What proof of PCI-DSS compliance status must a Carvel franchisee submit, and how often?

According to Carvel's 2025 Franchise Disclosure Document, franchisees must submit proof of their PCI-DSS compliance status annually. Carvel also retains the right to request evidence of compliance with applicable Privacy Requirements at any time. This requirement ensures that franchisees adhere to the Payment Card Industry Data Security Standards and other relevant laws and standards related to the collection, use, and security of personal information.

In addition to submitting proof of compliance, Carvel franchisees are obligated to operate their businesses in accordance with all applicable laws, including those related to data security and privacy. These laws encompass the use, storage, transmission, and disposal of data, regardless of the media type. Franchisees are expected to research and understand these legal obligations to ensure their operations remain compliant.

Carvel may also require franchisees to undergo periodic security audits conducted by approved vendors or suppliers to verify that personal data is adequately protected. Franchisees may need to provide copies of audits, scanning results, or related documentation to Carvel upon request. Carvel reserves the right to review a franchisee's systems and verify compliance with these requirements, potentially charging a fee not exceeding 110% of their actual costs and expenses related to such services.

These measures are in place to protect customer data and maintain the integrity of the Carvel brand. Failure to comply with these requirements could result in penalties or other consequences as outlined in the franchise agreement.