Colour formulas and photos on a hair salon client card

A client comes back to a salon in Lucerne after four months. She would like “the same colour as last time”. The stylist who coloured her then is now on maternity leave. The index card says “Roots 6/0, 35 min”, nothing more, and the client still remembers a photo on a colleague’s phone.

A good client card saves time in moments like this. It is also a collection of personal data, and photos and teenagers raise particular questions. This article describes what can be on a colour and cut card and what the Federal Act on Data Protection (DSG, also called nFADP) says about it. It is not legal advice; for their own salon, the owner decides.

What goes on the card

Under Art. 5 let. a DSG, personal data is any information relating to an identified or identifiable person. A colour formula with the client’s name is therefore personal data, and so is a cut with a date and the stylist’s name. That is nothing unusual: every client file consists of it.

The DSG requires such data to be collected only for a specific purpose that is recognisable to the person, and the processing to be proportionate (Art. 6 paras. 2 and 3). For a colour card in everyday terms: the purpose is to make the next treatment the same or deliberately different. What is needed for that goes on the card; what would only be “perhaps useful one day” deserves a second thought.

Detail	What it is for	Note
Hair length and texture	Price and duration of the appointment	Often already chosen at booking
Brand, shade, grams, developer, mixing ratio	The same result next time	Per bowl and zone: roots, lengths, ends
Processing time and technique	Repeatability	For example foils, balayage, gloss
Guard, fade, beard shape	Men’s cut and beard	Short words rather than running text
Photos	Before and after, discussion	See below: a purpose of its own, a consent of its own
Free-text “Notes”	Everything else	Freely worded, so handle with care

When a note is more than a note

The free text is the most inconspicuous and at the same time the most delicate spot. Notes such as “scalp reacts sensitively to bleach” or “after chemotherapy” concern health. Data on health counts under Art. 5 let. c no. 2 DSG as particularly sensitive personal data. If consent is needed to process it, Art. 6 para. 7 DSG requires it to be explicit.

A salon can therefore decide to record on the card only what the treatment needs and to leave out diagnoses. Whether an entry already counts as health information depends on the wording; the list in the law gives the direction but does not decide the individual case.

Photos: a purpose of their own

A photo in which a person is recognisable is personal data. The same photo can have two different purposes: as an aide-memoire on the card (“this is what the roots looked like before the treatment”) or as advertising on the website and social media. Under Art. 6 para. 3 DSG, data may be processed only in a way compatible with the purpose for which it was collected. Taking a photo for the card does not yet make it usable for advertising.

Where consent is needed, Art. 6 para. 6 DSG sets out three features: it is valid only if given for one or more specific processing operations, after adequate information and voluntarily. For photos in a salon this can be made concrete:

• Specific: “photo for the client card” and “photo for advertising” are two items, not one.
• Informed: the person knows who sees the photo and where it appears.
• Voluntary: a no has no effect on the appointment.

Where the photos are kept is a question of data security. Art. 8 DSG requires the controller to take appropriate technical and organisational measures. The gallery of an employee’s private phone and the client card in the business are, in this respect, two different places.

Teenagers on the client card

For minors, two questions come up in everyday life: who may book and pay for the appointment, and who may consent? Art. 19 ZGB states that persons capable of judgement but without full legal capacity can enter into obligations only with the consent of their legal representative. Without that consent they can obtain benefits that are free of charge and manage minor matters of everyday life. Under Art. 19a ZGB the consent can be given expressly or tacitly in advance, or the transaction approved afterwards.

Whether a haircut or a bleach counts as a minor matter of everyday life, the law does not say by name; it depends on the individual case. A salon can therefore set its own rules, for instance from what age a chemical treatment needs the consent of a parent or guardian. Such a rule is the salon’s decision, not a requirement of the ZGB. For photos of children, the same questions arise again.

Access, retention, deletion

Under Art. 25 DSG anyone can ask the controller for information on whether personal data about them is being processed. According to the law, this includes the data processed as such, the purpose and the retention period or the criteria for it. The FDPIC (EDÖB) writes that the information is as a rule provided free of charge within 30 days. A client’s colour card and photos are part of it; whoever keeps them in one place can put them together faster.

The DSG gives no figure for retention. Art. 6 para. 4 requires data to be destroyed or anonymised as soon as it is no longer needed for the purpose of processing. How long a colour formula is useful for a client who has not been back for three years is for the salon to decide. Invoices and receipts are subject to their own rules, which this article does not cover.

How we are approaching this for the salon

In the idea for hair salons that we are working on, the colour card will record brand, shades, grams, developer, mixing ratio and processing time per bowl, and “Same as last time” will pre-fill from the last card. The app will allow photos only with consent, given separately for the card and for advertising, and for treatments for people under 16 it will by default ask for the consent of a parent or guardian. Both are default settings the salon can adjust. There will be no health fields of its own, only a simple notes field that the team sees.