Customer data in franchising: set the rules before expanding

When an established business expands through franchised outlets, its customer database can easily become an overlooked risk. What was once used by a single business is suddenly handled by independent partners, head office and a software provider. Yet the franchise network should share only the data it genuinely needs. Before giving your first franchisee access to bookings, orders or a loyalty programme, define the purposes of processing, responsibilities and access limits.

1. Map how data moves, not just the applications you use

Start with a specific customer scenario: someone books a service with a prospective franchisee through the central website. Where do their name, telephone number and booking notes go? Who can see the data, who stores it and who contacts the customer afterwards? Work through the same questions for purchases, complaints and the loyalty programme.

For each process, draw up a simple overview covering:

• the purpose, such as handling a booking or crediting loyalty points;
• the scope of the data and where it is stored;
• the people and companies with access to it;
• the lawful basis for processing and the retention period;
• how data is corrected or erased and customer requests are handled.

Access to every customer's data across the entire network should not be the default. A franchisee generally does not need to view another outlet's bookings. For capacity planning, head office may only need aggregate figures that do not identify individual customers. Simply removing a name does not necessarily anonymise the data, however, if someone can still be identified from other information.

Pay particular attention to free-text fields. A customer's note may contain health information or other sensitive details, even though you do not need them to provide the service. Design forms so that they neither request unnecessary data nor encourage customers to enter it.

2. Assign roles according to who actually makes the decisions

The Czech Republic has no specific franchising law and does not require franchise agreements to be registered. A franchise agreement is usually concluded as an innominate contract under Section 1746(2) of Act No. 89/2012 Coll., the Civil Code. Personal data, however, is subject to the directly applicable General Data Protection Regulation, known as the GDPR, and Czech Act No. 110/2019 Coll., on Personal Data Processing.

What matters is not the label used in the franchise agreement, but who actually determines the purposes and means of processing. Distinguish between three situations:

• Independent controllers: the franchisee processes data for its own orders, while head office processes it for a separate purpose of its own. Any sharing must have a lawful basis and be transparent to the customer.
• Controller and processor: one party processes data on behalf of the other and in accordance with its instructions. This relationship requires an agreement under Article 28 of the GDPR.
• Joint controllers: head office and the franchisee jointly determine the purposes and means of processing. They need an arrangement under Article 26 of the GDPR allocating their responsibilities; the essence of that arrangement must be made available to customers.

The same partner may have different roles in different processes. Head office does not automatically become the controller of all data simply because it pays for the software. Equally, a blanket data processing agreement will not resolve a situation in which both parties make independent decisions.

3. Separate customer service from joint marketing

Data collected for a booking is not automatically a contact you can freely use to promote the entire franchise network. Fulfilling an order, keeping accounting records and sending promotional offers are different purposes. Each requires an appropriate lawful basis and a clear explanation to the customer.

For email and similar commercial communications, also take account of Czech Act No. 480/2004 Coll., on Certain Information Society Services. The existing-customer exception, which allows businesses to promote their own similar products or services under specified conditions, does not automatically authorise them to pass contact details to every partner. Before launching a joint campaign, check who collected the contact details, who is sending the message and whether the conditions for consent or the relevant exception have been met.

In practice, prepare separate rules for service messages and marketing. Do not use a booking confirmation as a pretext for sending advertising. For opt-outs, specify whether they apply to a particular sender or to the shared programme, and ensure that the technical settings match what you promise customers.

Privacy information should clearly identify the relevant controller, purposes, recipients and customer rights. A consistent website design must not obscure the fact that a particular service is provided by an independent franchisee.

4. Test access controls and incident procedures before opening

Test the rules using dummy data first. Create accounts for an outlet employee, its manager and a member of head office staff. Check that each person can see only the information they need, that important changes can be traced and that removing an account genuinely prevents further access. Banning shared passwords is not enough if the system does not make individual accounts practical to use.

Also prepare a procedure for a customer list sent to the wrong recipient, a lost device or an unauthorised database export. Appoint a contact person, establish prompt internal reporting and ensure relevant evidence is preserved. The GDPR may require the controller to notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, depending on the risk to individuals' rights and freedoms. Your internal procedure must therefore not wait for the regular monthly meeting.

Practical takeaway: Before granting access to your first franchisee, complete your data map, establish the parties' actual roles and test access permissions. Only then should you update contractual arrangements, customer information and working procedures so that they all reflect the same practice.