Is Calendly GDPR compliant? DPA, data location and EU transfers

What Calendly's documentation says

Calendly LLC is a US company and the contracting party in Calendly's terms. Its help centre says user and invitee data is stored in US data centres run by Google Cloud and AWS.

For transfers of EU personal data to the US, Calendly's data processing addendum relies on the EU-US Data Privacy Framework. If the framework is invalidated or stops being available, the DPA falls back to Standard Contractual Clauses. Calendly also publishes a list of its sub-processors, linked in the sources below.

So can you use it under the GDPR?

A transfer under the Data Privacy Framework rests on an adequacy decision of the European Commission, so it is a recognised route. If the framework fell away and the SCCs took over, the EDPB expects you to assess whether extra safeguards are needed. In both cases you remain the controller: you need a lawful basis, a privacy notice that mentions the transfer, and booking questions that don't collect more than you need.

Where it gets harder is sensitive bookings. An event type called "Medical consultation" or a free-text question about the reason for a meeting can reveal health or other special-category data under Article 9. That is true with any scheduling tool, so look at your own form before you look at the vendor.

An Article 28 checklist for any scheduling tool

Article 28 GDPR lists what a processor contract must contain. For a booking tool, these are the points worth reading closely:

1. Sub-processors: who they are, where they process data, and how you hear about changes. Include email, payment and calendar services, not only the main host.

2. Security measures: access control, encryption, backups and incident handling, described in the DPA or its annex.

3. Breach notification: Article 33(2) requires the processor to tell you without undue delay. The contract should say how.

4. Transfers: for each transfer outside the EEA, the adequacy decision or Article 46 safeguard it relies on.

5. Retention and deletion: whether you can set a retention period, delete a person's data on request, and get data returned or deleted when the contract ends.

Calendly's entity and VAT for procurement

For Calendly's VAT details, check the order form or invoice you receive. Kalendarius is operated by Ugur Akcelik in Turin, Italy (VAT IT12938420010); Paddle bills our subscriptions as merchant of record and issues the invoices.

How Kalendarius handles the same questions

Our application and database run on Hetzner servers in Germany. EU hosting covers that part only. If you connect Google Calendar or Microsoft 365, those providers process calendar data under their own terms; Paddle processes payment data, an email delivery provider sends booking emails, and error reports go to Sentry, a US company that stores them in its EU region. You still decide the lawful basis, the form fields and the retention period.

Completed appointments are deleted automatically after the period you set (up to 90 days on Personale and Professionista, 180 on Team, 365 on Business and Enterprise). If a guest asks to be erased, email info@kalendarius.com and we anonymise their bookings by email address: name, email address, notes and consent time are removed. The rest of the record (time, status, answers to custom questions, cancellation reason) is deleted at the end of your retention period. Events already written to a connected calendar stay there. We can also send you an export of a guest's bookings. Public booking pages load no advertising or analytics trackers; Sentry error monitoring runs there for bug fixing. A Data Processing Agreement (DPA) for the Business and Enterprise plans is in legal review; contact info@kalendarius.com. For a vendor-neutral checklist, see GDPR scheduling software; for a feature and price comparison, see the Calendly alternative page.

Primary sources and verification

Calendly details are based on its Data Processing Addendum, data storage and international transfers documentation, subprocessor list, and Customer Terms. Transfer guidance is based on the European Commission’s international-transfer guidance and the EDPB Recommendations 01/2020. Sources checked 25 September 2026.