Ask your current provider for a full export of your client file today, while you have no intention of leaving. How long the reply takes, and what format it arrives in, tells you more about your exit than any contract clause. A clean spreadsheet in a few days means leaving will be simple. Three weeks of silence, or a PDF, means it will not.
In short
- Your provider processes your client data on your behalf. At the end of the contract they must delete it or return it, at your choice, not theirs.
- A usable export is structured and machine readable. A PDF or a printout is neither.
- Test the exit before you cancel. The order matters more than the timing.
- The client file is not the only asset. Appointment history, photographs, reviews and the domain name leave by different doors, and some do not leave at all.
The fifteen-minute test
Write to your provider and ask for three things, in writing, through whatever support channel the contract names:
- A full export of the client file, in a structured, machine readable format such as CSV.
- The appointment history, saying explicitly how far back you want it.
- Written confirmation of anything that cannot be exported.
That third request is the one almost nobody makes, and it is the one that tells you what you will lose before the loss is irreversible.
Note the date you sent it. Then judge what comes back on the file itself, never on the message that came with it. Open it and ask four questions:
- Is it a table? A CSV or a spreadsheet can be imported. A PDF cannot.
- Are the columns separated? Name, phone, email and date of birth crammed into one column is retyping in disguise.
- Are accents and special characters intact? A badly encoded export turns every name with an accent into nonsense, across thousands of rows.
- Did the history come too? A contact list with no past appointments takes away the one thing that lets you win back a client who has not been in for six months.
An export that fails two of those four is not an export. It is a screenshot in a larger font.
Do this while the relationship is good. A request made calmly gets a better answer than the same request made in the middle of a cancellation.
What your provider actually owes you
A controller decides why and how personal data is used: that is you. A processor handles that data on the controller's behalf and on its instructions: that is your software provider. Those two words decide everything else on this page.
In this relationship you are the controller: it is your file, your clients, your decision. Your software provider is the processor, handling that data on your instructions.
That split has a concrete consequence at the end of the contract. Under Article 28(3)(g), the contract must say that the processor will, in the UK regulator's words, "at the controller's choice, delete or return to the controller all the personal data it has been processing for it" (ICO, what needs to be included in the contract, consulted on 13 September 2026).
So returning your file is not a commercial favour you ask for nicely. It is a contractual obligation, and the choice between return and deletion is yours.
If you are not in the UK. The obligation is not the regulator's invention. The same clause sits in Article 28(3)(g) of the EU GDPR, word for word, and the guidance quoted above is simply the clearest English-language statement of it. Outside those regimes the applicable text changes, the lever does not: your contract decides what your provider owes you and how fast. That is why this guide starts with reading the contract and sending a written request, two moves that work wherever you trade.
One distinction worth getting right. People often tell a salon owner to invoke "the right to data portability" against a provider. That right belongs to the individual, your client, over her own data. Your lever is the contract and Article 28. Citing the wrong one weakens the letter you send.
The portability standard is still a useful yardstick for judging a file, though. The regulator's own checklist asks organisations to "transmit personal data in structured, commonly used and machine readable formats" (ICO, right to data portability, consulted on 13 September 2026). If what lands in your inbox is a PDF, you now know what to reply.
The four assets that live outside the database

These are lost by omission rather than by refusal, which is what makes them easy to forget until the access is gone.
- The domain name. If your provider bought it for you, check who is listed as the holder. The holder decides, not whoever pays the invoice.
- Photographs published on your booking page. Ask for the originals, not the compressed versions served online.
- Reviews. Those left on a provider's own platform generally stay there. Those left on your own business listing follow you. The difference is measured in years of reputation.
- Business phone numbers tied to a messaging tool, along with the message templates you spent a season refining.
What exports, what you negotiate, what you lose
| Item | Usually | What to do |
|---|---|---|
| Client file, identity and contact | Exports | Insist on CSV, refuse a PDF |
| Appointment history | Negotiable | Ask for the exact depth, in writing |
| Purchase and treatment history | Negotiable | Often partial, check column by column |
| Photographs from the public page | Recoverable | Ask for the original files |
| Reviews on the provider's platform | Lost | Build reviews on your own listing in parallel |
| Domain name | Depends on the holder | Check the holder, not the payer |
| Search ranking of the booking page | Lost | Plan redirects if the site is yours |
Read the contract for three things, not for reassurance

Search your terms for "termination", "notice", "return" and "data", then write down three facts:
- The notice period, and the date it counts from. It is almost always calculated from your renewal date, not from the day you decide to leave.
- The form it must take. Recorded delivery, a form, or a plain email. This is where people lose a week they had not planned for.
- What is promised on the way out. A format, a delay, an export at all. Many contracts stay vague here, and noticing that is already an answer.
Then cancel last, not first. Import into the new tool, check that the next thirty days of appointments are all there, tell your clients the new booking link, and only then send the cancellation within the notice period. Cancelling out of relief is how people discover that access ends on the renewal date with the migration half done. On our side, importing an existing client file is part of the installation and handover, not an extra you discover later.
The mistakes that cost the most
1. Waiting for the dispute to ask for the export. The test exists so you never have to run it under pressure.
2. Accepting a PDF. It is the most common refusal, and the most polite one.
3. Forgetting that the notice period runs from a date that is not yours.
4. Believing that "you own your data" is enough. Ownership and ease of exit are independent. Most providers will tell you the file is yours. Very few will tell you how quickly you can leave with it.
5. Not telling your clients. The booking link changes. Without a message, online bookings stop for several weeks and nobody tells you why.
Frequently asked questions
Can a provider refuse to hand back my client file?
The contract has to provide for deletion or return at your choice at the end of the processing, so a flat refusal puts you in a position to challenge it. Check what your own terms say first, then make the request in writing, dated.
What format should I insist on?
Structured, commonly used and machine readable, which in practice means CSV or a spreadsheet. A PDF, a Word document or a printout does not meet that bar, even when offered as an extra alongside.
How long does migrating a client file take?
It depends on one thing: the quality of the file you receive. A clean CSV imports in minutes. A file with merged columns or broken encoding needs manual work, and then the row count decides. Ask for the export before you pick a switchover date, not after.
Can I take my reviews with me?
Usually not, when they sit on a provider's platform: they belong to that platform. Reviews on your own business listing stay yours, which is a good reason not to concentrate your whole reputation in one place.
Do I cancel before or after setting up the new tool?
After, every time. Import, verify upcoming appointments, tell your clients, then cancel within the notice period.
Further reading
- Salon booking website: what it needs before it can hold an appointment, which covers the domain name question in detail.
- WhatsApp auto-replies for a salon, for the templates and the number that also need to move with you.
- Our questions and answers page on importing an existing file, and the free audit if you want the exit mapped for your own salon.
In closing
You now know what to ask for, in what order, and how to judge the answer. The most useful test is still the simplest one: request an export today, while you have no plans to leave. The delay and the format will tell you everything the contract does not.
Sources
- ICO, Contracts and liabilities between controllers and processors: what needs to be included in the contract. Consulted on 13 September 2026. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/
- ICO, Right to data portability. Consulted on 13 September 2026. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-data-portability/
A question about your own project?
20 minutes to see what applies to your business.


