Privacy Policy

AppServe Ltd (“AppServe”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

AppServe Ltd operates Dorset365, an online platform that helps users discover, browse, book and purchase tickets, events, experiences, activities, attractions, deals and other products and services offered by businesses and organisations across Dorset.

This Privacy Policy explains how we collect, use, store, share and protect your personal information when you:

• visit or use Dorset365;
• create or manage a Dorset365 account;
• make a booking, order or purchase;
• save favourites or interact with listings;
• contact a business through Dorset365;
• register or operate a business account;
• create, advertise or manage listings;
• subscribe to marketing communications;
• participate in promotions, competitions, surveys or similar activities; or
• otherwise contact or interact with us.

It also explains your rights under applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For the purposes of UK data protection law, AppServe Ltd is the data controller responsible for personal information processed in connection with Dorset365, except where another organisation acts as an independent controller.

Legal entity: AppServe Ltd
Trading name/platform: Dorset365
Website: dorset365.com
Registered company number: 16814893
Registered office: 320 Firecrest Court, Warrington, United Kingdom, WA1 1RG
Privacy enquiries: info@dorset365.com

If you have questions about this Privacy Policy or how we use your personal information, please contact us using the details above.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection matters. We would appreciate the opportunity to address your concerns first, so please contact us before approaching the ICO where possible.

Personal data means information relating to an identified or identifiable individual.

Depending on how you use Dorset365, we may collect the following categories of information.

3.1 Identity Data

This may include:

• first name;
• last name;
• username or account identifier;
• title;
• date of birth, where required;
• business role or job title; and
• other information used to identify your account.

3.2 Contact Data

This may include:

• email address;
• telephone number;
• billing address;
• business address; and
• other contact information you provide to us.

3.3 Account and Profile Data

This may include:

• account credentials;
• account preferences;
• saved or favourite listings;
• order and booking history;
• reviews or feedback;
• communication preferences; and
• information contained within your customer or business profile.

Passwords are stored using appropriate cryptographic hashing and are not stored by us in readable plain text.

3.4 Business Account Data

If you create or manage a business account, we may collect:

• business name;
• legal entity name;
• company registration information;
• business address;
• contact information;
• website and social media information;
• business description and category;
• information about authorised representatives;
• listing information;
• booking and sales information;
• payment or payout information; and
• information necessary to verify or administer the business account.

Some business information may be displayed publicly as part of a Dorset365 business profile or listing.

3.5 Transaction and Booking Data

When you make a purchase or booking through Dorset365, we may process information including:

• products, tickets, deals or experiences purchased;
• booking date and time;
• quantity;
• booking reference;
• transaction value;
• discounts or promotional codes;
• booking status;
• refunds or cancellations; and
• information required by the business or event organiser to fulfil your booking.

3.6 Payment Data

Payments made through Dorset365 may be processed by third-party payment service providers.

We do not intend to store complete payment card numbers, security codes or other full card credentials on Dorset365's own systems.

We may receive and retain limited payment information from our payment providers, such as:

• payment status;
• transaction reference;
• payment method;
• card type or brand;
• the last four digits of a payment card;
• refund information; and
• fraud or payment-security information.

Your payment provider may process additional personal information in accordance with its own privacy policy.

3.7 Technical Data

When you access Dorset365, we may automatically collect technical information including:

• IP address;
• browser type and version;
• operating system;
• device type;
• screen or device information;
• time zone;
• approximate location derived from your IP address;
• referring website;
• pages requested;
• error and diagnostic information; and
• other technical identifiers.

3.8 Usage Data

We may collect information about how you use Dorset365, including:

• pages viewed;
• searches performed;
• listings viewed;
• links selected;
• favourites;
• interactions with features;
• session duration; and
• navigation through the website.

3.9 Marketing and Communications Data

This may include:

• whether you have agreed to receive marketing;
• your marketing preferences;
• newsletter subscriptions;
• records of marketing communications;
• whether communications have been delivered, opened or interacted with; and
• your communication preferences.

3.10 Communications

If you contact us, we may retain information contained in your communication and information about how and when you contacted us.

This can include communications made through email, website forms, customer support or other communication channels.

3.11 Aggregated and Anonymous Data

We may generate statistical, aggregated or anonymised information from personal data.

Where information has been properly anonymised so that an individual can no longer reasonably be identified, it is not personal data and may be used for purposes such as analytics, reporting, research and improving Dorset365.

We do not generally require or intentionally collect special category personal data, such as information concerning your health, racial or ethnic origin, religious beliefs, political opinions, sexual orientation or biometric information.

We also do not generally seek to collect information relating to criminal convictions or offences.

Please avoid providing this information unless it is genuinely necessary.

Where Dorset365 needs to process special category information for a particular service, we will only do so where an appropriate lawful basis and additional legal condition applies.

Dorset365 accounts and transactions are intended to be created or authorised by adults.

Some events, activities, attractions or bookings available through Dorset365 may be intended for children or require information about children attending.

Where information about a child is required for a booking, it should normally be provided by their parent, guardian or another adult authorised to provide it.

