You have compared prices, calendars, forms and reminders. The tool seems to fit your business, but one important question remains: what happens to the data of the people who book?
An appointment may include a name, an email address and a phone number. It may also involve form responses, information shared with an external calendar or, if you enable additional features, meeting recordings and transcripts.
To assess data protection, you need to understand that journey and check what the provider offers and what your business must configure and manage.
This guide brings together practical questions, documents and examples to help you review GDPR considerations when choosing and setting up an online booking system.
Checklist: What to Review Before Signing Up
Use this table to compare providers and prepare questions for a product demonstration.
| What to check | Documents or information to review | What to assess within your business |
|---|---|---|
| Data collected | Form fields and configuration options | Whether each question is necessary to manage the appointment |
| Responsibilities | Contract and service terms | Why you use the data and who decides how it is used |
| Data processing arrangements | An agreement meeting Article 28 requirements, where applicable | Whether it covers the service you are purchasing |
| Hosting and providers | Processing locations and subprocessor information | Which additional services you will connect |
| Information for customers | Privacy notice and form options | Whether they describe your actual processing |
| Access and security | Available safeguards and controls | Who needs access to each type of information |
| Retention and individual rights | Deletion terms and assistance arrangements | Retention periods, responsibilities and request-handling procedures |
| Recordings and AI | Terms specific to those features | Purpose, legal basis, transparency and access |
This table helps organize your review. The specific requirements depend on your processing activities and business context.
1. Start with the Data You Actually Need
Before asking where information will be stored, decide what information you need to collect.
The GDPR establishes the principle of data minimization: personal data must be adequate, relevant and limited to what is necessary for the purpose. In a booking form, this means being able to justify the questions you add.
Imagine an initial meeting with a consultancy:
| Field | Question to ask |
|---|---|
| Name and email address | Do I need these to identify the customer and confirm the appointment? |
| Phone number | Will I use it for a specific purpose connected to the booking? |
| Service of interest | Does it help direct the request to the appropriate meeting type? |
| Postal address | Is it necessary for this service, or can I request it later? |
| Open-ended description | Could predefined options avoid collecting unnecessary details? |
Instead of asking customers to “tell us everything about your situation,” you could offer a selection of services and request additional information at the appropriate stage.
Health information and other special categories of personal data require additional conditions for processing. Pay particular attention to open-ended fields in healthcare and other settings where sensitive information might be disclosed.
TuCalendi’s smart forms let you adapt questions and use conditional logic. Your configuration should start with the information needed for each booking journey.
2. Identify Who Decides How the Data Is Used
When your business determines why booking data is collected and how it is used, it will normally act as the data controller.
A provider processing that information on your behalf and following your instructions may act as a processor. However, the same provider may have a different role for its own processing activities, such as certain billing information or managing its relationship with your business.
Each party’s role depends on what it actually does with the data. The European Data Protection Board explains this distinction in its guidance on data controllers and processors.
When reviewing a tool, ask:
- Which data does it process on behalf of my business?
- For which purposes does it act as a controller?
- Which other providers are involved?
- What assistance does it offer when customers exercise their rights?
Selecting the provider is one part of the review. You also need to define how your team will use the information.
3. Review the Data Processing Agreement
When a provider acts as a processor, the contract or other legal act required by Article 28 of the GDPR must be in place.
Check that it covers the service you intend to use and addresses matters such as instructions, confidentiality, security measures, subprocessors, and the return or deletion of data when the relationship ends.
How to Access the Agreement in TuCalendi
TuCalendi makes its data processing agreement available to users on both free and paid plans.
The documented procedure is:
- Sign in to TuCalendi.
- Open Account → GDPR.
- Follow the instructions to view and download the document.
- Review its contents and complete the process using the contract-signing button.
See the tutorial on signing and downloading the data processing agreement.
Keep the agreement with your supplier documentation and review it when the services you use change.
4. Check Hosting and Integrations
Hosting location matters, but you also need to understand the connected services.
A booking process may involve a calendar, payments, video conferencing, messaging or a CRM. Review what information each service receives and why.
For example, follow a test booking through this journey:
Form → booking platform → calendar → confirmation email → video conferencing.
Then add the services you have actually enabled. This map makes it easier to identify where information is stored or shared.
TuCalendi is a European company based in Spain, with servers in Germany and Spain. You can read more in our article on European online booking software and GDPR.
