Are there any geographic limits on the application of Privacy Laws affecting a Circle K franchise?
Circle_K Franchise · 2025 FDDAnswer from 2025 FDD Document
; (ii) who has purchased or purchases products or services at the Store; or (iii) whom Franchisee has solicited to purchase any products or services at the Store. Franchisor may use the Customer Information as it deems appropriate, including sharing it with its Affiliates.
- (b) Without limiting the foregoing, Franchisee agrees to comply with applicable law in connection with its collection, storage, disclosure and its use and Franchisor's use of such Customer Information, including complying with all laws and regulations relating to data protection, privacy and security, including data breach response requirements ("Privacy Laws"), as well as data privacy and security policies, procedures and other requirements Franchisor may periodically establish. Some laws require Franchisee to obtain consent to collect, store, disclose, and use (collectively "process") personal information. Franchisee is responsible for obtaining appropriate Customer consent to ensure Franchisee and Franchisor may process Customer Information as outlined in this Agreement. Franchisee must notify Franchisor immediately of any suspected data breach at or in connection with the Store.
Source: Item 22 — CONTRACTS (FDD page 100)
What This Means (2025 FDD)
According to the 2025 Circle K Franchise Disclosure Document, the Privacy Laws affecting a Circle K franchise are not explicitly limited to a specific geographic area. The franchisee is responsible for complying with all applicable data protection, privacy, and security laws, including data breach response requirements. This obligation extends to the collection, storage, disclosure, and use of customer information. The franchisee must also adhere to any data privacy and security policies, procedures, and other requirements that Circle K may periodically establish. These requirements apply to all customer information, regardless of where the customer is located.
Circle K retains the right to modify these restrictions and issue updates to its standards and policies pertaining to Privacy Laws. This includes adding other similar restrictions that may be required under other state or federal Privacy Laws. The franchisee agrees to comply with these modifications and to execute any addenda that Circle K may determine are required to conform the Franchise Agreement to new or changed Privacy Laws. This indicates that the Privacy Laws affecting the franchise are subject to change based on evolving legal requirements at both the state and federal levels.
Furthermore, if a Circle K franchisee engages a third party (Subprocessor) to handle customer information, the franchisee must notify Circle K of this engagement. This engagement must be governed by a written contract that includes the same restrictions as outlined in the Franchise Agreement and imposes reasonable confidentiality obligations and privacy and security considerations. This ensures that all parties involved in processing customer information are compliant with Privacy Laws, regardless of their location. The franchisee is also obligated to cooperate with Circle K to stop or remediate any unauthorized use of customer information, including verifying that the franchisee no longer retains or processes any personal information that a consumer has asked the franchisee or Circle K to delete under applicable Privacy Laws.