Calendly Privacy
White Paper Calendly’s Prelude
Version 1.1 - October 2023

CONTENTS

3

Introduction

4

Types of Personal Information, Data Protection
Roles and Purposes of Processing

4

Calendly as a Data Processor

6

Calendly as a Data Controller

7

Regulatory Compliance

8

Data Processing Addendum and International Transfers

9Sub-processors

9

Government Requests

9

Data Subject Requests

10

Right to Erasure

11

User Permissions

11

Cookies

12

Data Security

13

Calendar Integrations

13

ATS Integrations

14

Additional Resources

14

Conclusion

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

2

Introduction
Calendly’s mission is to help you schedule more efficiently. To do so, weneed some personal information to make your interview scheduling happen.
We don’t take this responsibility lightly. We recognize the importance ofprivacy and we want you to feel confident about using our services and inyour interactions with us.
This Calendly Privacy White Paper - Calendly’s Prelude (“document”) is
designed to provide insight on how we collect, use, store, and protect personal
information from you and your candidates through the use of our schedulingautomation platform for recruiting teams.
Whether you are an existing customer or a prospect interested in our service,
we hope that this document serves as a valuable resource for you andrelevant teams within your organization as you assess privacy and regulatorycompliance topics.
This document is intended to supplement existing Calendly-issued privacy
documentation for informational purposes only. It is not intended to provide
legal advice or to address all circumstances that might arise. It does notcreate additional rights or remedies and should not be construed as a binding
agreement. We will update this document from time to time as necessary toreflect changes in our practices, services, and laws and regulations.
For the avoidance of doubt, Calendly is the contracting entity for ourscheduling automation platform for recruiting teams (formerly known as
Prelude) as well as our core Calendly scheduling platform. Any references
to Calendly in this document refer to Calendly as the service provider in the
recruiting platform context. Information about the core Calendly schedulingplatform is covered exclusively in our Calendly Privacy White Paper.
If you still have questions for our Privacy Team after reviewing this document
please email privacy@calendly.com.

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

3

Types of Personal
Information, Data
Protection Roles andPurposes of Processing
For the purposes of this document, personal information is any information
relating to an identified or identifiable person. The following sections provide
more detail on the types of personal information that may be processed,
data processing roles, and the purposes of processing in your interactions
with our scheduling automation platform for recruiting teams.

Calendly as a Data Processor
The Calendly as a Data Processor use case involves the personal information
submitted by or collected from you and/or your users or invitees, or any similaractions on your behalf, for the provision of the Calendly service. The personal
information we collect may include, but is not limited to:•Names and email addresses of users and candidates•

User-related information and preferences such as title/position, department,
employer, other contact information such as phone number and physicalbusiness address, timezone, preferred language, preferred working hours,
profile photo and calendar availability. Calendar integration to retrieve
availability of users includes access to certain specific information about
meetings in their calendar such as meeting name, invitees, and any notes
included in the meeting - regardless of whether they were scheduled via our
recruiting solution or not. We need this information to support the proper
functioning of the platform (i.e., which meetings can be moved and which
meetings cannot).

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

4•

Event details of meetings you schedule using our recruiting solution such as
subject and title of meeting, description, meeting preferences (e.g., Zoom,
Google Meet, phone call, etc.), participant and interviewer information(e.g., links to LinkedIn profiles, titles, their contact information)•

Attachments you wish to include to the email templates created by you
within the platform to communicate with your candidates and interviewers•

Attributes or any organizational labels you attribute to your candidates
and interviewers•

Read and/or write access to select fields of your chosen applicant tracking
system (ATS)Our recruiting solution is not intended to be used to collect sensitive personal
information from candidates. Platform administrators from recruiting teams
have the ability to customize and add certain fields to organize theircandidates and interviewers in accordance with their goals and hiring
practices. These additional functionalities, however, are not required fields
for the platform to work, and will only be activated and customized atyour discretion.
Calendly is the data processor (as the term is defined in the General Data
Protection Regulation or “GDPR” or applicable law in Europe, the United
Kingdom, applicable states in the United States or privacy laws from othercountries in the world with similar terminology) and the service provider (as theterm is defined in the California Consumer Privacy Act and its amendments,
collectively, the “CCPA”) of the personal information processed for service
delivery described above.
Calendly will use such personal information for the following purposes:•

Provide and update the service•

Respond to any of your support-related inquiries or questions about
the service•

Process any privacy-related request from you such as data deletion,
data access or other legally required actions directed by you

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

5•Resolve issues related to the service, including any downtime, bugs orservice errors•

Carry out instructions that are explicitly authorized by you or yourauthorized agent

Calendly as a Data Controller
The Calendly as a Data Controller use case involves the personal information
we need to protect and manage our business and account level information.
The types of personal information could include, but are not limited to:•

Account and billing details•

Customer relationship management (CRM) data about you•

Platform metrics•

Platform security logs and certain cookie-derived information

Calendly is the data controller (as the term is defined in the GDPR or applicablelaw in Europe, the United Kingdom, or applicable states in the United States)
and the business (as the term is defined in the CCPA) for the types of personal
information listed in this section only for the purposes listed below:•

Understand and improve the Calendly service either via product researchand development or improving performance or functionality•

Secure and protect the service and the data within it•

Detect, prevent, and protect the platform from abuse, including spam andviolations of our terms of use•

Communicate with you regarding the service, including product-related
updates or security and fraud notices•

Market our products and services, including sending emails about new
product features or other news about Calendly or on topics we think would
be relevant to the recipients (recipients may opt out of receiving thesecommunications at any time).

