Who owns client data when bookings come through a platform

The claim goes roughly like this: “If you take bookings through a platform, the platform owns your clients.” It is catchy, it sells well — and under the GDPR it is wrong.

Nobody owns personal data. The regulation has no concept of ownership. It has the controller: the party that determines the purposes and the means of processing personal data. In a salon’s relationship with its clients, that is normally you.

Yet the feeling that clients “belong to the platform” does not come from nowhere. It comes from three places where practice diverges from the law. Those are what this article is about.

Checked 6 August 2026 against the text of the regulation and providers’ public guidance. Contract terms differ between services — read your own.

What “controller” means

The controller is the party that, alone or jointly with others, determines the purposes and means of processing personal data. A processor handles that data on the controller’s behalf and under the controller’s instructions.

When a client books an appointment at your salon, you decide what data you need, why, and how long you keep it. The booking system is the tool you do it with. So the roles are usually: you as controller, the platform as processor.

The exception is the marketplace. When a platform runs its own consumer search service and markets that service itself, it processes the same personal data for its own purposes too. The role can then be shared — something to read in your own contract rather than assume.

Why “the platform owns your clients” is false

Three reasons, briefly.

First, there is no ownership. The client controls their own data and can demand deletion from either party.

Second, as controller you have the right to obtain the data being processed. That is the starting point, not a negotiation.

Third, a client relationship is not a database row. Someone who has visited you eight times comes back a ninth time because of you, not because of the booking software.

So far, so good. Then practice arrives.

Three places where practice diverges

Export. A right to receive data does not mean it arrives in a usable shape. The most common unpleasant surprise when switching systems is not lost data. It is that names and phone numbers come out cleanly while visit history and treatment notes come out in a format the new system cannot read. A technical question with a large practical effect.

Marketing consent. The point missed most often. When a client books through a marketplace, they accept the platform’s privacy notice. That is not the same as consenting to receive your marketing. The client relationship is yours; the right to send them a campaign message may not be, and you have to ask for it separately.

Perception. Outside the law, but commercially the most important of the three. If a client found you in a marketplace, booked in the marketplace’s app and got a reminder in the marketplace’s name, they will remember visiting “through that app”. Next time they open the app — and see your competitors there too.

What to check today

Four concrete things, about half an hour in total.

1. Who is recorded as controller in your system. According to Timma’s guidance the setting sits in the business location settings, under contracts and GDPR, in client register rights. This field very often gets skipped during onboarding. Go and look at what it says.

2. Test the export now. Run a client list export today and open the file. See which fields are there and which are missing. Half an hour of testing saves three weeks at the point when you actually move.

3. Find out whether you hold your own marketing consent. Not the platform’s consent — yours. If you don’t, start collecting: at the till, in the booking confirmation, or at the end of the visit.

4. Read the marketplace terms. Especially the clause covering what the platform may do with the data of clients who came through it.

An example

A salon in Tampere, two staff, around 180 client visits a month. Bookings arrive both through a marketplace and directly.

The owner wanted to send a spring campaign by SMS. The client list held 640 names. Marketing consent to her personally had been given by 90 — the rest had accepted the platform’s terms while booking, which is a different thing.

The campaign went to 90 people instead of 640. The data was there, she was the controller, nothing had been “stolen”. She could still use 14% of her list.

The fix was dull and it worked: a consent question in the booking confirmation and at the till. Over eight months the number of consents rose from 90 to about 310. No drama — they just started asking.

So should you drop the marketplace?

Not automatically, and here we part ways with a good many of our competitors.

A marketplace does one thing your own website does not: it brings you a new client who had never heard of you. A commission is paid for that, and it is the price of acquiring a customer rather than a penalty.

The sensible structure is usually both. The marketplace brings new clients; your own site and booking serve the returning ones. Once someone has visited, give them a reason to book direct: their usual slot, notes from last time, a loyalty benefit. Then the commission gets paid once instead of every time.

We covered the cost side separately on the comparison page, and beauty-sector pricing in its own article.

One thing worth doing either way

Collect marketing consents in your own name from the first visit onward.

It needs no system change, no investment, and it breaks nothing. It needs one question in the right place. And it is the only part of this whole picture that is entirely within your control today.

All our beauty-sector material sits in the beauty section.

If you want a booking channel where the client relationship and the consents are in your name — see what it costs.