In interacting with you, our customers, we will at times collect and process various categories of your personal data. This is only ever the right bits of your data, the right amount of it and for the right reasons as explained in this notice. We do so in order to provide you with the best possible Lidl experience and we commit to protect your personal data that is collected and processed when interacting with us and always tell you about what is being collected. When you interact with us you should never feel anything less than safe and secure in how your data is handled.
The following data protection information will inform you about the nature and scope of the processing of your personal data by Lidl Great Britain Limited (hereafter referred to as Lidl).
Personal data relates to information that is or can be directly or indirectly attributed to your person. The General Data Protection Regulation (GDPR) serves in particular as the legal foundation for data protection.
Read our Supplier Privacy Notice here.
Data processing by Lidl can essentially be divided into various categories:
- For contract processing purposes all data will be processed that is necessary for the implementation of a contract with Lidl. If external service providers are also involved in the execution of the contract, for instance logistics companies, agencies or service providers, your data will be passed to them to the extent necessary and processed by them for the specific purpose concerned.
- When you access the Lidl website, app and other Lidl platforms, certain information is exchanged between your device and our server. This may also be personal data. Data collected in this way can for instance be used to optimise our website or to display advertising in the browser of your device.
Purpose of data processing / legal basis and recipients / categories of recipients:
Personal information that you provide us with when filling out contact forms, by telephone, by e-mail or via social media is treated confidentially. We use third parties to manage customer enquiries and store associated data. As with all service providers we work with, we only share the information required to provide the service, and they are required to meet our own high standards of security. We use your data solely for the purpose of responding to your customer request. In order to identify you as a customer or to process your request, we may use data that you have provided to us. We collect more than one means of contact to enable us to deal with your query as efficiently as possible. This is done on the basis of legitimate business interests to ensure we can provide prompt query resolution, provide store/product information, handle comments/complaints and respond to product quality concerns in the most efficient way possible to maintain customer satisfaction as a cornerstone of our business.
Calls may be recorded for quality and training purposes. Calls are recorded at random and stored for up to 28 days on a secure password protected system only accessible by dedicated users and are used for training matters or when requested by government authorities. Where you may not wish for a call recording, you are welcome to utilise one of the other channels on offer to get in touch with us (in writing), alternatively notify a customer service agent in our call centre who can then call you back.
By interacting with you and fielding your customer query we may collect and process the following information depending on the category of your query (availability, stores, quality, suggestions etc.) and the information you provide to us:
• Personal details
• Email address
• Residential address
• Voice recordings of telephonic conversations held with customer service staff
Further information (till receipts, local store and shopping habits etc.) may be gathered to further evidence or enhance your query. You may provide further details relating to your person that were not prompted but this would not be processed unless relevant to the query at hand.
It may be necessary for us to forward extracts of your request within our business or to our business partners (e.g. suppliers for product-specific enquiries or our Quality Assurance department to investigate product concerns) in order to process your request. In these cases, however, the request will be anonymised beforehand, so that the third party cannot make any connection to you. If, in individual cases, the disclosure of your personal information should be required, we will inform you about this in advance and obtain your consent.
Storage duration / criteria for specifying the storage duration:
Customer service cases are classified according to a predefined retention schedule based on what is deemed necessary for each category of query.
These retention periods allow us to further support you with your query, for a limited period, after your case is closed. In other instances, there may be required legal reasons for retention, in which case we would not store data for longer than the statutory retention requirements call for.
As a general rule, where voice recordings have been made, they will be kept for up to 28 days before being deleted.
If you raise a query through enforcing your data subject rights (as outlined in point 16 of this notice) then the response to your request will be stored for a period of 3 years. The period begins with the final reply to you.
Should any excessive or irrelevant information be received by customer services (e.g. job applications), it will be deleted upon receipt and where possible the customer will be redirected to the correct avenue to handle such a query.
