Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of, and is incorporated by reference into, the Terms of Service or any other written agreement for COSS (the "Agreement") between Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, United States ("Cal.com"), and the customer that is party to the Agreement ("Customer"). It applies automatically, with no signature needed, whenever Cal.com processes Customer Personal Data in providing the Services. Customers that need a countersigned copy can request one from privacy@cal.com; its terms are the same as this page.

Capitalized terms not defined in this DPA have the meaning given in the Agreement.

1. DefinitionsCopy Anchor Link

• "Data Protection Laws" means all laws relating to the processing of personal data that apply to a party's processing of Customer Personal Data under the Agreement, including, where applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as retained in UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and other U.S. state privacy laws.
• "Customer Personal Data" means personal data contained in Customer Data that Cal.com processes on behalf of Customer in providing the Services.
• "Subprocessor" means a third party engaged by Cal.com that processes Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Cal.com or its Subprocessors.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.
• "DPF" means the EU-U.S. Data Privacy Framework and its UK Extension.
• "controller", "processor", "data subject", "personal data", "processing", "business", "service provider", "sale" and "share" have the meanings given in the applicable Data Protection Laws.

2. Roles and scopeCopy Anchor Link

2.1 Roles. For Customer Personal Data, Customer is the controller (or, where Customer acts on behalf of another controller, a processor) and Cal.com is a processor (or subprocessor) and, under the CCPA, a service provider. Where Customer is itself a processor, Customer confirms that its controller has authorized its instructions, including the appointment of Cal.com.

2.2 Scope. This DPA does not cover personal data for which Cal.com is a controller, such as account, billing and security data about Customer's users. That data is described in our Privacy Policy.

2.3 Details of processing. The subject matter, nature, purpose and duration of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.

3. Customer's obligationsCopy Anchor Link

3.1 Customer is responsible for the lawfulness of the processing of Customer Personal Data and of its instructions, including having a lawful basis (and, where required, consent) for every message it sends and for enabling open and click tracking, and for giving data subjects the notices that Data Protection Laws require.

3.2 Customer will not submit special categories of personal data, data relating to criminal convictions, protected health information or payment card data to the Services unless Cal.com has agreed to it in writing.

4. Cal.com's obligationsCopy Anchor Link

4.1 Instructions. Cal.com will process Customer Personal Data only on Customer's documented instructions, unless Data Protection Laws or other applicable law require otherwise, in which case Cal.com will inform Customer before processing unless that law prohibits it. The Agreement, this DPA and Customer's use and configuration of the Services (including through the dashboard and the API) are Customer's complete instructions. Additional instructions require a written agreement. Cal.com will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

4.2 Platform protection. Customer instructs Cal.com to process Customer Personal Data as needed to protect the Services, Customer and data subjects, as described in the Agreement and the Acceptable Use Policy. This includes maintaining suppression lists, screening a sample of messages for spam, phishing, malware and fraud with automated systems including AI models, and monitoring bounce and complaint rates.

4.3 Confidentiality. Cal.com will ensure that the people it authorizes to process Customer Personal Data are bound by appropriate obligations of confidentiality and access it only as needed to provide, secure and support the Services.

4.4 Security. Cal.com will implement and maintain the technical and organizational measures described in Annex 2. Cal.com may update them, provided the updates do not materially reduce the overall level of protection of Customer Personal Data.

4.5 CCPA. As a service provider, Cal.com will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including for any commercial purpose other than providing the Services; (c) retain, use or disclose it outside the direct business relationship between Cal.com and Customer; or (d) combine it with personal data Cal.com receives from or on behalf of anyone else, except as the CCPA permits. Cal.com will comply with the CCPA's obligations applicable to service providers, provide the same level of privacy protection the CCPA requires, and notify Customer if it can no longer meet its obligations. Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data. Cal.com certifies that it understands and will comply with these restrictions.

4.6 Aggregated data. Nothing in this DPA prevents Cal.com from using aggregated or de-identified data that does not identify Customer or any individual, as permitted by the Agreement and Data Protection Laws.

5. SubprocessorsCopy Anchor Link

5.1 Authorization. Customer gives Cal.com general authorization to engage Subprocessors. The Subprocessors that process Customer Personal Data are listed in Annex 3 and in our Trust Center at trust.cal.com, which Customer authorizes.

5.2 Obligations. Cal.com will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than those in this DPA, to the extent applicable to the services the Subprocessor provides. Cal.com remains liable for its Subprocessors' performance of those obligations.

5.3 Changes. Cal.com will give Customer at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the list at trust.cal.com and notifying subscribers to that list or the email address on Customer's account. Customer may object on reasonable data protection grounds by writing to privacy@cal.com within that period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected Services by written notice, and Cal.com will refund any prepaid fees for the remainder of the term after termination. Cal.com may replace a Subprocessor with less notice in an emergency affecting the security or availability of the Services, in which case it will notify Customer promptly and the objection right still applies.

