What is the Circle K franchisee's obligation to represent and warrant that they will not retain, use, or disclose Customer Information outside of the direct business relationship between Franchisee and Franchisor?
Circle_K Franchise · 2025 FDDAnswer from 2025 FDD Document
If any federal or state Privacy Law, including the California Consumer Privacy Act, as revised by the California Consumer Privacy Rights Act , Cal. Civ. Code § 1798.100, et seq. (collectively, "CCPA") and any related regulations, applies to the operation of the Store, whenever and to the extent Franchisee operates as a "Service Provider" or "Contractor" under the CCPA, a data processor, or in a similar capacity under any federal or state Privacy Law, Franchisee represents and warrants that:
- (3) Franchisee will not retain, use, or disclose Customer Information outside of the direct business relationship between Franchisee and Franchisor;
Source: Item 22 — CONTRACTS (FDD page 100)
What This Means (2025 FDD)
According to Circle K's 2025 Franchise Disclosure Document, if any federal or state Privacy Law, including the California Consumer Privacy Act (CCPA), applies to the operation of the store, the franchisee represents and warrants that they will not retain, use, or disclose Customer Information outside of the direct business relationship between the franchisee and Circle K. This obligation exists whenever and to the extent the franchisee operates as a "Service Provider" or "Contractor" under the CCPA, a data processor, or in a similar capacity under any federal or state Privacy Law.
This means that Circle K franchisees must ensure that their handling of customer data remains strictly within the bounds of their franchise agreement and the Business Systems Manuals. They cannot use this information for any purpose other than operating the store, and they must not share or sell it to third parties for advertising or other considerations. This is to protect customer privacy and ensure compliance with relevant data protection laws.
The franchisee also has obligations regarding data deletion requests, handling consumer data requests, and implementing security measures to protect customer information. The franchisee must inform Circle K of any customer data requests within one business day and cooperate to ensure a timely response. Additionally, franchisees must implement reasonable security procedures to protect customer information from unauthorized access, following any minimum requirements outlined in the Business Systems Manuals. Franchisees must also cooperate with Circle K if Circle K seeks to ensure that Franchisee has collected, retained, used, or disclosed Customer Information consistent with Privacy Laws and the Franchise Agreement.
These requirements highlight the importance of data protection and privacy compliance for Circle K franchisees. Failure to comply with these obligations could result in financial losses or remedial actions for which the franchisee is responsible. Furthermore, Circle K may modify these restrictions and require franchisees to execute addenda to conform to new or changed Privacy Laws, emphasizing the ongoing nature of these obligations.