What GDPR asks of a booking tool
- A data processing agreement. The tool processes personal data for you, so you need a contract with it under article 28 of GDPR. Most tools include one in their terms; some ask you to sign or download it.
- A lawful basis for any transfer out of the EU. If data goes to a country outside the European Economic Area, Chapter V of GDPR applies. The European Data Protection Board lists the usual bases: a country the Commission has found adequate, or safeguards such as standard contractual clauses.
- Telling people. Your privacy notice should say which tool you use and where data goes.
EU hosting isn't on that list. It removes or reduces the transfer question, which is why many European businesses prefer it, but a US-hosted tool can be used lawfully with the right basis in place.
The EU-US Data Privacy Framework, in 2026
On 10 July 2023 the European Commission found that the US gives adequate protection to data sent to companies certified under the EU-US Data Privacy Framework. Data can flow to those companies without extra contracts.
On 3 September 2025 the EU's General Court dismissed a challenge to that decision in Latombe v Commission (T-553/23). It also noted that the Commission must keep watching, and can suspend or change the decision if things change in the US. An appeal to the Court of Justice has been reported; we couldn't confirm it on the court's own site.
Its two predecessors, Safe Harbour and Privacy Shield, were both struck down by the Court of Justice. That history is the honest reason to prefer EU hosting: if the framework falls, a tool that already keeps your data in Europe needs nothing to change.
Where 13 booking tools keep your data
| Tool | Company | Where data is stored | DPA | Free plan |
|---|---|---|---|---|
| Zeeg | Zeeg GmbH, Germany | Germany and the Netherlands (Telekom cloud) | Included; download it in your account | Yes |
| meetergo | meetergo GmbH, Germany | Mainly the EEA ("Hosted in Germany") | Download it in the admin area | Yes |
| Doodle | Doodle AG, Switzerland | Ireland; test data in Germany | General data processing terms | Yes |
| SimplyBook.me | SimplyBook.me Ltd, Cyprus | In the EU for EU-based businesses | Online, or signed | Yes, up to 50 bookings |
| HubSpot Meetings | HubSpot Ireland (for the EEA) | EU data centre in Germany, set by where you sign up | Online | Yes |
| Zoho Bookings | Zoho group | EU data centres in Amsterdam and Dublin, set by the country you choose at sign-up | On request | Yes |
| Microsoft Bookings | Microsoft | In Exchange Online, which falls under Microsoft's EU Data Boundary for EU tenants | Microsoft's DPA | No; part of Microsoft 365 |
| Google Calendar booking pages | Europe, if your Workspace edition offers data regions and you choose it | Workspace terms | One booking page on personal accounts | |
| Cal.com | Cal.com, Inc., US | United States by default; EU on request, see below | Part of the terms | Yes |
| Calendly | Calendly, US | United States | Part of the terms | Yes |
| Acuity Scheduling | Squarespace Ireland (outside the US) | Transferred to Squarespace in the US | Squarespace's DPA | No |
| YouCanBookMe | AI Software (Capacity) UK | United States (Amazon Web Services) | Signed online | Yes |
| SavvyCal | SavvyCal, Inc. | United States | Online | No |
A few things the table can't show:
- Cal.com contradicts itself. Its pricing page offers "US & EU hosting", but its privacy policy says data "is processed in the United States" and that EU data residency is available if you contact them. Its sub-processor list is almost all US. Ask before you rely on EU hosting.
- Calendly relies on the Data Privacy Framework, with standard contractual clauses as a fallback, and its main infrastructure providers are all listed in the US. It has no EU hosting option.
- Microsoft's EU Data Boundary page doesn't name Bookings. Bookings stores its data in Exchange Online, which the boundary covers, so this is our reading, not Microsoft's wording.
- Google names Calendar as covered by Workspace data regions, but its help pages and pricing page disagree on which editions include them. Check your own edition.
- HubSpot and Zoho pick your data centre when you sign up, from your IP address or the country you choose. Moving an existing account may need a paid plan or a request.
EU hosting isn't the same as no US companies
A tool can store its main database in Europe and still send some data to US providers. Zeeg's privacy policy says its support chat, Intercom, "may be located in the USA". meetergo names Twilio for text messages, PostHog for analytics and Stripe for payments. HubSpot says some processing happens outside your data centre's location.
None of this is wrong: those transfers have their own bases, usually the Data Privacy Framework. But if your goal is "nothing leaves the EU", read the sub-processor list, not just the hosting line.
A checklist before you choose
- Find the DPA. If you can't find one, don't use the tool for clients.
- Read where data is stored, in the privacy policy or the DPA, not just the marketing page.
- Open the sub-processor list, and look for US companies that see booking data.
- Check the transfer basis for anything that leaves the EU: the Data Privacy Framework or standard contractual clauses.
- Collect less. Every question on a booking form is more personal data to protect. Name, email and a time are often enough.
- Update your privacy notice with the tool's name and where the data goes.
How we handle it in Signal
When we added call booking to Signal, the same questions came up. Signal itself is hosted in Frankfurt. When a visitor books, the event is created in the host's own Google Calendar, alongside the rest of that team's meetings, so it sits with the provider the business already uses for its calendars. Signal asks only for the visitor's name and email, and the site tells visitors before they book: "If you book a call, your name and email go into the calendar invite." It's the same rule as the checklist above: say what goes where, and collect only what the call needs.
Signal reads what a visitor does on your site, asks one short question when the answer would change what to offer, and offers the ready ones a call, a call back or WhatsApp, from €39 a month. It doesn't buy contact data or keep IP addresses. More on that in GDPR-friendly visitor tracking, and on routing calls in Calendly routing forms vs asking one question.
