What industry standards must a Burneys Sweets More franchisee comply with concerning privacy?
Burneys_Sweets_More Franchise · 2025 FDDAnswer from 2025 FDD Document
(v) Data Protection; Privacy.
(i) Definition of Personal Information. As used in this Agreement, "Personal Information" shall mean (i) any information that can be used to identify, locate, or contact an individual or household, including but not limited to Franchisee's employees and customers and (ii) information that is defined as protected, personal information under any Privacy Law.
(ii) Data Protection and Security Policies. Franchisee shall comply with, or, as applicable, adopt policies consistent with the then-current version of Franchisor's data protection and security policies as may be described in the Brand Standards Manual ("Data Protection and Security Policies"). Such policies may govern how Franchised Business Data and Personal Information contained in such data shall be collected, used, store, processed, shared, or destroyed. Franchisor has the right, but not the obligation to create such Data Protection and Security Policies. Franchisee acknowledges that Franchisor may supplement, modify, or amend the Data Protection and Security Policies from time to time in its sole discretion, and that Franchisee shall comply with such modifications or amendments within thirty (30) days of notice from Franchisor. Franchisor may require Franchisee to institute a data privacy policy for its Shop. Franchisee shall not publish, disseminate, implement, revise, or rescind a data privacy policy without Franchisor's prior written consent as to said policy.
(iii) Privacy Laws.
Franchisee warrants and represents and covenants that it shall comply with (i) applicable prevailing industry standards concerning privacy, data protection, confidentiality and information security, including, without limitation, the thencurrent Payment Card Industry Data Security Standard of the PCI Security Standards Council ("PCI-DSS"), (ii) those mandatory Data Protection and Security Policies, if any, and (iii) all applicable international, federal, state, and local laws, rules, and regulations, as the same may be amended or supplemented from time to time, pertaining in any way to the privacy, confidentiality, security, management, disclosure, reporting, and any other obligations related to the possession or use of Personal Information, including the Children's Online Privacy Protection Act (collectively, "Privacy Laws").
- (iv) Marketing; Consumer Protection.
Source: Item 22 — CONTRACTS (FDD page 50)
What This Means (2025 FDD)
According to Burneys Sweets More's 2025 Franchise Disclosure Document, franchisees must adhere to applicable prevailing industry standards concerning privacy, data protection, confidentiality, and information security. This includes compliance with the Payment Card Industry Data Security Standard of the PCI Security Standards Council (PCI-DSS).
In addition to industry standards, Burneys Sweets More franchisees must also follow any mandatory Data Protection and Security Policies established by the franchisor. Furthermore, franchisees are obligated to comply with all applicable international, federal, state, and local laws, rules, and regulations related to privacy, confidentiality, security, management, disclosure, reporting, and the possession or use of Personal Information, including the Children's Online Privacy Protection Act.
Burneys Sweets More retains the right to inspect a franchisee's shop, computer systems, databases, and business records to verify compliance with data protection and security policies, as well as privacy laws. Franchisees are responsible for obtaining necessary consent for the collection, use, storage, processing, and sharing of Personal Information from customers and employees. They must also comply with requests from individuals seeking to exercise their rights under privacy laws. These measures ensure that Burneys Sweets More franchisees handle personal data responsibly and in accordance with legal and industry requirements.