Data protection policy for our text- and voice-based communications platform (LiA):
This policy is intended to provide you with an overview of how we process your personal data when you use Lidl's text- and voice-based communications platform ("Lidl Assistant" or "LiA") on your device. LiA can assist you directly with a variety of queries. We will tell you what data we collect from you and how we use it. This data protection policy relates exclusively to the processing and analysis of data collected in connection with the use of LiA and the available functions by Lidl Great Britain Limited (hereafter referred to as Lidl). We have no influence on what or how data is processed in relation to the devices used.
1. What data do we process?
Interactions with LiA take place on an intelligent customer assistant platform with the assistance of data loss prevention and natural language processing services.
The data processed by us includes in particular:
• Data stored by the server when you use LiA (incl. date and duration of session, data on device used, such as an anonymised user ID for the communications channel);
• The written representation of statements spoken by you using LiA, whereby personal data provided by yourself is immediately anonymised. The resulting anonymised text is then processed to answer your enquiry and is further processed by tracking tools (Chatbase and Adobe Analytics) in anonymised form in order to improve the quality of services offered.
This data is necessary to enable you to actively use LiA.
2. Are you required to provide data?
The provision of data is voluntary. Data must be processed in order to enable LiA to function fully. If you do not authorise us to use your data, the service offered may not be fully functional.
3. For what purposes do we process your data and what is the legal basis for doing so?
3.1. LiA
Processing your queries submitted to LiA (see Section 1) The legal basis for the processing described above is our legitimate interest in improving customer communications.
3.2. Tailoring LiA to customer needs
We analyse the way you use LiA in order to improve processes and rectify any errors. In particular, we intend to make LiA more user-friendly. For instance, stored data can help us to further improve voice recognition and expand LiA's functionality.The data will be used exclusively in anonymised form. It is not possible for Lidl to identify you personally when processing this data.
The legal basis for the processing described above is our legitimate interest in analysing and improving LiA’s design.
3.3. Web server logs
When you use LiA, as a rule we process the date and duration of your visit.
The legal basis for the processing described above is our legitimate interest in guaranteeing the security of the IT systems used here.
4. Who can access your data and on what grounds?
Within Lidl, only those persons who need to access your anonymised data in order to perform their duties have access to that data. Externally, Lidl's service providers who assist us in performing our duties are granted access to your anonymised data. These service providers fall into the following categories:
• Hosting service providers for the purpose of operating our servers
• Development service providers for the purpose of programming, developing, maintaining and providing support for software applications
The service providers we engage are subject to strict duties of confidentiality. They are granted access to your data only to the extent it is necessary to perform their duties and only for the time required to do so. The data may not be reproduced or transmitted to third parties.
5. For how long will the data be stored?
We will generally store your data only for as long as we require it to carry out the required processing tasks. For instance, any data processed to resolve your enquiry is only processed until your enquiry is answered. The content of your enquiry will be retained only in anonymised form for the purpose of improving the service.
For further information including on your subject rights and who to contact in case of questions or complaints please consult our customer privacy notice under www.lidl.co.uk/privacynotice.
Purpose of data processing / legal basis:
CCTV recording is active in most Lidl stores. Such recordings are captured and processed in the legitimate business interests of;
• The safety and security of our customers
• The safety and security of our staff
• The safety and security of our premises and property
• The protection against, detection of and evidencing of criminal activities and
• The reduction of company losses and inventory discrepancies
In so far as a particular premises licence requires such CCTV, then the requirements of such recordings are performed under the legal basis of the licence requirements.
Recipients or categories of recipients:
CCTV footage of customers is recorded by cameras as laid out in our internal CCTV policy and camera layout procedures. The physical technological infrastructure and recordings are stored and backed-up internally.
As a general rule we will not disclose this data to third parties unless required to be provided to legal authorities when we have a statutory obligation to provide such recordings. Recordings may at times be used in evidencing legal/ongoing disputes where all requirements for the access and storage of such data have been met as laid out in our internal investigation procedures.
