What compliance requirements must an Even Hotels franchisee adhere to regarding data security and privacy?
Even_Hotels Franchise · 2025 FDDAnswer from 2025 FDD Document
(5) Data Privacy Laws. Licensee will: (i) comply with all applicable Data Privacy Laws; (ii) comply with all of IHG's requirements regarding data protection contained in the Standards or otherwise; (iii) refrain from any action or inaction that could cause IHG or its Affiliates to breach any of the Data Protection Laws; (iv) do and execute, or arrange to be done and executed, each act, document and thing necessary or desirable to keep IHG in compliance with any of the Data Protection Laws; (v) reimburse IHG for any and all costs incurred in connection with the breach by Licensee of such Data Privacy Laws or Brand Standards; (vi) immediately report to IHG the theft or loss of Personal Data or Guest Data; and (vii) permit IHG and its Affiliates to use any data or other information each of them gathers concerning Licensee, its Affiliates and/or the Hotel in connection with the establishment and operation of Brand System Hotels by IHG and its Affiliates. Licensee will implement commercially reasonable physical, administrative, and technical security controls for its processing of IHG Personal Data that are appropriate to the context and the risk of the Personal Data being processed.
7.2 Licensee shall be responsible for ensuring adequate security and backup procedures to avoid unauthorized access to, use of, or inadvertent loss of data and shall, in its discretion, determine appropriate security, which shall be no less than the standard of care in the industry. Without limiting Licensee's obligations set forth in subparts 7.1.1, 7.1.2 and 7.1.3 above, Licensee will comply with any additional security and data protection practice requirements that IHG will provide to Licensee in writing, which may be updated from time to time (the "Security Practices"). IHG may, in its sole discretion, amend the Security Practices at any time without prior notice (each, a "Security Practices Update"). A Security Practices Update may include additional terms and conditions, including the additional obligations of Licensee. Licensee will comply with any Security Practices Update within thirty (30) days following the date of the Security Practices Update and will comply with any changes to applicable laws, contractual obligations, and industry requirements (including PCI DSS and any successor standard) within the time period provided by such law or industry requirement.
Licensee represents, warrants, and covenants that any Licensee Personal Data transferred to IHG or its Affiliates for the purposes of this License has been collected, retained, used, and transmitted in compliance with applicable Data Privacy Laws.
During and after the License Term, Licensee shall have a non-exclusive, royalty-free license to use any Guest Data stored in the Hotel's property management system only for purposes of operating the Hotel; provided, that: (i) Licensee shall have no right to use the IHG Marketing Data except for the purpose of operating the Loyalty Program during the License Term, and Licensee must remove, or IHG and its Affiliates shall have the right, at Licensee's cost, to remove all IHG Marketing Data from the Hotel's property management system and other Hotel records upon expiration or termination of this License; (ii) Licensee shall retain, use and transmit (and procure that any agent or representative of Licensee that manages the Hotel after the termination of this License retain, use and transmit) such Guest Data only (a) in accordance with all Data Privacy Laws, and (b) to the extent permitted pursuant to any consents obtained from the relevant guests, employees or other individuals (the parties acknowledging that IHG provides no warranty or guaranty regarding any such consents); (iii) Licensee shall not sell or transfer the IHG Personal Data including, but not limited, to any Affiliate or other hotel of Licensee and will not combine IHG Personal Data with the Personal Data of any other hotel brand, company or operator; and (iv) Licensee may not use IHG Personal Data for any marketing purpose.
With respect to IHG Marketing Data, Licensee will act as IHG's processor and is prohibited from (x) "selling" or "sharing" it (as defined by Data Privacy Laws), (y) processing it for any purposes other than as expressly permitted by IHG, including any commercial purposes, or outside of
HotelKey will not retain, use, or disclose Personal Data outside of its direct business relationship with the Controllers or "sell" or "share" (as defined by the Privacy Laws) the Personal Data.
HotelKey will implement commercially reasonable physical, administrative, and technical security controls for its processing of Processed Data that are appropriate to the context and the risk of the Personal Data being processed that are designed to prevent the unlawful access or disclosure, unauthorized processing of, or accidental loss, destruction, damage, or alteration of the Personal Data.
Hotel will ensure all Designated Users comply with industry best practices to implement secure passwords, regularly change such passwords, and protect the security and privacy of their user logins and the PMS Data.
Hotel shall be solely responsible for any and all Claims and Losses (as each such term is defined below) relating to an unauthorized third party access to the PMS Solution and/or PMS Data that results or arises out of breach of the foregoing.
Source: Item 23 — RECEIPTS (FDD pages 99–438)
What This Means (2025 FDD)
According to Even Hotels' 2025 Franchise Disclosure Document, franchisees must adhere to several data security and privacy compliance requirements. Licensees must comply with all applicable Data Privacy Laws and IHG's data protection requirements outlined in the Standards. They must also avoid any actions that could cause IHG or its affiliates to breach Data Protection Laws and must take necessary actions to ensure IHG remains compliant. Franchisees are responsible for reimbursing IHG for any costs incurred due to breaches of Data Privacy Laws or Brand Standards. They must also immediately report any theft or loss of Personal Data or Guest Data to IHG. Furthermore, Even Hotels franchisees must allow IHG and its Affiliates to use any data gathered concerning the franchisee, its affiliates, and/or the Hotel in connection with the establishment and operation of Brand System Hotels. Licensees are required to implement commercially reasonable physical, administrative, and technical security controls for processing IHG Personal Data, appropriate to the context and risk involved.
Even Hotels franchisees must ensure adequate security and backup procedures are in place to prevent unauthorized access, use, or inadvertent loss of data. The level of security should meet or exceed the industry standard of care. Franchisees must comply with all applicable laws, including Data Privacy Laws, contractual obligations, and requirements of the credit card processing industry, such as PCI DSS. They must also adhere to all Standards and IHG policies, requirements, and requests concerning access to any Curated Solution, network connectivity, and transmission of data and reports to IHG and its Affiliates. IHG may provide additional security and data protection practice requirements in writing, which may be updated periodically, and franchisees must comply with these updates within thirty days.
Additionally, Even Hotels requires that any Licensee Personal Data transferred to IHG or its Affiliates is collected, retained, used, and transmitted in compliance with applicable Data Privacy Laws. Licensees are granted a non-exclusive, royalty-free license to use Guest Data stored in the Hotel's property management system for operating the Hotel, provided they comply with all Data Privacy Laws and any consents obtained from guests or employees. Licensees are prohibited from selling or transferring IHG Personal Data, combining it with data from other hotel brands, or using it for marketing purposes. For IHG Marketing Data, franchisees act as IHG's processor and are prohibited from selling or sharing it or processing it for any purposes other than those expressly permitted by IHG.
HotelKey, a third-party provider, also has specific obligations. HotelKey will not retain, use, or disclose Personal Data outside of its direct business relationship with the Controllers or "sell" or "share" the Personal Data. They must implement commercially reasonable security controls to prevent unlawful access or disclosure, unauthorized processing, or accidental loss of Personal Data. HotelKey cannot combine Personal Data with data from other entities and must allow the Hotel to take steps to ensure their processing of Personal Data aligns with obligations under Privacy Laws. The Hotel must ensure all Designated Users comply with industry best practices for secure passwords and protect the security and privacy of their user logins and PMS Data. The Hotel is solely responsible for any Claims and Losses relating to unauthorized third-party access to the PMS Solution and/or PMS Data resulting from a breach of these security measures.