Buying a franchise: who can use customer data?

A shared customer database can be a significant advantage of joining a franchise network. But having a loyalty app or booking system does not, in itself, guarantee that you will be allowed to contact customers or obtain the information needed to handle complaints. Before buying a franchise, check not only the technology in use, but also the legal roles, access permissions and responsibilities for personal data.

1. Map the flow of data from the customer to head office

Do not start by asking who “owns” the database. With personal data, the more important questions are who decides the purposes and means of processing, who has access to it and what they are allowed to use it for. Naming the database owner in a contract does not resolve these issues.

Ask the franchisor for a demonstration of the system using test data and a description of the data flows. Work through a booking, a purchase, loyalty programme registration, a complaint and the sending of a promotional offer. At each stage, record:

• what data is collected and why;
• which company receives it and who else will see it;
• where it is stored and how long it remains available;
• whether the franchisee can correct, search for or export it;
• whether head office can see individual customer records or only aggregate results.

Also distinguish customer data from operational statistics. A sales summary may not constitute personal data, whereas a purchase history linked to a particular loyalty programme member generally will. You do not need a real customer database for your initial due diligence; anonymised materials and a test account are more appropriate.

2. Establish the legal roles, not just the contractual labels

The Czech Republic has no specific franchise law or mandatory pre-contractual disclosure document intended exclusively for prospective franchisees. A franchise agreement is usually a contract not specifically defined by law, entered into under Section 1746(2) of Act No. 89/2012 Coll., the Civil Code. General rules on pre-contractual dealings also apply. However, the absence of a specific franchise regime does not reduce personal data protection obligations in any way.

The key legislation governing customer data is the General Data Protection Regulation, known as the GDPR, and Czech Act No. 110/2019 Coll., on Personal Data Processing. Electronic marketing communications are also governed by Act No. 480/2004 Coll., on Certain Information Society Services.

Roles are determined by what each party actually does, not by the heading on the contract. A franchisee may be an independent data controller for its own orders. Head office may be a separate controller for its own loyalty programme. If they jointly determine the purposes and means of processing, they may be joint controllers requiring an arrangement under Article 26 of the GDPR. If one party processes data solely on the other’s instructions, an agreement meeting the requirements of Article 28 of the GDPR is needed.

The same party may hold different roles for different activities. Ask a lawyer to assess the specific processes, rather than simply reviewing a generic GDPR appendix.

3. Check whether you can actually send customers marketing messages

Access to email addresses does not automatically give you permission to send promotional offers. Find out what lawful basis supports each processing activity and whether the conditions for sending marketing communications are met. Consent is not always required, but the exception allowing a business to market its own similar products or services to existing customers cannot simply be transferred between independent businesses.

Request copies of customer privacy notices, the wording of any consent requests and details of how consent and its withdrawal are recorded. Check whether customers can identify which company they are dealing with and who will send them offers.

A simple practical test is this: a customer buys from your company, and head office then sends them an offer from another outlet. The franchisor should explain the legal basis for this and how the customer can opt out. “It is all one brand” is not a sufficient answer where several legally separate entities operate under that brand.

4. Agree on access, security and the allocation of costs

Specify in the agreement or a binding appendix which data you will be able to access for customer service, accounting, complaints handling and establishing, exercising or defending legal claims. Access should reflect specific needs; unrestricted copying of the entire database is not an appropriate default.

Also agree on procedures for customer requests, data corrections and security incidents. A personal data breach may trigger a controller’s obligation to notify the supervisory authority within 72 hours of becoming aware of it. Internal reporting must therefore not wait until the next regular meeting.

Before signing, seek clear answers to these questions:

• Who creates and closes employee accounts and reviews their permissions?
• Who is responsible for backups, data recovery and access logs?
• Who checks the system provider and any transfers of data outside the European Economic Area?
• Who pays for necessary data exports, recovery or assistance with handling requests?

Also clarify how you will access necessary records after the franchise relationship ends, and the rules for deleting them. This is not about a right to take every contact with you, but about meeting legal obligations and legitimate needs. Allocating tasks in a contract does not, in itself, remove responsibility towards customers or the supervisory authority.

Practical takeaway: Before buying a franchise, request a data flow map, a demonstration of system permissions and a binding allocation of responsibilities. If head office cannot explain who is allowed to use the data and why, treat this as an unresolved risk, not a minor technical detail.