Last month, a hair salon in Utrecht received a letter from the Dutch Data Protection Authority. The reason: customer data (names, phone numbers, email addresses, appointment history) was being stored on servers of an American booking platform. Without a data processing agreement, without a DPIA, without the owner even knowing this was a problem.
That owner is not stupid. She simply did what everyone does: created a Calendly account, put the link on her website, and let customers book. Simple. Convenient. And legally a minefield.
This article is not about creating panic. It is about understanding where your customer data lives, why that matters, and what you can do about it.
Why GDPR matters for booking systems
The GDPR (General Data Protection Regulation) has been in effect since 2018. Most business owners know it from cookie banners and privacy statements. But the GDPR goes much further than that.
Every time a customer books an appointment, you process personal data. Name, email address, phone number, sometimes a note about what they want to discuss. At a physiotherapist or dentist, there is medical data involved, and that falls under the heaviest protection category of the GDPR.
As data controller, you are responsible for what happens to that data. Not the software vendor, not the hosting provider, but you. And that means you need to know:
- Where is the data stored?
- Who has access to it?
- In which country are the servers?
- Is there a data processing agreement if a third party processes the data?
The problem with cloud-based booking systems
Here is where it gets concrete. Most popular booking tools are cloud-based and run on American servers:
Calendly: servers in the US. Calendly Inc. is an American company, subject to the US Cloud Act. That means American authorities can request the data, even if it belongs to European citizens. Calendly offers a data processing agreement, but you depend on their compliance.
HubSpot: servers spread across the US and Germany. HubSpot offers a DPA (Data Processing Addendum), but the core of the platform runs in the US. Your data can be transferred between data centres, and you have limited visibility into that.
GoHighLevel: fully American. No EU servers, no serious GDPR documentation. GoHighLevel is popular with marketing agencies, but when it comes to privacy, it is a black hole. Your customer data sits on AWS servers in the US, and there is no transparency about who has access.
Calendly, Acuity Scheduling, Square Appointments: all the same story. American company, American servers, US Cloud Act.
The US Cloud Act: why this is not theoretical
The US Cloud Act of 2018 gives American authorities the right to request data from American companies, regardless of where that data is physically stored. That means: even if Calendly has a data centre in Frankfurt, the American government can request that data.
This is not a conspiracy theory. This is legislation. And it directly conflicts with the GDPR, which requires that personal data of EU citizens be protected against access by foreign governments.
The European Court of Justice invalidated the Privacy Shield agreement with the US in the Schrems II ruling (2020). A new framework has since been established (the EU-US Data Privacy Framework), but the legal foundation remains shaky. Privacy experts agree: placing your data on American servers is a risk you are better off avoiding.
Self-hosted: the only way to eliminate the problem
This is where NoveuFlow comes in. NoveuFlow is a WordPress plugin. That means it runs on your own server, the same server where your WordPress website lives. All data (customer details, appointments, notes, payment history) sits in your own WordPress database.
No third party. There is no American company managing your data. There is no cloud server you have no control over. Your data is on your server, managed by your hosting provider, in the country you choose.
No data processing agreement with NoveuFlow needed. We do not process your data. The plugin runs locally in your WordPress installation. We have no access to your database, your customer data, or your appointments. There is literally nothing to create a data processing agreement about.
Full control over data location. Choose a Dutch hosting provider (TransIP, Antagonist, Savvii) and your data is guaranteed to be in a Dutch data centre. No data leaving the EU, no US Cloud Act applying, no legal grey area.
Practical tips for GDPR-compliant appointment scheduling
Regardless of your software choice, there are a few things you can sort out today:
1. Check where your data is stored. Log into your current booking system and find out which country the servers are in. Is it the US? Then you need a data processing agreement, and even then you carry risk.
2. Do you have a data processing agreement? If you use a cloud-based tool, you must have a data processing agreement (DPA) with that vendor. No DPA? Then you are in violation.
3. Minimise data. Only ask for what you truly need. A booking form does not need to ask for a date of birth if that is not relevant to the appointment.
4. Inform your customers. Your privacy statement must mention which tools you use and where data is stored. "We use Calendly for scheduling appointments. Your data is stored on servers in the United States." Many business owners forget this.
5. Consider self-hosted. If you take your customers’ privacy seriously (and as a business owner you are legally required to), self-hosted is the safest option. No dependency on foreign servers, no data processing agreements, no risk.
What if you already use Calendly or HubSpot?
No panic. You do not have to switch today. But take these steps:
1. Download your data processing agreement from your current provider and keep it with your GDPR documentation. 2. Update your privacy statement on your website. Mention which tools you use and where data is stored. 3. Make a plan to migrate to a self-hosted solution. Not next week, but within a reasonable timeframe.
NoveuFlow has an import function that lets you transfer existing customer data and appointment history. The migration usually takes less than an hour.
The difference at a glance
| Cloud-based (Calendly, HubSpot) | Self-hosted (NoveuFlow) | |
|---|---|---|
| Data location | US or unclear | Your server, your country |
| US Cloud Act | Applies | Does not apply |
| Data processing agreement | Required with provider | Not needed |
| DPIA required | Probably yes | Usually not |
| Control over data | Limited | Full |
| Cost | EUR 10-50/month per user | Free plan at no cost, paid plans: see pricing |
Conclusion: your customer data is your responsibility
The GDPR is not optional. It is not a checklist you tick off and forget. It is an ongoing responsibility. And the easiest way to meet that responsibility is to make sure your customer data never leaves your own server.
NoveuFlow is free to install from WordPress.org. Choose your industry in the setup wizard, import your customers, and you have a fully GDPR-compliant booking system, without your data going out the door. Try it out and discover what it feels like when privacy is not an afterthought, but the foundation.