What GDPR asks of a salon or studio

Almost everything you write down about a client is personal data: name, phone, e-mail, visit history, notes about preferences, form answers and payments. A hairdresser with 400 regular clients holds 400 small client files, whether they sit in a diary, a spreadsheet or a booking system.

Some notes are more sensitive. An allergy to a hair dye, a skin condition before a cosmetic treatment or an injury before a massage is health data. The GDPR treats health data as a special category with stricter rules, so collect it only when you really need it for a safe treatment.

• Usually needed: name, phone or e-mail, booked service and time.
• Needed only sometimes: allergies or contraindications, date of birth for an age-restricted service.
• Rarely needed: home address, ID numbers, photos.

Data also hides outside the booking system: photos of the diary on your phone, a WhatsApp chat with a client, a spreadsheet of gift vouchers. They count too, so it helps to keep client data in as few places as possible.

Every use of personal data needs a legal ground. The European Commission lists six. The table shows where four of them may come up in a salon – as examples, not as a ruling on your case:

Which ground fits your exact situation is your decision as the business that controls the data. If you are unsure, ask your national data protection authority or an adviser.

Example: a client books a colour online. Without her name, phone and the time you cannot carry out the booking at all. Whether she wants offers by e-mail is a separate question, and per the Commission's consent conditions, saying no must not cost her the booking.

Consent counts only when the client actively gives it for a specific purpose, knows who you are and what you will do, and can say no without a disadvantage. In practice that means an unticked box the client has to tick, a clear sentence next to it and a record of when it was given. The Commission adds that withdrawing consent must be as easy as giving it.

In Resovu you set this up in Settings → Consents, on every plan:

• Marketing consent is a separate, optional box. Clients who don't tick it can still book.
• Your own consents (for example to taking before/after photos) are added with Add consent, as required or optional.
• Whether and when a client gave GDPR and marketing consent shows in Customer detail, and from the Starter plan also in the customers CSV export.
• The Privacy policy version you enter in Settings → Data protection / GDPR is saved with each consent, so you can later show which text the client agreed to.

The consent texts come prefilled and you can edit them; you are responsible for their wording.

A clear marketing consent sentence can be short: “I'd like to receive e-mails about news and offers from Salon Iris. I can unsubscribe at any time.” Avoid bundling it with the terms of the booking – a client who wants a haircut should not have to agree to newsletters.

The GDPR says personal data should be kept no longer than needed for the purpose it was collected for. It sets no fixed number of years, so you decide and should be able to explain the decision. Accounting and tax rules may oblige you to keep invoices for several years; client notes rarely need that long.

Resovu turns your decision into a setting. In Settings → Data protection / GDPR enter the Personal data retention period in days, from 30 to 3,650 (the default is 365). A weekly process then:

• anonymises clients whose last booking or visit is older than the period and who have no active gift card or portal activity,
• removes names, contacts, notes and form answers from older bookings,
• keeps amounts, dates and services, so your revenue reports and issued invoices stay correct.

Example with 365 days: a client last seen in October 2025 with no gift card is anonymised in the first weekly run after October 2026.

Clients can ask for a copy of their data, a correction, erasure, or object to marketing. According to the Commission, you should answer without undue delay and in principle within one month, and handle the request free of charge (unless it is manifestly unfounded or excessive).

• Copy of data: open Customers, click the client and choose Export data (GDPR). You get a JSON file to send them.
• Erasure: in the same place choose Erase data (GDPR). Name, contacts, form answers, notes and loyalty points are removed for good; your invoices and anonymous booking amounts stay.
• Their own bookings and billing details: clients see upcoming and past bookings in the customer portal and can save billing details for invoices in Details.

Export and erasure are available to the account owner only. Resovu does not e-mail the client about the erasure, so let them know yourself once it is done.

Example: a client writes on 3 March asking what you hold about her. By 3 April you send her the Resovu export plus anything you keep outside the system, such as diary notes or e-mails.

If children attend a service, you can have a parent or guardian confirm the booking. In Resovu, open Services, the service, and turn on This service is offered to minors. The form then asks whether the participant is under the age limit of your country and for the guardian's name and e-mail; the booking is confirmed once the guardian confirms by e-mail, and the place is held for 48 hours.

Limit who sees client data. In Resovu each team member has a role (owner, admin, staff or read-only), and client contact details are visible only to the owner and admins.

If data leaks – say you lose a phone with client contacts – the Commission's guidance is to notify the supervisory authority without undue delay and at the latest within 72 hours when the breach is likely to put people at risk, and to inform the clients themselves when the risk is high.

Every Resovu booking page also gets an automatically generated privacy notice filled with your business details and listing the processors Resovu uses. Treat it as a starting point and check it matches how you actually work with data. Data is hosted in the EU (Frankfurt), and you remain the controller of your clients' data.