Is a Southern Steer franchisee required to indemnify the Indemnified Parties for claims arising from the franchisee's failure to comply with the PCI DSS?

According to the 2025 Southern Steer Franchise Disclosure Document, a franchisee is required to indemnify the Indemnified Parties for damages arising from a failure to comply with the PCI DSS (Payment Card Industry Data Security Standard). This means the franchisee is responsible for protecting the Indemnified Parties from any losses, expenses, or liabilities they incur due to the franchisee's non-compliance with these security standards. The Indemnified Parties include the Franchisor and its Affiliates and their respective employees, Executive Management, shareholders, members, Owners, directors, officers, attorneys, accountants and agents.

This indemnification extends to all damages arising from claims related to the failure to comply with PCI DSS and/or other information security standards required by Southern Steer. This requirement underscores the importance Southern Steer places on data security and the protection of customer financial information. Franchisees must ensure they adhere to all PCI DSS requirements to avoid potential liabilities.

However, the franchisee is not obligated to indemnify the Indemnified Parties for damages resulting from the gross negligence or intentional misconduct by the Indemnified Parties themselves. This provision offers some protection to the franchisee, ensuring they are not held responsible for issues caused by the franchisor's actions. It is important for prospective franchisees to fully understand their obligations and potential liabilities related to PCI DSS compliance, as well as the exceptions to the indemnification requirements.