GDPR Article 6 lists six lawful bases for processing personal data. Scheduling tools typically rely on two: 'contract' (the booking itself is a contract) and 'consent' (for anything beyond the booking). The distinction matters for what you can send, track, and retain.
Contract: the booking itself
Processing "necessary for the performance of a contract" covers the name, email, meeting reason, and timezone you collect to schedule the meeting. This basis doesn't require a consent checkbox — the act of booking constitutes entering into the contract.
Consent: everything beyond the booking
If you want to add the invitee to a newsletter, retarget them with ads, or use their email for unrelated marketing, you need separate, specific, freely-given, informed consent. A pre-checked checkbox is not valid consent under GDPR. "By submitting, you agree" is not valid consent.
Legitimate interest: the contested middle ground
Tools sometimes claim "legitimate interest" for analytics on booking pages. This is legally fragile — legitimate interest requires a balancing test that weighs the tool's interest against the individual's privacy expectations. EU regulators have trended toward rejecting this basis for behavioral analytics on public-facing pages.
The practical implication
If your scheduling tool loads Google Analytics on the booking page and claims legitimate interest as the basis, your clients could object to the processing and the tool would need to stop. Privacy-first tools avoid this whole category by not loading analytics in the first place.
This is part of our privacy-first scheduling pillar guide — 18 articles covering every privacy angle.
Frequently Asked Questions
Do my clients need to opt in to Cal Clear's data processing?
No — the booking itself constitutes contract-basis processing for the booking metadata. Cal Clear doesn't do analytics, retargeting, or marketing processing, so consent checkboxes aren't needed for any of those secondary purposes.
Can I add invitees to my newsletter after they book?
Only with their separate, explicit opt-in. A 'by booking, you agree to receive our newsletter' line is not valid consent under GDPR.
Try privacy-first scheduling, free
Cal Clear runs zero trackers on booking pages and auto-deletes booking data on your schedule. Start at calclear.app.