Submit a Data Subject Request regarding your personal data held by franchise businesses using Franchise Builder US.
Iowa residents have the right to opt-out of targeted advertising and the right to delete non-PII identifiers. Enabling this toggle enforces the 90-day response window for appeals and surfaces Iowa-specific privacy controls in the Privacy Portal.
The Colorado Privacy Act requires a formal Data Protection Assessment (DPA) for "high-risk" profiling. Generate a timestamped report for each change to the AI lead-scoring algorithm to prove this assessment was conducted.
Under emerging state AI laws (Colorado AI Act, California AB 288) and GDPR Article 22, you have the right to request the principal reasons for any automated decision-making used in your franchise lead qualification. Enter your email below to receive a detailed Reason for Scoring report via email, documenting the non-protected factors used in your evaluation.
Your request is logged on your lead record for audit purposes. The report details only non-protected, non-discriminatory factors (financial readiness, timeline urgency, territory alignment, overall fit). No protected class characteristics (race, religion, national origin, etc.) are used in or disclosed by the scoring process.
California's Delete Act requires data brokers to process deletion requests through the California Privacy Protection Agency (CPPA) centralized Data Broker Request Link. Click below to route this deletion request through the CPPA portal.
Under India's Digital Personal Data Protection (DPDP) Act 2023, Section 6, data principals have the right to withdraw consent given to a Data Fiduciary at any time. Use the Consent Withdrawal request type below to exercise this right. Under Section 10, every Data Fiduciary must designate a Grievance Redressal Officer to address data principal grievances within the period prescribed by the Act.
Not yet designated
Not yet designated
Select Consent Withdrawal as the request type and set jurisdiction to IN (India) to submit a DPDP Act Section 6 consent withdrawal. Upon withdrawal, the Data Fiduciary must cease processing your personal data within a reasonable period, except where retention is required by law. Grievances must be acknowledged within 24 hours and resolved within 30 days per DPDP Rules.
The platform operator has not yet designated a DPDP Grievance Redressal Officer. If you are an Indian resident, you may still submit a consent withdrawal request below; it will be routed to the platform administrator for processing.
This gateway activates when your franchise targets Nigerian residents. Enable targeting below to configure NDPR/NDPA compliance requirements.
The UK IDTA (or UK Addendum to the EU SCCs) is required for data transfers from the UK post-Brexit. The Privacy Policy and DPA must reference the UK IDTA in addition to standard EU SCCs.
UK Addendum to EU SCCs
The UK Addendum bolts onto the EU SCCs, allowing them to be used for UK data transfers. Alternatively, the standalone UK IDTA may be used.
Records which PII attributes were sent to which API endpoint for every lead/franchisee transaction involving sub-processors (InvokeLLM, Avalara, etc.). Available for Data Subject Request audits.
No sub-processor transactions logged.
We use this to locate records associated with your data across all franchisee databases.
Instead of requesting a government ID scan (which collects unnecessary PII), we verify your identity using data already in our system. Answer at least one question below. This approach complies with CCPA/GDPR data minimization requirements for DSR identity verification.
If we cannot verify your identity with existing data, we may request additional verification. Government ID scans are only requested as a last resort for high-risk requests.
Colorado Privacy Act requires that revoking consent be as easy as giving it. Click any attribute below to immediately delete that specific data point. No multi-step process required.
Privacy Notice: Your request will be processed within 30 days per applicable privacy laws (GDPR Art. 12(3), CCPA § 1798.130). Delete requests result in permanent anonymization of your records. Access requests require additional identity verification before data is shared.
Under CPRA, you have the right to challenge the "Weighted Importance" of specific data points used in our lead scoring algorithm. Submit a manual review request for any scoring factor you believe is unfairly weighted.
The NZ Privacy Act 2020 requires mandatory breach notification to the Privacy Commissioner and affected individuals when a notifiable privacy breach occurs. IPP 12 requires explicit consent or legal basis for cross-border data transfers.
Franchise Builder US participates in the Swiss-U.S. Data Privacy Framework (DPF) as certified by the U.S. Department of Commerce. This certification provides a valid legal mechanism for transferring personal data of Swiss data subjects to the United States in accordance with the Swiss Federal Act on Data Protection (FADP, revised 2023).
Swiss-U.S. DPF Coverage: Personal data of Swiss residents transferred to the U.S. is protected under the DPF Principles, including notice, choice, accountability for onward transfer, security, data integrity, access, and enforcement.
SCC Swiss Addendum: For transfers not covered by the DPF, Standard Contractual Clauses (SCCs) include the Swiss Addendum, which adapts the EU SCCs for Swiss FADP compliance and accounts for the Swiss-U.S. DPF adequacy determination.
Right to Recourse: Swiss data subjects have the right to invoke the DPF binding arbitration mechanism for unresolved complaints involving the platform's handling of their personal data.
Under CPRA and GDPR, the platform contractually prohibits all downstream sub-processors and LLM providers from attempting to re-identify any anonymized brand assets, lead data, or de-identified datasets used for UI/UX model tuning, AI training, or analytics.
A cryptographic hash of all completed 'Right to be Forgotten' deletions is maintained and cross-referenced during any database backup restoration. If a backup is restored, the system automatically re-purges PII for users who exercised deletion rights between the backup date and the restoration date, preventing inadvertent PII restoration.
When a lead or franchisee requests data deletion, the platform automatically deletes associated vector embeddings and clears Retrieval-Augmented Generation (RAG) cache entries for that UserID/LeadID. This ensures PII does not persist in AI inference indices after a 'Right to be Forgotten' request is fulfilled, which would constitute unlawful retention under GDPR and CPRA.
Automatically generates a SHA-256 hashed Certificate of Destruction for every biometric data purge event, providing proof of compliance for corporate governance and litigation defense.
GDPR Article 20 — Data Portability Export
You have the right to receive your personal data in a structured, commonly used, and machine-readable format. The platform guarantees export in standardized JSON and CSV schemas per GDPR Art. 20.
Export includes:
Export is delivered within 30 days per GDPR Art. 20(3). Machine-readable schema documentation included.
Article 55 of China's PIPL requires a specific Personal Information Protection Impact Assessment (PIPIA) for processing activities involving automated decision-making (lead scoring) that significantly affect an individual's rights. A timestamped assessment must be generated and stored.
The New Jersey Data Privacy Act (NJOPA) requires a formal Data Protection Assessment for processing activities that present a "heightened risk of harm," specifically including profiling (AI lead scoring) for New Jersey consumers. This extends the Colorado PIA workflow with NJ-specific risk factors.
Egypt Data Protection Law No. 151 of 2020 requires that the Data Protection Officer for a non-Egyptian controller must be a resident of Egypt or a local representative with a physical address in Egypt.
Section 18 of POPIA requires notifying data subjects of their right to lodge a complaint with the Information Regulator, including the Regulator's specific contact details, at the point of collection.
Notice to be added:
You have the right to lodge a complaint with the Information Regulator of South Africa. Contact: inforeg@justice.gov.za | +27 12 406 2510
The India DPDP Act Section 13 requires a "readily available" grievance redressal mechanism. This form generates an automated Indian-law-compliant acknowledgment receipt and routes the ticket to the Grievance Redressal Officer (GRO).
Your grievance will be routed to: GRO (not yet assigned) — N/A
Essential cookies are always on. You can accept or reject analytics, marketing, and translation (CPRA / GDPR).