Calendly Privacy
White Paper
Version 2.0 - February 2024

CONTENTS

3

Introduction

4

Types of Personal Information, Data Protection
Roles and Purposes of Processing

4

Calendly as a Data Processor

6

Calendly as a Data Controller

7

Regulatory Compliance

8

Data Processing Addendum and International Transfers

9Sub-processors

9

Government Requests

9

Data Subject Requests

10

Right to Erasure

11

Roles and Permissions

11

Consent

12

Cookies

12

Data Security

13

Calendar Integrations

14

Additional Resources

14

Conclusion

Calendly Privacy White Paper Version 2.0 - Feb 20242

Introduction
Calendly’s mission is to help you schedule better. To do so, we need somepersonal information to make your meetings happen. We don’t take this
responsibility lightly. We recognize the importance of privacy and we want you
to feel confident about using Calendly services and in your interactions with us.
This Privacy White Paper is designed to provide insight on how we collect, use,
store, and protect personal information from you and your invitees throughthe use of the Calendly service. It will also provide an overview of our privacy
program practices, including information about regulatory compliance,international data transfers, sub-processors, data subject rights, and otherrelevant privacy topics - all in one place.
Whether you are an existing Calendly customer or a prospect interested in ourservice, we hope that this Privacy White Paper serves as a valuable resourcefor you and answers the questions you may have about our stance andactions regarding privacy and regulatory compliance.
This Privacy White Paper is intended to supplement existing Calendly-issued
privacy documentation for informational purposes only. It is not intended
to provide legal advice or to address all circumstances that might arise. It
does not create additional rights or remedies and should not be construed
as a binding agreement. We will update this Privacy White Paper from time
to time as necessary to reflect changes in our practices, services, and laws
and regulations.
If you still have questions for our Privacy Team after reviewing this Privacy
White Paper, please email privacy@calendly.com.

Calendly Privacy White Paper Version 2.0 - Feb 2024

3

Types of Personal
Information, Data
Protection Roles andPurposes of Processing
For the purposes of this document, personal information is any information
relating to an identified or identifiable person. The following sections provide
more detail on the types of personal information that may be processed,
data processing roles, and the purposes of processing in your interactions
with Calendly.

Calendly as a Data Processor
The Calendly as a Data Processor use case involves the processing by Calendlyof personal information submitted by or collected by you and/or your users, or
any similar actions on your behalf, for the provision of the Calendly service. The
personal information we collect may include, but is not limited to:•Names and email addresses of users and invitees•

User-related information and preferences such as title/position, department,
employer, other contact information such as phone number and physicalbusiness address, timezone, preferred language, preferred working hours,
and calendar availability (i.e., busy/free status)•

Event details of meetings you schedule using Calendly such as subject andtitle of meeting, description, and meeting preferences (e.g., Zoom, Google
Meet, phone call, etc.)•

Certain personal information from the events on your connected Calendly if
you use our calendar integration

Calendly Privacy White Paper Version 2.0 - Feb 2024

4

Calendly is not intended to be used to collect sensitive personal informationfrom invitees. In addition, name and email address is the only personal
information needed about invitees in order to schedule a meeting. Users
have the ability to customize and add certain fields to your events to gather
additional information such as payment information or other types of
information needed to schedule the meeting based on their needs. These
additional functionalities, however, are not required fields for the Calendly
service to work, and will only be activated and customized at your discretion.
Calendly is the data processor (as the term is defined in the General Data
Protection Regulation or “GDPR” or applicable law in Europe, the United
Kingdom, or applicable states in the United States) and the service provider(as the term is defined in the California Consumer Privacy Act and its
amendments, collectively, the “CCPA”) of the personal information processed
for service delivery.
Calendly may use such personal information when permitted by applicablelaw for the following purposes:•

Provide, improve, and update the service•

Respond to any of your support-related inquiries or questions about
the service•

Process any privacy-related request from you such as data deletion,
data access or other legally required actions directed by you•

Resolve issues related to the service, including any downtime, bugs orservice errors•

Assist with information security measures, and the prevention, detection,and investigation of spam, fraud, and abuse•

Carry out instructions that are explicitly authorized by you or yourauthorized agent

Calendly Privacy White Paper Version 2.0 - Feb 20245

Calendly as a Data Controller
The Calendly as a Data Controller use case involves the personal information
we need to protect and manage our business and account level information.
The types of personal information could include, but are not limited to:•

Account and billing details•

Customer relationship management (CRM) data about you•

Platform metrics•

Platform security log data and certain cookie-derived information

Calendly is the data controller (as the term is defined in the GDPR or applicablelaw in Europe, the United Kingdom, or applicable states in the United States)
and the business (as the term is defined in the CCPA) for the types of personal
information listed in this section only for the purposes listed below:•

Understand and improve the Calendly service either via product researchand development or improving performance or functionality•

Secure and protect the service and the data within it•

Detect, prevent, and protect the platform from abuse including spam andviolations of our terms of use•

Communicate with you regarding the service, including product-related
updates or security and fraud notices•

Manage your business account with us•

Protect Calendly’s rights and interests•

Perform internal reporting including forecasting and financial analysis•

Manage legal compliance and disputes•

Administer actions related to mergers and acquisitions

Our Privacy Notice further describes our data collection and processing
practices regarding your personal information.

