Regarding personal information collected as a result of agreements between the franchisee and Del Taco, who is considered the owner and controller of this information?

According to Del Taco's 2025 Franchise Disclosure Document, Del Taco is considered the sole owner and controller of personal information that a franchisee may collect, receive, or process as a result of any agreements between the franchisee and Del Taco, including the franchise agreement. The franchisee is considered a service provider or processor of this information. This means that while the franchisee may handle personal information in the course of operating their Del Taco restaurant, they do so on behalf of Del Taco, and Del Taco ultimately dictates how that information can be used.

This has several implications for a prospective Del Taco franchisee. The franchisee must adhere to all applicable privacy laws and regulations, as well as Del Taco's standards and policies regarding privacy. If there is a conflict between Del Taco's policies and applicable law, the franchisee must comply with the law, notify Del Taco of the conflict, and cooperate with Del Taco to find a solution. The franchisee cannot publish or change any policies related to processing personal information without Del Taco's written consent.

The franchisee is limited in how they can use personal information. They can only process it to provide services requested by Del Taco, including operating the restaurant, or as permitted by privacy laws. The franchisee must notify Del Taco before sharing personal information with any service provider or vendor, and ensure that those third parties agree to similar privacy protections. The franchisee cannot sell, rent, or disclose personal information for monetary or other valuable consideration, or use it for any purpose other than providing services to Del Taco. This includes not using the information for their own commercial purposes or for cross-context behavioral advertising.

Del Taco has the right to take steps to stop and fix any unauthorized use, disclosure, or processing of personal information by the franchisee, including requiring the franchisee to prove they no longer retain or use the information. These obligations regarding personal information survive the expiration or termination of the franchise agreement. This underscores the importance of franchisees understanding and adhering to these strict data handling requirements to avoid potential penalties or legal issues.