Storage duration / criteria for specifying the storage duration:
CCTV footage is kept for a period of up to 28 days from the time of recording unless specified separately under licence requirements. As so far as there is a potential/ongoing claim then footage may be retained for a period of up to 3 years or until the claim is finalised. Where there has been access requests successfully provided to recipients then still images shall be securely filed to evidence further correspondence on such footage for a period of 3 years.
Purpose of data processing / legal basis:
You have the possibility to participate in various competitions on our website, My Lidl Community, at Lidl events, from our newsletter or via the Lidl App. If not otherwise specified in special data protection principles at the point of entering the respective competition, or you have not given us further explicit consent, the personal data forwarded by you to us within the scope of participation in the competition will be used exclusively for processing the competition (e.g. identifying the winner, informing the winners, despatching the prize). The legal basis for the data processing within the scope of competitions is principally for the fulfilment of the competition contract as set out in the terms and conditions of the respective contract. In the event of the submission of a declaration of consent within the scope of a competition, then the legal basis for the data processing will be based on such consent. You have the possibility to revoke this consent at any time. In some cases, further details will be provided in the specific data protection information at the point of consent of the particular competition.
The name and county of major prize-winners will either be published or made available on request. For this reason a full name of the winner will be required.
Recipients or categories of recipients:
Data will only be forwarded to third parties if this is necessary for processing the competition (e.g. despatching the prize via a logistics company). We categorically exclude any further dissemination of this data to third parties.
Storage duration / criteria for specifying the storage duration:
After six months following the end of the competition and announcement of the winners, the personal data of the participants will be deleted. In the case of material prizes, the data of the winners will be kept for the duration of the statutory warranty claims, in order to arrange for repair or replacement in the case of a defect.
Purpose of data processing / legal basis:
On our website, on the Lidl Community page, through the Lidl app, at the point of certain competitions and through dedicated event communications we offer you the possibility to register for our newsletter. If you have consented to receive our newsletter, we will use your e-mail address and possibly your name in order to send you information about products, special offers, competitions and news, photography as well as for customer satisfaction surveys. We will store and process this data for the purpose of sending the newsletter until such time as you request for this to not be the case.
The content of the newsletter includes promotions (offers, discount promotions, competitions, etc.) as well as goods and services of the Lidl stores. With your consent we use email tracking technology (pixels) to collect data such as newsletter opens and click-throughs in order to create personalised usage profiles. This information is assigned to your email address in order to ensure the offers you receive are as relevant as possible to your interests. You may revoke your consent at any time by clicking on the unsubscribe link at the bottom of our newsletter.
The legal basis for data processing within the scope of the distribution of newsletters is your consent.
To ensure that no errors occur when entering your e-mail address, we use the so-called double opt-in procedure: After you have entered your e-mail address in the log-in field, we will send you a confirmation link. Only when you click this confirmation link will your e-mail address be added to our distribution list.
You may revoke your consent to the receipt of the newsletter at any time in the future, e.g. by unsubscribing from the newsletter on our website. You can find the link to unsubscribe at the end of each newsletter. When you revoke your consent all the collected user data will be deleted.
Recipients or categories of recipients:
We use a third party email provider to send our newsletter and store our email database. As with all service providers we work with, we only share the information required to provide the service, and they are required to meet our own high standards of security. They are under a contractual obligation in accordance with Article 28 of GDPR. We categorically exclude any further dissemination of this data to third parties.
Storage duration / criteria for specifying the storage duration:
If you revoke your consent to receipt of the Lidl newsletter, your data will be deleted from the corresponding (e-mail) distribution lists.
Purpose of data processing / legal basis:
In the process of planning for new Lidl stores we may undertake certain consultations with local residents and customers in prospective areas (within a defined radius) to open conversations, work with local councils and insure greater information and transparency preventing any objections at the submissions stage. This serves at the legitimate business interest in hosting meetings or interacting with said individuals. This is performed via public consultation/ town halls with voluntary attendance. Where your data will be processed for reasons other than stated here, your explicit consent will be required and details of the processing activities will be provided at the point of collecting such data.
