GDPR in your salon - free checklist

Go through the points and tick what you have. Each point shows the legal provision it comes from.

1. What you record about clients

You only record what you need for your work.Name, contact, what you did. No birth numbers or “life notes”.Art. 5(1)(c) GDPR
You know why you keep the data.Contact for appointments, service history to follow up next time.Art. 5(1)(b) and Art. 6 GDPR
You record allergies, skin conditions and pregnancy only with the client's consent.This is health data - specially protected.Art. 9 GDPR
You delete records of clients who no longer come after some time.For example 3 years after the last visit - the law sets no exact period, pick a reasonable one and stick to it.Art. 5(1)(e) GDPR

2. Client card and questionnaire

Clients get a short notice on what you use their data for and how long you keep it.A sheet with the card or a paragraph in the questionnaire is enough.Art. 13 GDPR
Consent to health data is separate - a tick box or signature.Not hidden in other text.Art. 7 and Art. 9(2)(a) GDPR
Paper cards are locked away, not lying at the reception.Art. 32 GDPR
Your phone and tablet with client data are protected by a code or fingerprint.Art. 32 GDPR

3. Before & after photos and Instagram

You have the client's consent for portfolio or social media photos.Ideally in writing or by message, so you can prove it.Sections 84-85 Act 89/2012; Art. 6(1)(a) GDPR
Consent is voluntary - clients who refuse are served the same.Art. 7(4) GDPR
When a client withdraws consent, you delete the photos from your website and social media.Art. 7(3) and Art. 17 GDPR
Without consent you only take photos where the client cannot be recognised.Nail close-ups, hair from behind - no face or distinctive tattoos.Section 84 Act 89/2012

4. Messages, texts and newsletters

You may send appointment reminders and confirmations.They relate to the agreed service.Art. 6(1)(b) GDPR
You send offers and news only with consent, or to existing clients with an unsubscribe option in every message.Section 7 Act 480/2004
You don't add clients to WhatsApp groups where they see each other without their consent.Art. 5(1)(f) GDPR

5. When a client asks or something happens

On request you tell her within 1 month, free of charge, what data you hold and give her a copy.Art. 12(3) and Art. 15 GDPR
On request you correct or delete the data.Except what you must keep by law - e.g. accounting records.Art. 16 and 17 GDPR
If your phone or client cards are stolen, you consider reporting it to the Data Protection Office within 72 hours.Art. 33 GDPR

Client templates filled with your details

On Enynka we prepare a photo consent for Instagram and a privacy notice for your client cards - with your name, business ID and contact. Free once your profile is complete.

Create a free profile

What you get free forever:

Online booking with no commission
Profile in the public catalog
Client records for up to 25 clients (CRM)

Show the full list (salons too)

For professionals

Online booking with no commission
Profile in the public catalog
Client records for up to 25 clients (CRM)
Income and expenses overview (services, product sales, expenses)
Email reminder to your client the day before
1 photo in your profile
Reviews from clients
Client message templates and a hygiene checklist
A4 poster with a QR code - clients book on their own, even while you work
One-tap appointment reminder via WhatsApp or text
Operating rules for your field, pre-filled with your details - once your profile is complete
Complaints policy filled in with your details - free for good if you create your profile by 31 Oct 2026

For salons

Salon profile in the public catalogue
All your professionals in one place - each creates their own free profile (with online bookings, client records and revenue overview) and we link them to your salon; employees without their own business ID you add to the salon team yourself
1 photo in your profile
Reviews from clients
Client message templates and a hygiene checklist
Operating rules for your field, pre-filled with your details - once your profile is complete
Complaints policy filled in with your details - free for good if you create your profile by 31 Oct 2026

0 CZK forever - no payment card needed

What do Pro and Premium add (e.g. mobile visits to clients)? See pricing

Important: This checklist is a guide and does not replace legal advice. The applicable regulations are binding - check the current wording. As of 17 Oct 2026.

Sources: Regulation (EU) 2016/679 (GDPR) · Act No. 110/2019 Coll. on personal data processing · Act No. 89/2012 Coll., Civil Code, sections 84-85 · Act No. 480/2004 Coll., section 7 · Czech Data Protection Office (uoou.gov.cz).