Data Processing Addendum (DPA)

Data Processing Addendum

Effective Date: June 1, 2026

This Data Processing Addendum, including the exhibits to it (“DPA”), is incorporated into the Customer Terms (the “Agreement”) that are between you (together, with any subsidiaries and affiliated entities, collectively, “Customer” or “Controller”) and Calendly LLC (together, with any subsidiaries and affiliated entities, collectively “Calendly” or “Processor”) and sets forth additional terms that apply to the extent any information you provide to Calendly pursuant to the Agreement includes Personal Data (as defined below).

• DEFINITIONS. “Data Privacy Framework(s)” means, as applicable, the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework developed by the US Department of Commerce and the European Commission, UK Government, and Swiss Federal Administration permitting organizations participating in such Data Privacy Frameworks to receive Personal Data from the European Union / European Economic Area, the UK and Gibraltar, and Switzerland in compliance with applicable Data Protection Laws in those regions.
• “Data Protection Laws” means all Applicable Laws relating to data protection and privacy applicable to the Processing of Personal Data under the Agreement, including, to the extent applicable, EU Data Protection Laws, Swiss Data Protection Laws, UK Data Protection Laws, and US State Privacy Laws.
• “Data Subject” means the individual to whom Personal Data relates.
• “Data Subject Request” means a request by a Data Subject to exercise rights afforded by Data Protection Laws with respect to the Data Subject’s Personal Data.
• “EU Data Protection Laws” means GDPR together with any applicable implementing legislation or regulations, as well as European Union or Member State laws, as amended from time to time.
• “GDPR” means the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.)
• “Instructions” means the documented instructions issued by Customer directing Calendly to perform a specific or general action regarding Processing Personal Data.
• “Personal Data” means any Customer Data relating to an identified or identifiable natural person that is Processed by Calendly on behalf of Customer in connection with providing the Services to Customer, when such information is protected as “personal data” or “personal information” or a similar term under Data Protection Law(s).
• “Process” or “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
• “Security Breach” means a confirmed breach of Calendly’s information security measures leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data covered by this DPA.
• “Services” means the services provided by Calendly to Customer under the Agreement.
• “Standard Contractual Clauses” or “SCCs” means the model clauses for the transfer of Personal Data to processors established in third countries approved by the European Commission, the approved version of which is set out in the European Commission Implementing Decision 2021/914 of 4 June 2021 and at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=e.