Recipients or categories of recipients:
The personal details and address along with site specific personal information of chosen individuals is logged on a register for internal record keeping purposes only.
Storage duration / criteria for specifying the storage duration:
Any handwritten information would be captured in a digital format and stored securely and disposed of once the store is built or when the specific requirements for gathering such information have been fulfilled (extension proposals, car park sizes etc.)
Purpose of data processing / legal basis:
For those stores with dedicated car parks, we may use an ANPR car park management system to collect and process certain data. The data collected includes still images of the vehicle, Vehicle Registration Number, date, time and location, in-line with the legitimate business interest of the efficient running of our car parks.
The ANPR cameras situated in any of our car parks collect the above data for every vehicle entering and exiting the car park.
Stores operating with Customer Only restrictions capture the vehicle registration number entered by a customer at the terminal after completing their shop with us.
The data collected can only be accessed, retrieved and deleted exclusively by our contracted ANPR car park management service provider, Athena ANPR Limited for the purpose of operating and managing our car parks.
The data collected is not transferred outside of the EEA.
Storage duration / criteria for specifying the storage duration:
Data captured by the ANPR cameras and terminals is securely stored on the ANPR backend system until the data is securely retrieved and remains on the system for no longer than 48 hours.
Data processed by the Car Park Management companies is stored securely in accordance with legal, DVLA and Parking Code of Practice guidelines.
Recipients or categories of recipients:
Contracted Car Park Management Provider
If a vehicle is identified as having overstayed the respective duration allowed, then our car park management provider will make an application to the DVLA for name and address of the registered keeper, in order to issue a parking charge notice. At no time is information obtained by the ANPR car park management service provider (in the course of the process of administering the incurred parking charge) shared with Lidl.
Government Law Enforcement Agencies
Government Law Enforcement Agencies e.g. Police, are entitled to request information captured by the ANPR system to enable support of criminal investigations.
Further details of the car park management can be found on the signage on-site. In some cases particular sites may have additional service providers managing the car parks.
At the point at which the service providers gather and process further information they would do so in accordance to their respective privacy notices.
Two of our main service providers and the links to their respective privacy notices can be found below:
- Athena ANPR Ltd.
- Euro Car Parks
Further details of the car park management can be found on the signage on-site. In some cases particular sites may have additional service providers managing the car parks.
Purpose of data processing / legal basis:
On our website, newsletter, Lidl App and various other platforms you have the option to voluntarily participate in online feedback surveys. This is based on the business interest of improving the Lidl website experience, customer offering and online services. The data processed would include your age range, gender, location and opinions or additional information provided freely by yourself in free text fields. The information gathered will not be personally identifiable as it will only be used for analytical metrics.
Should any personal data be provided in free text fields by yourself, this will not be processed/stored in line with the purposes of the surveys.
Recipients or categories of recipients:
We contract with third party service providers who process the information captured in surveys on our behalf in order to provide us with relevant metrics and statistics. This is only ever done in an anonymised format. As with all service providers we work with, we only share the information required to provide the service, and they are required to meet our own high standards of security.
Have Your Say – Customer Feedback Survey and Free Prize Draw
Data collection and processing.
This section informs you about the type and scope of processing of your personal data on www.lidl.co.uk/haveyoursay. Personal data is information that directly or indirectly relates to you as an individual. The Data Protection Act 2018 and the General Data Protection Regulation (GDPR) serve in particular as the legal grounds of data protection.
1. Accessing the website
Further information about how we use your data in relation to merely accessing the website can be found in section 9 of our Customer Privacy Notice
2. Providing Feedback on your store experience (“Have Your Say”)
Purposes of data processing / legal bases:
When you participate in one of our surveys, this happens on a purely voluntary basis. Whilst we ask for certain personal data from you [to allow us to analyse the feedback received through the ‘have your say’ survey in relation to these indicators], it will not allow us to identify you as an individual. Any information you do choose to provide also will be considered given voluntarily.
