What data protection laws must a Caring Transitions franchisee adhere to when processing Franchise Data?

ailable; or

• (4) alignment, combination, blocking, erasure or destruction.

• (b) Franchisee shall process any that may be collected or acquired by Franchisee, whether from clients, employees or other sources ("Franchise Data") strictly in accordance with data protection laws that may apply from time to time during the course of this agreement and, in particular:

• (1) only insofar as is necessary for the purpose of performing its obligations under this agreement;

• (2) in accordance with Franchisor's instructions except where to do so would infringe data protection laws or any other statutory provision that prevents Franchisee from complying with such instructions;

• (3) before processing any data, inform the person to whom the data relates of (i) the purpose(s) for which any processing is to be carried out, (ii) the availability of the option to remove their personal information, and (iii) the address, telephone number and identification of Franchisee in compliance with applicable laws;

• (4) obtain the approval and authorization of the person to whom the data relates for handling of their personal data;

• (5) not disclose the Franchise Data to or allow access to it other than by its or Franchisor's employees and/or any third parties engaged by Franchisee to perform the obligations imposed on Franchisee by this agreement and ensure that any such employees and/or third parties execute appropriate written contractual covenants concerning the protection of the Franchise Data from unauthorized access, use or disclosure;

• (6) without prejudice to any other obligations imposed upon Franchisee by this agreement, use all reasonable efforts to assist Franchisor to comply with such obligations as are imposed on the Franchisor by Data Protection Laws.

• (c) Franchisor shall provide such co-operation as is reasonably required to enable Franchisee to ensure compliance with its obligations under data protection laws, including entering into such additional agreements as may be required to ensure that there are adequate safeguards for the Franchise Data and that the transfer of Franchise Data to Franchisor complies with data protection laws.

• (d) Insofar as Franchisee acts as a data processor and processes any Franchise Data on its own and/or Franchisor's behalf, Franchisee shall comply with the obligations placed on a data controller by data protection laws.

• (e) Without prejudice to any of Franchisee's other obligations under this agreement, Franchisor has the right to notify Franchisee from time to time of any consent (the "Consents") that Franchisor requires Franchisee to obtain from its clients or prospective clients (or other data subject) in relation to any processing of Franchise Data to be undertaken either by Franchisee or Franchisor and the manner in which the Consents are to be detailed.

• (f) In order to comply with data protection laws, Franchisor may notify Franchisee from time to time of a nominated third party within who will be authorized to receive and process the Franchise Data on Franchisor's behalf. The possibility of having Franchise Data processed by a third party must also be disclosed to the person to whom the data relates.

• (g) Except where the express consent of a data subject has been obtained to the processing of personal data, Franchisee shall process only such personal data as may lawfully be processed under data protection laws in the absence of such consent.

• (h) Franchisee shall indemnify Franchisor against all Claims made or brought by any person (i) arising out of or alleging any failure to comply with any provision of data protection laws in relation to any Franchise Data processed by Franchisee or Franchisee's employees or agents, whether on Franchisee's behalf or as Franchisor's agent, or (ii) arising out of Franchisor's failure or alleged failure to comply with any provision of data protection laws in relation to any Franchise Data processed by Franchisor or Franchisor's employees or agents, if such failure arises as a result of Franchisee's failure to obtain Consents or otherwise comply with Franchisee's obligations under this agreement and/or data protection laws.

• (i) Franchisee consents to Franchisor's use of data relating to Franchisee and/or its business, and Franchisee shall do all such things as Franchisor may require and will use (and demonstrate to Franchisor that it has used) its best efforts to obtain, and enable Franchisor to process, data relating to Franchisee's clients including (but not limited to) Franchise Data, and Franchisee agrees that Franchisor may use and process all such data as is referred to in this section 7.25 for its own business purposes, including but not limited to marketing, monitoring the growth and performance of the Franchised Business and compliance with Franchisee's obligations, comparing such data to that of other Franchisees, advising Franchisee and other Franchisees on improving their performance and business operations, and to make all such data available to third parties selected by Franchisor, including but not limited to its affiliates.

• (j) Franchisee shall comply with Franchisor's standards and policies pertaining to data processing and the privacy of information about clients or other individuals. If there is a conflict between data protection laws and Franchisor's privacy standards and policies, Franchisee shall: (i) comply with the requirements of Data Protection Laws;

Source: Item 20 — OUTLETS AND FRANCHISEE INFORMATION (FDD pages 41–49)