The World Franchise Council (WFC) is a non-profit association headquartered in London, United Kingdom, and governed by the laws of England and Wales. WFC operates an international website hosted in Toronto, Ontario, Canada, where its Privacy & Data Protection Officer is also located. This Privacy Policy outlines how we collect, use, disclose, and safeguard your personal data, in accordance with applicable data protection laws, including the United Kingdom General Data Protection Regulation (UK GDPR), the European Union GDPR, the Personal Information Protection and Electronic Documents Act (PIPEDA – Canada), the California Consumer Privacy Act (CCPA/CPRA – USA), and the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados – LGPD).
During the course of our various programs and activities, the WFC may gather and use personal information. Anyone from whom we collect such information should expect that it will be carefully protected and that any use of, or other dealing with, this information is subject to consent. The WFC’s privacy practices are designed to achieve this.
1. Scope of this Policy
This policy applies to personal data collected through our website and digital platforms. It governs data processing related to all website visitors, regardless of jurisdiction.
2. Data Controller
The WFC is the data controller responsible for processing personal data under this policy. Our headquarters are located in London, United Kingdom.
3. Data Protection Officer
Our Privacy & Data Protection Officer is based in Toronto, Ontario, Canada, and can be contacted at [email protected].
4. What is Personal Information?
Personal information refers to any information about an identifiable individual. This includes information that can distinguish, identify, or contact a person. Exceptions may include business contact information and publicly available information (such as public directory listings), which may not be considered personal information.
Where WFC customers, members, employees, volunteers, or other stakeholders use their home contact information as business contact information, the WFC considers that the contact information provided is business contact information and is not therefore subject to protection as personal information.
5. SAFEGUARDING PERSONAL INFORMATION
The WFC protects the personal information in its custody or control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks. We implement appropriate technical and organizational measures to protect personal data, including encryption, access control, secure hosting, and staff training on data protection practices.
The WFC will take reasonable steps to ensure that a comparable level of personal information protection is implemented by its suppliers and agents who assist in providing products and services to you.
Please note that confidentiality and security are not assured when information is transmitted through e-mail or other electronic communication. We will not be responsible for any loss or damage as a result of a breach of security and/or confidentiality when you transmit information to us by e-mail or other electronic communication or when we transmit such information by such means at your request.
The WFC is open about the policies and procedures it uses to protect your personal information. Information about these policies and procedures will be made available. However, to ensure the integrity of our security procedures and business methods, we do not disclose sensitive information about our policies and procedures.
6. Personal Data We Collect
We may collect personal data including, but not limited to: name, email address, phone number, IP address, browser/device details, cookies, and other tracking data. Personal data may be collected directly from you, or through automated means such as cookies and analytics tools.
7. Legal Basis for Processing
Depending on your location, we process your personal data on the basis of one or more legal grounds:
– Consent (UK GDPR, EU GDPR, LGPD)
– Performance of a contract (UK GDPR, EU GDPR, LGPD)
– Legal obligation (UK GDPR, EU GDPR, LGPD, PIPEDA)
– Legitimate interests (UK GDPR, EU GDPR, LGPD)
– Public interest or regulatory compliance (PIPEDA, CCPA/CPRA)
8. Consent
We will seek your consent when required by law prior to collecting, using, or disclosing your personal data. Consent may be express (written, oral, electronic) or implied through your use of our services. You may withdraw your consent at any time, subject to legal or contractual restrictions. Withdrawal of consent may affect our ability to provide certain services.
An individual’s consent is required for the WFC to collect and/or process personal information when information is collected. Consent can either be express or implied and can provide directly by the individual or by an authorized representative.
We will obtain your express consent to collect, use, and/or disclose personal information, except where we are authorized or required by law to do so without consent. For example, we may collect, use, and/or disclose personal information without your knowledge or consent where:
- the personal information is publicly available from a prescribed source, such as a telephone directory, membership directory, etc.;
- the WFC is collecting or paying a debt;
- it is reasonable to expect that obtaining consent would compromise an investigation or proceeding; or
- the WFC has your implied consent.
Express consent may be provided orally, in writing, electronically, through action (such as when you click submit on an e-newsletter subscription form) or otherwise. By providing personal information to us, you agree that we may collect, use and disclose such personal information as set out in this Privacy Policy and as otherwise permitted or required by law.
Implied consent is consent that can be reasonably be inferred from an individual’s action or inaction.
In certain circumstances personal information can be collected, used or disclosed without knowledge and consent if seeking the consent of the person might defeat the purpose of collecting the information such as in the investigation of a breach of an agreement or a contravention of a federal or provincial law. WFC may from time to time engage outside suppliers, including technology providers.
The WFC will never disclose personal contact information without consent, unless the use or disclosure is authorized or required by law.
You may withdraw consent at any time, subject to legal or contractual restrictions, provided that reasonable notice of withdrawal of consent is given to the WFC. On receipt of notice of withdrawal of consent, we will inform you of the likely consequences of the withdrawal of consent, which may include our inability to provide services for which that information is necessary.
9. Use of Cookies and Similar Technologies
Our website uses cookies, web beacons, pixels, and other tracking technologies for the purposes of authentication, user experience optimization, audience measurement, and targeted advertising. You may opt out or configure cookie preferences via your browser or our website’s cookie settings tool.
