Dot5 Sub-Processors and Service Providers
Version 1.0
Last updated: October 1, 2026
We record material additions and removals in the change history at the end of this page, so customers can see when this list last changed. Older entries may be summarised or archived over time. Dot5™ is the trademark of Wicketech, LLC. To support Dot5 in delivering its Services, Wicketech, LLC engages service providers and sub-processors to assist with its data processing activities on behalf of Dot5 customers, as defined in our Terms of Use and Data Processing Agreement.
What is a sub-processor?
When Dot5 engages a third-party service provider in our capacity as a data processor for our customers' personal data, the General Data Protection Regulation ("GDPR") and a number of other global privacy frameworks call these third parties sub-processors. Sub-processors are service providers who have, or potentially will have, access to or process personal data that Dot5 processes for, and on behalf of, our customers.
This page sets out the sub-processors and service providers we use, what data they handle, what they do, and where they are established.
Due diligence
We carry out due diligence on our service providers (including sub-processors) when we engage them and review them periodically afterwards. This includes reviewing their security certifications and data protection terms. Our service providers are bound by contract terms designed to ensure that they process personal data only for the purpose of providing services to Dot5, in line with our commitments to customers and applicable data protection law.
Categories of data referenced below
To keep this page readable, we use the following shorthand:
User Content
Personal data that our customers and their users enter into the Dot5 platform. This includes guest, employee, vendor and contractor profiles and contact details — including, where children attend an event with a parent, guardian or other responsible adult, information about those children that the customer enters or maintains in the platform; scheduling, shifts and wage data; event, logistics and asset records; identity and travel documents; and uploaded files and agreements. It may include special-category data such as dietary, accessibility and allergy information.
Account data
Data about Dot5 account holders and their users, such as name, email address, phone number, billing address, user and organization identifiers, and tax/VAT ID.
Billing data
Subscription and transaction records, payment status, invoice details, and payment metadata.
Usage data
Product analytics and diagnostics, such as pages visited, feature interactions, clicks and scrolling, session activity, session replay recordings and frontend errors, together with the identifiers linked to them. Session replay masks input fields and form content, but other text and images shown on screen, such as event details and names shown in lists, may be visible in recordings, so Usage data may include User Content displayed in the platform.
Enquiry data
The information an individual includes when contacting Dot5 support, together with information our live chat collects to continue the conversation: approximate location (town and country) derived from the IP address, and the time the individual was last active.
Visitor data
Information collected from visitors to our marketing website, such as unique-visitor identifiers, session timing and basic log data.
List of sub-processors
These providers may access or process personal data that Dot5 processes on behalf of its customers. Some of these providers are engaged through V.Two, our development partner, in connection with building, monitoring and supporting the platform. Dot5 remains fully responsible to its customers for their processing.
| NAME | DATA | PURPOSE OF PROCESSING | ENTITY COUNTRY |
|---|---|---|---|
| V.Two LLC | User Content, Account data, Billing data, Usage data and Enquiry data | Software development, maintenance, deployment, infrastructure operation and technical support of the Dot5 platform | United States |
| Amazon Web Services, Inc. | User Content and Account data | Cloud infrastructure provider — database hosting, file storage, email delivery, content delivery and message queuing. See AWS's list of sub-processors. | United States |
| Stripe, LLC | Guest payer details entered into Stripe's payment form, payment amount and date, invoice reference, payment, refund and dispute status. | Processing of payments made by subscribers' guests through Dot5, for subscribers who obtain a Stripe merchant account through Dot5 (Connect marketplace payments). Stripe acts as an independent controller, not as our sub-processor, for the identity and business verification information it collects from subscribers when they set up that account. See Stripe's list of sub-processors. | United States |
| PostHog, Inc. | Usage data, including session replay recordings (see Usage data above) | Product analytics, session replay and frontend error tracking. See PostHog's list of sub-processors. | United States |
| Crisp IM SAS | Enquiry data | Live chat and customer support. Some conversations are answered first by Hugo, an AI support agent built into Crisp's service and running on Crisp's own systems, which passes the conversation to our team when it cannot help. Where our team turns on translation for a conversation, the message text is sent to Microsoft Corporation (Microsoft Azure), which Crisp uses for translation. See Crisp's list of sub-processors. | France. Data hosted in the EU; connection logs only (IP address, date, browser and source website) may pass through Crisp's relay servers in the United States, United Kingdom and Singapore. |
List of service providers
As set out in our Data Processing Agreement, Dot5 acts as a controller in relation to certain data about the operation, support and use of the Services, including for billing, account management, technical support and product development. The providers below support that processing. They do not have routine access to User Content.
