What is the Circle K franchisee's responsibility to obtain appropriate Customer consent to ensure Franchisee and Franchisor may process Customer Information as outlined in this Agreement?
Circle_K Franchise · 2025 FDDAnswer from 2025 FDD Document
A, or a resident of another jurisdiction under other applicable Privacy Law), Franchisee shall inform Franchisor of that request within one business day and cooperate with Franchisor to ensure that the consumer receives an appropriate and timely acknowledgement and response;
- (6) Franchisee will implement reasonable security procedures and practices appropriate to the Customer Information it collects, retains, uses or discloses, in order to protect it from unauthorized or illegal access, including following minimum requirements that may be set forth in the Business Systems Manuals;
- (7) Franchisee will cooperate with Franchisor if Franchisor seeks to ensure that Franchisee has collected, retained, used, or disclosed Customer Information consistent with Privacy Laws and this Agreement, including but not limited to providing Franchisor with requested compliance documents, or allowing Franchisor to assess, audit, or test Franchisee's privacy and security controls at least annually;
- (8) Franchisee will cooperate with Franchisor to stop or remediate any unauthorized use of Customer Information, including verifying that Franchisee no longer retains or processes any personal information that a consumer has asked Franchisee or Franchisor to delete under applicable Privacy Laws; and
- (9) Franchisee will notify Franchisor immediately if Franchisee determines it cannot meet its obligations under Privacy Laws or this Agreement regarding its collection, retention, use, or disclosure of Customer Information.
- (d) Franchisee certifies that it understands the restrictions in Paragraphs (1) (9) of section 9.6(c) and will comply with them. Franchisee also acknowledges and agrees that Franchisor may modify these restrictions from time to time by written notice to Franchisee, by issuing updates to Franchisor's standards and policies pertaining to Privacy Laws, including by adding other similar restrictions that may be required under other state or federal Privacy Laws, and Franchisee agrees to comply with the same. Franchisee also agrees to execute any addenda that Franchisor may determine are required to conform this Agreement to new or changed Privacy Laws.
Source: Item 22 — CONTRACTS (FDD page 100)
What This Means (2025 FDD)
According to the 2025 Circle K Franchise Disclosure Document, the franchisee has several responsibilities regarding customer information and privacy. While the document does not explicitly state that the franchisee is responsible for obtaining customer consent, it outlines several obligations related to handling customer information in compliance with privacy laws. Circle K owns all customer information and may use it as deemed appropriate, subject to applicable law. The franchisee may only use customer information for the purpose of operating the store to the extent permitted under the agreement, including the Business Systems Manuals.
The Circle K franchisee must implement reasonable security procedures and practices to protect customer information from unauthorized access, adhering to minimum requirements in the Business Systems Manuals. The franchisee must cooperate with Circle K to ensure customer information is collected, retained, used, or disclosed consistently with privacy laws and the franchise agreement. This includes providing compliance documents and allowing Circle K to audit the franchisee's privacy and security controls at least annually. The franchisee must also cooperate with Circle K to stop or remediate any unauthorized use of customer information, including verifying that the franchisee no longer retains or processes personal information that a consumer has requested to be deleted under applicable privacy laws.
Furthermore, the Circle K franchisee must notify Circle K immediately if they determine they cannot meet their obligations under privacy laws or the agreement regarding the collection, retention, use, or disclosure of customer information. The franchisee also agrees to execute any addenda that Circle K may determine are required to conform the agreement to new or changed privacy laws. If the franchisee engages a third party (Subprocessor) to process customer information, they must notify Circle K, and such engagement must be governed by a written contract that includes the same restrictions as outlined in the agreement, imposing confidentiality obligations and privacy and security controls on the Subprocessor. The franchisee is responsible for any financial losses incurred or remedial actions required due to a security breach or unauthorized access to customer information under their control.