Calendly Privacy White Paper Version 2.0 - Feb 2024

6

Regulatory Compliance
Calendly is a market-leading scheduling solution. As a result, we serve
customers all over the world who also have their own complex privacy
compliance obligations. We are committed to taking the necessary steps
to comply with relevant privacy laws and regulations, including the GDPR,
the CCPA, PIPEDA, the Privacy Act (Australia), and many others. We have
implemented policies and procedures to comply with the many common
elements of these applicable laws, and we regularly review our privacy
practices so that we are up-to-date with the latest regulations.
Here are some examples of the regular activities and responsibilities managed
by our dedicated Privacy Team:•

Conducting periodic reviews and updates of internal and external policies
as well as contracts and data processing addendum templates•

Maintaining records of processing activities and reviewing how data iscollected, used, and shared by Calendly•

Conducting product and feature reviews•

Training employees regularly on legal and regulatory requirements andproviding internal guidance•

Creating privacy documentation and privacy-related resources•

Processing data subject access requests•

Vetting and approving third party vendors and sub-processors•

Reviewing the use of cookies and other similar technologies•

Interacting with our EU and UK representatives

The following sections describe some of the above mentioned items in
more detail.

Calendly Privacy White Paper Version 2.0 - Feb 2024

7

Data Processing Addendum andInternational Transfers
A Data Processing Addendum (DPA) is a supplement to a services agreement or
terms of use, as applicable, specifying roles and obligations that are requiredby certain data privacy laws. Calendly customers are subject to Calendly’s
DPA made available here. We require that our customers use our DPA template
because it is specifically designed to cover the Calendly service.
Calendly is a US-based company. As such, user and invitee data is hosted indata centers located in the US. However, we take the subject of data transfersvery seriously, particularly regarding the international transfer of personal
information from the European Economic Area (EEA), United Kingdom (UK) or
Switzerland to Calendly in the US. Calendly has incorporated the newest GDPRmandated Standard Contractual Clauses, the UK addendum, and Swiss datatransfer clauses into its DPA as its legal transfer mechanisms under GDPR, UK
and Swiss data privacy laws. You can also read more about our approach todata transfers here.

Sub-processors
Calendly has executed DPAs with all sub-processors who receive personal
information to assist with the provision of the Calendly service. Our DPAs
with our sub-processors include obligations that are at least as restrictive
as Calendly’s obligations in its DPA with its customers with respect to dataprotection. Prior to entering into a contract, each sub-processor is carefully
reviewed as part of our vendor due diligence process and we check things liketheir security and privacy programs and documentation, certifications, andevidence of recent data breaches, among others. As we look to add AI features
to our platform, we will not allow any applicable sub-processor to use personal
information to train their models and we will not train our models without
permission from our customers.
Calendly maintains a sub-processors list that you may access at any time
here. We update this list from time to time. If you would like to be notified when
updates to this list occur, please sign up here.

Calendly Privacy White Paper Version 2.0 - Feb 20248

Government Requests
Due to the nature of our business and types of personal information we collect,
Calendly generally does not process personal information that is of particularinterest to US or other third country law enforcement or intelligence services.
Calendly has policies and procedures setting out the steps Calendly
takes upon receipt of a government demand to provide customer personal
information in order to assess the validity and scope of the demand. Our priority
is to protect our customers’ personal information and rights while remaining
compliant with legal requirements.

Data Subject Requests
Data privacy laws may grant certain rights to individuals (also known as “datasubjects” in some jurisdictions) when it comes to their personal information.
Some of these rights (and the terminology may also vary by jurisdiction) could
include, but are not limited to:•

The right to be informed•

The right of access•

The right to rectification•

The right to restrict processing•

The right to data portability•

The right to object

We understand that these requests often need to be processed in a timely
manner. As a data processor and a service provider, we aim to empower ourcustomers to handle these data subject requests in a seamless and userfriendly way within the Calendly platform. These controls are available to you
whether you choose to extend data subject rights to anyone or solely to therequests that are legally required. More details on how you can respond to eachtype of the data subject rights mentioned above can be found here.

Calendly Privacy White Paper Version 2.0 - Feb 2024

9

If Calendly receives a request from a data subject directly in its role as a dataprocessor, Calendly will promptly inform you of the request if the data subject
identifies you as the applicable controller and will advise the requestor to submit
their request directly to you. Calendly will reasonably assist you with processing
data subject requests in the event that you cannot act on such requests without
our assistance.

Right to Erasure
Deletion requests are perhaps one of the most common data subject
rights requests received by organizations. Calendly allows you to delete
personal information from your invitees and/or employees directly fromyour settings, without needing to contact Calendly’s support or privacy
teams.
For example, invitee data erasure requests can be initiated based on
an identified email address or a date range giving you different options
depending on your regulatory or business requirements. Once you request
to delete invitee data from your account, Calendly will process thedeletion within 7 days of the request giving you the option to cancel therequest if circumstances change. Note that once data has been deleted,it cannot be recovered.
This Help Center article covers data deletion functionality in more detailwith information about handling additional scenarios such as user selfdeletion and removing the personal information of departing employees.

