Building a franchise network: sharing customer data lawfully in a CRM

Within your own business, a shared customer database is often taken for granted. Once independent franchisees join, the situation changes: not everyone may access all customer data, and head office is not automatically responsible for every processing activity. If you are building a franchise network, you should therefore establish what data the shared customer relationship management system, or CRM, will process and who makes the decisions before connecting your first franchisee.

1. Plan data flows, not software features

Start with an overview of your actual processes, rather than choosing a CRM provider. Trace a customer enquiry from first contact through to deletion: does it arrive through the central website? Who assigns it to a franchisee? Who prepares the quotation, issues the invoice and handles complaints?

For each step, record:

• Purpose: Why is the information needed?
• Scope of data: Are contact details and the nature of the enquiry enough, or is further information required?
• Recipients: Which specific organisation or team needs access?
• Lawful basis: What is the lawful basis for each processing activity?
• Retention period: When will the data be deleted or restricted from use for other purposes?

Keep customer service separate from marketing and network-wide analysis. Answering an enquiry is not the same as contacting the person later as part of a head office marketing campaign. Nor does a shared brand provide blanket permission to exchange personal data across the entire network.

Also review your business’s existing customer records. Moving them into a shared CRM that franchisees can access is not merely a technical migration. New recipients and purposes may require a separate legal assessment and updated customer privacy information.

2. Determine data protection roles based on what actually happens

Germany has no dedicated franchise legislation and no legally prescribed, standard franchise disclosure document. General pre-contractual disclosure duties arise primarily under the German Civil Code. Customer data is governed mainly by the General Data Protection Regulation (GDPR), supplemented by the German Federal Data Protection Act and, for marketing, the German Act Against Unfair Competition.

The key question is who determines the purposes and essential means of processing. Roles may differ from one activity to another:

• Separate controllers: A franchisee serves its customers for its own contractual purposes. Head office processes other data for its own purposes. Transfers of data between them require a valid lawful basis.
• Processing on behalf of a controller: An organisation processes data solely on the controller’s documented instructions. This requires an agreement under Article 28 GDPR. The technical CRM service provider may be a typical example.
• Joint controllers: Head office and the franchisee jointly determine the purposes and essential means of processing. This requires an arrangement under Article 26 GDPR, allocating responsibilities in particular for handling individuals’ rights and providing privacy information.

Using the same software does not automatically make the parties joint controllers. Conversely, calling head office a “processor” in the contract does not make it one if it actually uses customer data for its own campaigns. Have the classification reviewed against your specific processes.

3. Limit and test access during the pilot phase

Configure the CRM on a need-to-know basis. As a rule, a franchisee should only be able to access the customer data needed for its tasks. For business performance comparisons, head office will often need aggregated figures rather than complete customer profiles. Distinguish genuine anonymisation from mere pseudonymisation: pseudonymised data remains personal data.

Create a roles and permissions matrix covering franchisee management, employees, head office support and technical administration. Also set rules for cover arrangements, data exports and the immediate disabling of accounts when users leave. Individual accounts, multi-factor authentication and auditable access logs should form part of your security framework.

During the pilot, test common edge cases: can Franchisee A view Franchisee B’s records? Does an export function give head office more information than intended? Does a former employee remain logged in through a mobile app?

Use synthetic data for technical testing wherever possible. Document faults, fixes and retesting. This provides a sound basis for approving the system before connecting your first franchisee.

4. Keep customer privacy information and marketing separate

Customers must be told clearly who processes their data, for what purposes and to whom it is disclosed. Align the privacy notices required under Article 13 or 14 GDPR, as applicable, with the way enquiries are actually allocated. A general reference to “our partners” is no substitute for the required transparency.

Specify who receives requests for access, rectification and erasure, and who forwards them internally. Where there are joint controllers, individuals can exercise their rights against any of them, regardless of how responsibilities are divided internally.

Email marketing generally requires prior consent unless a statutory exception applies. Consent given to an individual business does not automatically cover marketing by every franchisee. You should therefore record the wording, scope and timing of consent, as well as any withdrawal. A withdrawal of marketing consent must take effect across all relevant mailing processes.

5. Make responsibilities binding before connecting a franchisee

Set out in your contractual documentation how the CRM must be used, who bears the costs and which data protection agreements are required. Add specific procedures for permissions, deletion, security incidents and changes of service provider. The franchise agreement alone does not replace any required arrangement under Article 26 or agreement under Article 28 GDPR.

Appoint someone responsible for approving each franchisee’s connection to the system. Check the roles and permissions matrix, privacy notices, service provider contracts and, where relevant, international data transfers in advance. Personal data breaches require a rapid internal reporting process so that statutory assessment and notification deadlines can be met.

Practical takeaway: Only approve the shared CRM for use once data flows, lawful bases, access rights and responsibilities are aligned. A digitally connected franchise network does not need an unrestricted customer database.