. How We Use Personal Data

We use the personal data we collect for the following purposes:

• To provide, operate, and maintain the Dapple Service
• To process your account registration and manage your subscription
• To process payments and send billing-related communications
• To respond to your support requests and enquiries
• To send service-related notifications (e.g. updates, security alerts)
• To send marketing communications, where you have opted in
• To improve and develop the platform based on usage patterns and feedback
• To detect, investigate, and prevent fraud, abuse, or security incidents
• To comply with legal obligations

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

6. How We Share Personal Data

We do not sell your personal data. We may share it in the following circumstances:

6.1 Service Providers and Sub-processors

We engage trusted third-party service providers (sub-processors) to help us deliver the Service. These include providers of hosting infrastructure, email delivery, payment processing, customer support tooling, and analytics. All sub-processors are contractually required to process data only on our instructions and to maintain appropriate security standards. A list of current sub-processors is available on request by emailing hello@dapplehq.com.

6.2 Customers (End User Data)

End User submission data is accessible to the relevant Customer who configured the programme. Dapple processes this data on the Customer's behalf and does not use it for our own purposes.

6.3 Legal Requirements

We may disclose personal data to law enforcement, regulators, or other third parties where required to do so by law, or where we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of Dapple, our customers, or others.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of Dapple's assets, personal data may be transferred to the successor entity. We will notify affected users before any such transfer and will ensure the successor is bound by equivalent data protection obligations.

6.5 With Your Consent

We may share your data with third parties in other circumstances where you have given us your explicit consent to do so.

7. International Data Transfers

Dapple is based in the United Kingdom. Some of our sub-processors and service providers are located outside the UK, including in the United States and other countries. Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR, including:

• Transfers to countries that benefit from a UK adequacy decision (where the UK government has determined that the destination country provides an equivalent level of data protection);
• Use of the International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, where no adequacy decision applies; or
• Other transfer mechanisms approved under UK data protection law.

We work with a number of US-based service providers. Where we do so, we ensure appropriate transfer mechanisms are in place as described above. If you would like further information about the specific safeguards we use for any particular transfer, please contact us at hello@dapplehq.com.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our standard retention periods are:

• Customer account data: retained for the duration of your subscription and for up to 2 years after account closure, to allow for reactivation and to meet our contractual and legal obligations.
• Financial and billing records: retained for 6 years after the relevant transaction, as required by UK tax law.
• End User submission data: retained in accordance with the Customer's instructions. Upon account closure, End User data is deleted within 60 days unless the Customer requests earlier deletion or legal retention obligations apply.
• Support and communications records: retained for up to 2 years from the date of the last communication.
• Marketing consent records: retained until you withdraw consent, plus a reasonable period thereafter to evidence that consent was given.

When data is no longer required, it is securely deleted or anonymised so that it can no longer be linked to an individual.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve our website and platform. The types of cookies we use are:

• Essential cookies: necessary for the platform to function, such as maintaining your login session. These cannot be disabled without affecting core functionality.
• Analytics cookies: help us understand how users interact with the platform so we can improve it. We use anonymised or aggregated data where possible.
• Preference cookies: remember your settings and preferences across sessions.

You can control non-essential cookies through your browser settings or via our cookie consent banner. Disabling essential cookies may prevent some features from working correctly. We never store personally identifiable information in cookies. For full details, please see our Cookie Policy at www.dapplehq.com/docs/cookie-policy.

We also use session-based local storage to support platform functionality. This data is stored client-side and is not transmitted to third parties.

10. How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:

• Encryption of data in transit using TLS/SSL
• Encryption of sensitive data at rest
• Access controls limiting data access to authorised personnel only
• Regular security reviews and vulnerability assessments
• Secure payment processing via PCI-compliant providers (Dapple never stores card details)

While we take reasonable precautions, no system is completely secure. We cannot guarantee the absolute security of data transmitted to or from the platform. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and will inform affected individuals without undue delay, as required by UK GDPR.

11. Your Data Subject Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may ask us to correct inaccurate or incomplete data.
• Right to erasure: you may ask us to delete your personal data, subject to certain legal retention requirements.
• Right to restriction: you may ask us to restrict processing of your data in certain circumstances (for example, while a dispute is resolved).
• Right to data portability: you may request your data in a structured, commonly used, machine-readable format.
• Right to object: you may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at hello@dapplehq.com. We will respond within one month. We may ask you to verify your identity before fulfilling a request.

If you are an End User and your request relates to submission data held by a Customer, we will direct your request to the relevant Customer as the data controller.

You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO), at www.ico.org.uk or by calling 0303 123 1113.

12. Email Communications

We will only send you marketing emails where you have opted in to receive them, or where we have a legitimate interest in contacting you about our services (for example, if you are an existing customer and the communication is relevant to your use of the platform).

Every marketing email we send includes an unsubscribe link. You can opt out at any time and we will action your request promptly. Unsubscribing from marketing emails does not affect service-related communications (such as billing notifications or important platform updates).

Where you provide your email address, we may use it to create a custom audience for advertising on platforms such as Facebook or LinkedIn, to show relevant advertising to people who have expressed interest in Dapple. You can object to this use by contacting us at hello@dapplehq.com.

13. Children's Privacy

The Dapple Service is not directed at children under the age of 13. We do not knowingly collect personal data from anyone under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at hello@dapplehq.com and we will delete it promptly.

Customers who use Dapple to run programmes that may receive applications from individuals under 18 are responsible for ensuring their own compliance with applicable laws relating to children's data.

14. Information for US Customers and Users

Dapple serves customers in the United States. If you are based in the US, the following applies in addition to the rest of this policy.

14.1 California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, share, or sell
• The right to delete personal information we hold about you (subject to certain exceptions)
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information
• The right not to be discriminated against for exercising your privacy rights

Dapple does not sell personal information. We do not share personal information with third parties for cross-context behavioural advertising without consent.

To exercise your California privacy rights, please contact us at hello@dapplehq.com. We will respond within 45 days as required by CCPA.

14.2 Other US States

Residents of Virginia, Colorado, Connecticut, Texas, and other US states with applicable privacy laws may have similar rights to those described above. Please contact us at hello@dapplehq.com to exercise any applicable rights.

14.3 International Transfers to the US

Where we transfer personal data to US-based service providers, we do so using appropriate safeguards as described in Section 7. We do not rely on Privacy Shield (which was invalidated in 2020) as a transfer mechanism.

15. Links to Third-Party Websites

The Dapple platform may contain links to third-party websites. This Privacy Policy applies only to the Dapple Service. We are not responsible for the privacy practices of any third-party site and encourage you to read their privacy policies before submitting any personal data to them.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where a change is material, we will notify you by email or via a notice on the platform at least 30 days before the change takes effect. The date at the top of this policy reflects when it was last updated.

Continued use of the Dapple Service after changes take effect constitutes acceptance of the updated policy. If you do not agree to the updated policy, you may close your account.

17. Governing Law

This Privacy Policy is governed by the laws of England and Wales. Any disputes arising in connection with this policy are subject to the exclusive jurisdiction of the courts of England and Wales, except where applicable law requires otherwise.

18. Contact Us and Data Controller Details

The data controller for personal data processed through the Dapple Service is:

Send Something Ltd (trading as Dapple)
Company No. 15443608
64 Tantallon Road, London, SW12 8DH, United Kingdom
Email: hello@dapplehq.com
Website: www.dapplehq.com

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have a complaint about how we handle your personal data, please contact us at hello@dapplehq.com.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

© 2026 Dapple by Send Something Ltd. Company No. 15443608. All rights reserved.