When accessing our website, the browser used on your end device will – automatically and without any action on your part store the following data in the course of the survey in so-called cookies (see section 15 of our Customer Privacy Notice):
to our website server and be stored temporarily in what is known as a log-file for the following purposes:
We use your information as part of the survey and the above data dedicated only to conduct the survey/to be able to evaluate and rule out that multiple and duplicated in the survey are not included in the evaluation of our store. The legal basis for the processing the data is our legitimate interest in accordance with GDPR.
Recipients / categories of recipients:
We retain service providers, which are specialised in customer surveys, to provide our customer surveys. They process your data on our behalf as processors. Each processor has been carefully selected and is bound by contract in accordance with the GDPR. All of the companies listed as service providers in our cookie list act as processors on our behalf.
Storage period / criteria for determining the storage period:
The Data stored as log files using cookies will be deleted after a maximum of 7 days. For a full list of cookies used in the Have your Say Survey see below:
Category | Name | Provider | Type | Purpose | Expiry |
Statistics | Session | lidl.mcxplatform.de | Session | Cookie is used to identify if the browser has cookies enabled or disabled | When the browser is closed. |
Statistics | mcxSurveyFingerprintDaily | lidl.mcxplatform.de | HTTP | Cookie is added to track the number of times the survey is accessed on that machine within one day. | End of the day the survey is opened (time dependent on browser time 11:59:59pm) |
Statistics | mcxSurveyFingerprint | lidl.mcxplatform.de | HTTP | Cookie is added to track the number of times the survey is accessed on that machine within seven days. | Seven days after the survey is opened (time dependent on the browser time 11:59:59pm) |
Necessary | McxAuth.ProdDe | mcxplatform.de | Session | This is a CrossDomain cookie used by MaritzCX to allow authenticated users to pick up their survey after having closed it. | When the browser is closed. |
Statistics | startTime | lidl.mcxplatform.de | Session | Cookie is added to calculate the time taken to get from the start to the finish of the survey. | When the browser is closed. |
3. Purpose of the Customer experience survey
The results of our surveys are generally used purely for internal evaluations so that we can improve your shopping experience at our stores.
Your information in the context of the survey will only be saved anonymously and is stored for 12 months. Thereafter, all personal data and the date of purchase are aggregated to the beginning of the respective month in which the survey is conducted. This is to ensure that the survey data cannot be tied to any specific date/time or person.
4. Providing further feedback to our customer service
If you wish to share any more detailed feedback in relation to your shopping experience with us, you are of course welcome to get in touch with our friendly customer service team. In this case your personal data will be processed in line with the relevant section within the Customer Privacy Notice on Contacting Customer Services.
5. Have Your Say Free Prize Draw
All participants in our Have Your Say feedback survey are welcome to participate in our Have Your Say Free Prize Draw.
Purposes of data processing / legal bases:
The personal data (title, name and email address) required as part of your participation is used exclusively for the purpose of carrying out the prize draw (e.g. determination and notification of winners, sending the prize and subsequent public congratulations to our winners and engagement with the public). The legal basis for processing your data is our legitimate interests in the above.
Recipients / categories of recipients:
If you are a winner, your data will be passed on to third parties if and to the extent that this is necessary for the handling of the prize competition (e.g. sending the prize via a logistics company). Furthermore, the first name and county of the winners will be published in advertising material to publicly congratulate our winners and engage with the public. Please see the Prize Draw terms and conditions for more information. If you wish to object to your first name and county being published or wish to reduce the data published, please make this known to Lidl at the point of claiming your prize.
Storage period / criteria for determining the storage period:
After the conclusion of the respective prize draw and the announcement of the winners, the personal data of the respective participants will be deleted. Please be aware that once published it is out-with our ability to remove the first name and county of the winners.
6. Registration for the newsletter of Lidl GB
When submitting your data to participate in the Have Your Say Prize Draw, you can also additionally optionally subscribe to the Lidl GB newsletter. You can find more information on how we use your data in the context of a newsletter subscription in point (see section 5 in our Customer Privacy Notice.)
