GDPR-compliant scheduling for EU teams

Short answer: a GDPR-compliant booking tool needs EU data residency, a signed DPA, explicit guest consent for data collection, a published subprocessor list, and export/delete on request. IntoCal is built EU-first and meets all five.

Data residency

Bookings, guest emails, and calendar data are stored on EU infrastructure. No cross-Atlantic transfer of personal data by default.

Data Processing Agreement (DPA)

Organization-plan customers can request a signed DPA before rolling IntoCal out to their team.

Consent and lawful basis

Every booking form shows what data is collected (name, email, timezone) and why. Custom fields are opt-in. No hidden marketing profiling.

Subprocessors

A published subprocessor list is maintained on the trust page. Notification of changes goes to Organization customers.

Guest rights

• Guests can request data export or deletion by emailing the host or IntoCal support.
• Bookings older than the host's retention setting are auto-purged.
• API and MCP calls respect the same consent boundaries as the UI.

In summary: if your team operates in the EU, don't ship personal data to a US-only booking tool. EU-first tools like IntoCal remove the legal grey area entirely.