Calendly Privacy White Paper Version 2.0 - Feb 2024

10

Roles and Permissions
As you navigate the roles and responsibilities within your organization
regarding these data subject rights, another important operational
element to consider is the key user roles and permissions within the
Calendly platform itself. Calendly offers 5 different roles depending onplan subscription:
•

Owner

•

Admin

•

Group admin•

Team manager

•

User

Each role has set permissions ranging from complete control to limited
control of functionality. Owners and admins, for example, have all
permissions whereas regular users do not. More information about roles
and permissions within Calendly can be found here.

Consent
To accommodate certain requirements you may have around obtaining consent
prior to collecting personal information from your invitees, you have the ability tocustomize the details of your event within Calendly to capture that consent. You
can review this option and how to set it up here.

Cookies
Calendly uses cookies to provide certain features and improve the user
experience of our service. When accessing Calendly or a booking page for the
first time (and periodically as notices need to be refreshed), users and invitees
will see a cookie banner in accordance with their local requirements. If theirpreferences change at any time, users and invitees always have the option to
return to our privacy preference center and make the necessary changes.

Calendly Privacy White Paper Version 2.0 - Feb 2024

11

Additional information about cookie management can be found here as wellas in our Cookie FAQs page.

Data Security
Customer trust is critical to everything we do at Calendly. Our software isdesigned to request the most limited access to customer resources to achievea seamless scheduling experience. We are continuously mindful of your privacy,
security, and compliance obligations. Securing the personal information we docollect from you is a crucial component to achieving these goals.
Calendly has implemented a range of technical and organizational measures tosecure your personal information. Examples of our technical and organizational
measures include, but are not limited to:•

Personnel management controls such as vetting employees and contractors
before hiring, providing secure tools and training necessary to conduct work,and securely managing employee departures•

Security controls in the cloud such as continuous monitoring, distributed
data centers with layered security, continuous availability, secure by design
infrastructure, identity and access management controls, least privilege
access, appropriate firewall configurations, as well as encryption at rest andin transit, among others-

Regarding encryption, Calendly requires HTTPS for all services using
TLS (v1.2 or higher using non-deprecated cipher suites) with HSTS
enabled and SHA-256 with 2048 bit RSA encryption•

Incident response, disaster recovery and business continuity policies andcontrols such as incident response processes, emergency succession plans,and data backup and restoration plans

Calendly Privacy White Paper Version 2.0 - Feb 2024

12•

Third party audit controls such as security audits and penetration tests
conducted in appropriate intervals and certifications such as SOC 2 Type II,
ISO 2700, and others.

Additional information about Calendly’s security practices may be found on our
Security page, our Security White Paper and under the Security & Compliancesection of the Calendly Help Center. You may also request copies of ourcertifications and detailed security documentation in Whistic and, dependingon the documentation you request, we require that you execute our MNDA.
Customers can also sign up to receive real time notifications about service
disruptions or view our historical uptime records, as well as current status here.

Calendar Integrations
You may use either the Google Calendar or Office365 integrations to connect
your calendar with Calendly to simplify scheduling. Calendly is built to only
access the minimum data needed from your connected calendars to deliver
its service. Calendly is designed not to store the details about the existing
appointments in your calendar including details such as who you are meeting
with, their email address, the meeting title or any other details about theappointments in your calendar that were not scheduled via Calendly.
Following the principles above, actual details regarding the integration mayvary depending on whether you are using Google or Office 365 integrations
and depend on the functionality made available by your connected calendar
provider. Additional details regarding the security of calendar connections canbe found here.

Calendly Privacy White Paper Version 2.0 - Feb 2024

13

Additional Resources
In addition to this document, we encourage you to review our Privacy Notice,
our Calendly Help Center, our Resource Center and our Developer Portal todelve into topics that may be more specific to your use or intended use of
Calendly (e.g., your use of our extensions, add-ons and integrations, setting up
SAML or SCIM controls, etc.). From time to time, we also update these resources
to reflect changes in our business, to include details around data processing
and technical information, or to comply with new laws and regulations.

Conclusion
Calendly’s mission is to help you schedule better. We are committed toprotecting your personal information and the personal information of all
invitees who receive a Calendly link. We believe that transparency andcontrol are key to a successful partnership. The regulatory landscape isalso constantly evolving. As a result, we are continuously looking for ways toimprove your ability to obtain the necessary information or take necessary
actions with the Calendly service to meet your compliance obligations.
We hope that this Privacy White Paper has provided you with valuable
information about our privacy practices and that it will help you make informed
decisions about operationalizing your privacy program while using Calendly.
If you have any additional questions or suggestions, please don’t hesitate toreach out to us. You can contact us at privacy@calendly.com.

Calendly Privacy White Paper Version 2.0 - Feb 202414