| NAME | DATA | PURPOSE OF PROCESSING | ENTITY COUNTRY |
|---|---|---|---|
| Stripe, LLC | Account data and Billing data | Payment processing, subscription billing and invoicing | United States |
| Google LLC | Account data, Enquiry data, and personal data about customers, leads and contacts held in email, files and pipeline records | Email, calendaring, contacts, cloud storage and collaboration tools (Google Workspace) | United States |
| Slack Technologies, LLC | Internal team communications, which may reference Account data and Enquiry data, including the name and email address of a user when we escalate a technical support issue to V.Two | Internal messaging, coordination and file sharing, including escalation of technical support issues to V.Two, our development partner | United States |
| Squarespace, Inc. | Visitor data | Hosting and measurement of our marketing website (dot5.io) | United States |
| GitHub, Inc. | Developer account identifiers (username, name, email); commit metadata; issue/PR content. No customer personal data. | Source-code hosting, version control, issue tracking and code review | United States |
| Circle Internet Services, Inc. (CircleCI) | Developer account identifiers via GitHub-linked login (username, email); build metadata and logs. No customer personal data — synthetic test data only; no DB records or credentials in logs. | Continuous integration / continuous deployment (CI/CD) pipelines | United States |
| Xero, Inc. | Staff, vendor and customer identity, contact, banking and transaction data; expense receipts | Cloud accounting, invoicing and bookkeeping platform | United States |
| Anthropic PBC | Account identifiers (name, work email, organisation ID); prompt, file and output content submitted by staff. No customer User Content. | AI assistant used internally for drafting and analysis. | United States |
International transfers
Dot5 is established in the United States and several of our sub-processors are located outside the European Economic Area and the United Kingdom.
Transfers of customer personal data to Dot5 are made under Module 2 (Controller to Processor) of the European Commission's Standard Contractual Clauses, incorporated into our Data Processing Agreement, with Irish law governing and the courts of Ireland having jurisdiction. Clause 9(a) option 2 applies, meaning customers give general authorisation for our use of sub-processors subject to the 30-day notice and objection process described below. The UK International Data Transfer Addendum applies to transfers originating in the United Kingdom.
Onward transfers to the sub-processors listed above are covered by the data protection terms in our agreements with each of them, which provide a valid transfer mechanism, such as the EU Standard Contractual Clauses and, for UK personal data, the UK International Data Transfer Addendum. Where a provider is also certified under the EU–US Data Privacy Framework, we treat that certification as an additional safeguard only and do not rely on it as our transfer mechanism.
Updates to this page
Our business needs and the providers we use may change from time to time. We may remove a provider in order to consolidate and minimise our supply chain, or add one where doing so improves the Services.
We update this page whenever a provider is added or removed, so that it always reflects the sub-processors and service providers currently in use.
This page is not our only notice to customers.
Under our Data Processing Agreement we notify customers directly, and in advance, of any intended change to our sub-processors. To make sure you receive those notices, please keep your account's administrative contact details up to date, or write to us at privacy@dot5.io to be added to our notification list.
A customer may object to the addition of a sub-processor on reasonable grounds relating to an actual or potential breach of data protection law, by giving us written notice setting out those grounds within 30 days of our notification. We will then work with the customer in good faith to address the objection. If we decide to retain the sub-processor, we will tell the customer at least 30 days before that sub-processor is authorised to process their personal data. The customer may immediately stop using the affected parts of the Services, and may terminate those parts within 30 days.
The full terms are set out in our Data Processing Agreement, which prevails over this summary.
For more information about our privacy practices, please see our Privacy Policy. If you have questions about this page, please contact us at privacy@dot5.io.
Change history
October 1, 2026: first publication of this list.