Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
iClosed is a US based appointment scheduling and booking platform tailored for high ticket sales teams. It embeds a calendar widget on landing pages, qualifies leads, and captures attribution data through cookies and tracking parameters.
iClosed is a US based scheduling and booking platform built for high ticket sales teams. It embeds a calendar widget on landing pages, qualifies leads through pre booking forms, and captures attribution data so that sales and marketing teams can measure which campaigns drive booked calls. For EU operators the service raises classic third country and ePrivacy questions that need to be addressed before deployment.
iClosed provides a calendar booking widget that can be embedded on any landing page or website. It supports lead qualification questions, routing rules, team round robin assignment, reminders, integrations with CRM tools, and conversion tracking. The product is positioned as a Calendly alternative optimised for high ticket sales pipelines, where each booked call has significant revenue impact and attribution accuracy matters.
When the iClosed widget loads it can set first party and third party cookies for session continuity, attribution, AB testing and analytics. It collects the visitor IP address, user agent, referrer, UTM parameters, page URL, and any data entered in the booking form (typically name, email, phone, company, and qualification answers). Data is sent to iClosed servers in the United States.
Under Article 5(3) of the ePrivacy Directive, the storage of non essential cookies on a user device requires prior, informed and freely given consent. Under the GDPR the IP address and form inputs constitute personal data. Because iClosed is a third party processor located in the United States, the controller must also document an adequate transfer mechanism (Standard Contractual Clauses, Data Privacy Framework where applicable) and complete a Transfer Impact Assessment.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The iClosed widget should be blocked behind a Consent Management Platform until the user opts in to functional and analytics cookies. The consent banner must list iClosed by name (or by purpose with a clear vendor reference), describe the categories of data sent to the United States, and offer an equally easy way to refuse. Form submission itself can be processed on the basis of the contract or pre contractual measures once the user actively submits a booking.
Sign a Data Processing Agreement with iClosed, document Standard Contractual Clauses and any DPF certification, list iClosed in your record of processing activities and privacy policy, configure the widget to load only after consent, restrict the booking form to strictly necessary fields, set appropriate retention on lead data in the CRM, and review your DPIA if you combine iClosed with paid advertising or large scale profiling.
Websites using iClosed must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended when iClosed is used at scale on lead generation pages or combined with marketing analytics. Key risks: systematic profiling of prospects, persistent cookies, US transfers, integration with CRM and ad platforms, and potential collection of special category data via free text form fields.
Sample consent text
We use the iClosed scheduling widget to let you book a call with our team. iClosed sets cookies and may transfer your IP address, device data and form inputs to its servers in the United States for booking, attribution and analytics. You can accept or refuse these non essential cookies at any time.
Third-party domains contacted
iclosed.ioapp.iclosed.ioassets.iclosed.ioapi.iclosed.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| iclosed_session | Functional | Session | Maintains the booking widget session, including the selected slot, the qualification answers and the step in the booking flow. |
| iclosed_visitor_id | Attribution | 1 year | Persistent visitor identifier used for attribution: links the visitor to the original referrer and UTM parameters across pageviews and devices. |
| iclosed_utm | Attribution | 6 months | Stores the first and last UTM parameters seen for the visitor so that bookings can be attributed to the right campaign. |
| iclosed_ab | Analytics | 30 days | Stores the AB test variant assigned to the visitor for the booking widget so that the same variant is shown on return visits. |
iClosed uses cookies for user preferences — inform visitors with a consent banner.
iClosed loads a third party JavaScript and may set first party and third party cookies for session continuity, attribution (UTM and referrer), AB testing of booking widgets, and analytics. Typical cookies include a session identifier, a visitor identifier used for attribution, and analytics cookies. The exact list depends on the configuration chosen by the website operator and on the iClosed plan in use.
Yes, on EU websites. The cookies and tracking identifiers set by iClosed are not strictly necessary to display the page itself, so they fall under Article 5(3) of the ePrivacy Directive and require prior, freely given, specific and informed consent. The widget must be blocked behind a Consent Management Platform until the visitor opts in. The booking form data submitted afterwards can rely on contract or pre contractual measures.
Two legal bases typically apply. Consent (Article 6(1)(a) GDPR) covers the deposit and reading of non essential cookies and the analytics, attribution and AB testing they enable. Contract or pre contractual measures (Article 6(1)(b) GDPR) cover the booking itself once the user actively submits a form to request a call. Legitimate interest is generally not a safe fallback for the widget given the ePrivacy consent requirement.
Yes. iClosed is a US company and processes booking and analytics data on servers in the United States, typically on AWS infrastructure. EU controllers must put in place Standard Contractual Clauses with iClosed and check whether iClosed is certified under the EU-US Data Privacy Framework. A Transfer Impact Assessment is recommended to document supplementary measures (encryption, access controls, processor commitments to challenge disproportionate access requests).
A DPIA is recommended whenever iClosed is deployed on large scale lead generation pages, integrated with paid advertising, or combined with CRM enrichment that profiles prospects. Triggers include systematic profiling, US transfers, persistent identifiers and the potential collection of sensitive information through qualification answers. Even where no DPIA is strictly required, documenting a focused risk assessment is good practice.
Sign a Data Processing Agreement with iClosed, block the widget script until consent is granted, declare iClosed in your cookie banner and privacy policy with its purpose and country of processing, restrict the booking form to fields you actually need, set retention rules in your CRM, and review configuration regularly. If you also push iClosed events to advertising platforms, make sure the corresponding marketing consent is captured.
Yes. EU hosted scheduling tools such as TimeTree, Lemcal (operated from France), or self hosted solutions like Cal.com on EU infrastructure can reduce third country transfer risk. They will not always offer the same sales focused features, so the choice depends on whether high ticket sales workflows and US integrations are critical for your operations.
List iClosed in the third party vendors table of your cookie policy with its purpose (scheduling and attribution), the data categories processed, the cookies set, the country of processing (United States) and the transfer mechanism. Reference the iClosed privacy policy and DPA. Use the same descriptions in your Record of Processing Activities. Update both documents whenever you change iClosed configuration or integrate new destinations such as ad platforms.