Buying a franchise: check your access to customer data

A full appointment book may look like a solid foundation for your franchise outlet. But can you contact those customers yourself, view their order history and transfer their data to another system? Customer data is often processed centrally within a franchise network. Before signing, investigate not just which software you will receive, but, more importantly, the access and usage rights that come with it. These determine how independently you can run your business day to day.

1. Ask who can do what, not who owns the data

The statement ‘the customer database belongs to the franchisor’ does not provide enough clarity. Personal data is not simply a question of ownership. Contractual arrangements concerning a database and the rules governing the processing of personal data are separate matters. A contractual entitlement does not automatically give you permission to contact customers for any purpose.

Start by identifying the data your outlet needs. This might include contact details, appointments, orders, complaints and loyalty programme membership. Then record where that information is held: in your own records, in a central customer management system or with an external software provider.

For each category of data, ask:

• Can I view, correct and export the data?
• Which members of staff at my outlet will have access?
• Which other parties can use the data?
• For what purposes is the data collected?
• What restrictions apply to local customer communications?

Distinguish between essential service communications and marketing. Informing a customer about a delayed order is different from sending that same customer a marketing newsletter. Electronic marketing is also subject to additional rules alongside data protection legislation.

2. Have data protection roles clearly documented

Alongside franchise rules, the EU General Data Protection Regulation (GDPR) applies. Whoever determines why and how personal data is processed is the controller for that processing. A party that processes data solely on behalf of that controller may be a processor. If the franchisor and franchisee jointly determine the purposes and means of processing, they may be joint controllers.

These roles depend on how things actually work, not solely on the labels used in the contract. For example, the franchisor may be responsible for a central loyalty programme, while you are responsible for a separate local customer database. Have the roles assessed for each processing activity.

Ask for the relevant data protection documents. A controller–processor relationship requires a data processing agreement; joint controllers must document their respective responsibilities. Also check that the customer privacy notice reflects what your outlet actually does.

Agree practical arrangements for:

• customer requests to access, correct or erase their data;
• retention periods and the deletion of outdated data;
• access security and the revocation of staff accounts;
• reporting and handling security incidents.

Ask who takes action if a customer requests erasure at your reception desk. You want to avoid a situation where everyone refers the matter to head office but nobody handles the request in time. Not every erasure request has to be granted in full: a statutory retention obligation may, for example, prevent this.

3. Carry out your checks before signing

The Netherlands has specific franchise legislation: the Franchise Act, incorporated into Book 7, Title 16 of the Dutch Civil Code. It has applied since 1 January 2021. Before entering into the agreement, the franchisor must provide, among other things, the draft contract and its annexes, together with information reasonably relevant to your decision.

Restrictions on access to customer data may be important here. Consider a franchise model in which you are responsible for customer appointments, but only head office can export the appointment diary. Ask for these restrictions in writing, along with the terms for any mandatory software and any charges for exporting data.

The law also requires you to carry out your own investigations within reasonable limits. Do not settle for ‘our system takes care of that’. Ask for a demonstration using fictitious customer data. Have them show you how to retrieve an order, block an account and export a usable file.

The information required by law must be provided at least four weeks before the franchise agreement is concluded. Ask your adviser to assess whether the documentation is complete and how any subsequent additions should be handled.

4. Arrange access during outages and changes

Access to customer data is also a business continuity issue. What happens if the central system goes down, the software provider is replaced or a contractual dispute arises? Ask what contingency procedure is available and whether you can continue to manage essential appointments and outstanding orders.

Document which data you may export, in what file format, at what cost and within what timeframe. A download is only useful if relevant fields, such as order numbers and appointment dates, are included in an intelligible form. A right to export data does not, however, mean that every subsequent use is permitted under the GDPR.

Also agree what happens to the data when the franchise agreement ends. Distinguish between information you need for statutory record-keeping obligations or ongoing complaints and data intended for future marketing. Arrange timely access to what you are legally required to retain, without demanding unrestricted access to the entire central customer database.

Practical conclusion: only sign once it is clear which customer data you can use, for what purposes and how your access works in practice. Make sure the contract, data protection documents and system demonstration all align.