What restrictions does CJR impose on a Carls Jr. franchisee's use of Consumer Information?

sed Restaurant opens, Franchisee agrees to enter into the OLO Authorized Operator Agreement with Olo, Inc. Franchisee further agrees to enter into any participation agreement required with CJR's designated delivery providers at the same time (currently, the approved delivery providers are Uber Eats, Door Dash, and GrubHub). Unless CJR provides its prior written consent, Franchisee agrees that it will not provide its own delivery service or use its employees to deliver orders to Franchisee's customers.

O. Customer Satisfaction Programs

In order to (among other things) maintain and enhance the goodwill associated with the Proprietary Marks, the System and each Carl's Jr. Restaurant, Franchisee agrees to participate in programs initiated to verify customer satisfaction and/or Franchisee's compliance with all operational and other aspects of the System, including (but not limited to) secret shoppers, customer survey, or other Quality Assurance ("QA") or similar programs as CJR may require. CJR will share the results of these programs, as they pertain to the Franchised Restaurant, with Franchisee. Franchisee will reimburse CJR for all costs related to the Franchised Restaurant associated with any and all of these programs.

P. Consumer Information

Franchisee may only use Consumer Information (as defined below) to the extent necessary to perform Franchisee's obligations under this Agreement during the term hereof and subject to such instructions and restrictions as CJR may from time to time impose and in compliance with all data privacy, security and other applicable laws. "Consumer Information" means any identifiers (including name, address, phone numbers, usernames, birthdates and e-mail addresses), sales, transaction, loyalty and payment history, and all other information about or related to any customer or prospective customer, including any information deemed "personal information" or "personal data" under applicable law. As used in this Agreement, the term "customer" refers to any person or entity (i) whose information is collected by any CJR system or application or included in any consumer or customer database, file or system owned or controlled by CJR, its parent, subsidiary or affiliate companies; (ii) who is included on any marketing or customer lists Franchisee develops or uses or any customer information generally collected and saved for any reason; (iii) who has purchased, purchases or intends to purchase products or services online, through an CJR application, or at the Franchised Restaurant; or (iv) who has been solicited to purchase any products or services at the Franchised Restaurant. CJR may use the Consumer Information as CJR deems appropriate, including sharing it with CJR's affiliates.

CJR owns all Consumer Information and may use the Consumer Information as it deems appropriate (subject to applicable law), including disclosing it to vendors or sharing it with its affiliates for cross-marketing or other purposes. Franchisee may only use Consumer Information for the purpose of operating the Franchised Restaurant to the extent permitted under this Agreement, including the OPM, during the term hereof and subject to such restrictions as CJR may from time to time impose and in compliance with all data privacy, security and other applicable laws. Without limiting the foregoing, Franchisee agrees to comply with applicable law in connection with Franchisee's collection, processing, storage and use of such Consumer Information, including, if required under applicable law, obtaining consents from individuals for CJR's and its affiliates' use of the Consumer Information. Franchisee must comply with all laws and regulations relating to data protection, privacy and security, including data breach response requirements ("Privacy Law(s)"), as well as data privacy and security policies, procedures and other requirements CJR may periodically establish.

Source: Item 22 — CONTRACTS (FDD pages 75–76)