Cal.com Standard Contractual Clauses Schedule

Module

Module Two (controller to processor) where Customer is a Controller of the Customer Personal Data. Module Three (processor to processor) where Customer is itself a Processor acting for a third-party Controller. Only the clauses for the applicable Module apply.

§12.4(a)

Clause 7 — Docking clause

Applies. An entity may accede as data exporter or data importer with the agreement of the Parties by completing the Appendix and signing Annex I.A.

§12.4(b)

Clause 8.1 (Module Three) — Instructions

Customer warrants that it holds the authority and instructions of each Controller needed to appoint Cal.com under Module Three and to pass those instructions on. Instructions are handled in accordance with Clause 8.1 of Module Three, including the Controller’s instructions communicated through Customer and any further documented instructions permitted by that Clause.

§12.4(a), §3

Clause 8.5 — Duration of processing and erasure

Processing continues for the duration in Annex I.B. At the end of the processing services, Customer may choose return of the personal data followed by deletion of existing copies, or deletion with certification to Customer, as required by Clause 8.5. DPA §10 applies only to the extent consistent with that Clause. Protection continues until return or deletion is completed; legally required retention is governed by Clause 8.5.

§10

Clause 8.6 — Security

Technical and organisational measures are those in Annex II. Personal Data Breach notification follows DPA §8.

§5, §8

Clause 8.9 — Documentation and compliance (audits)

Audit rights are exercised as described in DPA §11 (compliance information and reports first, on-site or remote audit where those are insufficient or a supervisory authority requires). This describes how the audit right under Clause 8.9 is exercised and does not restrict it.

§11

Clause 9(a) — Use of sub-processors

Option 2: general written authorisation. Notice period: prior written notice before a new or replacement Subprocessor begins processing, given as early as reasonably practicable so that the data exporter has sufficient time to object (DPA §6.3). The Parties agree that this is the time period for the purposes of Clause 9(a). The list of Subprocessors is the live Subprocessor List at trust.cal.com, referred to in Annex III. Customer’s objection right is DPA §6.4.

§12.4©, §6.3–6.4

Clause 11(a) — Redress

The optional independent dispute resolution body language does not apply. Data subjects may lodge complaints with Cal.com at privacy@cal.com, with the competent supervisory authority, and before the courts under Clause 18.

§12.4(d)

Clause 13 — Supervision

The competent supervisory authority is determined under Clause 13(a) as stated in Annex I.C.

§12.4(e)

Clause 15 — Access by public authorities

Clauses 15.1 and 15.2 govern public-authority access to personal data transferred under the SCCs. DPA §13.1 confirms Cal.com’s compliance with those Clauses and does not limit them.

§13.1

Clause 17 — Governing law

Option 1. The SCCs are governed by the law of Ireland.

§12.4(f)

Clause 18(b) — Forum

The courts of Ireland. Clause 18© (data subject’s right to sue in the Member State of habitual residence) is unaffected.

§12.4(f)

Liability (Clause 12)

Nothing in the DPA or the Agreement limits either Party’s liability to data subjects under the SCCs (DPA §15). The Agreement’s liability limitations do not exclude or limit liability governed by Clause 12 of the SCCs. Liability for other claims remains governed by the Agreement, subject to applicable mandatory law.

§15

Name

The Customer identified in the Agreement (the entity or person holding the Cal.com account)

Address

As recorded in Customer’s Cal.com account or Order Form

Contact

The contact person’s name, position, and contact details recorded in the Agreement, Order Form, or Customer account and incorporated into this Annex.

Activities relevant to the transfer

Use of the Cal.com Services to offer, schedule, manage, and hold meetings and related communications with Customer’s users, meeting attendees, and other Data Subjects described in Annex I.B

Role

Module Two: controller. Module Three: processor (acting on behalf of the Controllers who instruct Customer)

Signature and date

As recorded in the execution record incorporating the completed Annex I.A under Part 1.4

Name

Cal.com, Inc.

