What security controls must a Hardees franchisee maintain to protect Consumer Information?
Hardees Franchise · 2025 FDDAnswer from 2025 FDD Document
Franchisee must maintain reasonable, appropriate, and effective security controls to preserve the security, integrity, availability, confidentiality, and resilience of Consumer Information. Franchisee must notify HR immediately of any suspected data breach at or in connection with the Franchised Restaurant or the business operated at the Franchised Restaurant. Franchisee must fully cooperate with HR and its counsel in determining the most effective way to meet HR's standards and policies pertaining to Privacy Laws, including those governing notification of a data breach. Franchisee is
responsible for any financial losses it incurs or remedial actions that it must take as a result of breach of security or unauthorized access to Consumer Information in Franchisee's control or possession.
Without limiting the foregoing, Franchisee represents, warrants, and covenants that:
(1) Franchisee will not "sell" or "share" (as defined under any Privacy Law) any Consumer Information or make Consumer Information available to any third party for valuable consideration;
(2) Franchisee will retain, use, or disclose Consumer Information only for the specific business purposes specified in this Agreement, and not for any other commercial or noncommercial purpose;
(3) Franchisee will not retain, use, or disclose Consumer Information outside of the direct business relationship between Franchisee and HR.
Source: Item 22 — Contracts (FDD page 85)
What This Means (2025 FDD)
According to Hardees' 2025 Franchise Disclosure Document, franchisees must maintain reasonable, appropriate, and effective security controls to preserve the security, integrity, availability, confidentiality, and resilience of Consumer Information. This includes adhering to all applicable laws relating to data security and data protection, privacy and security, including data breach response requirements. Franchisees must also comply with data privacy and security policies, procedures, and other requirements that Hardees may periodically establish.
In the event of a suspected or actual data breach, the franchisee is required to notify Hardees within 24 hours of becoming aware of the breach and provide timely updates and information when requested by Hardees. The franchisee is responsible for complying with industry standards and best practices regarding breach reporting and notification obligations. They must also take all necessary and appropriate corrective action to remedy the data breach, prevent a recurrence, and avoid or prevent any further loss or damage arising from the data breach.
Furthermore, franchisees are prohibited from selling or sharing any Consumer Information or making it available to any third party for valuable consideration. They can only retain, use, or disclose Consumer Information for the specific business purposes outlined in the Franchise Agreement and not for any other commercial or noncommercial purpose. Franchisees must also ensure they do not retain, use, or disclose Consumer Information outside of the direct business relationship between the franchisee and Hardees.
Hardees owns all Consumer Information and may use it as deemed appropriate, subject to applicable law. Franchisees may only use Consumer Information for operating the franchised restaurant, subject to restrictions imposed by Hardees and in compliance with all data privacy, security, and other applicable laws. This includes obtaining consents from individuals for Hardees' and its affiliates' use of the Consumer Information, if required by law. Franchisees are responsible for any financial losses incurred or remedial actions required due to a breach of security or unauthorized access to Consumer Information in their control or possession.