What consents and authorizations must a Cinnabon franchisee secure from customers regarding Customer Information?

According to Cinnabon's 2025 Franchise Disclosure Document, a franchisee must obtain all necessary consents and authorizations from customers, prospective customers, vendors, and others as required by applicable law. These consents and authorizations are needed to transmit customer information to Cinnabon and its affiliates, and for Cinnabon and its affiliates to use that customer information, in the manner contemplated by the Franchise Agreement. Customer Information includes names, contact information, financial information, purchasing history, market research data, and other personal information of or relating to the customers and prospective customers of the Franchised Business.

This means that a Cinnabon franchisee has the responsibility to ensure they are compliant with all relevant data privacy laws, such as GDPR or CCPA, depending on the location of their business and customers. This includes providing necessary disclosures to customers about how their data will be used and obtaining explicit consent for data collection, storage, and transmission to Cinnabon. Failure to comply with these legal requirements could result in fines and legal repercussions for the franchisee.

Cinnabon retains the right to use Customer Information in any manner or for any purpose, so the franchisee must ensure that the consents they obtain from customers cover this broad usage. This requirement places a significant burden on the franchisee to stay informed about changing data privacy laws and to implement appropriate systems and processes to manage customer data and obtain necessary consents. It is common practice in franchising for the franchisor to dictate how customer data is handled to maintain brand consistency and leverage data for marketing purposes, but the legal responsibility for compliance typically falls on the franchisee.