6. International transfersCopy Anchor Link

6.1 Location. Cal.com and its Subprocessors process Customer Personal Data mainly in the United States.

6.2 Transfer mechanisms. To the extent Customer Personal Data subject to the GDPR, the UK GDPR or the FADP is transferred to a country without an adequacy decision, the parties rely on the following, in this order:

1. Data Privacy Framework. Cal.com is certified under the EU-U.S. Data Privacy Framework and the UK Extension, and will process such data in accordance with the DPF Principles. Cal.com will notify Customer if it determines it can no longer meet its obligations under the DPF.
2. Standard Contractual Clauses. Where the DPF does not apply, or ceases to be a valid transfer mechanism, the SCCs are incorporated into this DPA as set out in section 6.3, together with the UK Addendum or the Swiss amendments in section 6.4 where applicable.

6.3 The SCCs. Where the SCCs apply:

• Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) where Customer is a processor;
• Clause 7 (docking clause) applies;
• in Clause 9, Option 2 (general written authorization) applies, with the notice period in section 5.3;
• in Clause 11, the optional language does not apply;
• in Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland;
• in Clause 18(b), disputes are resolved by the courts of Ireland;
• Annex I of the SCCs is completed with Annex 1 of this DPA, and the competent supervisory authority is the one determined under Clause 13;
• Annex II of the SCCs is completed with Annex 2; and
• Annex III of the SCCs is completed with Annex 3.

6.4 UK and Switzerland. For transfers subject to the UK GDPR, the UK Addendum applies, completed with the information in this DPA; Table 4 is completed by selecting "neither party". For transfers subject to the FADP, the SCCs apply with these amendments: references to the GDPR are to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers; "Member State" includes Switzerland so that data subjects in Switzerland can sue in their place of habitual residence; and the SCCs protect the data of legal entities until the revised FADP no longer does.

6.5 Precedence. If there is any conflict between this DPA and the SCCs (or the UK Addendum), the SCCs (or the UK Addendum) prevail.

7. Security IncidentsCopy Anchor Link

7.1 Cal.com will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident. The notice will be sent to the email address of Customer's organization owners and will describe, to the extent then known, the nature of the incident, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. Where information is not available at once, Cal.com will provide it in phases as it becomes available.

7.2 Cal.com will promptly take reasonable steps to contain, investigate and mitigate the Security Incident, and provide reasonable assistance to Customer in meeting its own notification obligations.

7.3 Cal.com's notification of a Security Incident is not an acknowledgment of fault or liability. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, failed sign-in attempts or denial-of-service attacks, are not Security Incidents.

8. AssistanceCopy Anchor Link

8.1 Data subject requests. Cal.com will provide Customer with the means, through the Services or otherwise, to respond to requests from data subjects to exercise their rights under Data Protection Laws. If Cal.com receives such a request directly about Customer Personal Data, it will not respond to it other than to refer the data subject to Customer, unless legally required, and will promptly forward it to Customer where it can identify Customer.

8.2 Other assistance. Taking into account the nature of the processing and the information available to it, Cal.com will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities that relate to Customer's use of the Services.

8.3 Government requests. If Cal.com receives a request from a public authority for access to Customer Personal Data, it will (a) refer the authority to Customer where possible; (b) notify Customer promptly, unless prohibited by law; (c) review the legality of the request and challenge it where there are reasonable grounds to do so; and (d) disclose only the minimum amount of data necessary to comply with a lawful request.

9. AuditsCopy Anchor Link

9.1 On written request, Cal.com will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, such as security documentation and the results of third-party assessments, where they exist. Such information is Cal.com's Confidential Information.

9.2 If that information is not sufficient to demonstrate compliance, or where a supervisory authority or Data Protection Laws require it, Customer may audit Cal.com's compliance with this DPA, itself or through an independent auditor bound by confidentiality, no more than once in any 12-month period (except after a Security Incident or at a supervisory authority's direction). Customer will give at least 30 days' notice, and the parties will agree on the scope, timing and duration of the audit in advance. Audits will be conducted during business hours, in a way that does not unreasonably disrupt Cal.com's operations or compromise the security or confidentiality of other customers' data, and at Customer's expense.

10. Deletion and returnCopy Anchor Link

10.1 During the term of the Agreement, Customer can export and remove Customer Personal Data through the Services, and ask Cal.com to delete the rest by writing to privacy@cal.com.

10.2 After the Agreement ends, Customer has 30 days to export Customer Personal Data. Cal.com will then delete it from its active systems within a further 30 days, and from backups as they expire in the normal course, unless applicable law requires Cal.com to keep it. Data retained under law or in backups remains protected by this DPA and is not actively processed. On request, Cal.com will confirm deletion in writing.

