Does Belocal have an obligation to create Data Protection and Security Policies?

According to Belocal's 2025 Franchise Disclosure Document, Belocal does not have an obligation to create Data Protection and Security Policies. The FDD specifies that Belocal has the right, but not the obligation, to create such Data Protection and Security Policies. However, franchisees must comply with Belocal's data protection and security policies if Belocal chooses to implement them, or adopt policies consistent with the then-current version of Belocal's data protection and security policies as described in the Franchise Brand Standards Manual. Franchisees must adhere to any supplements, modifications, or amendments to these policies within thirty days of notice from Belocal.

Furthermore, Belocal may require franchisees to institute a data privacy policy for their franchised business. However, franchisees cannot independently publish, disseminate, implement, revise, or rescind any data privacy policy without Belocal's prior written consent. This ensures that all data privacy policies are aligned with Belocal's standards and legal requirements.

In practical terms, this means a prospective Belocal franchisee should be prepared to implement and adhere to data protection and security policies dictated by Belocal. While the franchisee may need to institute a data privacy policy, they will not have the autonomy to create or modify such policies without franchisor approval. This arrangement centralizes control over data protection with Belocal, potentially reducing the franchisee's flexibility but also ensuring compliance with evolving data privacy laws and standards.