Buying a well established salon, help!

[elliotf9]

I am buying a salon which the owner is retiring from and moving away. She said that I can't have any of the clients phone numbers or addresses because of data protection even when the sale has completed in the next few weeks. She said I will have to ask the clients when I meet them which I don't think is right. When I brought my other salon 7 years ago the owner of that transferred to me on sale completion all of the client details.

Also, her clientele mainly consists of weekly older ladies which she has told me she is giving to the other staff member who only works 2 days a week, as they clients don't know me and the staff member who is employed already has a well established clientele. This means I would hardly have any clients to start with and I want to take on another stylist part time as well to bring in more younger clients. I feel this isn't right.

Any ideas or advice on what to do as I have never experienced this before in business?

 

[AcidPerm]

Yes, she is right.
Client data cannot be sold or shared without the express consent of each individual client. Some larger businesses will include a section about transfer of ownership of the business in their privacy policy that clients sign and agree to, but very few independent salons would do this.

You need to familiarise yourself with GDPR regulations which came into effect in 2018 as well as current employment regulations if you are buying an established business that employs staff.

Presumably you are using a solicitor to assist with this purchase? They should be the person advising you on these extremely complex matters.

 

[TheDuchess]

I’m surprised you’ve been in business and don’t know the basics of data protection. The database is a key asset so it’s important to check whether this is included in the valuation and the sale - however business owners do not always have the appropriate consents from their clients to enable them to legally sell their database. It all depends on the wording of the privacy notice at the time the client gave their original consent to share their data. If you’ve made assumptions about what was included in the purchase of the business, now is the time to clarify the position. You can’t buy something that she doesn’t have a legal right to sell.

This is a complicated area and you should have legal advice. I am not qualified to give advice, however the basics to check are

1 Does the seller have the right to transfer the data?
2. Can the purchaser use the data lawfully after the sale?

if the data was included you would need to check whether data protection considerations were built into the sale and that you weren’t going to face a potential fine for any data misuse. It’s probably much safer not to transfer data and to start afresh. When I first set up, this is what I did. I bought a new booking system and as clients came in we entered their details afresh and everyone was perfectly fine about it.

it seems that the business owner either knows that she doesn’t have the right to sell her database, or she is reluctant to take a risk of a fine for any misuse complaint.

Regarding her plan for another member of her team to take over the database. This is a separate issue. She is splitting her database asset away from her business and transferring this to a competitor. I would be unhappy about this for a number of reasons including a risk that you face potential liability, as the new business owner, for the data being misused.

You should also be talking with the Owner about how client consent can be renewed to cover your data processing intentions. I’m not going to make suggestions here - but surely you aren’t planning that she leaves one day and you appear the next day for your first day in the salon?

You’re much better off not having to worry about whether the previous owner had obtained her data “fairly, lawfully with transparent privacy and consent” and I would structure the sale so that you purchase tangible assets but leave liabilities with the seller and obtain warranties and indemnities in respect of data protection compliance,