Cal.com Data Processing Agreement

Version 2.3 — Effective date: November 1, 2026

This Data Processing Agreement (“DPA”) forms part of the agreement governing Customer’s use of the Services (“Agreement”) between the customer identified in the Agreement (“Customer”) and Cal.com, Inc. (“Cal.com”). Customer and Cal.com are each a “Party” and together the “Parties.” Subject to §14.2, this DPA applies to every Customer account and plan governed by the Agreement and becomes binding as provided in §16.4. Incorporation of this DPA into a master services agreement does not incorporate Cal.com’s website Terms of Service into that agreement.

1. Scope and roles

1.1 This DPA applies where Cal.com processes Personal Data on Customer’s behalf in providing the Services.

1.2 For Customer Personal Data, Customer acts as a Controller or as a Processor on behalf of another Controller, as applicable, and Cal.com acts as Customer’s Processor or Subprocessor accordingly. For personal data Cal.com processes for its own purposes, including account administration, billing, marketing, security, and compliance, Cal.com acts as an independent Controller, as described in Cal.com’s Privacy Policy.

1.3 This DPA does not govern processing by third-party services that Customer selects, connects, or configures and that Cal.com does not operate as part of the Services, for example Customer’s own calendar, video-conferencing, CRM, webhook, SMTP, or automation provider. It continues to apply to Cal.com’s processing of Customer Personal Data in providing integrations with those services. Customer is responsible for its relationship with, instructions to, and lawful use of those third parties. Features Cal.com provides as part of the Services, including features delivered through Subprocessors such as Cal.com-hosted video and transactional email, remain within this DPA.

1.4 Customer must not submit, upload, or otherwise make available through the Services any Protected Health Information unless a Business Associate Agreement (“BAA”) covering the relevant Services has been executed between Customer and Cal.com. Customer is responsible for any Protected Health Information submitted in breach of this section. Customer may process Personal Data subject to Article 9 GDPR or equivalent heightened protection under Applicable Data Protection Law through the functionality provided under the Agreement, provided Customer is responsible for determining that it has a lawful basis and any required condition for doing so and for configuring the Services appropriately for that data.

1.5 Where Customer has executed a BAA, the BAA governs any conflict between this DPA and the BAA concerning the use, disclosure, privacy, or security of Protected Health Information (as defined in the BAA). This DPA continues to govern all other Customer Personal Data and fills any gap the BAA does not address.

2. Definitions and interpretation

“Applicable Data Protection Law” means data-protection and privacy laws applicable to the processing of Customer Personal Data, including, where applicable, the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, US State Privacy Laws, and implementing or supplementary laws.

“Customer Personal Data” means Personal Data processed by Cal.com on Customer’s behalf in connection with the Services.

“EEA” means the European Economic Area.

“Executed DPA” means a data processing agreement, other than this DPA, that Customer and Cal.com have both signed.

“GDPR” means Regulation (EU) 2016/679.

“Personal Data Breach” has the meaning given in the GDPR.

“SCCs” means the standard contractual clauses for the transfer of personal data to third countries adopted by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

“Swiss Amendments” means the modifications to the SCCs required by the Swiss Federal Data Protection and Information Commissioner for transfers subject to the Swiss Federal Act on Data Protection.

“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

“Services” means Cal.com’s scheduling, booking, video, communication, integration, and related hosted services provided under the Agreement.

“Subprocessor” means a third party engaged by Cal.com to process Customer Personal Data on Cal.com’s behalf in connection with the Services. Vendors that process personal data only for Cal.com’s own purposes as an independent Controller, including analytics and advertising tools on Cal.com’s marketing website, are not Subprocessors.

“Subprocessor List” means Cal.com’s current list of Subprocessors, available at trust.cal.com.

“US State Privacy Laws” means the California Consumer Privacy Act as amended by the California Privacy Rights Act, and other US state laws of general application governing the processing of personal information, together with their implementing regulations, in each case to the extent applicable.

“BAA” means a Business Associate Agreement, if executed between Customer and Cal.com, governing the use and disclosure of Protected Health Information under HIPAA. Where no BAA is in effect, references to a BAA in this DPA do not apply.

“Controller,” “Processor,” “Data Subject,” “Personal Data,” “Processing,” and related terms have the meanings given in Applicable Data Protection Law. Under US State Privacy Laws, “Controller” includes “business,” “Processor” includes “service provider” and “contractor,” and “Personal Data” includes “personal information.”