Further information about your data subject rights and our contact data can be found in sections 17.-19. Of our Customer Privacy Notice
Purpose of data processing / legal basis:
When you access our website, the browser used on your terminal device will, automatically and without any action on your part, send
• the IP address of the requesting web-enabled device,
• the date and time of access,
• the name and URL of the requested file,
• the website/ application from which the access was made (referrer URL),
• the browser you are using and possibly the operating system of your web-enabled computer as well as the name of your access provider
to our website server where they are temporarily stored in a so-called log file for the following purposes:
• ensuring a smooth establishment of the connection;
• ensuring convenient use of our website / application;
• evaluation of system security and stability.
If you have consented to so-called geo-localisation in your browser or in the operating system or other settings of your device, we will use this function in order to be able to offer you individual services related to your current location (e.g. the location of the nearest store). When we process your location data in this way, it is processed exclusively for this function.
The legal basis for the processing of the IP address is for the legitimate interests as explained in the above-listed purposes of data processing.
Recipients or categories of recipients:
We categorically exclude the dissemination of this data to third parties.
Storage duration / criteria for specifying the storage duration:
The data is stored for the duration of navigation on our website and automatically deleted thereafter. After your website session ends, the geo-localisation data for the purposes of store locations is stored until your browser settings are reset/forgotten.
The Lidl website and other online/mobile sites may use Social Media plug-ins for the social networks;
- Facebook (Facebook Inc., 1601 South California Avenue, Palo Alto, CA 94304, USA)
- Twitter (Twitter, Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA)
- YouTube (YouTube, LLC 901 Cherry Ave., 94066 San Bruno, CA, USA, a subsidiary of Google Inc., Amphitheatre Parkway, Mountain View, CA 94043, USA)
- Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, California 94025, USA, a subsidiary of Facebook Inc., 1601 South California Avenue, Palo Alto, CA 94304, USA)
- LinkedIn (LinkedIn Ireland, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland)
Social Media plug-ins are social network programs that are embedded on other companies’ websites. Embedding a Social Media plug-in causes personal and person-related data to be transmitted to the provider of the social media plug-in. Furthermore, if you are also logged on to a social network, an activated social media plug-in enables your activities to be assigned to your profile.
For data protection reasons, we have decided to initially block the social media plug-ins that are embedded on our website.
We do, however, offer you the possibility of using social media plug-ins if you so desire.
The plug-in is only activated by you clicking on the desired plug-in symbol, which we have pre-connected.
Please note that, when the plug-in you have selected is activated, this results in personal data being transmitted to the respective provider of the social media service.
The plug-in you have activated immediately sets up via your browser a connection to the server of the social media provider you have selected.
We would expressly point out that we have no influence on the scope, type and purpose of the processing of your personal and person-related data by the provider of the social media service and can inform you only according to our level of knowledge at this point.
The personal data collected and processed by the social media providers includes:
• Your IP address
• The address of the website on which the activated social plug-in is located,
• Information about the browser used and the operating system you use,
The date and time our website was accessed or the social media plug-in was activated, respectively
The above-mentioned data is transmitted and stored when the plug-in is activated irrespective of whether you are a Member of the corresponding social media provider.
In addition we would refer you at this point explicitly to the social media provider’s privacy policy.
If at the time of the interaction you are also logged on to a social media provider, such as Facebook, it is capable of learning your user name or, if stored, your real name, and assigning the information underlying the interaction to your profile correspondingly.
The above-mentioned data also makes it possible for the providers of the corresponding social media services to create pseudonymised, and potentially also individualised, usage profiles for their own purposes.
Where there is interaction with the activated plug-in (e.g. Facebook “likes”), the social media provider may possibly cause a cookie to be stored on your PC or device, which also makes it possible to identify your person or your profile.
If the plug-in is activated, your IP address is stored and a cookie saved irrespective of whether you are Member of one of the social media providers.