Address

2261 Market Street #4382, San Francisco, CA 94114, United States

Contact

Felix Kolodziej, Information Security Officer (ISO), privacy@cal.com (Attn: Privacy)

Activities relevant to the transfer

Provision, operation, support, maintenance, security, and improvement of the Cal.com Services as described in Annex I.B

Role

Processor (Module Two); sub-processor to Customer as processor (Module Three)

Signature and date

As recorded in the execution record incorporating the completed Annex I.A under Part 1.4

Categories of data subjects

Customer’s users, administrators, employees, and contractors; Customer’s prospects, clients, and other contacts; meeting attendees, Bookers, and guests; and other individuals whose personal data Customer or its Authorized Users submit to the Services (DPA Annex 1)

Categories of personal data

Account and profile data; availability data; names, email addresses, phone numbers; booking data, including meeting titles, descriptions, times, locations, notes, guest lists, booking-question responses, and rescheduling or cancellation reasons; support data; technical data such as IP address, device and browser data, and usage logs; and other personal data Customer chooses to submit through the Services

Sensitive data

No special categories of personal data are required to use the Services. Customer may submit them only through fields it configures (for example booking questions); where it does, the measures in Annex II apply. Customer is responsible for establishing the required lawful basis and any applicable condition for processing special categories of personal data. Protected Health Information requiring a Business Associate Agreement may be submitted only under an executed BAA covering the relevant Services. Permission elsewhere in the Agreement does not replace a required BAA

Frequency of the transfer

Continuous, for the duration of the Agreement

Nature of the processing

Collection, storage, organisation, retrieval, consultation, use, transmission at Customer’s direction, support, security monitoring, backup, restoration, deletion, and other processing necessary to provide the Services

Purpose of the transfer and further processing

To provide scheduling, booking, account, communication, video, integration, support, and related product functionality to Customer in accordance with the Agreement and Customer’s documented instructions

Retention period

For the duration of the processing services and thereafter only as necessary to complete the return or deletion required by Clause 8.5, or for retention required by law as permitted by that Clause. Retention information: at least 30 days for export after termination (DPA §10.2); deletion normally within 90 days after that period (DPA §10.3); backup copies deleted under Cal.com’s ordinary backup-retention schedule and protected until then (DPA §10.4)

Transfers to (sub-) processors

Subject matter, nature, and duration: the Subprocessors on the Subprocessor List at trust.cal.com (Annex III) process Customer Personal Data for the purposes stated there (hosting and storage, content delivery, email and SMS delivery, video, payments, support tooling, product analytics, AI features, and internal operations), for the duration of Cal.com’s engagement of each Subprocessor within the term of the Agreement

Customer is established in an EEA Member State

The supervisory authority of that Member State (Clause 13(a), first paragraph)

Customer is not established in the EEA but has a representative under Article 27(1) GDPR

The supervisory authority of the Member State where the representative is established

Customer is not established in the EEA, is subject to Article 3(2) GDPR, and is exempt from appointing a representative under Article 27(2) GDPR

The supervisory authority of the Member State in which the data subjects whose data is transferred are located, as determined under Clause 13(a), third paragraph

Transfers subject to the UK GDPR

The UK Information Commissioner (see Part 6)

Transfers subject to the Swiss FADP

The Swiss Federal Data Protection and Information Commissioner (see Part 7)

Pseudonymisation and encryption

Encryption in transit using TLS for connections to the Services. Encryption at rest for the production database (Amazon RDS, keys managed in AWS KMS), its backups, and object storage, using the hosting provider’s managed encryption (AES-256). Subprocessors’ own encryption controls are assessed under the vendor risk assessment below

Confidentiality, integrity, availability, and resilience

Role-based access control and least privilege for production systems; single sign-on and multi-factor authentication for personnel access to production and administrative systems; separation of production, staging, and development environments; DDoS protection and web application firewall at the network edge

