Buying a franchise: access to customer data in Croatia

Before joining a franchise network, check who controls the data generated by tills, reservations, online orders and loyalty programmes. Access to an application does not automatically give you the right to export or reuse its data. If this remains unclear, you could be paying for the system in full yet still lack the reports you need to run your business or access to records when a dispute arises. Resolve this issue before signing, with support from legal and technical advisers.

1. List the data your business generates

Ask the franchisor for a map of how data flows: where it originates, which system stores it, who can see it and who receives it. Cover both the physical outlet and digital channels. An order placed through the central website may be fulfilled by your outlet, while the customer's contact details remain accessible only to the franchisor.

Distinguish between three categories:

• Business metrics: turnover, quantities sold, stock levels and aggregated performance reports.
• Personal data: names, contact details, purchase histories linked to individuals and reservation details.
• Mandatory records: invoices and other documentation you must retain under applicable legislation.

These categories can overlap. An invoice, for example, may contain personal data. For each category, record the purpose of use, the user permissions required and the export options available. Do not accept “it is all in the system” without a demonstration: ask to see a specific report and an export of sample data, without using real customer data.

2. Understand Croatia's legal framework and the relevant roles

Croatia has no specific franchise law or mandatory pre-contractual disclosure document prescribed specifically for franchises. The contractual relationship is governed by the Civil Obligations Act, alongside other applicable legislation, including competition and intellectual property rules. The franchise register maintained by the Croatian Chamber of Economy (HGK) is an information resource, not a compulsory state authorisation to operate.

For personal data, the key legislation is the General Data Protection Regulation (GDPR) and Croatia's Act on the Implementation of the General Data Protection Regulation. Croatia's supervisory authority is the Croatian Personal Data Protection Agency, known as AZOP. A franchise agreement does not, in itself, provide a lawful basis for every use of customer data.

The franchisor and franchisee may act as independent data controllers for different purposes. If they jointly determine the purposes and means of particular processing activities, they may be joint controllers and must set out their respective responsibilities transparently. If one party processes data solely on the other's instructions, an appropriate controller–processor arrangement is required under Article 28 of the GDPR.

Roles depend on what the parties actually do, not just the labels used in the contract. Avoid simplistic wording suggesting that anyone “owns the customers”. A contract can govern access to and use of a database, but it cannot override the rights of the people whose data is processed.

3. Agree on access, exports and the true cost of the system

Use a schedule to the agreement to specify which reports you can access, how often they are updated and whether you can download them yourself. Make separate provision for your accountant's access and employees' permissions. Not everyone needs to see all the data.

Check whether the application fee includes data exports, additional users, integration with accounting software, archiving and technical support. The cost is not limited to the monthly subscription: charges may arise for transferring historical records, customising reports or restoring a backup. Request a written price list and an approval process for additional work.

A contractual requirement could state that the franchisee has regular access to reports for their own outlet and can download them in a commonly used, machine-readable format, to the extent permitted by law. Personal data, permitted purposes and retention periods should be addressed separately.

This is not the same as a data subject's right to data portability under the GDPR. Your business's right to export data must be clearly agreed in the contract; it does not arise automatically because the data relates to your customers.

4. Check how problems will be handled

Before signing, work through three scenarios: the system goes down, a customer requests deletion of their data, and the franchisor blocks your account because of a dispute. For each, establish who is responsible, what fallback procedure applies, the response deadline and how the event will be documented.

Agree on prompt information sharing in the event of a security incident. Where notification to the supervisory authority is required, the GDPR sets a deadline of no later than 72 hours after the controller becomes aware of the breach, where feasible. Internal notification must therefore not wait until the regular monthly meeting.

Also check where data is stored and whether it can be accessed from outside the European Economic Area. Such a transfer requires an appropriate legal mechanism; simply stating that the application provider is internationally recognised is not enough.

Finally, agree on what happens to records once access to the system ends: what you may lawfully export, what must be returned or deleted, and what you must retain to meet legal obligations. Exporting contact details does not automatically give you the right to send new marketing messages.

Practical takeaway: before buying a franchise, ask for an export demonstration, a list of permitted uses of data and a written allocation of responsibilities. Unclear data access is a business risk, not just an IT issue.