Buying a franchise: who controls your customer data?

When buying a franchise, a shared loyalty programme, online shop or booking system can conceal a significant business dependency. Customers visit your outlet, but someone else manages their data. Before joining a franchise network, check which data you will be able to use, who is responsible for keeping it secure and what happens if your access ends. This is not simply a technical issue: it is part of your investment due diligence.

1. Map the data journey from customer to system

Start by asking for a demonstration of how the digital tools actually work. A sales presentation will often show an attractive sales dashboard without revealing access restrictions. Go through the demonstration with someone who understands the outlet’s day-to-day operations, rather than just the franchisor’s sales representative.

List the points at which personal data is collected: online orders, bookings, complaints, loyalty programme registrations and marketing sign-ups. For each route, establish who collects the data, where they send it and who can view it.

In particular, ask:

• Can you see individual customer data or only aggregated reports?
• Can you correct inaccurate data and handle a request for erasure?
• Does the franchisor also use the data for its own outlets or other franchisees?
• Who sets retention periods and staff access rights?
• Is any data stored or processed remotely outside the European Economic Area?

Access to a sales report is not the same as the right to use data for marketing. Even if you can download a list of email addresses, that does not necessarily mean you may send an offer to those addresses. Pay particular attention to the distinction between data needed to fulfil an order and data used for additional marketing.

2. Clarify legal roles and Slovenian rules

Slovenia has no specific franchising law, mandatory dedicated franchise register or legally prescribed standard pre-contractual disclosure document for all franchises. Franchise agreements are governed primarily by the Slovenian Code of Obligations, including the principle of good faith and fair dealing and the rules on liability during negotiations. The absence of a specific law does not mean there are no legal obligations.

Personal data is subject to the General Data Protection Regulation, known as the GDPR, and Slovenia’s Personal Data Protection Act (ZVOP-2). The Electronic Communications Act (ZEKom-2) is also relevant to direct marketing through electronic communications. Contractual permission from the franchisor does not, by itself, replace an appropriate lawful basis for processing.

Legal roles depend on who actually decides the purposes and means of processing, not merely on the labels used in the agreement. The franchisor and franchisee may be independent controllers, joint controllers, or one may carry out certain processing activities on behalf of the other as a processor. The relationship may differ between activities.

Where processing is carried out on behalf of a controller, an agreement under Article 28 of the GDPR is required. For joint controllership, responsibilities must be allocated transparently through an arrangement under Article 26. Also check that the customer privacy notice reflects the actual arrangements. Slovenia’s supervisory authority is the Information Commissioner.

Do not accept a blanket statement that ‘head office takes care of GDPR’. Ask for a clear allocation of tasks: who responds to customers, who maintains records, who handles incidents and who checks external providers.

3. Set out access, costs and security in the contract

Before signing, request a schedule covering digital systems and data. It should specify the mandatory software, user accounts, permitted uses of data, export options and responsibilities in the event of an outage. Check whether any documents incorporated by reference into the agreement allow these rights to be changed unilaterally.

Break down the costs into initial setup, recurring subscriptions, additional users, accounting system integrations and data exports. Find out whether the price includes support with customer requests and security incidents. An open-ended obligation to pay ‘all compliance costs’ calls for more detailed negotiation.

On security, ask for more than a promise of a reliable system. Check for multi-factor authentication, role-based access controls, access logs, backups and prompt deactivation of former employees’ accounts.

The agreement should also require prompt notification of personal data breaches. For certain breaches, the GDPR requires the controller to notify the supervisory authority within 72 hours of becoming aware of them, so waiting several days for head office to respond is not a workable operational arrangement. Not every breach needs to be reported; the decision must be based on an appropriate risk assessment.

4. Test the outlet’s independence

Before making your decision, carry out a simple test: ask for a sample export using fictitious data. Check whether the format is usable, whether it contains the agreed fields and whether your accounting or other business system can open it. This will reveal any gap between the contractual promise and what you can actually do.

Agree what happens if the software provider changes, a dispute arises or the franchise relationship ends. You need reliable access to any records you must retain to meet legal obligations. However, this does not automatically give you the right to keep the entire customer database for a new business.

An individual’s right to data portability under the GDPR is not a general right for a franchisee to transfer a business database. Your export rights must be set out in the contract, and any export must comply with data protection rules.

Practical takeaway: before buying, obtain a data map, a written allocation of responsibilities and a tested export process. If the franchisor cannot explain these clearly, you cannot yet reliably assess your dependence on its digital systems.