Digital access in a franchise: what to check before you buy

When buying a franchise, entrepreneurs usually assess the brand, premises and financial model. Yet an outlet’s operations may depend on a single account controlled entirely by the franchisor. Shared digital tools help maintain standards across a franchise network, but without clear access rules they also create vulnerabilities. Before making any payment, establish who controls the systems, which data you can access and what happens if there is a technical failure or the agreement ends.

1. Map your digital dependencies

Ask not just for a list of software, but for an explanation of how it supports a typical working day. Where are orders taken, customer appointments booked, stock tracked, royalties calculated and refunds processed? Which operations would stop if head office disabled your account?

Create a table covering each system, the account owner, who pays, your permission level, data export options and the procedure for restoring access. Include separate entries for:

• customer relationship management (CRM) and online booking systems;
• point-of-sale and inventory management software;
• delivery platform and marketplace accounts;
• your outlet’s listings on maps and in directories;
• advertising accounts, telephone systems and business email;
• cloud storage for manuals and training materials.

Distinguish between the software owner and the administrator of a particular account. A franchisor may lawfully provide access to a third-party service, but its subscription terms must allow franchisees to use it. Ask for confirmation through appropriate documentation or the supplier’s terms.

Also check whose email address and telephone number are registered to critical accounts. An account linked to a manager’s personal number creates a risk even when there is no dispute between the parties. For your own accounts, arrange business contact details and a backup administrator.

2. Set out the digital package in the agreement

Russia has no standalone franchising law. Commercial concession arrangements are governed by Chapter 54 of the Civil Code of the Russian Federation, while the use of software and other intellectual property is also governed by Part Four of the Code. General rules on obligations and contracts apply as well. If you are offered several agreements, assess the complete set rather than just the document labelled ‘franchise’.

Article 1031 of the Civil Code requires the rights holder to supply the necessary technical and commercial documentation, provide the information needed to exercise the rights granted and give instruction. However, this obligation does not itself specify how quickly a service must be restored, how much detail a data export must contain or how many user accounts must be provided. These points should be agreed separately.

Russian law does not require a specific pre-contractual franchise disclosure document. It is therefore best to request details of the digital package before signing: a demonstration of live accounts, pricing, user restrictions and a draft technical schedule.

In the schedule, replace a promise of ‘access to the system’ with verifiable commitments:

• service names, modules and permitted actions;
• the number of user accounts and activation deadlines;
• the cost of setup, subscriptions, updates and additional users;
• support hours, contact procedures and response times;
• grounds for restricting access and the notification procedure;
• rules for replacing software and changing prices.

For a commercial concession, it is important to understand the registration requirement correctly: under Article 1028 of the Civil Code, it is the grant of the right to use a package of exclusive rights, rather than the agreement itself, that is registered with Rospatent, Russia’s intellectual property office. Without registration, the grant is deemed not to have taken effect. Providing a software password is no substitute for this procedure.

3. Separate access to data from the right to use it

A statement that ‘the customer database belongs to the franchisee’ is not enough. A system may contain personal data, order histories, financial figures and information protected as a trade secret. Each category needs its own rules on access, use and transfer.

Personal data processing is governed by Federal Law No. 152-FZ ‘On Personal Data’. Establish who determines the purposes of processing and which data is processed, who acts as the personal data operator under Russian law, and who processes data on that operator’s behalf. These roles depend on how the business actually operates, not just on the wording of the agreement. Any arrangement for processing on another party’s behalf must meet the statutory requirements.

Clarify the legal basis for transferring customer information to head office and using it for advertising. The right to fulfil an order does not automatically confer the right to send any subsequent marketing messages. Nor does a shared network system release a franchisee from its own data protection obligations.

Request a test export using anonymised sample data. Check whether it retains dates, order statuses, payments, refunds and transaction identifiers. An attractive report supplied as an image will do little to help you migrate your records or check royalty calculations.

4. Test failure, dispute and exit scenarios

Ask to see how the outlet operates when the central service is unavailable. Is there a backup procedure for taking orders? Who restores data after a failure? How are manually recorded transactions reconciled? The answers must account for requirements governing point-of-sale transactions and personal data protection, rather than simply advising you to ‘write everything in a notebook’.

Discuss the possibility of access being blocked because of overdue payments. Propose written notice, a period to remedy the breach and, where technically possible, read-only access to your own business records. There may be no automatic entitlement to this access: it needs to be agreed.

For the end of the relationship, specify the data export deadline, file formats, the cost of assistance and the procedure for deleting or returning data. List separately the accounts that will be transferred to you and the brand resources to which access will end. A data export must not become permission to continue using the trade mark or to retain personal data unlawfully.

Practical takeaway: before buying, obtain a systems map, a technical schedule and a sample data export. If it is unclear how you would continue keeping business records after losing access, the franchise’s digital terms are not yet ready to sign.