Franchise customer data: what should you clarify before buying?

Joining a franchise network often gives you access to a ready-made booking platform, loyalty programme and customer relationship management system. These can be valuable tools, but you should not assume that you can view, download or use all customer data for your own marketing. Before buying, clarify which data you can access and for what purposes, who is responsible, and how much the system costs to use. This is not simply an IT issue: it also shapes your day-to-day operations and the continuity of your customer relationships.

1. Map the data and your actual access rights

Do not start by asking, “Who owns the customer list?” Treating personal data as property is misleading: what matters is establishing the purposes and lawful bases for processing, the parties’ roles and individuals’ rights. Permission to use the central system does not, in itself, entitle you to use all the data it contains freely.

Ask for a demonstration using the level of access you would actually receive. Do not settle for an impressive display of administrator features. Check which data a branch manager can see, which reports they can produce and which records they can correct.

Draw up a simple data inventory covering:

• online bookings and orders;
• customer details recorded at the premises;
• purchase histories collected through the loyalty programme;
• complaints and customer service messages;
• newsletter subscriptions and consent records.

For each item, note who collects the data, where it is stored, who can access it and how long it is kept. Distinguish personal data from aggregated business reports. You may, for example, be able to see sales trends across the network, while having no justification for viewing identifiable customers of other branches.

Practical test: ask what happens if a customer asks you to correct their telephone number in the central app. The answer will show how well the division of responsibilities works in practice.

2. Define data protection roles, not just labels

Hungary has no standalone, comprehensive franchise act, but this does not mean that franchise agreements lack specific provisions under civil law. Act V of 2013, the Hungarian Civil Code, expressly recognises franchise agreements. General contract rules also apply, including duties to cooperate and provide information. There is no separate regime requiring a standard franchise disclosure document across the board, so you should specifically request the terms governing data processing too.

Customer data is primarily subject to the General Data Protection Regulation, or GDPR, and Hungary’s Information Act, Act CXII of 2011. Electronic advertising also requires consideration of additional Hungarian advertising and e-commerce rules. A franchise network’s internal policies or code of ethics cannot override these laws.

Roles must be established for each processing purpose:

• Independent controllers: the franchisor and franchisee each determine the purposes and means of their own processing separately.
• Joint controllers: they decide the purposes and means jointly; an arrangement under Article 26 of the GDPR is required.
• Controller and processor: one party processes data on behalf of the other and in accordance with its instructions; a contract under Article 28 of the GDPR is required.

The label used in the contract is not decisive: what matters is how the arrangement actually works. Request the privacy notices and agreements appropriate to the parties’ roles. Have the procedures for handling access and erasure requests, as well as personal data breaches, reviewed. Support from head office does not automatically remove your own responsibilities.

3. Calculate the full cost of access

The cost of the customer relationship management system may extend beyond the monthly subscription. Ask for an itemised quote distinguishing one-off setup costs, per-branch charges, user access fees and usage-based costs. Also clarify which items are already included in other franchise fees.

Ask specifically about charges for messaging, data storage, data exports, integration with external systems and support. A seemingly inexpensive basic package may be less attractive if every additional employee or essential report costs extra.

Turn the demonstrated features into a schedule to the contract. This should cover:

• the access permissions and reports provided;
• the conditions for fee changes and the advance notice required;
• how to report faults and the agreed response times;
• backup and recovery procedures;
• a workable process to follow during system outages.

Check what happens if there is a dispute over fees. Immediate suspension of access over a disputed invoice could prevent you from honouring bookings or handling complaints. Seek a proportionate procedure, advance notice and an opportunity to resolve the issue. These are safeguards to negotiate in the contract, not special franchise rights that arise automatically.

4. Test whether the data is usable and transferable

A promise that “data can be exported” is not enough. Request a sample file containing no personal data and check that the fields are understandable, dates are consistent and customer histories can be linked together. If you plan to send your own newsletter, do not assume that a subscription through the central system also allows you to send advertising.

Before data is transferred or moved to another system, the lawful basis, original purpose, information provided to individuals and retention obligations must be assessed separately. Being technically able to download data does not give you an unrestricted right to use it. The GDPR right to data portability belongs to the individual and applies under specified conditions; it is not a general entitlement for the franchisee to obtain the franchisor’s entire database.

Agree from the outset how you will later access records needed in connection with the goods or services you have supplied, for example when dealing with a complaint or legal claim. The solution may be restricted access or a clearly defined data transfer, rather than a complete copy of the database.

Practical takeaway: before signing, make sure you have a data inventory, an agreement defining the parties’ roles, an itemised fee schedule and access you have tested. Without these, you cannot yet assess the value of the digital support on offer.