What is the Circle K franchisee's obligation to obtain appropriate Customer consent to ensure Franchisee and Franchisor may process Customer Information as outlined in this Agreement?

According to Circle K's 2025 Franchise Disclosure Document, the franchisee is responsible for obtaining appropriate customer consent to ensure that both the franchisee and Circle K can process customer information as outlined in the franchise agreement. This obligation arises because some laws require franchisees to obtain consent to collect, store, disclose, and use personal information, a process broadly defined as "process." Customer Information includes any contact information, sales and payment history, and all other information about any customer. The term "customer" refers to any person or entity included on marketing lists, who purchases products or services at the store, or whom the franchisee has solicited to purchase any products or services at the store.

Circle K owns all Customer Information and may use it as deemed appropriate, subject to applicable law, including disclosing it to vendors and affiliates. The franchisee may only use Customer Information for operating the store as permitted under the agreement and Business Systems Manuals, adhering to restrictions imposed by Circle K and complying with data privacy, security, and other applicable laws. Franchisees must comply with all laws and regulations relating to data protection, privacy and security, including data breach response requirements ("Privacy Laws"), as well as data privacy and security policies, procedures and other requirements Circle K may periodically establish.

This means that a prospective Circle K franchisee must understand and implement procedures to obtain and document customer consent for data collection and usage. This includes staying updated on evolving privacy laws and Circle K's policies, and ensuring that all data processing activities comply with these requirements. Failure to obtain proper consent or comply with privacy laws could result in legal repercussions and damage to the franchisee's and Circle K's reputation. Franchisee must notify Franchisor immediately if Franchisee determines it cannot meet its obligations under Privacy Laws or this Agreement regarding its collection, retention, use, or disclosure of Customer Information.

Furthermore, the franchisee must implement reasonable security procedures and practices to protect customer information from unauthorized access, following minimum requirements set forth in the Business Systems Manuals. The franchisee must cooperate with Circle K to ensure compliance with Privacy Laws, including providing requested documents and allowing assessments and audits of privacy and security controls at least annually. The franchisee must also cooperate with Circle K to stop or remediate any unauthorized use of Customer Information, including verifying that the franchisee no longer retains or processes personal information that a consumer has asked to be deleted under applicable Privacy Laws. If the franchisee engages a third party (Subprocessor) to process Customer Information, they must notify Circle K and ensure the third party adheres to the same restrictions and confidentiality obligations.