Being European does not, by itself, demonstrate full compliance. Equally, using a provider outside the European Economic Area does not automatically mean non-compliance: international transfers must meet the applicable requirements.
The European Data Protection Board provides guidance on international data transfers.
Ask your provider where data is processed and which documentation supports that journey, including any international transfers.
5. Inform Customers and Distinguish Between Purposes
People booking an appointment must receive clear information about how their data is processed.
Check that your privacy information identifies the controller, purposes, legal basis, recipients, retention arrangements and how to exercise rights, alongside any other applicable information. It should match what actually happens in your process.
You must also identify the appropriate legal basis for each purpose. Consent is not the only legal basis under the GDPR, and a generic “I accept the privacy policy” checkbox does not, by itself, resolve every processing activity.
In some circumstances, managing a requested appointment may be necessary for pre-contractual steps or the performance of a contract. Assess which legal basis applies to your situation. Where you rely on consent, it must meet its specific requirements.
The European Data Protection Board explains the available bases in its guidance on processing personal data lawfully.
Distinguish, for example, between:
- Managing the booking and sending information related to it.
- Sending newsletters or marketing communications.
- Recording and analyzing the meeting.
Do not assume that booking an appointment authorizes every subsequent use of the data.
6. Organize Access and Security Measures
Security depends on the provider’s capabilities and how your business uses them. Measures must be appropriate to the risks of the processing.
As a practical review:
- Avoid sharing login credentials between team members.
- Use the available authentication controls.
- Check which team members need access.
- Remove access and integrations when they are no longer required.
- Review the information included in event titles and notifications.
An event title such as “Consultation about Maria’s sensitive case…” could appear on screens or calendars where that level of detail is unnecessary. A more discreet title, such as “Professional consultation,” can reduce the information exposed.
Before enabling a feature, ask which controls it offers and who will be able to see the resulting data.
For further guidance, see the European Data Protection Board’s recommendations on securing personal data.
7. Define Retention and How You Will Handle Rights Requests
Decide how long you will retain each type of information and why. Canceling an appointment does not necessarily delete all associated data.
You may need different criteria for bookings, invoices, form responses and recordings. Certain legal obligations may also require information to be retained for a particular period.
Ask the provider how deletion works, what happens to backup copies and what happens when you close your account.
Also prepare a procedure for handling requests for access, rectification or erasure, as applicable. The provider must offer the assistance required of it, but your business needs to know who receives and handles those requests.
The European Data Protection Board provides practical guidance on respecting individuals’ rights.
Run an internal test: could you locate a booking’s information and its copies across connected services?
8. What Changes When You Add Recordings, Transcripts and AI?
Meeting content expands the scope of processing. A recording may contain voices, names, customer information and matters that were never included in the booking.
Before enabling these features, define:
- Why you need to record, transcribe or analyze the meeting.
- Which legal basis applies and what information participants will receive.
- Which providers and models are involved, and whether they use content for their own purposes.
- Who will access the results and for how long.
- How you will review possible transcription or summary errors.
Providing notice of a recording and establishing a legal basis are matters that must be assessed. A technical notification does not, by itself, resolve both.
The TuCalendi and Meetfy.ai Ecosystem
Meetfy.ai is part of the TuCalendi ecosystem and supports meetings before, during and afterwards through preparation, AI coaching, analysis and summaries.
TuCalendi users can view their bookings in the Meetfy.ai app and access recordings, transcripts and analyses through the AI Center in the dashboard. Meetfy.ai can also be used independently.
When introducing these features, review their specific terms. The hosting arrangements and documentation for the booking platform should not automatically be attributed to every connected AI service or process.
A Test Before You Start Accepting Bookings
Create a test booking using fictitious data and check:
- Which questions appear and which are mandatory.
- What privacy information the customer receives.
- Where information is copied and who can see it.
- What confirmation messages and reminders contain.
- How cancellations and erasure requests are handled.
- What changes when you enable recordings or AI features.
Document your findings and resolve outstanding questions with the provider. This test helps turn service terms into a process your team understands and can manage.
Want to Review How to Set Up Your Business Bookings?
Book a demo with the TuCalendi team. We will show you how to organize bookings, adapt forms and distribute appointments, and where to find the data processing documentation.
You can also discover how TuCalendi connects with Meetfy.ai to support your meetings before, during and afterwards.
This guide provides general information about data protection. Its application should be assessed in light of your organization’s processing activities, sector and applicable law.