Customer data in franchising: what to agree before you buy

Access to apps, online booking systems and a loyalty programme can be a strong reason to choose a franchise brand. However, it does not mean that you will be free to use customer data as you wish. Before joining a franchise network, check who decides how the data is used, who handles customer requests and what happens to your access when the relationship ends. This is part of assessing the offer, with implications for costs, liability and business continuity.

1. Establish who is responsible for each type of data

Start by mapping the customer journey: from the first booking or order, through payment, to complaints and marketing. At each stage, identify the organisation collecting the data, the purpose for which it is used and the system in which it is stored. Consider sales on the premises, the online shop and the central loyalty programme separately.

Personal data is not a commodity whose “ownership” can simply be assigned to one party to a contract. The key is to establish the roles defined by the EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679 of the European Parliament and of the Council:

• A controller determines the purposes and means of processing personal data. This may be the franchisee, for example in relation to its own customer accounts and payments.
• A processor acts on behalf of the controller and follows its instructions. A booking system provider may fulfil this role.
• Joint controllers jointly determine the purposes and means of processing. In this case, an arrangement under Article 26 of the GDPR is required.

These roles depend on what the parties actually do, not just the labels used in the paperwork. The franchisor may be the controller for the central loyalty programme but perform a different role in another processing activity. Ask for an explanation of these relationships rather than accepting a general assurance that “head office takes care of GDPR”.

2. Check the documents and the actual legal grounds

In Poland, franchise agreements are not governed by a separate, comprehensive statutory framework. They are treated as contracts without a specifically defined statutory form, based primarily on the Civil Code, including the principle of freedom of contract under Article 353¹. Nor is there a general statutory requirement to provide a dedicated franchise disclosure document within a specified period before signing. It is therefore worth explicitly requesting documents relating to data and systems during negotiations.

The absence of franchise-specific legislation does not remove the obligation to comply with the GDPR or Poland’s Personal Data Protection Act. Poland’s Electronic Communications Law is also relevant to electronic marketing. Having access to a customer’s telephone number or email address does not, in itself, entitle you to send them advertising.

Before signing the agreement, ask for:

• a description of how data flows between the outlet, head office and technology providers;
• templates of the privacy information given to customers;
• a draft data processing agreement, if a controller–processor relationship actually exists;
• a joint controller arrangement, if the parties jointly make the relevant decisions;
• a procedure for handling customer requests and personal data breaches.

A data processing agreement under Article 28 of the GDPR is not a universal solution for every exchange of information. If two organisations act as separate controllers, the legal grounds for sharing data and the duties to inform individuals must be assessed. A lawyer should also check whether head office receives more data than is needed for the specific purpose.

3. Assess system access and hidden operating costs

Ask for a demonstration of the system using test data. Check what the outlet owner, manager and employee can each see. Individual accounts, appropriately restricted permissions and the ability to revoke access when an employee leaves matter more than assurances about a “modern platform”.

Establish who pays for licences, workstation set-up, additional accounts, backups and technical support. Ask whether charges for exporting information or restoring access are covered by the regular fee or require a separate paid service. Your calculations should also allow for the time spent training staff and handling customer requests.

Test two scenarios. In the first, a customer requests access to their personal data, some of which is held only by head office. In the second, an employee sends an order report to the wrong person. Who receives the report, secures the information and takes further action?

Where a breach must be reported to the supervisory authority, the GDPR generally requires notification within 72 hours of the controller becoming aware of it. The contractual deadline for passing information between the parties should therefore allow an effective response, including at weekends. A clause stating that each party is responsible for its own actions is no substitute for a procedure.

4. Plan access after the franchise relationship ends

Disabling your account on the day the agreement ends could make it difficult to handle complaints, settle accounts or defend claims. Before buying a franchise, agree what information you will need after the relationship ends and the legal grounds on which you can retain it.

Do not assume that you will receive the entire loyalty programme database. Equally, do not accept without checking that all data must be deleted immediately. The scope for retaining data depends, among other things, on the purpose, legal obligations and the role of the party concerned.

The agreement should specify the format and deadline for transferring the information you need, the cost of exporting it, the terms of limited access to archived records and how the remaining data will be deleted. Where a controller–processor relationship exists, include the requirements for returning or deleting data under Article 28 of the GDPR, subject to any legal retention obligations.

Practical takeaway: before signing, prepare a single table covering the type of data, the responsible organisation, access during the franchise relationship, operating costs and what happens after it ends. Any blank fields are issues to resolve before investing.