Similarly, I was with a friend who parked at the far end of a parking lot that had a McDonalds at the other end. When we came back there was a car boot on the car, I wanted to speak with a general manager to confirm they were "Enforcing the parking lot of McD's customers only", they said we could talk with the shift manager (who they may or may not be working with separately). My friend just wanted his car and paid them without checking anything with a credit card - on their phone+square device (or whatever that portable cc reader is). It was sketchy and I hadn't seen them there before. I am not even sure that is legal tbh, but didn't have time to work through it with him/them.