Privacy policy for your beauty salon: how to write one, process by process

What belongs in a beauty salon privacy policy?

Start with your salon's name, your contact details and who is responsible for the use of client data. Explain in plain language which data you collect, why you do so and how clients can contact you with questions. The work of a beauty therapist differs per salon, so match your policy to your own treatments and way of working.

Then map your data flows per process. Look beyond your appointment book to invoicing, newsletters, photos and intake forms. A worked example for a salon with five processes:

- Appointment: name, phone number and time, to confirm and remind the client of the appointment. - Till and invoice: name and amount, for the financial records. - Newsletter: only an email address, and only if the client signed up for it. - Intake form: allergies and skin conditions, to carry out the treatment safely. - Before and after photos: only if you really take them, with the purpose stated.

Only mention photos or intake data if you actually collect them. Looking for the legal background? Read GDPR for beauty salons.

### Which salon and client data do you describe?

Go through your forms, client records and systems. Think of contact details, appointment details and notes on preferences. Record allergy or health information separately if you keep it. If you use before and after photos, state that you process images and what for.

A client record can hold notes, allergy alerts and client history. With client management for salons, such record data becomes part of your data overview. A short explanation could read:

*“To schedule appointments, (salon name) processes your name, contact details and appointment details. We use this information to manage your appointment and to keep you informed about it.”*

Replace the text in brackets and adapt the data and purposes to your own practice.

How do you describe purposes, retention periods and client rights carefully?

Make every purpose concrete. Do not just write that you use data for “the service”; say what you do with it. Contact details are needed to confirm an appointment; invoice data is used for the financial records. For a newsletter you process data for a different purpose. Describe those processes separately and do not list more data than necessary.

For each process, make an overview with the purpose, the types of data and the retention period. The GDPR does not set one general retention period for all client data. So decide how long you need data for your own process and check which current legal obligations apply. For tax records, the Dutch Tax Administration sets a retention obligation of seven years for invoices and till data, among other things. Do not apply that period automatically to intake forms or client notes.

### How do you make sensitive data and rights understandable?

Allergies, skin conditions and medication use are health data. Describe them separately and check which rules apply to your processing; you can read more in health data and GDPR in your salon. If you rely on explicit consent, ask for it separately for a clearly described purpose and record what you do with it. Have the legal wording checked before you publish.

Also explain in plain language how clients can ask questions about their data. For example, state which email address they can use to request access, correction or deletion. With free client records you can keep your digital client information organised and align your record of data processes with it.

How do you cover salon software and security in your privacy policy?

Salon software is one link in your data processing. Map which data runs through the system, what you use it for and which external services are involved, such as appointment management, client records and payments. As the salon, you decide what client data is used for; software helps you manage that data for that purpose.

Separate the security you organise yourself from the measures of your software supplier. Describe only what you can substantiate. Check who in your salon has access to client information and how you store paper records.

Salonnare stores data on EU servers and encrypts it with TLS and AES-256. Health data is kept in an encrypted vault. Also read the guide to client records software for salons for more context on managing that data.

### Worked example: what does payment processing cost?

Your payment provider also belongs in your overview as a recipient of payment data. You can work out the cost like this: Salonnare deducts 0.5% on every online or card payment, with a minimum of €0.30.

- Treatment of €40: 0.5% × €40 = €0.20. That is below the minimum, so you pay €0.30. - Treatment of €100: 0.5% × €100 = €0.50. - The break-even point is €60: there 0.5% is exactly €0.30.

Make privacy part of your salon routine

A privacy policy is not a text you write once and forget. If your way of working changes, you add a treatment or you use data differently, update your policy and check your contact details, processes and supplier details too.

Schedule a recurring check and name someone to keep track of changes. If you doubt the legal wording, check the relevant rules before you change the policy. A short, clear explanation that matches what you actually do shows how you handle client data.

Frequently asked questions