Data Protection

(Version 1.0; dated January 2021)

You Come First

At Lidl, our customers come first! That’s why Lidl is committed to protecting your privacy. At Lidl, we want you to feel comfortable and secure knowing that your personal data is always processed in line with Data Protection requirements This Privacy Policy explains what personal data we collect and how that data is processed.

The following privacy notice informs you about the nature and scope of the processing of your personal data by Lidl GB (hereafter referred to as Lidl).

1. Accessing the website

Purposes of data processing/legal basis

When accessing our website, the following will be automatically transmitted from the browser used on your device without any action on your part:

  • the IP address,
  • the date and time of access,
  • the name and URL of the retrieved file,
  • the website from which you come from when visiting us,
  • the browser you are using and the operating system of your device and
  • the name of your internet provider

This information will be temporarily stored on a log file for the following purposes:

We use this information to ensure a stable connection, the efficient use of our website, and also to evaluate system security and stability. This is necessary and in our legitimate interest.

If you have enabled geolocation services in your browser or other settings, our website may use this function to offer location specific services such as our store locator function. Your location data will only be used for this function.

Recipients/categories of recipient

Your data will also be processed by our 3rd party Data Processors from the IT hosting sector on our behalf. They are selected with great care and are audited by us and under a contractual obligation.

Retention period/criteria for determining retention period

The data will be stored for a period of seven days and then automatically deleted.

2. Contact form

Purposes of data processing/legal basis

Personal data that you give us when filling out our contact form will of course be treated confidentially. We will use your data only to handling your request or enquiry. This is necessary and in our legitimate interest.

Retention period/criteria for determining retention period:

If our application was successful (or we have successfully appealed a rejected planning decision) and a store will be built in your local area, all data processed as part of the consultation will be retained until 1 month after store opening date.

If Lidl no longer intends to build a store in your local area, any personal data processed during the consultation period will be retained for a maximum of one month following our decision not to appeal the planning decision.

3. Use of cookies and similar techniques to process usage data

Purposes of data processing/legal basis

To make your visit on our website as comfortable and enjoyable as possible, Lidl uses cookies. A cookie is a small text file that is downloaded onto your device e.g. a computer or smartphone when you access a website. It allows our website to recognise user’s device and store some information about the user’s preferences or past actions. Cookies enable your device to access information on our website faster and in a more efficient way.

Cookies do not cause any damage to your device, do not contain viruses, trojans or other types of malware.

We have included below under an overview of all cookies we use, the purpose for which we use them, and how long they are retained. Some of these cookies are designed to make this website available to you and are installed directly on your device without the need for your consent. Other cookies will only be stored once you have given your consent.

  • Technically necessary: These are cookies and similar methods, without which you cannot use our services (e.g. to display our website/functions you have requested correctly, to remember your registration in the login area etc.).
  • Preferences: These technologies allow us to take into account your assumed preference. For example, it also helps us to avoid showing you products that may not be available in your area or remember your preferred language. 
  • Statistics: These technologies enable us to compile anonymous statistics on the use of our services in order to tailor them to your needs. This enables us to determine, for instance, how we can adapt our websites even better to the habits of the users.
  • Marketing: This enables us to display advertising content that is suitable for you, based on the analysis of your pattern of use. In this context, your pattern of use can also be tracked via different websites, browsers or terminal devices using a User ID (unique identifier).

You can find information on the cookies and other technologies we use, including the respective processing purpose, the storage period and any third-party provider involved, here.

When using cookies to process usage data, the following types of personal data in particular are processed, depending on the purpose:

Technically necessary:

  • Optimisation of the response times by distributing the traffic on the website to several servers;
  • User input to save the user's consent status for cookies for the current domain (for example, cookie consent).

Preference:

  • User interface customisation settings (for example, active language selection);
  • Storage of the interactions between a user and Bing Maps in order to optimise the map functionality.

Statistics:

  • Pseudonymised usage profiles with information about the use of our website. These include in particular:
    • type and version of browser,
    • the operating system used,
    • referrer URL (the previously visited page),
    • host name of the computer accessing the site (IP address),
    • time of the server query,
    • individual user ID and
    • events triggered on the website (surfing behaviour).
  • The IP address is regularly anonymised so that it cannot be traced back to you personally.

Marketing:

  • Pseudonymised (de-personalised) user profiles with information about the use of our website. These include in particular:
    • IP address,
    • individual user ID,
    • potential product interest,
    • triggered events on the website (browsing patterns)
  • The IP addresses are anonymised on a regular basis, so that it generally cannot be traced back to your person.
  • We only combine the user ID with other data from you e.g. name, email address, etc. with your specific express consent. Based solely on the user ID itself, we cannot draw any conclusions about you. Where appropriate, we share the user ID and the associated usage profiles with third parties via providers of advertising networks.

The legal basis for the use of preference, statistical and marketing (and similar techniques) is your consent. The legal basis for the use of technically necessary cookies (and similar techniques) is the performance of a contract, meaning we process your data to provide our services in the course of initiation or performance of the contract.

You can revoke / adjust your consent at any time. Simply click here and make your selection.

Recipients/categories of recipient

In the context of data processing, with cookies and similar techniques for processing usage data, we may use specialised service providers. They process your data on our behalf as contract processors, and they are each carefully selected and contractually obliged in accordance with article 28 GDPR. All of the companies listed as providers in our cookie policy act as contract processors for us.

As part of our cooperation with Google LLC, the aforementioned data is usually also processed on servers in the USA for statistical purposes.

Retention period/criteria for determining retention period

The storage period for cookies can be found in our cookie policy. If “persistent” is specified in the “expiration” column, the cookie is stored permanently until the corresponding consent is revoked.

