Data processing agreement — Cal.com

Cited by

Facts read from this source

• DPA version Report an error

  “Version 2.3 — Effective date: November 1, 2026”

• DPA entity Report an error

  “between the customer identified in the Agreement (“Customer”) and Cal.com, Inc. (“Cal.com”)”

• DPA applies all plans Report an error

  “Subject to §14.2, this DPA applies to every Customer account and plan governed by the Agreement and becomes binding as provided in §16.4”

• Baa HIPAA Report an error

  “Customer must not submit, upload, or otherwise make available through the Services any Protected Health Information unless a Business Associate Agreement (“BAA”) covering the relevant Services has been executed between Customer and Cal.com”

• Applicable laws Report an error

  “including, where applicable, the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, US State Privacy Laws, and implementing or supplementary laws”

• Security measures Report an error

  “access control and least-privilege practices; encryption in transit and at rest where appropriate; authentication controls, including SSO and multi-factor authentication for relevant systems; secure development, vulnerability management, logging, monitoring, incident response, backup, and resilience practices; and periodic security testing and independent assurance activities appropriate to the Services”

• List location Report an error

  ““Subprocessor List” means Cal.com’s current list of Subprocessors, available at trust.cal.com.”

• Change notice Report an error

  “Before a new or replacement Subprocessor begins processing Customer Personal Data, Cal.com will give Customer prior written notice, and will use commercially reasonable efforts to give that notice early enough for Customer to review the change and object under §6.4”

• Objection termination refund Report an error

  “If no reasonable resolution is available and Customer cannot reasonably continue to use the affected Service without the proposed Subprocessor, Customer may discontinue the affected Service or terminate the affected portion of the Agreement. Cal.com will refund any prepaid, unused fees for the terminated affected Service.”

• Phi AI training ban Report an error

  “including a restriction on using Protected Health Information to train, fine-tune, or improve any artificial intelligence or machine-learning model”

• Data subject request assistance Report an error

  “Cal.com will provide reasonable assistance to Customer, through appropriate technical and organizational measures, to enable Customer to respond to Data Subject requests.”

• Breach notification Report an error

  “Cal.com will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.”

• Dpia assistance Report an error

  “Cal.com will provide reasonable assistance to Customer with data-protection impact assessments and consultations with supervisory authorities required under Articles 35 and 36 GDPR or equivalent Applicable Data Protection Law”

• Export period Report an error

  “Following termination or expiration of the Services, Customer will have at least 30 days to export Customer Personal Data, unless Customer instructs earlier deletion or the Agreement or Customer’s configuration provides a longer period.”

• Deletion schedule Report an error

  “Following the applicable export period, Cal.com will delete Customer Personal Data in accordance with its standard deletion schedule, normally within 90 days, unless retention is required by applicable law.”

• Deletion confirmation Report an error

  “On Customer’s written request, Cal.com will confirm in writing when deletion under this section has been completed, where Applicable Data Protection Law requires it or such confirmation is reasonably available.”

• Audit rights Report an error

  “Customer may conduct an audit of Cal.com’s relevant processing activities no more than once every 12 months, subject to: at least 30 days’ prior written notice; a scope reasonably related to Customer Personal Data and this DPA; conduct during normal business hours; reasonable measures to avoid disruption of Cal.com’s operations; an independent, qualified auditor bound by confidentiality obligations and not a competitor of Cal.com; and Customer bearing its own costs, unless a material non-compliance by Cal.com is identified.”

• UK addendum swiss Report an error

  “the SCCs, together with the UK Addendum and the Swiss Amendments where applicable, as set out in §12.4”

• Dpf certification Report an error

  “if and for so long as Cal.com is certified under the EU-U.S. Data Privacy Framework or the UK Extension to that Framework, that Framework”

• Scc governing law Report an error

  “In Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland. In Clause 18(b), disputes are resolved before the courts of Ireland.”

• DPA contact address Report an error

  “Contractual notices to Cal.com may be sent to legal@cal.com or delivered to Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, United States, Attn: Legal. Privacy requests may be sent to privacy@cal.com.”

• DPA negotiation Report an error

  “Customers who purchase under an Order Form or master services agreement with Cal.com may request an Executed DPA. Cal.com does not otherwise negotiate or modify this DPA.”

• DPA update termination right Report an error

  “Customer may terminate the affected Services by written notice before the effective date if it does not accept such a materially adverse update.”

• US state privacy certification Report an error

  “Cal.com will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose, including a commercial purpose, other than the business purposes specified in the Agreement and this DPA, or as otherwise permitted by US State Privacy Laws”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Independent Consultant European sovereignty
• The Data Protection Officer European sovereignty
• The Practice Owner European sovereignty
• The Sales Team Lead European sovereignty
• The Salon Owner Integrations, API & data export
• The Salon Owner European sovereignty
• The Skeptic European sovereignty