Franchising in Belarus: agreeing how customer data will be handled

A shared loyalty programme and a single customer management system can make belonging to a franchise network more convenient. Before buying a franchise, however, establish who receives customers’ phone numbers, on what legal basis they share them with other network members, and what happens if access to the system is blocked. A promise that “the entire customer database will be yours” is no substitute for contractual terms and a lawful basis for processing personal data.

1. Separate software rights from data responsibilities

In Belarus, franchise relationships are governed by Chapter 53 of the Civil Code, “Comprehensive Business Licence (Franchising)”. There is no standalone franchising law, but the Civil Code does contain specific provisions. The agreement must be in writing and registered with the patent authority — the National Centre of Intellectual Property. Registration alone, however, does not authorise the transfer of customer information between companies.

Personal data is governed by the Republic of Belarus Law No. 99-Z of 7 May 2021, “On Personal Data Protection”. It covers, among other things, information that can identify a person directly or indirectly. Phone numbers, names, purchase histories and details from loyalty programme registration forms need to be assessed under this law.

Ask the franchisor to set out three aspects of the arrangement separately:

• the right to use the software and any necessary licences;
• access to commercial information about your outlet’s operations;
• the legal grounds and procedures for processing customers’ personal data.

These are distinct issues. Paying for software does not mean you can freely export any information it holds, and belonging to a network does not automatically give other franchisees access to your customer records. Rather than saying “the database belongs to the user”, the agreement should specify each party’s access rights and obligations.

2. Map the flow of customer data

Before signing the agreement, ask for a demonstration using sample data rather than real customer records. Follow a single purchase through the system: a booking made through the website, order processing, loyalty points allocation, marketing messages and reporting to head office. At each stage, establish which company receives the information and why.

Draw up a simple table covering data categories, processing purposes, recipients, storage locations, retention periods and legal grounds. Do not stop at the brand name: identify the legal entities involved, including the software provider, messaging service and shared call centre operator.

It is particularly important to establish each party’s role. Under Belarusian law, an “operator” organises or carries out personal data processing; an “authorised person” processes it on the operator’s behalf or in its interests on a basis provided for by law, including under a contract. The franchisor may have different roles in different processes — a single blanket description in the agreement is not enough.

For example, processing an order for your outlet and sending the franchisor’s own marketing messages are different purposes. Each needs a legal basis. Consent is not the only possible basis, but fulfilling an order cannot be used to justify all subsequent advertising.

If data is sent to a foreign franchisor or hosted abroad, check the cross-border transfer rules separately. The law imposes specific conditions on such transfers. Establish the countries in which data is stored and from which it can be accessed: saying “the server is in the cloud” explains nothing.

3. Document access and security arrangements

Request not only the main agreement, but also the software’s terms of use, data processing documents, sample consent forms and procedures for bringing in service providers. If processing is entrusted to an authorised person, the contract must address the statutory requirements for that arrangement. A generic confidentiality clause is no substitute.

The following terms are particularly important for a prospective franchisee:

• Access controls. What information your staff, head office and other network members can see, and who grants and revokes access rights.
• Data exports. Which records relating to your outlet can be exported, in what format and subject to what legal restrictions.
• System changes. How new recipients, processing purposes and connections to external services are agreed.
• Handling requests. Who receives customer requests and ensures that customers can exercise their rights within the statutory deadlines.
• Incidents. Who records a data breach, restricts access, preserves event logs and fulfils any applicable notification obligations.

Do not accept an arrangement in which your company is accountable to the customer but cannot obtain information about actions taken within the system. Ensure you can access the necessary evidence: versions of consent forms, records of consent being given or withdrawn, and access logs. The scope of this evidence should match your responsibilities, without exposing unnecessary information about the wider network.

4. Check how your outlet would operate without access to the shared system

Ask for a demonstration not just of a sale, but also of what happens when things go wrong: the software is unavailable, an account is blocked, or a customer asks for their details to be corrected. Would you be able to find an order, handle a complaint and confirm the terms on which loyalty points were awarded?

Agree on backups, restoration of access and procedures for supplying necessary information during a payment dispute. A commercial dispute with the franchisor does not remove your company’s obligations to customers. A backup, however, also needs a lawful basis for retention, appropriate protection and restricted access.

When the relationship ends, information should neither automatically remain with every participant indefinitely nor be deleted in its entirety. Procedures for returning, deleting and retaining data should distinguish between different purposes and mandatory retention periods. Keeping documents to comply with legal requirements does not authorise continued marketing messages.

Practical takeaway: before paying for a franchise, obtain a data flow map, review the companies’ roles with a Belarusian lawyer and test the export function using a sample database. What you buy should be clearly defined access to operational tools, not a vague promise that “the customers will stay with you”.