What policies and procedures must a Camp Margaritaville franchisee follow regarding personal data?
Camp_Margaritaville Franchise · 2025 FDDAnswer from 2025 FDD Document
(xv) policies and procedures regarding the collection, storage, use, processing and transfer of personal data (which includes information that identifies or is capable of identifying an individual), payment card data, or other financial data and information, including any data privacy or data security compliance programs, any payment card industry data security standards, together with any related audit or certification requirements, and all other applicable data protection and privacy laws and regulations;
(b) Data and Consumer Protection Laws.
Franchisee represents, warrants and covenants that it is familiar with the requirements of, and that it has been, is and will continue at all times to be, in compliance with all consumer protection, data protection, privacy and cybersecurity laws that may be applicable to the Resort, the Camp Margaritaville System, Franchisor or Franchisee, including but not limited to the Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) ("GDPR"), the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) ("CCPA"), the Virginia Consumer Data Protection Act ("CDPA"), the Colorado Privacy Act ("CPA"), the Utah Consumer Privacy Act ("UCPA"), the Connecticut Personal Data Privacy and Online Monitoring Act ("CPDPA"), the Telephone Consumer Protection Act of 1991 ("TCPA"), the Controlling the Assault of Non-Solicited Pornography and Marketing Act (the "CAN-SPAM Act"), the Telemarketing Sales Rule ("TSR") and the Junk Fax Prevention Act, any regulations related thereto, and similar federal, state and local privacy-related and telemarketing-related laws, rules, regulations and ordinances ("Data Protection Laws").
Franchisee grants Franchisor the right to take reasonable and appropriate steps to ensure all Guest Profile Data is being processed in accordance with Data Protection Laws.
Franchisee must promptly inform Franchisor if Franchisee determines that it can no longer meet its obligations under Data Protection Laws.
- (c) Data Subject Requests.
For any data subject request submitted to Franchisee that requires Franchisor's cooperation or assistance for Franchisee to process the request in accordance with
Applicable Law (e.g., data subject requests that implicate Guest Profile Data), Franchisee shall:
- (i) Upon receiving notice of the request, inform Franchisor of the request within 2 days by emailing Franchisor at legal@margaritaville.com.
The Loyalty Program may be administered by a subcontractor of Franchisor or its Affiliates and Franchisee will, upon request from Franchisor, cooperate with such subcontractor to collect and share certain data regarding actual or prospective guests or customers in connection with the administration of the Loyalty Program.
- (xiii) delivering to Franchisor or otherwise providing Franchisor access to the Guest Profile Data as described in Section 4.05;
- (xiv) record retention policies and programs;
Source: Item 23 — RECEIPTS (FDD pages 72–406)
What This Means (2025 FDD)
According to Camp Margaritaville's 2025 Franchise Disclosure Document, franchisees must adhere to several policies and procedures concerning personal data. These include policies for the collection, storage, use, processing, and transfer of personal data, payment card data, and other financial information. Franchisees must also comply with data privacy and security programs, payment card industry data security standards, and all applicable data protection and privacy laws and regulations. This ensures the protection of customer and financial data within the Camp Margaritaville system.
Camp Margaritaville franchisees must stay compliant with consumer protection, data protection, privacy, and cybersecurity laws applicable to the resort, the Camp Margaritaville system, the franchisor, or the franchisee. These laws include GDPR, CCPA, CDPA, CPA, UCPA, CPDPA, TCPA, CAN-SPAM Act, TSR, and the Junk Fax Prevention Act, along with any related regulations. Franchisees must also allow Camp Margaritaville to take steps to ensure that all Guest Profile Data is processed according to Data Protection Laws. Franchisees must inform Camp Margaritaville if they cannot meet their obligations under Data Protection Laws and must provide necessary documents for compliance.
Furthermore, Camp Margaritaville franchisees are required to manage data subject requests according to applicable laws. If a request requires Camp Margaritaville's cooperation, the franchisee must inform Camp Margaritaville within two days of receiving the request via email at legal@margaritaville.com, provide all relevant information, and process the request in accordance with the law. The franchisee's response to the consumer must state that they are part of a franchisor/franchisee relationship with Margaritaville Enterprises LLC, that the request only applies to personal information collected by the franchisee, and that any questions for Margaritaville Enterprises LLC should be directed to them directly. These measures ensure that data requests are handled correctly and that consumers are aware of the scope of the franchisee's data handling practices.
Camp Margaritaville also has a loyalty program where franchisees must cooperate with any subcontractors to collect and share certain data regarding actual or prospective guests or customers in connection with the administration of the Loyalty Program. Franchisees must also comply with the Camp Margaritaville System, the Manual, and all other written System Standards, which may regulate delivering to Franchisor or otherwise providing Franchisor access to the Guest Profile Data as described in Section 4.05 and record retention policies and programs. These policies ensure that Camp Margaritaville maintains control over its brand reputation and customer data, while also complying with legal requirements.