Client records and the GDPR: what your salon may write down

The GDPR applies to paper records too

The General Data Protection Regulation doesn't only apply to software. A paper card file is covered as well if it's kept in an ordered way, for example alphabetically in a card box (Art. 2(1) GDPR). Whether you work with paper, a spreadsheet or a program makes no difference: the rules are the same. And because the GDPR is an EU regulation, its core rules are the same in every EU country. National laws can add details, for example on how long certain documents must be kept.

As a salon, you are the “controller” of your clients' data under the GDPR. That means you decide what is stored, and you must be able to explain why.

What you may write down

Every piece of stored data needs a legal basis. For ordinary client records, two are the most important:

• Contract (Art. 6(1)(b) GDPR): you need a client's name and contact details to arrange appointments, confirm them and let them know about changes.
• Legitimate interests (Art. 6(1)(f) GDPR): notes that serve your work and that the client would expect, such as last time's colour formula or the length they like to wear.

Typically unproblematic:

• name, phone number, email address,
• appointments and the services booked,
• colour formula, mixing ratio, processing time,
• hair type, cutting preferences, preferred length,
• practical notes such as “prefers mornings”.

The rule of thumb: only note what you really need for the next treatment. Less data means less risk, and less work when someone asks for access or erasure.

What doesn't belong in your records

• Judgements about people such as “difficult”, “annoying” or “reluctant to pay”. Your client can request access and will then see every entry. Only write what you would also show them.
• Private details unrelated to the treatment, such as relationships, employer or family arguments, even if they came up in conversation.
• ID or bank details, unless you need them for a specific purpose.
• Health information without consent. More on that below.

Factual information, such as an appointment marked as a no-show, is different from a judgement about a person.

Allergies and health data: special category data

Allergies matter, especially for colour: you should know about a known reaction to certain dyes before you start mixing. Legally, though, this is health data, and under Art. 9 GDPR health data is one of the special categories of personal data. Processing it is prohibited in principle unless an exception applies. In a salon, that exception is usually the client's explicit consent (Art. 9(2)(a) GDPR).

In practice, that means:

1. Ask before you write it down: “May I note that you react to this dye? Then my colleague will know next time too.”
2. Record the consent, ideally in writing, or at least with the date in the record. You must be able to prove it later.
3. Only note what's necessary. “No colour with PPD” is enough. A medical history doesn't belong in your records.
4. Mention that consent can be withdrawn at any time. If it is, you delete the entry.

The same applies to other health information, such as a scalp condition or a pregnancy, if it's relevant to the treatment.

If you use software, think about who can see such notes. On Kammzeit's Free plan there is one login per salon. With Pro, staff members get their own logins: they see all of the customer records, including every note, but can't delete customers or export the records. You can't hide individual notes from your team. When someone leaves the salon, you remove their access.

Informing your clients

Under Art. 13 GDPR you must inform people when you collect their data: who is responsible, what the data is used for, how long it's kept and what rights they have. In the salon, a notice or a sheet at the till works well, alongside the privacy policy on your website.

Online booking needs this information too. Kammzeit's booking page links to a privacy notice explaining that the salon is responsible for the bookings and that Kammzeit processes the data on its behalf. Mention online booking and Kammzeit as a service provider in your own privacy policy as well.

Access and erasure

Access

Under Art. 15 GDPR, every client can ask what data you hold about them. You generally have to respond within one month; for complex requests, this can be extended by up to two further months if you tell the client. Access is normally free of charge. First check that the request really comes from your client, especially if it arrives from an unknown email address.

In Kammzeit, a person's contact details, notes and appointments are on their customer card. You can print or copy this information and hand it over, including the notes.

Erasure

When you no longer need data, or the client asks for erasure (Art. 17 GDPR), you delete it unless a legal obligation to keep it applies. Tax and accounting rules, for instance for invoices and receipts, still apply, and they differ from country to country. If in doubt, ask your accountant which records you need to keep and for how long.

In Kammzeit you delete a client from their customer card, together with their appointments. Even without requests, it's worth tidying up once a year. Someone who hasn't been in for years doesn't need a customer card any more. Set yourself a period and stick to it.

Software providers and data processing agreements

When a provider stores your clients' data for you, such as a booking system or records in the cloud, this is usually processing on your behalf. Art. 28 GDPR requires a contract for it, the data processing agreement (DPA). It sets out, among other things, that the provider only processes the data on your instructions, how it protects the data and which sub-processors are involved.

What to check:

• Is there a DPA, and can you read it before you sign up?
• Where is the data stored? Are the servers in the EU?
• Which sub-processors are there?
• Can you export your data and have it fully deleted at the end?

With Kammzeit, the DPA applies from the moment you sign up. The data is stored on servers in a data centre in Eygelshoven in the Netherlands. You can export your customer records as CSV and all of your salon's data as JSON, and you can delete your account yourself.

Checklist

• Only note what you need for the treatment.
• No judgements, and nothing you wouldn't show the client.
• Allergies and other health data only with explicit consent, and keep a record of that consent.
• A privacy notice in the salon and on your website.
• Answer access requests within one month.
• Delete old records regularly.
• A DPA with every provider that stores client data for you.
• Access to the records only for people who need it.

Note: This guide is general information, not legal advice. For specific questions, contact a lawyer, your trade association or the data protection authority in your country.