What obligations does a Caring Transitions franchisee have as a data processor?
Caring_Transitions Franchise · 2025 FDDAnswer from 2025 FDD Document
(b) Franchisee shall process any that may be collected or acquired by Franchisee, whether from clients, employees or other sources ("Franchise Data") strictly in accordance with data protection laws that may apply from time to time during the course of this agreement and, in particular:
(1) only insofar as is necessary for the purpose of performing its obligations under this agreement;
(2) in accordance with Franchisor's instructions except where to do so would infringe data protection laws or any other statutory provision that prevents Franchisee from complying with such instructions;
(3) before processing any data, inform the person to whom the data relates of (i) the purpose(s) for which any processing is to be carried out, (ii) the availability of the option to remove their personal information, and (iii) the address, telephone number and identification of Franchisee in compliance with applicable laws;
(4) obtain the approval and authorization of the person to whom the data relates for handling of their personal data;
(5) not disclose the Franchise Data to or allow access to it other than by its or Franchisor's employees and/or any third parties engaged by Franchisee to perform the obligations imposed on Franchisee by this agreement and ensure that any such employees and/or third parties execute appropriate written contractual covenants concerning the protection of the Franchise Data from unauthorized access, use or disclosure;
(6) without prejudice to any other obligations imposed upon Franchisee by this agreement, use all reasonable efforts to assist Franchisor to comply with such obligations as are imposed on the Franchisor by Data Protection Laws.
(c) Franchisor shall provide such co-operation as is reasonably required to enable Franchisee to ensure compliance with its obligations under data protection laws, including entering into such additional agreements as may be required to ensure that there are adequate safeguards for the Franchise Data and that the transfer of Franchise Data to Franchisor complies with data protection laws.
(d) Insofar as Franchisee acts as a data processor and processes any Franchise Data on its own and/or Franchisor's behalf, Franchisee shall comply with the obligations placed on a data controller by data protection laws.
(e) Without prejudice to any of Franchisee's other obligations under this agreement, Franchisor has the right to notify Franchisee from time to time of any consent (the "Consents") that Franchisor requires Franchisee to obtain from its clients or prospective clients (or other data subject) in relation to any processing of Franchise Data to be undertaken either by Franchisee or Franchisor and the manner in which the Consents are to be detailed.
(f) In order to comply with data protection laws, Franchisor may notify Franchisee from time to time of a nominated third party within who will be authorized to receive and process the Franchise Data on Franchisor's behalf.
The possibility of having Franchise Data processed by a third party must also be disclosed to the person to whom the data relates.
(g) Except where the express consent of a data subject has been obtained to the processing of personal data, Franchisee shall process only such personal data as may lawfully be processed under data protection laws in the absence of such consent.
(h) Franchisee shall indemnify Franchisor against all Claims made or brought by any person (i) arising out of or alleging any failure to comply with any provision of data protection laws in relation to any Franchise Data processed by Franchisee or Franchisee's employees or agents, whether on Franchisee's behalf or as Franchisor's agent, or (ii) arising out of Franchisor's failure or alleged failure to comply with any provision of data protection laws in relation to any Franchise Data processed by Franchisor or Franchisor's employees or agents, if such failure arises as a result of Franchisee's failure to obtain Consents or otherwise comply with Franchisee's obligations under this agreement and/or data protection laws.
Source: Item 20 — OUTLETS AND FRANCHISEE INFORMATION (FDD pages 41–49)
What This Means (2025 FDD)
According to Caring Transitions' 2025 Franchise Disclosure Document, franchisees have specific obligations regarding data protection. If a franchisee acts as a data processor and handles Franchise Data on their own or on behalf of Caring Transitions, they must adhere to the obligations placed on a data controller as defined by data protection laws. This means the franchisee is responsible for complying with laws and regulations related to data privacy and security. Franchisees must process data strictly in accordance with data protection laws. This includes processing data only when necessary to fulfill their obligations under the franchise agreement and following Caring Transitions' instructions, unless those instructions violate data protection laws.
Before processing any data, the franchisee must inform the data subject about the purpose of the data processing, their option to remove their personal information, and the franchisee's contact information, all in compliance with applicable laws. They also need to obtain approval and authorization from the data subject for handling their personal data. Franchisees are not allowed to disclose Franchise Data or allow access to it, except by their or Caring Transitions' employees, or authorized third parties who have agreed to protect the data through written agreements. Franchisees must also assist Caring Transitions in complying with its own obligations under Data Protection Laws.
Caring Transitions will cooperate with the franchisee to ensure they meet their data protection obligations, including providing additional agreements to safeguard Franchise Data and ensure its transfer to Caring Transitions complies with data protection laws. Furthermore, Caring Transitions has the right to inform the franchisee of any consents needed from clients or prospective clients regarding the processing of Franchise Data, specifying how these consents should be obtained. Caring Transitions may also designate a third party to receive and process Franchise Data on its behalf, which must be disclosed to the data subject. Franchisees must only process personal data that is lawful to process without express consent, unless such consent has been obtained.
Finally, the franchisee is required to indemnify Caring Transitions against any claims arising from their failure to comply with data protection laws, whether the data is processed on the franchisee's behalf or as Caring Transitions' agent. This also applies to claims arising from Caring Transitions' failure to comply with data protection laws if that failure results from the franchisee not obtaining necessary consents or otherwise not meeting their obligations under the agreement and data protection laws. This highlights the importance of franchisees understanding and adhering to all data protection requirements to avoid potential legal and financial repercussions.