3. Processing instructions

3.1 Cal.com will process Customer Personal Data only: (a) to provide, secure, support, maintain, and improve the Services in accordance with the Agreement, this DPA, Customer’s documented configuration and use of the Services, and applicable law; (b) on Customer’s further documented instructions consistent with the Agreement and this DPA; or © as required by applicable law, in which case Cal.com will inform Customer of that legal requirement before processing, unless applicable law prohibits that notice.

3.2 Customer is responsible for ensuring that its instructions and its collection, use, disclosure, and other processing of Customer Personal Data through the Services comply with Applicable Data Protection Law.

3.3 The subject matter, duration, nature, purposes, categories of Data Subjects, categories of Personal Data, and processing operations are set out in Annex 1.

3.4 If Cal.com considers that an instruction from Customer infringes Applicable Data Protection Law, Cal.com will promptly inform Customer of that opinion, and Cal.com may suspend performance of the affected instruction until Customer confirms, modifies, or withdraws it.

4. Confidentiality and personnel

4.1 Cal.com will ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations or are under an appropriate statutory duty of confidentiality.

4.2 Cal.com will limit access to Customer Personal Data to personnel and Subprocessors who require access to provide, secure, support, or maintain the Services.

5. Security

5.1 Taking into account the state of the art, implementation costs, nature, scope, context, and purposes of processing, and the risks to Data Subjects, Cal.com will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, as required by Article 32 GDPR.

5.2 Cal.com’s security measures include, as appropriate: access control and least-privilege practices; encryption in transit and at rest where appropriate; authentication controls, including SSO and multi-factor authentication for relevant systems; secure development, vulnerability management, logging, monitoring, incident response, backup, and resilience practices; and periodic security testing and independent assurance activities appropriate to the Services.

5.3 Cal.com may update or modify its security measures from time to time, provided that the changes do not materially diminish the overall security of the Services.

6. Subprocessors

6.1 General authorization. Customer grants Cal.com general written authorization to engage Subprocessors to process Customer Personal Data for the provision, operation, security, support, maintenance, and improvement of the Services. Where Customer acts as a Processor, any required Controller authorization must be obtained and communicated in accordance with the applicable SCCs; Customer’s authorization does not replace it.

6.2 Current Subprocessors. Customer authorizes Cal.com’s use of the Subprocessors listed in the Subprocessor List as of the effective date of this DPA.

6.3 Changes to Subprocessors. Before a new or replacement Subprocessor begins processing Customer Personal Data, Cal.com will give Customer prior written notice, and will use commercially reasonable efforts to give that notice early enough for Customer to review the change and object under §6.4. Notice may be provided by email to Customer’s account administrator or privacy/legal contact, by in-product notification, or another documented electronic method. Updating the Subprocessor List alone will not be Cal.com’s only notice method.

6.4 Objections. Customer may object in writing within a reasonable time after receiving notice, and where practicable before the new Subprocessor begins processing, on reasonable and substantiated grounds relating to data protection. The Parties will work in good faith to resolve a valid objection. If no reasonable resolution is available and Customer cannot reasonably continue to use the affected Service without the proposed Subprocessor, Customer may discontinue the affected Service or terminate the affected portion of the Agreement. Cal.com will refund any prepaid, unused fees for the terminated affected Service.

6.5 Subprocessor obligations. Before a Subprocessor processes Customer Personal Data, Cal.com will enter into a written agreement requiring the Subprocessor to protect Customer Personal Data with obligations no less protective than those applicable to Cal.com under this DPA, as required by Applicable Data Protection Law.

6.6 Responsibility. Cal.com remains responsible for the performance of its Subprocessors’ data-protection obligations to the extent required by Applicable Data Protection Law.

6.7 Downstream subprocessors. Cal.com’s Subprocessors may engage their own subprocessors where permitted by their agreement with Cal.com and Applicable Data Protection Law. Cal.com will maintain contractual accountability through its direct Subprocessor and does not need to list every downstream subprocessor as a direct Cal.com Subprocessor. To the extent required by Applicable Data Protection Law, Cal.com will proactively make available to Customer current information identifying the Subprocessors and downstream subprocessors that process Customer Personal Data, including their names, addresses, contact persons and contact details, and the processing entrusted to them. This information may be provided through accessible vendor lists or other documented resources and will be kept up to date.

