What is the Circle K franchisee's responsibility to ensure that both the franchisee and franchisor may process Customer Information?

According to Circle K's 2025 Franchise Disclosure Document, the franchisee is responsible for obtaining appropriate customer consent to ensure that both the franchisee and Circle K can process customer information as outlined in the franchise agreement. Customer information includes contact details, sales and payment history, and any data that could identify an individual or household. This obligation stems from data protection, privacy, and security laws that require consent for collecting, storing, disclosing, and using personal information.

The Circle K franchisee must also comply with all applicable laws related to data protection, privacy, and security, including data breach response requirements. They must adhere to data privacy and security policies, procedures, and other requirements that Circle K may periodically establish. Furthermore, the franchisee is obligated to immediately notify Circle K of any suspected data breach at or connected to the store and fully cooperate with Circle K and its counsel to determine the most effective way to meet Circle K's standards and policies regarding privacy laws.

In practical terms, this means a Circle K franchisee needs to implement systems and procedures to obtain and document customer consent for data processing. This might involve providing clear and conspicuous notices to customers about how their information will be used and obtaining affirmative consent, such as through a check box or signature. The franchisee must stay updated on the latest privacy laws and Circle K's policies to ensure ongoing compliance. Failure to comply with these requirements could result in legal penalties, damage to Circle K's reputation, and potential liabilities for data breaches.