•

Manage your business account with us•

Protect Calendly’s rights and interests

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

6•Perform internal reporting including forecasting and financial analysis•

Manage legal compliance and disputes•

Administer actions related to mergers and acquisitions

Our Privacy Notice further describes our data collection and processing
practices regarding your personal information.

Regulatory Compliance
Calendly is a market-leading recruiting solution. As a result, we serve customers allover the world who also have their own complex privacy compliance obligations.
We are committed to taking the necessary steps to comply with relevant privacy
laws and regulations, including the GDPR, the CCPA, and many others. We have
implemented policies and procedures to comply with the many common elementsof these applicable laws, and we regularly review our privacy practices so that weare up-to-date with the latest regulations.
Here are some examples of the regular activities and responsibilities managed byour dedicated Privacy Team:•

Conducting periodic reviews and updates of internal and external policies aswell as contracts and data processing addendum templates•

Maintaining records of processing activities and reviewing how data iscollected, used, and shared by Calendly•

Conducting product and feature reviews•

Training employees regularly on legal and regulatory requirements andproviding internal guidance•

Creating privacy documentation and privacy-related resources•

Processing data subject access requests•

Vetting and approving third party vendors and sub-processors•

Reviewing the use of cookies and other similar technologies•

Interacting with our EU and UK representatives

The following sections describe some of the above mentioned items in more detail.

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

7

Data Processing Addendum andInternational Transfers
A Data Processing Addendum (DPA) is a supplement to a services agreement or
terms of use, as applicable, specifying roles and obligations that are requiredby certain data privacy laws. All Calendly customers are subject to Calendly’s
DPA made available to our platform customers during the contract review
process. We require that our customers use our DPA template because it isspecifically designed to cover the Calendly recruiting service.
Calendly is a US-based company. As such, user and candidate data is hosted
in data centers located in the US. However, we take the subject of datatransfers very seriously, particularly regarding the international transfer of
personal information from the European Economic Area (EEA), United Kingdom(UK) or Switzerland to Calendly in the US. Calendly has incorporated the newest
GDPR-mandated Standard Contractual Clauses, the UK addendum, and Swissdata transfer clauses into its DPA as its legal transfer mechanisms under GDPR,
UK and Swiss data privacy laws.
This subject continues to evolve as evidenced by the current updates on thepotential new EU-US Privacy Framework and the UK-US Data Bridge. Our
Privacy Team continuously tracks additional guidance from data protection
authorities, adequacy decisions and any related court decisions closely,
including the EU-US Privacy Framework discussions, and will take the necessary
steps to update our data transfer mechanisms as appropriate.

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

8

Sub-processors
Calendly has executed DPAs with all sub-processors who receive personal
information to assist with the provision of the Calendly service. Our DPAs
with our sub-processors include obligations that are at least as restrictive
as Calendly’s obligations in its DPA with its customers with respect to dataprotection. Prior to entering into a contract, each sub-processor is carefully
reviewed as part of our vendor due diligence process and we check things liketheir security and privacy programs and documentation, certifications, andevidence of recent data breaches, among others.
Calendly maintains a sub-processors list that you may access at any time here.
The sub-processors used for our scheduling automation platform for recruiting
teams are listed towards the bottom of the page in the second box. We update
this list from time to time. If you would like to be notified when updates to this list
occur, please sign up here.

Government Requests
Due to the nature of our business and types of personal information we collect,
Calendly generally does not process personal information that is of particularinterest to US or other third country law enforcement or intelligence services.
Calendly has policies and procedures setting out the steps Calendly takes uponreceipt of a government demand to provide customer personal information inorder to assess the validity and scope of the demand. Our priority is to protect
our customers’ personal information and rights while remaining compliant withlegal requirements.

Data Subject Requests
Data privacy laws may grant certain rights to individuals - either users or
candidates (also known as “data subjects” in some jurisdictions) when it comes

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

9

to their personal information. Some of these rights (and the terminology may also
vary by jurisdiction) could include, but are not limited to:•

The right to be informed•

The right of access•

The right to rectification•

The right to restrict processing•

The right to data portability•

The right to object

We understand that these requests often need to be processed in a timely
manner. As a data processor and a service provider, we aim to empower ourcustomers to handle some of these data subject requests where possible within
the recruiting platform. These controls are available to you whether you choose
to extend data subject rights to anyone or solely to the requests that arelegally required.
If Calendly receives a request from a data subject directly in its role as a dataprocessor, Calendly will promptly inform you of the request (where data subjects
identify you as the data controller), and will advise the requestor to submit theirrequest directly to you. Calendly will reasonably assist you with processing data
subject requests in the event that you cannot act on such requests without
our assistance.

