Is a Cream franchisee required to follow Cream's instructions regarding curative actions and public statements related to a data breach?

According to Cream's 2025 Franchise Disclosure Document, franchisees are required to adhere to Cream's instructions concerning curative actions and public statements if a data breach occurs. This obligation is part of the franchisee's broader responsibility to protect personal information and comply with data security protocols.

The FDD states that if a franchisee becomes aware of a suspected or actual breach of security or unauthorized access involving Personal Information, they must immediately notify Cream. Following this notification, the franchisee is obligated to follow Cream's instructions regarding both the actions taken to remedy the breach (curative actions) and any public communication about the breach.

This requirement ensures that Cream maintains control over how data breaches are handled and communicated, protecting the brand's reputation and ensuring consistent messaging. It also allows Cream to implement a coordinated response to data breaches across all franchise locations, which is crucial for minimizing potential damage and maintaining customer trust. Cream also retains the right to conduct data security and privacy audits of the franchisee's shop and computer systems at any time to ensure compliance.