Buying a Franchise: Check Customer Data and Access Rights

Customer data is essential to many franchise businesses: for managing appointments, providing customer service and securing repeat business. However, a centrally provided booking or customer management system does not automatically give you unrestricted use of all the data it holds. Shared systems within a franchise network need clear lines of responsibility. Before joining, check which data your business will receive, how you may use it and what happens if the system changes or the agreement ends.

1. Understand data flows rather than relying on promises of ‘data ownership’

The statement ‘The customers are yours’ answers none of the key questions. There is no blanket ownership right over personal data comparable to ownership of a piece of furniture. Relevant considerations include permissions under data protection law, contractual rights of use and, where applicable, database rights.

Ask for a demonstration of how the system handles a typical customer interaction: someone books through the central website, is assigned to your location, pays on site and later receives marketing. Where is data generated in this process? Who stores it? Who decides how it is used afterwards?

Request an overview covering at least these types of data:

• Contact details, bookings and order histories;
• Invoice data and payment information;
• Complaints, service notes and customer preferences;
• Marketing consents, including evidence of consent;
• Data from central loyalty programmes or apps.

For each category, record whether your business may only view the data, or may also amend it, download it or use it for its own purposes. Also clarify whether the franchisor may assign contacts to other locations or contact them directly. This helps prevent a convenient technical solution from concealing commercial dependencies.

2. Clearly establish data protection roles and lawful bases

Germany has no dedicated franchise law or franchise-specific registration procedure. Franchise agreements are governed primarily by the general provisions of the German Civil Code (BGB) and, where applicable, the German Commercial Code (HGB). Standard-form contract terms are subject to scrutiny under sections 305 onwards of the BGB. Personal customer data is also subject to the EU General Data Protection Regulation (GDPR), supplemented by the German Federal Data Protection Act (BDSG).

Data protection roles depend on who actually decides the purposes and means of processing, not simply on the heading of an agreement. Depending on the arrangements, the franchisor and franchisee may be separate controllers, joint controllers or parties to a controller–processor relationship. Different processing activities may require different classifications.

If a service provider processes data solely on your business’s instructions, an agreement under Article 28 GDPR is generally required. If two parties jointly determine the purposes and means of processing, Article 26 GDPR requires an arrangement setting out their respective responsibilities. A blanket statement that ‘Head office handles data protection’ is no substitute for this assessment.

Have the lawful bases clarified too. Data used to fulfil a customer contract cannot automatically be used for every centrally organised marketing campaign. Alongside the GDPR, electronic marketing must comply in particular with section 7 of the German Act Against Unfair Competition (UWG). Having someone’s email address does not give you general permission to send them marketing.

Ask specifically who provides privacy notices, handles data subject access requests, and assesses or reports personal data breaches. If your business is the controller, centrally provided software does not relieve you of that responsibility.

3. Secure access and business continuity in the agreement

Permission under data protection law and practical access to a system are two different things. Even if you may lawfully process certain customer data, the inability to export it can hamper your business. Conversely, the technical ability to export data does not make every subsequent use permissible.

Before signing, review the customer system’s service specification and the relevant contract schedules. If possible, request a demonstration using test data. Key points include:

• Access rights: Which staff receive which permissions? Who may suspend access?
• Availability: What support is available during outages, and how can ongoing orders continue to be handled?
• Export: Which data fields, records of consent and documents can be exported in a commonly used format suitable for further processing?
• Costs: Are exports, data recovery and support when switching providers included, or do they incur additional charges?
• Changes: What advance notice and support are provided if head office changes the system?

Agree objective grounds and a reasonable procedure for suspending access. A blanket suspension during a contractual dispute could disrupt customer service and your ability to meet record-keeping obligations at the same time. An independent legal adviser should assess whether any particular clause is enforceable.

4. Agree in advance how data will be handled after termination

When you leave the franchise, the contractual arrangements, data protection requirements and statutory retention obligations must work together. A blanket obligation to delete all customer data immediately could put essential records at risk. An unrestricted right to take all centrally held contacts with you would not be a workable solution either.

Set out separately which data you need to complete outstanding orders, which records must be retained, and which information must subsequently be deleted or have access restricted. Specify the timing and format of exports, who is responsible and who bears the costs. The process should also cover backups and former employees’ access.

Do not confuse a contractual right to export data with the right to data portability under Article 20 GDPR. The latter protects individuals in certain circumstances; it does not give a franchise business a general right to receive the entire customer database.

Practical takeaway: Before buying, ask to see a sample export and obtain a written explanation of the data protection roles. Only sign once permitted uses, ongoing access and an orderly data handover have been clearly agreed.