Buying a Franchise: Who Can Use Customer Data?

When buying a franchise, access to a shared customer database may look like a clear advantage. Yet being able to view bookings does not necessarily give you the right to send offers or retain contact details. Before signing, you therefore need to clarify not only technical access within the franchise network, but also legal responsibilities. Otherwise, you could pay for a business opportunity that you cannot lawfully use.

1. Map the data and establish the actual roles

Start by setting out the customer journey in practical terms. Who takes the order, whom does the customer pay, where is their account created, and who sends them offers afterwards? Ask the franchisor for an overview of the systems and data you will use. Distinguish between bookings, purchase history, contact details, complaints and marketing preferences.

Identify who is responsible for each processing purpose. A controller determines the purposes and means of processing personal data. A processor processes data on the controller’s behalf and in accordance with its instructions. If you and the franchisor determine the purposes and means together, you may be joint controllers. The same company can hold different roles in different circumstances.

A contractual label alone is not enough. A clause stating that the franchisor is always a processor may not reflect a situation in which it independently decides how to use customers’ purchase histories for its own marketing. Equally, access to a central system does not automatically make you a joint controller of all the data it contains.

For each processing activity, prepare a simple overview covering:

• what data is used and for what purpose;
• who decides how it is used;
• who has access to it;
• the lawful basis for processing;
• how long it is retained and who is responsible for deletion.

2. Check the lawful basis, not just the franchise agreement

The Czech Republic has no specific franchise law. Franchise agreements are generally concluded as contracts not specifically defined by statute under Section 1746(2) of Act No. 89/2012 Coll., the Civil Code. There is also no specific mandatory registration of franchise agreements or standard statutory disclosure document for prospective franchisees. General pre-contractual duties do, however, apply.

Personal data processing is governed primarily by the General Data Protection Regulation, known as the GDPR, and the related Czech Act No. 110/2019 Coll., on Personal Data Processing. Act No. 480/2004 Coll., on Certain Information Society Services, is also important for electronic marketing communications.

A clause stating that ‘the database belongs to the franchisor’ does not establish whether its use is lawful. Technical control over a system, any rights in the database and the legal basis for processing personal data are separate matters. Customers’ rights cannot be excluded by an agreement between members of the network.

If one party processes data on behalf of the other, you need contractual provisions that meet Article 28 of the GDPR. Joint controllers must allocate their responsibilities transparently under Article 26. Where the parties are independent controllers, check the lawful basis and transparency of data sharing. A lawyer should assess how the business actually operates, not merely the title of a schedule to the agreement.

3. Verify whether you can actually use the contacts for marketing

Ask for a demonstration of the system from a prospective franchisee’s perspective, ideally using fictitious data. Find out whether you will see only your own outlet’s customers or also contacts belonging to other members of the network. Check who can export, correct and use the data for marketing campaigns.

Ask the franchisor a specific question: ‘May I send my own offer to my outlet’s customers and, if so, on what terms?’ The answer must cover both contractual permission and legal requirements. Consent given to one company does not necessarily cover marketing by another simply because they use the same brand.

For electronic marketing communications, you cannot automatically assume that every contact in the network can be approached without consent. The legal exception allowing businesses to market their own similar products or services to existing customers has specific conditions, including a straightforward way to opt out. It is not enough that the contact details came through a shared form.

When assessing the financial value of the franchise offer, therefore, count only uses of the database that are documented and legally permissible. If the franchisor promises customer contacts, ask for details of how they will be transferred, how you may use them and what costs are involved. A demonstration of anonymised sales reports does not, in itself, prove that you will receive contacts for your own campaigns.

4. Agree day-to-day responsibilities and access rights

Before signing, establish who handles customers’ requests to access, correct or erase their data. A customer may approach staff at an outlet even if head office manages the database. You need a workable process for passing on requests, a designated person responsible for handling them and internal deadlines that allow you to meet statutory time limits.

The contractual documentation should also cover:

• granting and revoking employees’ access rights;
• rules on data exports and the use of personal devices;
• reporting lost devices or unauthorised access;
• co-operation in the event of a security incident;
• the costs of locating, correcting or transferring data.

For the end of the franchise relationship, distinguish between data needed to meet legal obligations or defend legal claims and contacts held for marketing purposes. Both automatically deleting everything and retaining the entire database indefinitely can be problematic. Agree on a format for handing over necessary records and rules for terminating access.

Practical takeaway: Before buying, ask for a map of customer data, a clear allocation of legal roles and written rules governing its use. Access to data has value only if you can use it safely and lawfully.