We only intend to process children's information where reasonably necessary for purposes such as:

• administering a booking;
• determining ticket eligibility;
• complying with event requirements;
• safety;
• fulfilment of a service; or
• compliance with legal obligations.

We do not knowingly use children's personal information for behavioural advertising.

Information You Give Us

You may provide information directly when you:

• create an account;
• create a business profile;
• create or manage a listing;
• make a booking or purchase;
• contact us;
• submit a review;
• save favourites;
• complete a form;
• subscribe to marketing;
• enter a promotion or competition;
• respond to a survey; or
• otherwise use Dorset365.

Information Collected Automatically

When you use Dorset365, certain Technical and Usage Data may be collected automatically through cookies, server logs and similar technologies.

Non-essential technologies are used subject to applicable consent requirements.

Information From Businesses

Where you book or purchase something from a business through Dorset365, that business may provide information to us where necessary to administer your booking, resolve an enquiry, process a refund or provide customer support.

Information From Third Parties

We may receive information from organisations such as:

• payment processors;
• authentication providers;
• analytics providers;
• advertising and marketing providers;
• fraud prevention and security providers;
• businesses listed on Dorset365;
• event organisers;
• booking or ticketing providers; and
• publicly available sources.

We only use information received from third parties where we have a lawful basis to do so.

We only process personal information where we have a lawful basis under UK data protection law.

Depending on the circumstances, we may rely on:

Performance of a contract — where processing is necessary to provide a service you have requested or to take steps before entering into a contract.

Legal obligation — where processing is necessary for us to comply with the law.

Legitimate interests — where processing is necessary for our legitimate business interests or those of another organisation and those interests are not overridden by your rights and freedoms.

Consent — where you have freely given us permission to process your information for a particular purpose.

We may use your information to:

• create and administer your Dorset365 account;
• authenticate users and protect accounts;
• provide Dorset365's features and services;
• process bookings and orders;
• facilitate transactions;
• communicate booking information;
• connect customers with participating businesses;
• process payments and refunds;
• provide customer support;
• manage business accounts and listings;
• administer deals, events and promotions;
• send service-related communications;
• personalise your experience;
• maintain favourites and account preferences;
• prevent fraud, abuse and unauthorised access;
• protect Dorset365, our users and participating businesses;
• investigate complaints and disputes;
• maintain accounting and transaction records;
• comply with tax, regulatory and legal requirements;
• understand how Dorset365 is used;
• diagnose technical problems;
• improve the website, products and services;
• develop new Dorset365 features;
• measure the effectiveness of our services; and
• send marketing communications where permitted by law.

Where we rely on legitimate interests, we consider whether our interests are proportionate and whether your privacy rights outweigh those interests.

Dorset365 provides a platform through which customers can discover and transact with participating businesses, venues, attractions, event organisers and other providers.

When you make a booking or purchase, we may share information necessary to fulfil that transaction with the relevant provider.

This may include:

• your name;
• contact details;
• booking reference;
• ticket or order details;
• number of attendees;
• booking date;
• information required for admission or fulfilment; and
• relevant customer requests.

The relevant business may process this information as an independent data controller for purposes connected with providing its services.

Where this occurs, that business is responsible for its own use of your personal information and its own compliance with data protection law.

You should consult the relevant business's privacy information where appropriate.

We may send you information about Dorset365, events, attractions, deals, activities, offers and participating businesses where permitted by law.

Where consent is required, we will ask for it before sending such communications.

You can unsubscribe from marketing at any time by:

• selecting the unsubscribe option contained in a marketing email;
• changing your communication preferences within your account, where available; or
• contacting us.

Opting out of marketing does not prevent us from sending necessary transactional or service communications, such as booking confirmations, security notices or important account information.

We will not sell your personal information to third parties for their own direct marketing.

Where consent is legally required before information is shared with another organisation for its own electronic marketing purposes, we will obtain that consent.

Dorset365 uses cookies and similar storage or access technologies.

Some technologies are strictly necessary for the operation, security and functionality of Dorset365.

Other technologies may be used for purposes such as:

• analytics;
• measuring website performance;
• remembering preferences;
• improving user experience;
• advertising; and
• measuring marketing campaigns.

Where required by the Privacy and Electronic Communications Regulations (PECR) and applicable data protection law, non-essential technologies will not be activated until you have provided the required consent.

You can manage or withdraw your choices through Dorset365's cookie consent controls where available.

Withdrawing consent does not affect the lawfulness of processing that occurred before consent was withdrawn.

Further details about the specific technologies used by Dorset365, their providers, purposes and duration should be provided in our Cookie Policy.

We may share personal information with organisations where reasonably necessary to operate Dorset365.

Businesses and Event Organisers

Where necessary to administer or fulfil your booking, purchase or enquiry.

Payment Providers

To securely process transactions, refunds, fraud checks and related payment services.

Hosting and Infrastructure Providers

Providers that host or support Dorset365's websites, applications, databases, communications and infrastructure.

Email and Communications Providers

Where necessary to send account, booking, transactional or marketing communications.

Analytics Providers

Where permitted, to understand how Dorset365 is used and improve our services.