We would expressly point out that the duration of storage of such cookies is not known to us and we have no influence over it.
In the case of non-members, a usage profile might subsequently be created by any stored cookie, when you log on to a social media provider in the future.
Note:
Please note that when a social media plug-in is activated, your personal data can also be stored, processed and used in countries outside the European Union and thus possibly in countries that do not have an adequate and appropriate level of data protection corresponding to that in the European Union.
You can prevent/delete cookies for our website to prevent the above activities from happening, though it may affect your user experience.
Purposes of data processing / legal basis:
In addition to the information we have directly shared with you through social networks, we also use the option of “social listening”in order to get an idea of perceptions of our products and services and to identify any potential for improvement. Contributions made public by you on online platforms (Twitter, Facebook, LinkedIn etc.) are reviewed and evaluated according to a search request (for example in relation to a new product line). Only contributions that have been made publicly available will be viewed here.
The extent of the data processed is primarily determined by the nature and content of the respective article; such as e.g. a posting in text form or an uploaded image file will be affected. In individual cases, the respective user ID used may be relevant, if Lidl would like to offer help with any problems. We also receive information from the respective platform operators on the scope of the respective contributions.
The legal basis for the processing of personal data in the context of social listening is our legitimate interest in being able to identify in publicly made comments any deficiencies in our products and services and to react to them in an appropriate manner.
Recipients:
In the process of social listening personal data is also processed on our behalf by Processors in the Marketing Sector. These are carefully selected, audited by us and are contractually obliged in accordance with Article 28 GDPR. Our Data Processors may also use severs located in Canada to process personal data.
Storage duration / criteria for determining the storage duration:
The relevant personal data is not permanently stored by Lidl, but only viewed and analysed to understand where we can potentially take action and do better.
On our website, we use so-called cookies on the basis of legitimate business interest in optimising our website offering. Responsible entities for and purposes of data processing / legal bases:
We, Lidl Great Britain Limited, 19 Worple Road, Wimbledon SW19 4JS, are the controller for data processing activities in the context of the use of cookies and other similar techniques to process usage data on all (sub-) domains under www.lidl.co.uk.
Cookies are small text files that are placed on your device (laptop, tablet, smartphone or similar) when you visit our websites. Cookies do not cause any damage to your device, do not contain viruses, trojans or other types of malware. In the cookie, information is stored which is related to the specific device you use. This does not mean though, that we are directly informed about your identity.
The use of cookies and other technologies to process usage data serves the following purposes, depending on the category of the cookie or other technique:
You can find an outline of information on the cookies and other techniques used, including the respective processing purpose, the storage period and any third-party provider involved, here.
Within the scope of the use of cookies and similar technologies to process usage data, depending on the purpose, in particular the following categories of personal data are processed:
Technically necessary:
Convenience:
Statistics:
Marketing:
Pseudonymized user profiles with information about the use of our website. These include in particular:
• IP address,
• Individual user ID,
• Potential product interest,
• Triggered events on the website (browsing patterns).
• The IP addresses are anonymized on a regular basis, so that it generally cannot be traced back to your person.
The legal basis for the use of convenience, statistical and marketing cookies (and similar techniques) is your consent. The legal basis for the use of technically necessary cookies (and similar techniques) is to provide our services in the course of initiation or performance of the contract.
On our websites we also regularly integrate content from partner companies. Further information on these partner companies can be found in section 20 of this data protection notice. Within the scope of the integrated contents, our partners may use their own cookies on their own responsibility and, where necessary, obtain consent. Notwithstanding the fact that these cookies are also included in the above-mentioned outline of information for technical reasons, we have no access to these cookies and are not (jointly) responsible for the data processing activities. You can find further information on this in the privacy policy of these partners here in section 20.
Recipients/ Categories of recipients:
Within the scope of data processing by means of cookies and similar technologies, we use specialised service providers from the online marketing sector. These service providers process your data on our behalf as processors and are carefully selected and contractually obliged in accordance with Article 28 GDPR. All the companies listed as providers in our cookie notice are acting for us as processors, unless they are named as a (joint) controller at the beginning of this paragraph.
