Hosted in the USA. Lawful under the GDPR.

Both fell for the same reasons: US law gave the intelligence agencies broad access, and it gave people in Europe no court. Executive Order 14086 changed US law on both points, and the Data Protection Review Court exists.

The General Court of the EU examined exactly these points and upheld the adequacy decision on 3 September 2025. The case is now before the Court of Justice (C-703/25 P), which has not yet ruled. Until a court rules otherwise, the decision is binding EU law in every member state.

Both laws exist, and we will not pretend otherwise. Collection under FISA Section 702 is now bound by Executive Order 14086: tied to defined objectives, necessary, proportionate, and open to review by the Data Protection Review Court. The Commission assessed this in its adequacy decision.

The CLOUD Act is about criminal investigations. It works through legal process for specific accounts, such as a warrant or a court order, not through bulk collection. It applies to every provider under US jurisdiction, wherever the servers are. Like any company, Cal.com can be required to disclose data in response to lawful requests by public authorities.

Then transfers need another tool, as the DSK notes in its Anwendungshinweise. Ours is already in place: the DPA includes the 2021 standard contractual clauses, and they apply to every transfer the framework does not cover (DPA section 12).

The safeguards of Executive Order 14086 are US law. They apply to all data sent to the USA, whatever the transfer tool, as the European Data Protection Board points out. Organizations that want no transfer question at all can talk to us about Cal.eu.

No. A TIA and supplementary measures belong to transfers that rest on Article 46 tools such as standard contractual clauses. For transfers to listed companies, the information note of the European Data Protection Board is explicit: no Article 46 tool, and no supplementary measures.

Not for the transfer. Article 45 GDPR is the basis for it, so the consent exception in Article 49 does not come into play. The booking itself needs a legal basis under Article 6, as it would with any scheduling tool in any country.

Under the framework, HR data means personal data about a certified company's own staff, collected in the employment relationship. The DSK notes that this is how the US side reads the term. Cal.com processes account and booking data as a service for its customers, which is non-HR data.

German authorities ask exporters to look closely at employee data that is sent in an employment context. If you take the stricter view, the standard contractual clauses in our DPA cover that transfer.

The United Kingdom: yes. Cal.com, Inc. is certified under the UK Extension to the EU-U.S. Data Privacy Framework, in force since 12 October 2023. Switzerland: Cal.com is not certified under the Swiss-U.S. Data Privacy Framework. Transfers from Switzerland rest on the standard contractual clauses with the Swiss amendments, in our SCC Schedule.

Write to [email protected] first. We answer complaints about the framework within 45 days. If that does not settle it, Cal.com has committed to cooperate with the panel of the EU data protection authorities and to follow its advice. This is free of charge for the person who complains.

A complaint about access by US intelligence agencies goes to your national data protection authority, which passes it on through the European Data Protection Board. Our privacy policy has the details.

No. It is our reading of the public sources listed below. The date of the last review is at the top of this page. Your data protection officer decides for your organization, and we are glad to answer their questions at [email protected].