Data Protection


Thank you for visiting our website. We take the protection of your personal data very seriously and therefore strive not only to provide you with a comprehensive online offering, but also to uphold your rights to self-determination with regard to information. The General Data Protection Regulation (GDPR) serves in particular as the legal basis for this data protection. 


In the context of this website, our data processing may essentially be divided into two categories:

  • Processing messages relating to our property offers and searches: All data required for this purpose will be processed. If external service providers, e.g. an IT service provider, is also involved, your data will be shared with and processed by these organisations for the specified purpose within the necessary scope. 
  • Upon accessing our website, various information will be exchanged between your device and our server. This may also include personal data. The information collected in this manner will be used primarily in order to optimise our website or display advertising in the browser of your device.

Contact form/email correspondence/telephone calls

Purposes of data processing / legal basis:

We will treat any personal data you provide us with when filling in contact forms or contacting us by telephone or email as confidential information. We will use your data only for the purpose of handling your request or enquiry. The legal basis for this data processing is point (f) of Article 6 paragraph 1 GDPR. The legitimate interests that you and we concurrently hold in this data processing stem from the objective of replying to your requests or enquiries, solving any problems that may arise, so that we are able to ensure and improve your customer / user satisfaction when using our website.

Recipients / categories of recipient:

As a rule, we do not share any data with third parties. In exceptional cases, data will be processed by processors working on our behalf. In each case, these processors are selected with great care. They are also audited by us and under contractual obligation to comply with Article 28 GDPR.

Furthermore, it may be necessary that we share excerpts from your enquiries with contract partners (e.g. suppliers when receiving enquiries about specific products) in order to process your enquiry. In these cases, the enquiry will first be anonymised so that the third party will not be able to link it to you. If in an individual case the sharing of your personal data might be necessary, we will inform you of this in advance and obtain your consent.

Duration of storage / criteria for determining duration of storage:

All personal details that you provide us via this website or by email (suggestions, commendations or criticism) will be deleted or anonymised by us at the latest 90 days after the final reply is made. Experience has demonstrated that as a rule, there will be no further queries in response to our replies after 90 days.

Accessing our website

Purposes of data processing / legal basis:

When accessing our website, the following will be automatically transmitted from the browser used on your device without any action on your part:

  • the IP address of the internet-ready device accessing information, 
  • the date and time of access,
  • the name and URL of the retrieved file,
  • the website / application from which the site was accessed (referrer URL),
  • the browser you are using, and if required, the operating system of your end device and the name of your access provider.

This information will be temporarily stored in a log file for the following purposes:

  • ensuring a seamless connection,
  • ensuring the user-friendliness of our website/application, 
  • evaluation of system security and stability. 

The legal basis for the processing of IP addresses is point (f) of Article 6 paragraph 1 GDPR. Our legitimate interest is defined with the data processing purposes listed above.

Recipients / categories of recipient:

As a basic principle, we exclude the sharing of this data with third parties.

Duration of storage / criteria for determining duration of storage:

The data will be stored for a period of 30 days and then automatically deleted.

Cookies – General Information

We use cookies on our website on the basis of point (f) of Article 6 paragraph 1 GDPR. Our interest in optimising our website is therefore deemed legitimate within the meaning of the above-mentioned provision. Cookies are tiny files that are saved on your device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies are not harmful to your device and do not contain any viruses, trojans or other malicious software. The cookie contains information that is acquired in relation to the specific device used. However, that does not mean that we obtain direct knowledge of your identity via the cookie. The use of cookies serves firstly to create a better suited offering for you. For this, we use session cookies to detect that you have visited individual pages of our website or are already logged on your customer account. These will be automatically deleted after you leave our website. In addition, we also use temporary cookies for the purpose of user friendliness. These cookies will be stored on your device for a defined period. If you visit our site again to make use of our services, the fact that you had visited us before and the inputs and settings you had made will be automatically detected, so you will not be required to enter these again. 

If you have a customer account and are logged in, or you have activated the ‘stay signed in’ function, the information stored in the cookies will also be stored in your customer account. 

We also use cookies to capture statistics on the use of our website, to optimise our offering and to insert information tailored to your needs. When you return to our website, these cookies enable us to detect automatically that you had visited us before. These cookies will be automatically deleted after a specified period. Most browsers accept cookies automatically. Nevertheless, you can configure your browser so that no cookies will be stored on your computer, or to display a message every time before a new cookie is saved. However, the complete disabling of cookies may mean that you will not be able to use the full functionality of our website. 

You can find an overview of the cookies that we use, along with additional information (e.g. about retention times) and how to lodge an objection, in our rules for cookies.

Google Analytics 

Purposes of data processing / legal basis:

We employ the web analysis services of Google Inc. (‘Google’) on the basis of point (f) of Article 6 paragraph 1 GDPR for the purposes of demand-driven design and the ongoing optimisation of our websites. Our legitimate interests ensue from the purposes described above. Accordingly, pseudonymous user profiles will be created and cookies used. In doing so, the cookies will generate the following information about your use of the website:

  • Type and version of browser,
  • The operating system used,
  • Referrer URL (the previously visited page),
  • Host name of the computer accessing the site (IP address), 
  • Time of the server query. 

The information will be used to evaluate the use of our websites, to compile reports about our website activities and to leverage the use of the website and services related to internet use, both for the purpose of advancements in market research and for user-oriented design of these internet pages. The IP addresses are anonymised so that attribution will not be possible (so-called IP masking).

