What are the obligations of a Cream franchisee (and their owners/employees) regarding the processing, retention, and use of Personal Information during and after the term?
Cream Franchise · 2025 FDDAnswer from 2025 FDD Document
). You may gain access to such Personal Information from us, our affiliates, our suppliers, and/or your own operations. You acknowledge and agree that all Personal Information (other than Restricted Data, defined below) is our Confidential Information and is subject to the protections in Section 6.A.
During and after the Term, you (and if you are conducting business as an Entity, each of your owners) agree to, and to cause your respective current and former employees, representatives, affiliates, successors, and assigns to: (1) process, retain, use, collect, and disclose all Personal Information only in strict accordance with all applicable laws, regulations, orders, the guidance and codes of practice issued by industry or regulatory agencies, and the privacy policies and terms and conditions of any applicable Digital Presence; (2) assist us with meeting our compliance obligations under all applicable laws, regulations, and orders relating to Personal Information, including the guidance and codes of practice issued by industry or regulatory agencies; and (3) promptly notify us of any communication or request from any customer or other person to access, correct, delete, opt-out of, or limit activities relating to any Personal Information.
If you become aware of a suspected or actual breach of security or unauthorized access involving Personal Information, you will notify us immediately and specify the extent to which Personal Information was compromised or disclosed. You also agree to follow our instructions regarding curative actions and public statements relating to the breach. We reserve the right to conduct a data security and privacy audit of any of your Shop and your Computer Systems at any time, from time to time, to ensure that you are complying with our requirements.
Notwithstanding anything to the contrary in this Agreement or otherwise, you agree that we do not control or own any of the following Personal Information (collectively, the "Restricted Data"): (i) any Personal Information of the employees, officers, contractors, owners, or other personnel of you, your affiliates, or your Shop; (ii) such other Personal Information as we from time to time expressly designate as Restricted Data; and/or (iii) any other Personal Information to which we do not have access. Regardless of any guidance we may provide generally and/or any specifications that we may establish for other Personal Information, you have sole and exclusive responsibility for all Restricted Data, including establishing protections and safeguards for such Restricted Data; provided, that in each case you agree to comply with all applicable laws, regulations, orders, and the guidance and codes of practice issued by industry or regulatory agencies applicable to such Restricted Data.
L. EMPLOYEES, AGENTS, AND INDEPENDENT CONTRACTORS.
You acknowledge and agree that you are solely responsible for all decisions relating to employees, agents, and independent contractors that you may hire to assist in the operation of your Shop.
Source: Item 23 — RECEIPTS (FDD pages 61–192)
What This Means (2025 FDD)
According to Cream's 2025 Franchise Disclosure Document, franchisees and their associated parties have specific obligations regarding personal information both during and after the franchise term. During the term, franchisees must process, retain, use, collect, and disclose all Personal Information strictly in accordance with all applicable laws, regulations, orders, the guidance and codes of practice issued by industry or regulatory agencies, and the privacy policies and terms and conditions of any applicable Digital Presence. Franchisees are also required to assist Cream in meeting its compliance obligations under these laws and regulations. Furthermore, they must promptly notify Cream of any communication or request from customers or other persons to access, correct, delete, opt-out of, or limit activities related to any Personal Information.
If a franchisee becomes aware of a suspected or actual breach of security or unauthorized access involving Personal Information, they must immediately notify Cream and specify the extent of the compromise or disclosure. They must also follow Cream's instructions regarding curative actions and public statements related to the breach. Cream retains the right to conduct data security and privacy audits of the franchisee's shop and computer systems to ensure compliance.
After the termination of the franchise agreement, the franchisee must comply with all System Standards established by Cream, as well as all applicable laws, in connection with the closure and de-identification of their shop. This includes properly disposing of Personal Information in any form that is in their possession or the possession of their employees. Franchisees must also provide Cream with satisfactory evidence of their compliance with these obligations.
It is important to note that Cream does not control or own Restricted Data, which includes Personal Information of the franchisee's employees, officers, contractors, owners, or other personnel, as well as any other Personal Information to which Cream does not have access. Franchisees have sole responsibility for all Restricted Data, including establishing protections and safeguards, while still complying with all applicable laws and regulations.