GDPR for salons and service businesses

A salon, massage studio or other appointment-based business processes personal data throughout the day: a name and phone number for a booking, appointment history and, in some activities, health information. GDPR does not prohibit this processing. It requires you to know the purpose and lawful basis, collect only what you need, and explain the processing clearly to the individual.

This article is not legal advice. It is a practical framework for conversations with your lawyer, accountant and software provider, with Slovenian businesses in mind.

Consent is not the default basis for an appointment

When a client books a service, you need certain information in order to provide that booking. GDPR provides several lawful bases; consent is only one of them. Depending on the workflow, processing ordinary booking data may be necessary to perform a contract or take steps before entering into one. Invoice processing and retention may instead be required by law.

The useful rule is not “add a consent checkbox to everything.” It is “identify the purpose, choose the appropriate lawful basis, and tell the individual what you are doing.” The European Data Protection Board provides a practical SME guide for making that assessment.

Health data needs an additional Article 9 condition

Information about allergies, diagnoses, pregnancy or injuries can be health data, which is a special category of personal data under Article 9 GDPR. For this kind of data, an Article 6 lawful basis alone is not enough; one of the additional Article 9 conditions must also apply.

Explicit consent is one possible condition, but it is not the only one. Certain health-related activities may rely on another condition provided by EU or national law. That is why “health data always requires consent” is too broad a rule.

The same purpose-by-purpose approach applies to client photographs. A photo is personal data, and storing it in a client record is a different purpose from publishing it publicly on social media.

An appointment reminder is not the same as a marketing campaign

Separate messages about an existing booking from messages whose purpose is to sell another service.

In Slovenia, direct marketing by email and SMS is governed not only by GDPR but also by electronic-communications rules, including ZEKom-2. Prior consent is the general rule, with a limited existing-customer exception for email marketing of similar products or services where a clear and easy opt-out is provided. The exact rule depends on the channel and circumstances, so do not treat a booking checkbox as blanket marketing permission.

See Appointment reminders for how Calendra separates operational notifications from other communication.

Retention: define a purpose and period for each category

GDPR uses the storage-limitation principle: keep personal data no longer than necessary for the purpose for which it is processed. That does not mean one retention period applies to everything.

1. Invoices and tax records. Retention comes from accounting and tax rules.
2. Appointment history and client notes. The period should be justified by the operational or professional purpose; regulated activities can have additional requirements.
3. Marketing data. Consider the lawful basis, the right to object or withdrawal of consent, and the rules that apply to the communication channel.

A written retention schedule by category is easier to apply consistently than an informal rule that exists only in someone's memory.

What to check with a hosted software provider

Where a software provider processes personal data on your behalf, it will generally be a processor for that processing. Article 28 GDPR requires a contract or other legal act with specific safeguards. Before choosing a platform, check:

1. Data processing agreement (DPA). What the processor may do with data and under whose instructions.
2. Subprocessors. Which other providers support hosting, messaging or other parts of the service.
3. Data location and transfers. Whether personal data leaves the EEA and on what transfer mechanism.
4. Security measures. How access, backups, transfers and incidents are handled.
5. Support for data-subject rights. How you locate, export, correct or erase data when a request applies.

Calendra publishes its data processing agreement and subprocessor list openly. The same transparency is a useful benchmark when comparing vendors.

Client rights go beyond erasure

GDPR gives individuals rights including information, access, rectification and, in certain circumstances, erasure, restriction, portability and objection. Not every right applies in the same way under every lawful basis.

Operationally, you should be able to identify what information you hold about one person and why. That is much harder if records are split across a paper diary, phone, email and several spreadsheets than if they sit in one place in client management. See Data rights for the process used with Calendra.

Three checks to make this week

First, list the data you need for a booking and the lawful basis used for each purpose. Second, separate operational booking messages from direct marketing and check the Slovenian rules for your email or SMS channel. Third, locate your current provider's DPA, subprocessor list and international-transfer information.

Sources and further reading

• EDPB: Process personal data lawfully
• EDPB: Respect individuals' rights
• EDPB: Data controller or data processor
• Slovenian Information Commissioner: spam and direct marketing
• Slovenian Information Commissioner: controller obligations and ZEKom-2