 

4. Bing Maps

We use Bing Maps on this website. This enables us to show you interactive maps directly on the website and allows you to conveniently use the map function, for example to find contact locations in your desired area or to place our stores on the maps.

Bing Maps is used in the interest of an appealing presentation of our online offers and to make it easy to find the locations we have indicated on the website. This represents a legitimate interest within the meaning of article 6 paragraph 1 letter (f) GDPR.

When you visit our website, the provider of Bing Maps, Microsoft Corporation, receives the information that you have accessed the corresponding subpage of our website. In order to use the functions of Bing Maps, it is necessary to process your IP address as part of Internet communication. This is usually processed on a Microsoft server in the USA.

We have no influence on the specific data processing by Bing Maps. For more information on the purpose and scope of data processing by Bing Maps, please refer to the provider's privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy. Address and data protection information of the provider of Bing Maps: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA, https://privacy.microsoft.com/de-de/privacystatement.

5. Transmission to recipients in a third country

If we transmit data to recipients in a third country (located outside the European Economic Area or the UK), you can find this out in the information on the recipients/categories of recipients in the description of the respective data processing. The European Commission certifies that some third countries have a data protection standard that is comparable to the level in the European Economic Area through adequacy resolutions. A list of these countries can be found at http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.html. If there is no comparable data protection standard in a country, we ensure that data protection is adequately guaranteed by other measures. This is possible, for example, through binding company regulations, standard contractual clauses of the European Commission for the protection of personal data, certificates or recognised codes of conduct. Please contact our data protection officer (Section 7) if you would like more information on this.

6. Your rights

Whilst we only process the necessary amount of data, for the necessary length of time, for the agreed purposes whilst ensuring secure storage and management, you reserve your own rights to your personal data.

Overview

You have the following rights if the respective legal requirements are met

  • The right to be informed about the collection and use of your personal data
  • The right to have access to your personal data
  • The right to request rectification of incorrect data or completion of incomplete data
  • The right to request deletion of your personal data stored with us
  • The right to request restriction of processing of your data
  • The right to request data portability
  • The right to object to the processing of your personal data

Right to be informed

You have the right to be informed about the collection and use of your personal data:

  • the purposes for which the personal data are processed;
  • the categories of personal data that are processed;
  • the recipients or categories of recipients of the personal data;
  • the retention periods for the personal data;
  • all available information about the origin of the data, if the personal data was not collected from you;
  • the details of the existence of existence of an automated decision-making process, including profiling;
  • the details of transfer of the personal data to any third countries or international organisations

Right of access

You have the right to receive, upon request, information about the personal data stored with us about you, free of charge, commonly known as ‘data subject access request.’ You have the right to ask for:

  • Confirmation of the data processing activities involving your data;
  • A copy of your personal data; and
  • Information outlined in this Privacy Policy.

Right to rectification

You have the right to seek the immediate rectification by us of inaccuracies in your personal data. Considering the purposes of the processing, you have the right to request the completion of incomplete personal data and add newly available supplementary information.

Right to erasure

You have the right to request from us that personal data concerning yourself is immediately erased if one of the following grounds applies:

  • the personal data is no longer necessary for the purposes for which they have been collected or have been processed in any other way;
  • you withdraw consent and there is no other legal ground for the processing;
  • you object to the processing and there are no overriding legitimate grounds for the processing to continue;
  • the personal data has been unlawfully processed; or
  • the deletion of the personal data is necessary for the fulfilment of a legal obligation;

Where our processing of your data is based on your consent, you have the right to withdraw your consent, but this will not affect the lawfulness of the processing based on your original consent. We will no longer process your data for the purpose you originally agreed to unless we have another legal basis for continuing to process your data, which we will explain to you.

In the event that we have made the personal data public and are obliged to delete it, we will take appropriate measures in so far as possible to ensure this data is removed. This may include us informing the third party processing your data to delete all links to the personal data (copies or replications).

Right to restriction of processing

You have the right to request from us a restriction of the processing, if one of the following requirements exist:

  • the correctness of the personal data is disputed by you;
  • the processing is unlawful and you request a restriction of the use of the personal data rather than its deletion;
  • we no longer require your personal data for the purposes of the processing, but you require it in order to enforce, exercise or defend legal claims; or
  • you have raised an objection to the processing, so long as it is not certain whether the legitimate grounds of Lidl outweigh those of yourself

Right to data portability

You have the right to receive the personal data that concerns you, which you have provided to us, in a structured, common and machine-readable format, and you have the right to transfer this data to another data controller without hindrance by us, considering:

  • the processing is based on consent or on a contract; and
  • the processing takes place with the aid of automated procedures

When exercising your right to data portability, you have the right to ensure that the personal data is transferred directly by us to another data controller, where this is technically feasible.

Right to object

You have the right to object to the processing of your personal data, for reasons arising from your particular situation.

The above general right of objection applies to all processing purposes described in this privacy notice, which are processed on the basis of legitimate interests. This also applies in relation to data processing for the purpose of direct mail for marketing purposes. If you object to any processing of data, it will be stopped with effect for the future unless we as the controller are able to demonstrate overriding legitimate grounds for further processing that outweigh your interests. 

7. Points of contact

Point of Contact in case of Questions regarding Data Protection

If you have further questions regarding the processing of your data, you can contact the company data protection officer on Data.Protection@lidl.co.uk

The Supervisory Authority

A complaint can be lodged with the supervisory authority for data protection in the United Kingdom which is the Information Commissioners Office (ICO). Further advice and guidance can be found on their website at www.ico.org.uk or by contacting their helpline on 0303 123 1113.

Lidl GB Contact details

Lidl Great Britain Limited
Lidl House
14 Kingston Road
Surbiton
KT5 9NU
+44 (0)204 530 0000

Lidl Great Britain Limited (registered company number 02816429) and ICO reference number Z6682144