Right to Erasure
Deletion requests are perhaps one of the most common data subject
rights requests received by organizations. Calendly allows you to delete
personal information from your candidates directly from your settings,
without needing to contact Calendly’s support or privacy teams.
You may easily delete data from a candidate by clicking on“Settings” → “Company Settings” → “Privacy”.
For data subject requests regarding user data deletion,please email privacy@calendly.com.

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

10

User Permissions
As you navigate the roles and responsibilities within your organization
regarding these data subject rights, another important operational
element to consider is the key user permissions within the platform itself.
Calendly offers 4 different permissions for your users:•

Recruiting Coordinator users•

Recruiter users•

Admin users•

Interviewer users

Each role has set permissions ranging from complete control to limited
control of functionality. Recruiting coordinators and admins, for example,
have all permissions, whereas other users, such as interviewers, do not.
You will need to define roles and responsibilities within your organization
to operationalize these requests on your own.

Cookies
Calendly uses cookies to provide certain features and improve the user
experience of our service. When your candidate visits the schedulingpage for the first time (and periodically as notices need to be refreshed),candidates will see a cookie banner in accordance with their local
requirements and a link at the bottom right of the scheduling page tochange their cookie preferences.

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

11

Data Security
Customer trust is critical to everything we do at Calendly. Our software isdesigned to request the most limited access to customer resources to achieve aseamless interview scheduling experience. We are continuously mindful of yourprivacy, security, and compliance obligations. Securing the personal information
we collect from you is a crucial component to achieving these goals.
Calendly has implemented a range of technical and organizational measures tosecure your personal information. Examples of our technical and organizational
measures include, but are not limited to:•

Personnel management controls such as vetting employees and contractors
before hiring, providing secure tools, deploying infrastructure and endpoint
protections and providing the training necessary to conduct work, andsecurely managing employee departures•

Security controls in the cloud such as continuous monitoring, distributed
data centers with layered security, continuous availability, secure by design
infrastructure, identity and access management controls, least privilege
access, appropriate firewall configurations, as well as encryption at rest andin transit, among others-

Regarding encryption, Calendly requires HTTPS for all services using TLS(v1.2 or higher using non-deprecated cipher suites) with HSTS enabled
and SHA-256 with 2048 bit RSA encryption•

Incident response, disaster recovery and business continuity policies andcontrols such as incident response processes, emergency succession plans,and data backup and restoration plans•

Integration with single sign-on providers

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

12

Calendar Integrations
You may use either the Google Calendar or Office365 integrations to connect
your calendar with our platform to simplify scheduling for the users withinyour organization. We will use the minimum required scope to perform basic
functions such as read access to users’ calendars, profile information as wellas write access to book meetings and send emails on your behalf (to enable
you to automatically send meeting information to your candidates).
Following the principles above, actual details regarding the integration mayvary depending on whether you are using Google or Office 365 and dependon the functionality made available by your connected calendar provider.

ATS Integrations
Our ATS integrations provide your recruiting team with the ability to easilypull and transmit information regarding the candidate and the interviews
you schedule through our platform. Depending on the ATS used by yourorganization, our ability to read or write certain information may differ.
Your sales representative or your customer success manager can assist
with providing more technical information about the data flows for these
integrations to take place.

Application Integrations
To meet your organization’s communication, interview, and security needs, ourplatform also provides integrations to conferencing (e.g., Zoom, BlueJeans,etc.), chat (e.g., Slack, Microsoft Teams, etc.), coding assessments (e.g.,
CoderPad. HackerRank, etc), and single sign on providers (e.g., Okta, etc.).
More information about some of these integrations can be found here.

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

13

Additional Resources
In addition to this document, we encourage you to review our Privacy Noticeand the Calendly’s Prelude Help Center to delve into topics that may be
more specific to your use or intended use of our recruiting solution. From time
to time, we also update these resources to reflect changes in our business,to include details around data processing and technical information, or tocomply with new laws and regulations.

Conclusion
Calendly’s mission is to help you schedule more efficiently. We are committed
to protecting your personal information and the personal information of all
candidates who interact with our scheduling automation platform for recruiting
teams. We believe that transparency and control are key to a successful
partnership. The regulatory landscape is also constantly evolving. As a result,
we are continuously looking for ways to improve your ability to obtain thenecessary information or take necessary actions with the Calendly service tomeet your compliance obligations.
We hope that this document has provided you with valuable information
about our privacy practices and that it will help you make informed decisions
about operationalizing your privacy program while using our platform.
If you have any additional questions or suggestions, please don’t hesitate toreach out to us. You can contact us at privacy@calendly.com.

Calendly Privacy White Paper - Calendly’s Prelude Version 1.1 - October 2023

14