11. Liability, term and precedenceCopy Anchor Link

11.1 Liability. Each party's liability arising out of or relating to this DPA, including the SCCs to the extent permitted by them, is subject to the limitations of liability in the Agreement.

11.2 Term. This DPA remains in effect for as long as Cal.com processes Customer Personal Data, and its obligations survive termination of the Agreement until the data is deleted.

11.3 Precedence. If there is any conflict between the Agreement and this DPA concerning the processing of Customer Personal Data, this DPA prevails, subject to section 6.5.

11.4 Changes. Cal.com may update this DPA as required by Data Protection Laws, by a supervisory authority, or to reflect changes to the Services that do not materially reduce the protection of Customer Personal Data. Other changes follow the change process in the Terms of Service.

11.5 Governing law. This DPA is governed by the law that governs the Agreement, except where the SCCs or Data Protection Laws require otherwise.

Annex 1: Details of processingCopy Anchor Link

Parties.

• Data exporter: Customer, as identified in its account. Role: controller (or processor). Activities: use of the Services to send messages and manage related data. Contact: the organization owners on the account.
• Data importer: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, United States. Role: processor (or subprocessor). Activities: providing the Services. Contact: privacy@cal.com.

Categories of data subjects. Recipients of Customer's messages (including to, cc, bcc and reply-to addresses); senders named in Customer's messages; any other individuals whose personal data Customer includes in messages, attachments, tags, metadata, suppression lists or webhook configuration.

Categories of personal data. Email addresses and display names; the content of messages and attachments, as determined solely by Customer; message headers, tags, categories and other metadata Customer provides; delivery, bounce, complaint and suppression events, including information returned by recipient mail servers; and, where Customer enables tracking, the time of opens and clicks, the clicked link and the user agent of the request (not the IP address).

Special categories of data. None intended. Customer will not submit special categories of data unless agreed in writing (see section 3.2).

Frequency of the transfer. Continuous, as determined by Customer's use of the Services.

Nature and purpose of the processing. Receiving, storing, screening, transmitting and delivering messages on Customer's instructions; recording and reporting delivery events; maintaining suppression lists; measuring open and click tracking where enabled; sending webhook events to endpoints Customer configures; protecting the Services and data subjects from spam, phishing, malware and fraud; and providing support.

Duration and retention. For the term of the Agreement and until deletion under section 10. Attachment contents are deleted once a message is sent, canceled or fails. Messages and delivery events are kept while Customer's account is active, unless Customer asks for earlier deletion.

Transfers to Subprocessors. As listed in Annex 3, for the purposes and duration stated there.

Annex 2: Technical and organizational measuresCopy Anchor Link

Encryption. Data is encrypted in transit using TLS, and at rest in Cal.com's databases and storage. Webhook signing secrets are additionally encrypted with AES-256-GCM. Passwords and API keys are stored only as hashes.

Access control. Access to production systems and Customer Personal Data is limited to personnel who need it, on a least-privilege basis, and is protected by strong authentication. Platform administrators' actions in the Services are recorded in an append-only audit log.

Tenant isolation. Every query against customer data is scoped to the customer's organization. API keys are bound to a single environment and organization and carry explicit permissions.

Customer controls. Customers can require two-factor authentication or single sign-on for their organization, assign roles to members, revoke sessions and API keys, and separate sandbox from live environments, which never deliver real messages.

Data minimization. Attachment contents are deleted once they are no longer needed for delivery. Tracking records the user agent but not the IP address. Content screening sends only a bounded extract of a message (sender, subject, up to 8,000 characters of text and link hosts and paths without query strings), never recipients or attachments, to a provider that retains nothing; screening verdicts never store message content. Rate limiting keys store email addresses only as hashes.

Network and application security. Outbound webhook requests are restricted to public addresses, with protections against server-side request forgery. Rate limits protect authentication and the API from abuse. Customer-supplied HTML is displayed in the dashboard only in a sandboxed frame. A content security policy restricts the scripts the website and dashboard may load.

Availability and resilience. The Services run on redundant cloud infrastructure, with regular backups and monitoring.

Vulnerability management. Dependencies are kept up to date, changes are reviewed and tested before release, and vulnerabilities can be reported through a responsible disclosure program at cal.com/security.

Personnel. Personnel with access to Customer Personal Data are bound by confidentiality obligations.

Incident response. Cal.com maintains a process to detect, respond to and notify Security Incidents, as described in section 7.

Subprocessors. Subprocessors are selected after assessing their security and data protection practices, and are bound by written agreements (see section 5).

Annex 3: SubprocessorsCopy Anchor Link

The current list, including any changes announced under section 5.3, is maintained at trust.cal.com.