We use your IP address to help administer our website. Your IP address is also used to gather broad, aggregated demographic information to help us track website and program performance. When you submit a transaction, we may store your IP address for validation and to protect against fraud. We may use cookies to deliver content specific to your interests, to save your password so you don’t have to re-enter it every time you visit our site, and for other purposes set out below:
Our site uses analytics and marketing cookies from third parties such as Facebook, Google, X (Twitter), Instagram, Bing and LinkedIn. We may update the cookies used from time to time. We may use cookies to remind us who you are and to find your account information in our database when you access a service so you do not need to log in at every visit. This helps us to provide you with service tailored to your specific needs and interests. A cookie may be created when you register for a service. We may use cookies to determine the browser the visitor uses so the site can be designed to work properly with the most common versions of different browsers. Advertisers that place ads with WFC may use cookies. We may use cookies to estimate our audience size. Your browser is given a unique cookie that helps us determine whether yours is a repeat visit or a first visit. We may use cookies, pixels, and other similar technologies to track actions on our website and serve interest-based ads to you.
Visitors that wish to opt-out of cookies should review the help documentation for their web browser software to decline or selectively decline cookies. Learn how you can manage your cookies. Declining cookies may adversely impact website performance.
Please note that our web site may contain links to other sites and advertisements. Our Privacy Policy only applies to information collected by our web site. We are not responsible for the privacy practices and policies of third parties.
10. Google Analytics
We use Google Analytics to gather anonymized data on website usage, traffic sources, and interaction patterns. Google Analytics does not collect personally identifiable information.
We also track the performance of promotional links to our site using Google Analytics. In compliance with the Google Analytics Terms of Service, at no time is personally identifiable information (PII) passed to Google Analytics. Note that Google Analytics stores its data within the United States of America and is subject to US laws. We use this data to understand site performance to serve you better. Those wishing to opt out of Google Analytics data collection should use the Google Analytics Opt-out Browser Add-on.
11. Data Sharing and Third Parties
We do not sell or rent personal data. We may share it with trusted service providers, including IT, analytics, hosting, and legal services, under strict contractual obligations. Data may also be disclosed when required by law or in connection with legal proceedings.
12. International Data Transfers
Personal data may be stored or processed outside your country of residence, including in Canada, the United States, the United Kingdom, and the European Union. When applicable, we implement Standard Contractual Clauses (SCCs), adequacy decisions, or similar safeguards to ensure lawful data transfer.
13. Limits for Using, Disclosing and Retaining Personal Information
Personal data is only used or disclosed for the purposes set out in this policy or as authorized by law. We retain data only as long as necessary to fulfill those purposes or legal obligations. When no longer needed, it is securely deleted or anonymized. We take precautions to prevent unauthorized access during the disposal process.
We will retain personal information only as long as necessary for the fulfillment of the purpose for which it was collected, except with the consent of the person or as required by law. Depending on the circumstances, where personal information has been used to make a decision about a person, WFC will retain, for a period of time that is reasonably sufficient to allow for access by the person, either the actual information or the rationale for making the decision.
We will destroy, erase or make anonymous documents or other records containing personal information as soon as it is reasonable to assume that the original purpose is no longer being served by retention of the information and retention is no longer necessary for legal or business purposes.
We will take due care when destroying personal information so as to prevent unauthorized access to the information.
14. Accuracy
We make reasonable efforts to ensure that personal information is accurate and complete. We encourage users to inform us of any changes or corrections to their personal information to maintain accuracy.
If you demonstrate the inaccuracy or incompleteness of personal information, we will amend the information as required. If appropriate, we will send the amended information to third parties to whom the information has been disclosed.
When a challenge regarding the accuracy of personal information is not resolved to your satisfaction, we will annotate the personal information under our control with a note that the correction was requested but not made.
15. Data Subject Rights
You may have the following rights under applicable laws:
– Right of access
– Right to rectification
– Right to erasure (‘right to be forgotten’)
– Right to data portability
– Right to object or restrict processing
– Right to withdraw consent
– Right to lodge a complaint with a supervisory authority
16. Providing Access
You have a right to access your personal information held by the WFC.
Upon written request and verification of identity, we will provide access to personal data we hold about you, how it is used, and with whom it has been shared. A reasonable fee may be charged to cover administrative costs, and you will be notified in advance. We may require a deposit for all or part of the fee. Requests will be fulfilled within 30 days, or you will be notified if additional time is required.
In some situations, we may not be able to provide access to certain personal information. This may be the case where, for example, disclosure would reveal personal information about another individual, the personal information is protected by solicitor/client privilege, the information was collected for the purposes of an investigation, disclosure of the information would reveal confidential commercial information that, if disclosed, could harm the competitive position of the WFC, or where we exercise our solicitor’s lien against materials in our files in respect of outstanding accounts. The WFC may also be prevented by law from providing access to certain personal information.
Where an access request is refused, we will notify you in writing, document the reasons for refusal and outline further steps which are available to you.
17. Third-Party Links
Our website may include links to third-party websites. This policy does not apply to those websites. We recommend reviewing their privacy policies before sharing personal data.
18. Children’s Privacy
Our services are not directed to children under the age of 16. We do not knowingly collect personal data from minors without verifiable parental consent.
19. Changes to this Policy
We may revise this policy from time to time. Updates will be posted on our website with an updated effective date. Your continued use of our website constitutes your acceptance of the updated policy.
20. ACCOUNT AND DATA DELETION
If you would like for the WFC to delete any of your online accounts associated with your WFC membership and associated data, please contact [email protected].
21. Contact Information
If you have any questions or concerns regarding this policy or your personal data, please contact:
Privacy & Data Protection Officer
5399 Eglinton Avenue West, Suite 116
Toronto, Ontario, Canada M9C 5K6
Email: [email protected]