6.8 PHI-capable Subprocessors. Where Customer has executed a BAA, Cal.com will not permit a Subprocessor to create, receive, maintain, or transmit Protected Health Information unless that Subprocessor is bound by a written agreement containing protections consistent with the BAA, including a restriction on using Protected Health Information to train, fine-tune, or improve any artificial intelligence or machine-learning model.

7. Assistance with data-subject requests

7.1 Taking into account the nature of processing, Cal.com will provide reasonable assistance to Customer, through appropriate technical and organizational measures, to enable Customer to respond to Data Subject requests.

7.2 If Cal.com receives a Data Subject request relating to Customer Personal Data, Cal.com will, unless legally prohibited, promptly notify Customer and will not respond to the request except on Customer’s documented instructions or as required by applicable law.

7.3 Customer remains responsible for handling Data Subject requests in accordance with its role as Controller or Processor and its obligations under Applicable Data Protection Law. Cal.com’s assistance is governed by this DPA and the applicable SCCs.

8. Personal Data Breaches

8.1 Cal.com will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

8.2 Cal.com will provide information reasonably available to it to assist Customer in meeting its notification and other legal obligations, including, where available: the nature of the breach; categories and approximate number of affected Data Subjects and records; likely consequences; measures taken or proposed to mitigate the breach; and a contact point for further information.

8.3 Information may be provided in phases as it becomes available. Cal.com will cooperate reasonably with Customer in investigating, mitigating, and remediating the Personal Data Breach.

8.4 Cal.com’s notification of, or response to, a Personal Data Breach is not an acknowledgement by Cal.com of fault or liability.

9. DPIAs and supervisory authority consultation

Taking into account the nature of processing and information available to Cal.com, Cal.com will provide reasonable assistance to Customer with data-protection impact assessments and consultations with supervisory authorities required under Articles 35 and 36 GDPR or equivalent Applicable Data Protection Law, solely to the extent the request concerns Cal.com’s processing of Customer Personal Data.

10. Return and deletion

10.1 During the term, Customer may access and export Customer Personal Data through the Services where the relevant functionality is available. At the end of the processing services, Customer may choose return of Customer Personal Data followed by deletion of existing copies, or deletion, as required by Applicable Data Protection Law and the applicable SCCs.

10.2 Following termination or expiration of the Services, Customer will have at least 30 days to export Customer Personal Data, unless Customer instructs earlier deletion or the Agreement or Customer’s configuration provides a longer period.

10.3 Following the applicable export period, Cal.com will delete Customer Personal Data in accordance with its standard deletion schedule, normally within 90 days, unless retention is required by applicable law. On Customer’s written request, Cal.com will confirm in writing when deletion under this section has been completed, where Applicable Data Protection Law requires it or such confirmation is reasonably available.

10.4 Customer Personal Data remaining in backups after termination will remain protected and be put beyond ordinary use pending deletion under the applicable backup-retention schedule. Any retention, restoration, or other processing must be permitted by Applicable Data Protection Law and the applicable SCCs.

10.5 This section does not require Cal.com to delete data it processes as an independent Controller, where Cal.com has a separate lawful basis and purpose, such as billing, tax, fraud prevention, security, or legal-compliance records.

10.6 Where a BAA applies, return or destruction of Protected Health Information, including copies in backups, is governed by that BAA and applicable law. Any continued retention based on infeasibility must satisfy those requirements, and the BAA’s protections continue for retained Protected Health Information.

11. Audits and compliance information

11.1 Cal.com will make available information reasonably necessary to demonstrate compliance with this DPA.

11.2 Before requesting an audit, Customer will use Cal.com’s current compliance documentation, including relevant security reports, certifications, audit summaries, questionnaires, and written responses, where such materials reasonably demonstrate compliance.

11.3 If those materials are not reasonably sufficient, Customer may conduct an audit of Cal.com’s relevant processing activities no more than once every 12 months, subject to: at least 30 days’ prior written notice; a scope reasonably related to Customer Personal Data and this DPA; conduct during normal business hours; reasonable measures to avoid disruption of Cal.com’s operations; an independent, qualified auditor bound by confidentiality obligations and not a competitor of Cal.com; and Customer bearing its own costs, unless a material non-compliance by Cal.com is identified.

11.4 Cal.com may object to an auditor or audit plan on reasonable security, confidentiality, or operational grounds and will work in good faith to agree a suitable alternative. The procedures and limitations in this section apply only to the extent consistent with Applicable Data Protection Law and the applicable SCCs. They do not restrict an audit or inspection required by a competent supervisory authority or otherwise required under those provisions.