Professional Advisers

Including accountants, auditors, lawyers, insurers and other professional advisers.

Fraud Prevention and Security Providers

Where reasonably necessary to detect, investigate or prevent fraud, abuse, security incidents or unlawful activity.

Regulators, Authorities and Law Enforcement

Where disclosure is required by law or reasonably necessary to protect legal rights, prevent crime, comply with regulatory obligations or respond to a lawful request.

Corporate Transactions

If AppServe Ltd or Dorset365 is involved in a merger, acquisition, restructuring, financing or sale of some or all of its business or assets, information may be disclosed to relevant professional advisers and prospective purchasers subject to appropriate safeguards.

We require service providers processing personal information on our behalf to protect that information and process it only for authorised purposes and in accordance with applicable law.

Some organisations that provide services to Dorset365 may process information outside the United Kingdom.

Where a transfer of personal information constitutes a restricted international transfer under UK data protection law, we will ensure that an appropriate transfer mechanism or safeguard is used.

Depending on the circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the EU Standard Contractual Clauses; or
• another legally recognised transfer mechanism.

Where appropriate, we also assess whether additional measures are necessary to adequately protect personal information.

You may contact us for further information about safeguards relating to international transfers.

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• unlawful processing;
• accidental loss;
• destruction;
• alteration; and
• disclosure.

These measures may include, where appropriate:

• encrypted communications;
• secure password storage;
• access controls;
• authentication controls;
• network and application security;
• monitoring and logging;
• backups;
• restricted administrative access; and
• security procedures.

Access to personal information is limited to people and service providers that reasonably require it for legitimate purposes.

No internet-based service can guarantee absolute security. However, we regularly review our security arrangements and take reasonable steps to protect the information entrusted to us.

We maintain procedures for responding to suspected personal data breaches and will notify affected individuals and the ICO where we are legally required to do so.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, regulatory, tax, accounting, security and reporting requirements.

Retention periods depend on factors including:

• the type of information;
• why it was collected;
• whether an account remains active;
• the existence of an ongoing booking or transaction;
• legal limitation periods;
• accounting and tax requirements;
• fraud prevention requirements; and
• whether information is required to establish, exercise or defend legal claims.

Transaction and accounting records may need to be retained for up to six years or longer where required by law.

Account information will generally be retained while your account remains active and for an appropriate period afterwards.

Marketing information may be retained until you withdraw consent, object to marketing or the information is no longer reasonably required.

We may retain a limited suppression record after you unsubscribe to ensure that we respect your marketing preference.

Where information is no longer required, we will delete, anonymise or otherwise securely dispose of it in accordance with our retention procedures.

Depending on the circumstances, UK data protection law gives you rights in relation to your personal information.

These may include the right to:

Request Access

Ask for confirmation that we process your personal information and request a copy of that information.

Request Correction

Ask us to correct inaccurate or incomplete personal information.

Request Erasure

Ask us to delete your personal information in certain circumstances.

This right is not absolute, and we may need to retain information where there is a lawful reason to do so.

Request Restriction

Ask us to restrict the processing of your information in certain circumstances.

Object to Processing

Object to processing based on legitimate interests in certain circumstances.

You have an absolute right to object to the use of your personal information for direct marketing.

Request Data Portability

Where applicable, request certain information in a structured, commonly used and machine-readable format or ask us to transfer it to another organisation.

Withdraw Consent

Where we rely on your consent, you may withdraw it at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights Relating to Automated Decision-Making

Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

Dorset365 does not intend to make significant decisions about users solely through automated decision-making unless appropriate safeguards and legal grounds are in place.

To exercise your data protection rights, contact us at:

info@dorset365.com

We may need to request information from you to confirm your identity before responding to certain requests.

You will not normally be required to pay a fee.

However, applicable data protection legislation may allow us to charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

We aim to respond to valid requests within the period required by applicable data protection legislation.

Dorset365 may contain links to websites, applications or services operated by third parties.

Selecting those links may allow third parties to collect or process information about you.

We do not control third-party websites and are not responsible for their privacy practices.

We encourage you to read the privacy information provided by any third-party service you use.

We may update this Privacy Policy periodically to reflect:

• changes to Dorset365;
• new products or services;
• changes to how we process personal information;
• changes to our service providers;
• legal or regulatory developments; or
• improvements to our privacy practices.

The latest version will be published on Dorset365 and the Last updated date at the top of this page will be amended.

Where a change materially affects how we use your personal information, we will take reasonable steps to bring the change to your attention where required.

If you are concerned about how we have handled your personal information, please contact us first so that we can investigate your concerns.

You also have the right to complain to the:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

The ICO provides further information about data protection rights and making a complaint through its website.

Questions about this Privacy Policy, Dorset365's use of personal information or the exercise of your data protection rights should be directed to:

AppServe Ltd
Trading as Dorset365

Registered company number: 16814893
Registered office: 320 Firecrest Court, Warrington, United Kingdom, WA1 1RG
Email: info@dorset365.com
Website: dorset365.com

© 2026 AppServe Ltd. All Rights Reserved.