Managing Customer Data When Launching a Franchise in Belarus

When turning an existing business into a franchise, it is easy to treat the customer database as just another asset: give a partner access to the shared system and let them use all the contacts. Yet that information was collected by a particular company for specific purposes, and a franchisee is an independent business. To build a sustainable franchise network, decide in advance which data each partner needs, on what grounds they will receive it and who will be accountable to customers.

1. Take stock of your customer data

Start by mapping how information flows, rather than exporting phone numbers. Trace the customer journey: an enquiry through the website, a telephone booking, a purchase, delivery, participation in a loyalty programme or a complaint. At each stage, identify who collects the information, where it is stored and who can access it.

Do not limit your review to the main customer management system. Copies of the database may be held in administrators’ spreadsheets, employees’ phones, mailing platforms, email accounts and backup archives. These scattered stores pose a particular risk when bringing independent partners on board, as access to them is difficult to control.

Create a working table with five columns:

• data held: name, phone number, address, order history;
• purpose of processing: order fulfilment, delivery, marketing messages;
• lawful grounds for processing;
• recipients and employees with access;
• retention period and deletion procedure.

Do not assume that every piece of information is equally necessary. An address is needed to make a delivery, but usually not to compare revenue across outlets. Sales statistics that do not allow customers to be identified can often meet management needs without sharing personal data.

Review old contacts whose source is unknown separately. The mere presence of a number in a spreadsheet does not establish a right to use it for a new advertising campaign or pass it to a prospective franchisee.

2. Distinguish the franchise agreement from the grounds for processing

Belarus has a personal data protection law: Law No. 99-Z of 7 May 2021, ‘On Personal Data Protection’. It regulates the processing of information about an identified or identifiable individual. A customer database containing names, phone numbers and purchase histories needs to be assessed against this law.

Franchising itself is specifically governed by Chapter 53 of the Civil Code of the Republic of Belarus, which covers the comprehensive business licence (franchising). The agreement must be in writing and registered with the patent authority, the National Centre of Intellectual Property. However, registering the agreement does not, in itself, provide lawful grounds for sharing any and all customer information.

Establish each party’s role in each process. If a franchisee determines the purposes for which its customers’ data is processed, it acts as an operator under Belarusian law. If another organisation processes information on the operator’s behalf or in its interests under a contract, assess its role as an authorised person. A company may perform different roles in different processes; the role assigned in the contract must reflect what it actually does.

Do not reduce the entire review to obtaining consent. The law allows processing without consent in certain circumstances, but the relevant grounds must be established for the specific operation. Fulfilling an order and sending marketing messages serve different purposes: grounds that apply to the former should not automatically be extended to the latter.

Where consent is used, check its wording, how it is obtained and whether you can demonstrate that it was obtained. A phrase such as ‘we share data with partners’ should not replace a proper explanation of the purposes, recipients and conditions of processing.

3. Set up access controls before bringing on board your first partner

A practical starting principle is that franchisees should see the data needed to serve their own customers, not the entire network’s database. Sharing a brand does not mean that every partner needs access to other outlets’ orders.

Set up individual user accounts, assign permissions according to employees’ responsibilities and log their actions. Restrict bulk exports of contacts where these are not needed for work. Make sure access can be revoked promptly when an employee leaves or changes roles, or when the relationship with a partner ends.

Test common scenarios before launch:

1. An administrator at one outlet tries to open another outlet’s order.
2. A manager exports customer contacts for a marketing campaign.
3. An employee leaves but retains access from a personal phone.
4. A customer asks what information about them is being processed.

There should be a clear procedure and a designated person responsible for each scenario. Use fictional data for testing rather than copying the live database into a test environment.

If the system, backup storage or support service is located outside Belarus, assess separately whether this involves a cross-border transfer and which legal requirements apply. The convenience of a cloud service is no substitute for this review.

4. Define responsibilities and procedures for handling requests

Prepare a separate schedule to the agreement or another suitable document covering data processing. Describe the purposes, categories of information, permitted activities, each party’s obligations and security measures. Where an authorised person processes data, take account of the law’s specific contractual requirements.

Agree who will receive customer requests, verify the requester’s identity and arrange a response within the statutory time limits. Set out procedures for correcting information, stopping processing and deleting data where there are grounds to do so. Withdrawal of consent does not always mean that every document must be deleted: some information may be retained on other lawful grounds.

Provide for notifying the designated responsible person of unauthorised access, preserving logs and investigating incidents. When the relationship ends, distinguish between information the partner must retain, data that must be deleted and access rights that must be revoked.

Practical takeaway: before sharing the database with your first franchisee, prepare a data map, a justification for each transfer, an access matrix and contractual rules. Share only what is necessary for a specific lawful purpose, not everything you have accumulated.