Ability to restore availability and access after an incident

Automated daily backups of production databases with point-in-time recovery, encrypted and access-restricted; documented restoration procedures, tested periodically; incident response plan with defined roles, severity levels, and communication steps, including Customer notification under DPA §8

Regular testing, assessment, and evaluation

Independent third-party penetration testing of the production environment, performed periodically; automated vulnerability scanning; compliance monitoring against ISO 27001 and SOC 2 control sets through Cal.com’s compliance platform; independent audit reports available to Customers under NDA through trust.cal.com; review of code changes before deployment

User identification and authorisation

Unique accounts for all personnel; MFA enforced for production, cloud-console, and code-repository access; access granted on a need-to-know basis and reviewed at least quarterly; access revoked on role change or departure as part of the offboarding process

Protection of data during transmission

Encryption in transit for data sent to and from the Services; API keys for Customer integrations; webhook payloads signed where Customer configures a webhook secret; calendar, video, and other third-party integrations use OAuth or provider-issued credentials

Protection of data during storage

Encryption at rest as above; database access restricted to application services and named engineers through audited channels; no production data in development or test environments except pseudonymised or synthetic data

Physical security of processing locations

Cal.com does not operate its own data centres. Physical security is provided by the hosting Subprocessors (AWS and Vercel), whose relevant services are covered by SOC 2 Type II reports and ISO 27001 certifications within their respective assurance scopes

Event logging

Centralised logging of application, infrastructure, and administrative events; infrastructure server logs retained for 365 days for security investigation; application-level booking audit logging for organisations where booking auditing is enabled

System configuration, including default configuration

Change management under Cal.com’s ISO 27001 and SOC 2 controls: changes to production are reviewed and pass automated checks before deployment

Internal IT and IT security governance and management

Information-security policies approved by management and reviewed annually; a designated security and compliance owner; security awareness training for all personnel on hire and annually; confidentiality undertakings for all personnel with access to Customer Personal Data (DPA §4); vendor risk assessment before engaging a Subprocessor

Certification and assurance of processes and products

ISO/IEC 27001:2022 certification (certificate no. 122217, Prescient Security LLC, valid until 30 October 2028 subject to annual surveillance audits; scope: the information security management system supporting the Cal.com scheduling platform, including infrastructure hosted on AWS); SOC 2 Type II report on the Security criteria (most recent period 21 November 2024 to 30 April 2026, Prescient Assurance LLC); both available to Customers under NDA through trust.cal.com; HIPAA control mapping maintained for BAA Customers

Data minimisation

Customer can configure booking questions and fields through the available Services functionality. The data collected depends on the selected fields, enabled features, and integrations.

Data quality

Users can view and correct data through functionality available to their role. Cal.com assists Customer with other applicable rectification requests under DPA §7.

Limited data retention

Deletion and return under DPA §10; Customer-initiated deletion of bookings and attendee data through the Services; Cal Video recordings and transcripts stored in Cal.com-controlled object storage and deleted when the Customer deletes them or the booking, or on request; recordings from standalone cal.video rooms deleted automatically under Cal.com’s retention schedule; backups purged under the ordinary backup-retention schedule

Accountability

Records of processing activities and Subprocessor engagements; documented incident and breach register; deletion certification and compliance information provided as required by Clauses 8.5 and 8.9

Data portability and erasure

Export through available Services or API functionality; other required return of personal data is handled under Clause 8.5 and DPA §10 to the extent consistent with that Clause; account and data deletion on Customer request; deletion certification to Customer as required by Clause 8.5

Measures for assistance to the controller

Tooling and processes to help Customer respond to Data Subject requests (DPA §7), to conduct DPIAs (DPA §9), and to obtain compliance information and audit reports (DPA §11)

Measures imposed on Subprocessors

Each Subprocessor is bound by a written agreement imposing data-protection obligations no less protective than the DPA and the SCCs, including onward-transfer safeguards (DPA §6.5); Subprocessors are assessed before engagement and monitored; Customer receives prior written notice of new or replacement Subprocessors and may object (DPA §6.3–6.4)