12. International transfers

12.1 Cal.com may transfer Customer Personal Data outside the EEA, the United Kingdom, or Switzerland only where it has a lawful transfer mechanism under Applicable Data Protection Law.

12.2 Appropriate mechanisms include: an adequacy decision; the SCCs, together with the UK Addendum and the Swiss Amendments where applicable, as set out in §12.4; if and for so long as Cal.com is certified under the EU-U.S. Data Privacy Framework or the UK Extension to that Framework, that Framework; or another valid transfer mechanism recognized by Applicable Data Protection Law.

12.3 Where required, Cal.com will implement supplementary measures and make relevant transfer information available through the Subprocessor List or on reasonable request.

12.4 Standard Contractual Clauses. The SCCs apply to transfers of Customer Personal Data that fall within their permitted scope and require those safeguards because no other valid transfer mechanism under §12.2 covers the transfer. They are incorporated into this DPA and completed by the Cal.com Standard Contractual Clauses Schedule at cal.com/dpa-scc (the “SCC Schedule”). The Parties enter into them through valid execution as specified in the SCC Schedule. A change of transfer mechanism does not automatically extinguish existing SCC obligations; termination or revocation must comply with the applicable transfer instruments, and accrued rights are unaffected. The following elections apply:

(a) Module Two (controller to processor) applies where Customer is a Controller of the Customer Personal Data, and Module Three (processor to processor) applies where Customer is itself a Processor acting on behalf of a third-party Controller. Customer is the “data exporter” and Cal.com is the “data importer.” Where Customer acts as a Processor, Customer warrants that it has the authority and instructions from each relevant Controller necessary to appoint Cal.com under Module Three and to pass those instructions to Cal.com, and Customer will indemnify Cal.com against claims by those Controllers arising from Customer’s lack of that authority or from instructions Cal.com receives through Customer. This indemnity does not limit Cal.com’s obligations or liability under the SCCs.

(b) Clause 7 (docking clause) applies.

© In Clause 9(a), Option 2 (general written authorisation) applies. The advance notice period is the specified period in §6.3 and the SCC Schedule. Notice and authorization must comply with the applicable Module.

(d) In Clause 11(a), the optional language on independent dispute resolution does not apply.

(e) In Clause 13 and Annex I.C, the competent supervisory authority is determined under Clause 13(a) and identified in the Customer-specific information incorporated into Annex I.C of the SCC Schedule.

(f) In Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland. In Clause 18(b), disputes are resolved before the courts of Ireland.

(g) The Parties’ details and execution records are identified in Annex I.A of the SCC Schedule; the transfers are described in Annex I.B; the security measures are specified in Annex II; and subprocessor information and authorizations are addressed in Annex III and Clause 9 of that Schedule.

(h) For transfers subject to the UK GDPR that require this safeguard, the UK Addendum applies and amends the SCCs as set out in it. Tables 1 to 3 are completed with the information in Part 6 of the SCC Schedule. In Table 4 only Cal.com, as the Importer, may end the UK Addendum as set out in section 19 of it.

(i) For transfers subject to the Swiss Federal Act on Data Protection, the Swiss Amendments in Part 7 of the SCC Schedule apply. Where a transfer is subject to both the GDPR and that Act, the SCCs apply in parallel under both regimes.

(j) If the SCCs are amended, replaced, or invalidated, the Parties will cooperate in good faith to adopt the successor or an alternative valid mechanism. If there is a conflict between the SCCs and this DPA or the Agreement, the SCCs prevail.

13. Government and law-enforcement requests

13.1 For Customer Personal Data transferred under the SCCs, Cal.com will comply with Clauses 15.1 and 15.2 of the SCCs. Nothing in this section limits obligations under Applicable Data Protection Law or the applicable SCCs, UK Addendum, or Swiss Amendments.

14. Order of precedence

14.1 If there is a conflict between this DPA and the Agreement concerning the processing of Customer Personal Data, this DPA controls to the extent of that conflict. A signed Order Form changes a provision of this DPA only where it expressly identifies that provision.

14.2 Where Customer and Cal.com have an Executed DPA in effect covering particular processing of Customer Personal Data, that Executed DPA applies instead of this DPA to that processing for as long as it remains in effect.