You may block the installation of cookies by using the appropriate setting on your browser; however, we advise you that in this case, you may not be able to make use of the full functionality of this website. Furthermore, you may block the recording of data generated by cookies relating to the use of the website (including your IP address) and the processing of this data by Google by downloading and installing this Browser-Add-on. As an alternative to using a browser add-on, and particularly when using browsers on mobile devices, you may also block data capture by Google Analytics by clicking on this Link. A cookie opt-out will be set that will prevent future collection of your data when visiting this website. The cookie opt-out will apply only in this browser and only for our website; it will be stored in your device. If you delete the cookies for this browser, you will have to reset the cookies opt-out. Further information about data protection in relation to Google Analytics is available on the Google Analytics Website.

Recipients / categories of recipient:

The information created by the cookies will be transferred via and stored on a Google server in the USA. Under no circumstances will your IP address be combined by Google with other data. In addition, this information will be shared with third parties only if this is legally required or if the third party processes the data on the basis of a contractual order. 

Duration of storage / criteria for determining duration of storage:

After the IP address is anonymised, it will no longer be possible for the IP address to be traced to you personally. The reports generated on the basis of Google Analytics will thus not include any linkage to personal identity. 


With the exception of the processing described under Google Analytics, we will not share your data with any recipient based outside the European Union or the European Economic Area. The processing described under Google Analytics results in transmission of data to the server operated on our behalf by a tracking and targeting technologies provider. This server is located in the USA. The data transfer is performed according to the principles of the Privacy Shield and on the basis of the standard contractual classes of the EU Commission.



Besides the right to withdraw the consent you give to us, you also have the following additional rights, subject to the statutory requirements that apply in each case: 

  • The right to information about your personal data that we hold under Article 15 GDPR;
  • The right to rectification of inaccurate data or completion of incomplete data under Article 16 GDPR;
  • The right to erase any personal data that we hold on you under Article 17 GDPR;
  • The right to restrict processing of your data under Article 18 GDPR;
  • The right to data portability under Article 20 GDPR;
  • The right to object under Article 21 GDPR.

The right to information under Article 15 GDPR

Under Article 15 paragraph 1 GDPR, you have the right to obtain a copy of all personal data we hold on you upon request and without. This includes specifically:

  • the purpose of processing your personal data;
  • the categories of personal data that are processed;
  • the recipients or categories of recipient to whom the personal data about you has been or will be disclosed;
  • the envisaged duration for which the personal data about you will be stored, or, if specific information about this is not available, the criteria used to determine that the duration of storage;
  • the existence of the right to rectification or deletion of your personal data, the right to restrict processing by the data controller or a right to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the personal data is not collected from the person involved, any available information as to the source of the data;
  • the existence of automated decision-making, including profiling, referred to in Article 22 paragraph 1 and paragraph 4 GDPR and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the person involved.

Where personal data is transferred to a third-party country or an international organisation, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.

Right to rectification under Article 16 GDPR

You have the right to request us to rectify any inaccurate personal data concerning yourself without undue delay. Taking into account the purposes of data processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to deletion under Article 17 GDPR

You have the right to request from us the deletion of personal data concerning yourself without undue delay where one of the following grounds applies:

  • the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  • you withdraw your consent upon which the processing is based according to point (a) of Article 6 paragraph 1, or point (a) of Article 9 paragraph 2 GDPR, and there is no other legal ground for the processing;
  • you object to the processing pursuant to Article 21 paragraph 1 or paragraph 2 GDPR and in the case of Article 21 paragraph 1 GDPR there are no legitimate overriding grounds for processing;
  • the personal data has been processed unlawfully;
  • the personal data has to be erased for compliance with a legal obligation;
  • the personal data has been collected in relation to the offer of information society services referred to in Article 8 paragraph 1 GDPR.

Where we have made the personal data public and are obliged to erase it, we shall take reasonable steps, including technical measures, taking into account the available technology and the cost of implementation, and inform any third parties who are processing your data that you have requested the deletion of any links to, or copy or replication of, this personal data.

Right to restriction of processing under Article 18 GDPR

You have the right to request us to restrict processing of your personal data where one of the following requirements applies:

  • the accuracy of the personal data is contested by you;
  • the processing is unlawful and instead of erasure, you request the restriction of the use of the personal data;
  • the controller no longer needs the personal data for the processing purpose, but data is required by the person involved for the establishment, exercise or defence of legal claims; or
  • you have objected to processing pursuant to Article 21 paragraph 1 GDPR until it has been determined whether the legitimate grounds of the controller override those of the person involved.

Right to data portability under Article 20 GDPR

You have the right to receive any of your personal data that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit this data through ourselves to another controller without hindrance, where:

  • the processing is based on consent pursuant to point (a) of Article 6 paragraph 1 or point (a) of Article 9 paragraph 2 or on a contract pursuant to point (b) of Article 6 paragraph 1 GDPR; and
  • the processing is carried out by automated means.

In exercising your right to data portability, you have the right to have the personal data transmitted directly from us to another controller where technically feasible.

Right to object under Article 21 GDPR

Under the requirements of Article 21 paragraph 1 GDPR, objection may be lodged against the data processing on grounds relating to your particular situation.

The above-mentioned general right to object applies to all purposes of processing described in these data protection provisions where data may be processed on the basis of point (f) of Article 6 (1) GDPR. Other than in the case of the right to object created specifically for data processing for advertising purposes (compare with the above points 9 and 11.6 in particular), under GDPR we are only obligated to act on such general right of objection if you are able to specify a reason of overriding importance for this, e.g. your life or health may be in danger. Furthermore, you may also contact the relevant supervisory authority for Lidl Digital International GmbH & Co. KG or the data protection officer of Lidl Digital International GmbH & Co. KG.


These data protection provisions apply for data processing by Lidl U.K. GmbH and Lidl Great Britain, Limited 19 Worple Road, Wimbledon, London, SW19 4JS, represented by Katharina Landbrecht for the website at The company data protection officer for the controller can be contacted at the above-mentioned address, attn: data protection officer, or at