What is the Circle K franchisee's responsibility regarding the storage of Customer Information?
Circle_K Franchise · 2025 FDDAnswer from 2025 FDD Document
sor deems necessary to operate the Store or to collect data from the Store. Franchisee acknowledges and agrees that it will not be excused from performing any of its obligations hereunder as a result of the failure or malfunction of either the EPOS System or the Computer Systems. It is Franchisee's responsibility to make sure that it is in compliance with all laws that are applicable to the EPOS System or other technology used in the operation of Franchisee's Store, including all data protection, privacy or security laws as well as payment card industry (PCI) and Europay, MasterCard and Visa (EMV) compliance.
Exhibit F - Franchise Agreement 11.2 Participation in Website or Other Online Communication Systems. Franchisor has the right to require Franchisee, at Franchisee's expense, to participate in a "Circle K" extranet website or other online communication systems. Franchisor has the right to determine the content and use of any websites or other online communication systems and will establish the rules under which its franchisees (including Franchisee) will participate. Franchisor will retain all rights relating to any website or other online communication systems and may alter or terminate the site or systems.
Source: Item 22 — CONTRACTS (FDD page 100)
What This Means (2025 FDD)
According to Circle K's 2025 Franchise Disclosure Document, the franchisor owns all customer information and may use it as they deem appropriate, subject to applicable law, including disclosing it to vendors. While Circle K owns the customer data, franchisees must comply with all data protection, privacy, and security laws applicable to the EPOS system or other technology used in the store's operation, including Payment Card Industry (PCI) and Europay, MasterCard, and Visa (EMV) compliance.
This means that while Circle K retains ownership of customer data, franchisees are responsible for ensuring that their data handling practices comply with all relevant laws and regulations. This includes implementing and maintaining systems that protect customer data from unauthorized access, use, or disclosure. Franchisees must also stay up-to-date on the latest data protection laws and regulations and ensure that their practices are compliant.
The franchisee is responsible for maintaining records according to the Business Systems Manuals. Circle K may require franchisees to enter into separate agreements with third parties for the use and maintenance of systems required for the store, including the EPOS system and other computer systems, to collect data from the store. Franchisees are not excused from obligations due to the failure or malfunction of the EPOS system or the Computer Systems.
In practice, this means that a Circle K franchisee must invest in secure data storage and transmission systems, train employees on data protection best practices, and regularly audit their systems to ensure compliance. Failure to comply with these requirements could result in legal penalties and damage to the Circle K brand's reputation.