15. Liability

Each Party’s liability arising from or relating to this DPA is subject to the exclusions and limitations of liability in the Agreement, except to the extent those provisions would contradict or undermine the liability provisions of the applicable SCCs, UK Addendum or Swiss Amendments, or otherwise violate applicable law. This exception applies to liability between the Parties as well as liability to Data Subjects. This DPA does not create an additional contractual data-loss indemnity by Cal.com or a guarantee of backup or recovery beyond the express measures described in §5 and Annex II of the SCC Schedule. This does not limit those express obligations, mandatory liability, or additional data-loss protection expressly agreed in an Executed DPA or signed Order Form.

16. General

16.1 Notices. Notices under this DPA must be in writing and may be sent by email to the applicable Party’s legal, privacy, or account-administration contact. Contractual notices to Cal.com may be sent to legal@cal.com or delivered to Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, United States, Attn: Legal. Privacy requests may be sent to privacy@cal.com.

16.2 Changes. Cal.com may update this DPA where required by law, to reflect changes in the Services, or to address operational needs. Each version carries a version number and effective date, and prior versions remain available in the version history below. Updates must be made in accordance with the Agreement and applicable law. Cal.com will provide reasonable advance written notice through the channels described in §6.3 of any update that materially reduces Customer’s rights or Cal.com’s obligations. Such an update takes effect only after the applicable notice period and any required acceptance. Customer may terminate the affected Services by written notice before the effective date if it does not accept such a materially adverse update. Any refund is limited to amounts required by applicable law or the Agreement. Other updates take effect on publication only to the extent permitted by the Agreement and applicable law. This section does not amend an Executed DPA; amendments to that document are governed by its own terms.

16.3 Governing law and jurisdiction. The governing-law and jurisdiction provisions of the Agreement apply to this DPA. This does not affect the governing law and forum of the applicable SCCs, UK Addendum or Swiss Amendments, as specified in the SCC Schedule, or rights and obligations that cannot lawfully be varied by contract.

16.4 Acceptance. This DPA becomes binding when it is validly incorporated into an Agreement binding on both Parties. Electronic acceptance may be used to the extent permitted by applicable law. Changes to an existing contractual relationship are governed by §16.2 and the Agreement. Execution of the SCCs and the UK Addendum is governed by the SCC Schedule. On request, Cal.com may, at its discretion, provide a copy of this DPA countersigned by Cal.com for Customer’s records. A countersigned record copy has the same terms and effect as the version binding between the Parties and is not an Executed DPA for purposes of §14.2. This does not limit any required execution or right to receive a copy of the binding DPA or applicable SCCs.

16.5 Negotiated terms. Customers who purchase under an Order Form or master services agreement with Cal.com may request an Executed DPA. Cal.com does not otherwise negotiate or modify this DPA.

Annex 1: Details of processing

Annex 2: Subprocessors

Cal.com’s current list of direct Subprocessors is available at trust.cal.com. Vendors that process personal data only for Cal.com’s own purposes as an independent Controller are not Subprocessors for purposes of this DPA.

Annex 3: US State Privacy Laws

This Annex applies to the extent US State Privacy Laws apply to Customer Personal Data. Terms have the meanings given in those laws.

1. Cal.com acts as a service provider or processor to Customer for Customer Personal Data. Customer discloses that data to Cal.com only for the limited and specified business purposes of providing scheduling, booking, account management, communications, video, integrations, customer support, maintenance and security for the Services used by Customer, as further described in Annex 1.

2. Cal.com will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose, including a commercial purpose, other than the business purposes specified in the Agreement and this DPA, or as otherwise permitted by US State Privacy Laws; © retain, use, or disclose Customer Personal Data outside the direct business relationship between Customer and Cal.com, except as permitted by US State Privacy Laws; or (d) combine Customer Personal Data with personal information Cal.com receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted by US State Privacy Laws.

3. Cal.com will comply with applicable obligations under US State Privacy Laws and provide the same level of privacy protection as those laws require of Customer. Cal.com will notify Customer if it determines it can no longer meet its obligations under US State Privacy Laws. Customer may take reasonable and appropriate steps to help ensure that Cal.com uses Customer Personal Data consistently with Customer’s obligations under applicable US State Privacy Laws and, upon notice, to stop and remediate unauthorized use. These rights are exercised in accordance with §11 to the extent its procedures and limitations are consistent with applicable US State Privacy Laws.

4. Cal.com will flow the obligations in this Annex down to its Subprocessors in accordance with §6.5, and will assist Customer in responding to consumer requests in accordance with §7.

5. Where required by applicable US State Privacy Laws, Cal.com certifies that it understands and will comply with the restrictions in this Annex.