Last week a client asked you a simple question: "Why is my before-and-after photo on your Instagram?" A junior stylist had posted it in good faith, and nobody had asked her. The same week, the paper appointment book was left open at reception, and a waiting client could easily read phone numbers and notes like "laser, session 3, sensitive skin". None of this was malicious. All of it damages your reputation, and all of it matters under the Turkish data protection law (KVKK).
Below is a practical roadmap: map the data you collect, separate a privacy notice from explicit consent, get separate photo consent, limit access and handle deletion requests. If you run a salon in the EU, much of this will feel familiar, as KVKK shares many principles with the GDPR. This article is not legal advice; for questions specific to your business, please consult a data protection specialist or lawyer.
What data does your salon really collect?
Most owners say, "We only take a name and a number." Track one ordinary week and the list grows:
- Identity and contact details: full name, phone, email, sometimes date of birth.
- Photos: before-and-after shots, colour references, face photos taken for a skin analysis.
- Skin and hair information: skin type, sensitivities, allergies, colour formulas, laser session notes.
- Free-text notes: "pregnant, no chemical treatments", "on medication" and similar remarks.
- Financial information: payments, deposits, outstanding balances.
Crucially, allergies, pregnancy, medication or skin conditions are health-related, and under KVKK they count as special categories of personal data, much like under the GDPR. The rules for them are stricter. For every item, ask: "Do I need this to deliver the service safely, or is it habit?" What you don't collect, you don't have to protect.
A privacy notice and explicit consent are not the same thing
The privacy notice: informing the client
A privacy notice tells the client which of their data you process and why, who you may share it with, how long you keep it and what rights they have. A notice at reception or a one-page form at the first visit is a good start.
Explicit consent: a freely given yes
Explicit consent is a specific, informed and freely given agreement to one particular thing. It comes up when you want to send marketing messages, share a photo or record certain health details. Two rules matter most:
- Consent must not be a condition of service. "We can't book you unless you agree to promotional messages" is not a free choice.
- One signature should not cover everything. Use separate tick boxes for marketing, photos and health notes.
Tip: Split your first-visit form into three parts: (1) the privacy notice with an "I have read this" line; (2) consent for skin and health information; (3) separate yes/no boxes for photos and for marketing. Keep the signed form with its date.
Why photos need their own consent
Photos travel faster than any other salon data. Tracking progress and showcasing your work are two different purposes.
- Record-keeping photos: stored on the client profile for comparison at the next session. Explain why and get agreement.
- Photos for sharing: used on Instagram, your website or in the window. These need separate, explicit consent, and you should agree in advance whether the face will be visible.
- Staff personal phones: photos kept in an employee's own gallery leave with that employee when they move on. Keep photos in one place that belongs to the business.
In sysSalon, client photos are attached directly to the client profile, so they sit alongside that client's visit history instead of circulating on staff phones or in chat groups. If you use the AI skin or hair analysis, tell the client clearly that the photo taken for the analysis falls under the same rules.
Paper books and WhatsApp groups: the risks you don't see
Most salon data leaks come from everyday habits, not hackers.
- The paper appointment book: left open at reception, easy to photograph or lose, and there is no way to know who read which page.
- The staff WhatsApp group: "3 pm, Mrs Smith, laser, sensitive skin" lands on every member's phone. When someone leaves, the old messages stay on their device.
- Spreadsheets and USB sticks: every copy makes it less clear which version is current and who holds what.
With, say, 20 appointments a day, one photo of one page means twenty clients' details have left the building. A single web-based system reduces that risk considerably. In sysSalon, the appointment calendar and client profiles open in the browser over an HTTPS connection, and each business sees only its own data.
Limit access: not everyone needs to see everything
Under KVKK, only people who need data should access it. This doesn't require a big IT budget:
- No shared passwords. Every team member logs in with their own account. sysSalon separates administrator and user accounts, so a single password doesn't get passed around for years.
- Close access for leavers on their last day. Remove their account, change any shared passwords and take them out of chat groups.
- Lock the screen. Set the reception computer or tablet to lock automatically when idle.
- Keep sensitive notes minimal. "Sensitive skin, avoid acids" is enough; if you don't need a diagnosis or a drug name, don't write it down.
For finer control, role-based permissions and activity logs are coming soon to sysSalon. For now, access control is built on individual user accounts and the habits above.
When a client asks you to delete their data
KVKK gives individuals the right to request that their data be erased or destroyed, similar to the GDPR's "right to be forgotten". Have a procedure ready:
- Get the request in writing (email or signed form) and note the date.
- Verify that the person asking really is the client.
- Map where the data lives: software, paper forms, phone galleries, chat groups.
- Set aside records you are legally required to keep, such as invoices and accounting documents, and check with your accountant.
- Delete the rest and confirm to the client in writing. The law sets a deadline for responding, so don't let requests sit.
If client details are scattered across notebooks, phones and chat groups, honestly saying "it's deleted" is almost impossible.
Make trust part of your salon's standard
KVKK compliance is not a form you fill in once; it is a daily routine: knowing what you collect, informing clients properly, getting separate consent for photos, limiting access and being ready for deletion requests. That routine also sends clients a quiet message: "Your information is looked after here."
You can take the first step away from paper books and scattered chat groups today. Start with sysSalon's free plan; no credit card required and no time limit. Explore the client profiles, the appointment calendar and the other features, or request a demo tailored to your salon.
Cover photo: RDNE Stock project / Pexels
#KVKK #client data #GDPR #consent #salon management