Privacy notice for a salon using online booking

A salon with online booking has its client list in a platform it does not control, its client records holding skin and allergy information that is health data, its reminders and marketing going out by text, its clients' photographs on social media, and self-employed stylists keeping their own records at the same chairs. The privacy notice has to explain the platform, state the right basis for the health data, separate the reminders from the marketing, deal with the photographs, and say which records belong to the salon and which to the stylists. For £595, fixed, with delivery in five working days, I draft the privacy notice and the cookie notice for the business and set out how the consent mechanism should work.

Who this is for

Hair, beauty, nail, barber and aesthetic salons in England and Wales using an online booking system, with employed staff, self-employed stylists or both.

What matters in a salon privacy notice

The booking platform and the data it holds for the salon

Article 13 of the UK GDPR obliges the business as controller to tell clients what it collects and who holds it, and a salon's booking platform holds the client list, contact details, appointment history, notes, card details for deposits and the marketing preferences, acting as the salon's processor under Article 28 (with an agreement the salon should have accepted in the platform's terms) and often as a controller for its own purposes (its own marketplace, its own marketing to the client), which the notice should explain; the client should be told that booking through the platform's app or marketplace may involve the platform's own notice as well as the salon's, and the salon should know whether the platform transfers data outside the United Kingdom under the safeguards Article 46 requires.

Client records, patch tests and the data that is special category

Patch test results, allergies, skin conditions, medication, pregnancy and the contraindications a treatment consultation records are health data under Article 9 of the UK GDPR, and the notice should state the condition the salon relies on: explicit consent where the client chooses to disclose for a treatment, which is the usual basis for a salon, with the records kept for the period the salon's insurer requires (which for colour and chemical services is years, because the claim comes later), access limited to the stylist and the manager, and the records not shared without the client's agreement; a salon that keeps patch test cards in a drawer at reception has a security problem the notice cannot cure, and the operational note that comes with the documents says so.

Reminders, reviews and the messages that are marketing

Confirmations and reminders for appointments are messages the client expects as part of the service; texts about offers, new treatments and 'we miss you' campaigns are something else, and the soft opt-in apart, regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 requires consent for electronic marketing to individuals (which it can for a client who was given the chance to refuse at booking and in every message); the notice should say which the salon relies on, the booking platform's settings should implement it, review requests sent after an appointment are marketing if they promote the salon and should be treated as such, and every marketing text should carry an opt-out that works.

Photographs, social media and the client's image

Before and after photographs, images for the salon's social media and portfolio, and photographs used for colour matching and records are personal data, and the notice should say that the salon takes photographs for the client's record with their agreement, uses them on social media and the website only with the client's consent (recorded, revocable, with the image removed when withdrawn), does not tag or name clients without consent, and does not let staff take or post images on personal accounts; a client's image used in an advertisement without consent is a complaint and, where the salon is identifiable, a claim.

Self-employed stylists and the records that are theirs

Where stylists rent chairs and run their own client relationships, each stylist is the controller of their own client records and needs their own notice and registration, and the salon is the controller of the booking platform's data and the salon's own records; the salon's notice should say which is which, how the booking platform is shared (the stylist's clients booked through the salon's system, with the stylist's access limited to their own clients), and what happens to the records when a stylist leaves, because a stylist who takes the salon's client list is a dispute and a stylist who cannot take their own records is another.

Cards, deposits, no-shows and the payment processor

The notice should explain that card details for deposits and no-show charges are held by the payment processor rather than the salon, with the processor as a controller for its own compliance, that the salon's deposit and cancellation policy is applied to the data the platform holds, that the retention of booking and payment records follows tax law, and what the individual may ask for (access, correction, erasure, restriction, portability, objection), how and within the month allowed, and the Information Commissioner's Office as the place to complain; the website's cookies and the booking widget's tracking need the consent mechanism the pack provides guidance on under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, and registration with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018 is required where the fee applies, and the notice can state it.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Our booking platform sends marketing texts to clients. Is that our responsibility?

It is, where the salon sends them through the platform: the salon needs consent or the soft opt-in, implemented in the platform's settings, with an opt-out in every message. The notice says which basis the salon relies on.

Are patch test records health data?

They are, as are allergies and skin conditions. The notice states explicit consent as the basis, limits who sees them and keeps them for the period the insurer requires. Where they are stored is a security question the note addresses.

Do our self-employed stylists need their own privacy notice?

Where they control their own client records, yes, and their own registration. The salon's notice covers the booking platform and the salon's records and says which is which.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Staff handbook for a salon
• Contractor agreement for a self-employed hairdresser

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.