In the event of a Compromised Data Event at an Atwell Suites franchise, who is responsible for the cost of the independent investigation and forensics analysis?
Atwell_Suites Franchise · 2025 FDDAnswer from 2025 FDD Document
- 4.4 Your Compromised Data Event. If a Compromised Data Event (as defined in Section 4.8) occurs or is suspected to have occurred, you must, at your own expense: (a) perform or cause to be performed an independent investigation, including a forensics analysis performed by a certified forensic vendor acceptable to us and the Card Organizations in accordance with Card Organization standards, of any data security breach of Cardholder data or Transaction Data; (b) provide a copy of the certified forensic vendor's final report regarding the incident to us and the Card Organizations; (c) perform or cause to be performed any remedial actions recommended by any such investigation; and (d) cooperate with us in the investigation and resolution of any security breach. Notwithstanding the foregoing, if required by a Card Organization, we will engage a forensic vendor approved by a Card Organization at your expense. You must cooperate with the forensic vendor so that it may immediately conduct an examination of your equipment and other Merchant Systems, and your and Merchant Providers' procedures and records, and so that it may issue a written report of its findings.
Source: Item 23 — Receipts (FDD pages 99–486)
What This Means (2025 FDD)
According to Atwell Suites's 2025 Franchise Disclosure Document, if a Compromised Data Event occurs or is suspected to have occurred at your Atwell Suites franchise, you, as the franchisee, are responsible for the expense of an independent investigation. This investigation must include a forensics analysis performed by a certified forensic vendor that is acceptable to both Atwell Suites and the Card Organizations. The investigation must adhere to Card Organization standards.
As the Atwell Suites franchisee, you are also obligated to provide a copy of the certified forensic vendor's final report regarding the incident to Atwell Suites and the Card Organizations. Furthermore, you must perform any remedial actions recommended by the investigation and cooperate with Atwell Suites in the investigation and resolution of any security breach. However, if a Card Organization requires it, Atwell Suites will engage a forensic vendor approved by the Card Organization, but the expense will still be borne by you, the franchisee. You must cooperate with the forensic vendor so that they can immediately examine your equipment, Merchant Systems, procedures, and records, and issue a written report of their findings.
This means that as an Atwell Suites franchisee, you bear the financial risk associated with data security breaches. Even if you believe you have complied with all security precautions, you are still responsible for covering the costs of the investigation, remediation, and any related expenses imposed by Card Organizations. This allocation of responsibility is fairly typical in franchising, where franchisees often bear the direct costs of operating their specific location, including compliance and security measures.