Findings · 15 of 16
The franchise gap
The brand's privacy policy does not describe the business that holds your data
What it is
In franchised industries the company publishing the privacy policy owns almost none of the locations. The entity that actually scans your ID, stores your card and keeps the access log is an independent small business with its own systems, its own security posture and no obligation you can read.
Why it matters
Searching '<brand> privacy policy' returns the franchisor's document, which describes a company that never touched your data. There is no published document for the property that did. It also fragments accountability after an incident: a breach at one location creates no notification duty at another under the same sign, and the consumer has no way to identify which entity to contact. G6/Motel 6 is the extreme case — individual properties handed guest registries to ICE, producing a $12M Washington State settlement, while the corporate policy said nothing of the kind.
Who holds your data
Companies and rows it touches
Choice Hotels franchises ~7,600 hotels with ~1,700 corporate employees. Wyndham franchises ~9,100 across ~25 brands. Same structure at Ace Hardware (~5,000 member-owned stores), CrossFit affiliates, Gold's Gym, Anytime Fitness, 7-Eleven, Royal Farms and the auto dealerships in the CDK breach. Best Western is a step further — a member cooperative, not a franchisor at all.
Where to look
Hotels & Lodging and Car Rental & Mobility tabs; also Mid-Atlantic Convenience Chains, Gyms, F500 Auto & Dealerships, F500 Wholesalers Remainder