TL;DR:<\/strong><\/p>\n Here\u2019s the distinction that decides who calls the shots on your client data. GDPR defines the controller as the person or organisation that determines the purposes and means of processing personal data, and the processor as the one that processes it on the controller\u2019s behalf (Art. 4(7) and 4(8)). For a salon, clinic or studio using scheduling software, the business is the controller and the software provider is the processor for the client data it hosts.<\/p>\n That sounds abstract until you apply it to a Tuesday afternoon at the front desk. You decide that a client\u2019s phone number is kept for appointment reminders and not for anything else. A processor may handle that number only on your documented instructions (Art. 28(3)(a) and Art. 29). If a provider started using your clients\u2019 data for purposes of its own, GDPR would treat it as a controller for that processing (Art. 28(10)), with all the obligations that come with it.<\/p>\n Two more rules follow from the regulation:<\/p>\n Owning the software and controlling the data are two separate things.<\/strong> Your scheduling platform owns its code, its interface and its servers. Decisions about your clients\u2019 names, appointment history and contact details stay with you as the controller, and a good contract makes that explicit. A business that assumes \u201cthe system holds the data, so the system decides\u201d is making an expensive mistake.<\/p>\n A verbal promise that \u201cyour data is safe with us\u201d means little if the contract says otherwise. GDPR requires processing by a processor to be governed by a contract or other legal act in writing, which can be in electronic form (Art. 28(3) and 28(9)). Before you import a single client record into a new platform, read the provider\u2019s terms or data processing agreement line by line, or ask someone who understands contracts to do it. Here\u2019s what has to be in there.<\/p>\n The contract can be based in whole or in part on standard contractual clauses (Art. 28(6)), and a provider\u2019s adherence to an approved code of conduct or certification can serve as one element showing sufficient guarantees (Art. 28(5)). Neither replaces reading what you sign.<\/p>\n Tip:<\/strong> Ask for the data protection terms before you sign the main contract, not after. If a provider stalls on sending them, that\u2019s your answer.<\/em><\/p>\n Contracts promise. Exports prove. Before you commit your client base to any platform, export a sample and actually open the file.<\/p>\n A real sample export reveals problems a sales call never will: field names that don\u2019t match your old system, missing columns, truncated notes. They show up the moment you open the file, not months later when you actually need it.<\/p>\n Whether a platform has a self-serve export or only a manual, on-request download can decide whether a migration takes days or weeks.<\/strong> Providers that build export into the product, rather than treating it as a support ticket, make the controller and processor relationship real rather than theoretical.<\/p>\n Switching providers, or simply wanting a backup, should never feel like negotiating a hostage release. Here\u2019s the sequence that keeps it calm.<\/p>\n None of this needs to take weeks. It needs a checklist and someone willing to follow it properly.<\/p>\n The biggest risk in a migration is not losing data outright \u2013 it\u2019s losing pieces of it quietly.<\/p>\n Three habits reduce that risk. First, request a sample export early, before you sign, so you can catch formatting mismatches while you still have leverage. Second, reconcile record counts before and after the move: if you had 4,000 client profiles before, you should have 4,000 after, not 3,850 with no explanation. Third, spot-check a sample of records for notes, visit history and consent records rather than only names and phone numbers, because these are easy to lose in a rushed export.<\/p>\n Watch the import rules on the receiving side, too. Some systems use the phone number as the key for a client card, so two cards with the same number can be merged or rejected during import. Clean up duplicates before you import, not after.<\/p>\n Structured exports with clear column names make all of this far easier to verify. A dump of unlabelled columns forces you to guess what each one means, and guessing is how allergy notes and consent records quietly disappear.<\/p>\n Liability doesn\u2019t disappear because your provider handles the storage. Anyone who suffers damage from an infringement of GDPR can claim compensation from the controller or the processor (Art. 82(1)). As controller, you are liable for damage caused by processing that infringes the regulation. A processor is liable only where it has not complied with the obligations GDPR places specifically on processors, or where it acted outside or against your lawful instructions (Art. 82(2)).<\/p>\n In practice this splits the risk. If your provider ignores your instructions or fails its own obligations, that is largely on them. If you instruct the processor to do something that itself breaches GDPR, such as keeping client data with no lawful basis, the responsibility sits with you \u2013 although a processor must tell you immediately if it thinks an instruction infringes data protection law (Art. 28(3)). Where both of you are responsible for the same damage, each can be held liable for all of it towards the client and then claim back the other party\u2019s share (Art. 82(4) and 82(5)).<\/p>\n Breaches have their own clock. As controller, you must notify the competent data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people\u2019s rights and freedoms (Art. 33(1)). That deadline is hard to meet if your contract leaves the provider\u2019s notice to you vague. A solid contract doesn\u2019t remove liability from either side. It defines where each party\u2019s responsibility starts and stops, which is exactly why vague contracts are dangerous.<\/p>\n GDPR is an EU regulation, so the controller and processor rules above work the same way whether your business is in Lisbon, Warsaw or Prague. What differs is the detail around them. How long you must keep invoices and accounting records is set nationally, so ask your accountant or tax authority. Rules on health-related records can also differ between countries, which matters if you run a clinic or offer treatments that involve a client\u2019s medical history. And complaints and breach notifications go to your national data protection authority.<\/p>\n The practical takeaway: your contract should say which law governs it and where disputes are settled, and your own records should note which national rules apply to the data you keep. \u201cWe comply with privacy law\u201d is not a clause \u2013 it\u2019s a slogan.<\/p>\n Altegio is scheduling and business management software for appointment-based businesses \u2013 beauty, wellness, clinics, auto services, fitness and more. Altegio also follows a Zero-Competition Policy: it isn’t a marketplace, so clients book through links that belong only to your business, they don’t see competitors while booking, and your client base is never resold. Here\u2019s how the three steps map onto it.<\/p>\n Before you sign, read the service agreement, the Data Transfer Agreement and the privacy policy<\/a> against the checklist above. If you are comparing providers, you can start a 7-day free trial<\/a> and ask Support about anything the documents don\u2019t answer.<\/p>\n The business that collects the data and decides how it is used is the controller under GDPR. The software provider acts as a processor and handles the data only on the business\u2019s documented instructions.<\/p>\n Under Art. 28(3) GDPR, it sets out the subject-matter, duration, nature and purpose of processing, the types of data and categories of people, and the processor\u2019s duties: documented instructions, confidentiality, security, rules for subprocessors, help with clients\u2019 requests and breaches, deleting or returning the data at the end, and audits.<\/p>\n As a processor, it may process your clients\u2019 data only on your documented instructions. A provider that decides on its own purposes for the data is treated as a controller for that processing and takes on the controller\u2019s obligations and liability. Check that your contract limits processing to providing the service.<\/p>\n Not directly. Article 20 gives your clients the right to receive the data they provided to you in a structured, commonly used and machine-readable format and to have it transmitted to another controller, where the processing is based on consent or a contract and is carried out by automated means. Your own right to get the data back from a provider comes from your contract and Art. 28(3)(g), and your provider must help you answer clients\u2019 portability requests (Art. 28(3)(e)).<\/p>\n Ask the provider for a sample export, or try the export during a trial, and open the file. A real export tool gives you complete, labelled columns. A provider that stalls or offers only a manual, on-request download is a warning sign.<\/p>\n To delete a Location in Altegio, you contact your personal manager or Support. Export your client list and financial transactions first, and ask in writing how and when the data will be deleted. Under GDPR, the choice between deleting and returning personal data at the end of the service is yours as controller (Art. 28(3)(g)).<\/p>\n This article is general information, not legal advice. Rules differ between EU countries.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" Under GDPR your business controls its client data. The Art. 28 contract terms to check, how to test an export, and a handover checklist for switching.<\/p>\n","protected":false},"author":34,"featured_media":49760,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":"","_members_access_role":[],"_members_access_error":""},"categories":[328,319,322],"tags":[193,90,277],"class_list":["post-49787","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-clientes","category-protecao-de-dados","category-juridico","tag-booking-software","tag-clients","tag-salon-management"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n
\nWhat controller and processor mean for appointment businesses<\/h2>\n
\n
Step 1. Contract checklist: terms to insist on before you upload your client list<\/h2>\n
\n
Step 2. Technical checks: test the export, access rights and logs before you commit<\/h2>\n
\n
Step 3. Leaving a vendor: a step-by-step handover checklist<\/h2>\n
\n
Keeping your export clean: data integrity in migration<\/h2>\n
![\"Three](\"https:\/\/alteg.io\/blog\/wp-content\/uploads\/2026\/10\/client-data-ownership-02.jpeg\")
<\/p>\nWho is liable when something goes wrong with client data<\/h2>\n
![\"Diagram](\"https:\/\/alteg.io\/blog\/wp-content\/uploads\/2026\/10\/client-data-ownership-01.jpeg\")
<\/p>\nOne regulation, national details: what differs between EU countries<\/h2>\n
How client data control works in Altegio<\/h2>\n
\n
FAQ<\/h2>\n
Who controls the client data in salon software?<\/h3>\n
What should a data processing agreement include?<\/h3>\n
Can a scheduling platform sell or share my client list?<\/h3>\n
Does the right to data portability apply to my business?<\/h3>\n
How do I check if I can export my client data before signing up?<\/h3>\n
What happens to my data when I close my Altegio account?<\/h3>\n
Read next<\/h2>\n
\n