As part of our cooperation with Google LLC and Facebook Ireland Limited, the above-mentioned personal data is usually also processed on servers in the USA for statistical and marketing purposes.
To the extent covered by your respective consent, your data will also be collected as described above by Lidl Stiftung & Co. KG as separate or joint controller.
Storage period/ Criteria to determine the storage period:
You can find the storage period for cookies in our cookie regulations. If You can find the storage period for cookies in our cookie notice If "persistent" is stated in the "expiration" column, the cookie is stored permanently until the corresponding consent is revoked.
D. Implementation: Cookie Notice
Cookie Notice
For details of our cookies and when they were last updated click here.
For more information on cookies in general or on instructions on how to stop cookies being installed on your browser, please refer to various specific websites on the internet, such as AboutCookies.
While most of the cookies we use are implemented by default, you can set your browser to not store any cookies and to delete all existing cookies by adjusting your browser settings. If you are using any of the below browsers, you may click the below links to find out how to deactivate the use of cookies:
Google Chrome browser
Microsoft Internet Explorer browser
Mozilla Firefox browser
Apple Safari browser
Opera Web browser
Should you use another internet browser, please check the instruction on your help function on how to disable and delete cookies.
Hint: Blocking cookies might prevent some pages from displaying correctly.
Click here to see a breakdown of cookies used on our site.
15.2 Google Analytics
For the purposes of demand-oriented design and ongoing optimisation of our websites, we use Google Analytics, a web analytics service provided by Google, Inc. ("Google") on the basis of our legitimate interest as follows. Pseudonymised user profiles are created and cookies are used. In the process, the cookie generates the following information about your use of this website:
• Browser type and version,
• Operating system used,
• Referrer URL (the previously visited website),
• Host name of the accessing computer (IP address),
• Time of server request.
The information is used to evaluate the use of our websites, to compile reports about website activities and to perform further services connected with the website usage and internet usage for the purposes of market research and the demand-oriented design of these websites. The IP addresses are anonymised, so that attribution is not possible (so-called IP masking).
You may prevent the installation of cookies by selecting the appropriate settings on your browser. However, please be advised that if you opt out of using cookies, you may not be able to fully use all the features of this website. Furthermore, you can prevent the collection of data generated by the cookie and related to the usage of the website (incl. your IP address) and the processing of the data by Google by downloading and installing this browser add-on. As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent collection of information by Google Analytics by clicking on this link. This sets an opt-out cookie which prevents any future collection of your data when visiting this website. The opt-out cookie applies only in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the ‘opt-out’ to cookies again. Further information on data protection in the context of Google Analytics can be found on the Google Analytics website.
Lidl also uses third party vendor re-marketing tracking cookies, including the Google Adwords tracking cookie. This means we will continue to show ads to you across the internet, specifically on the Google Content Network (CGN). As always, we respect your privacy and are not collecting any identifiable information through the use of Google's or any other third party marketing system.
The third party vendors, including Google, whose services we use will place cookies on web browsers in order to serve ads based on past visits to our website. This allows us to make special offers and continue to market our services to those who have showed interest in our service.
Recipients or categories of recipients:
The cookie-generated data is forwarded to a Google server in the USA and stored there. Google will under no circumstances associate your IP address with other data. Google may also pass this information on to third parties in so far as this is required by law or if third parties process the data on Google's behalf.
Storage duration / criteria for specifying the storage duration:
Once the IP address has been anonymised, a conclusion as to your person is no longer possible. The statistically prepared data will be deleted periodically in Google Analytics. In reports generated on the basis of Google Analytics, there is no longer any reference to individuals.
15.3 Google Marketing Platform
Google Campaign Manager, Display & Video 360, Studio
Purpose of the processing/legal basis:
This website uses the online marketing tools Campaign Manager, Display & Video 360 and Studio, a service of Google as part of the Google Marketing Platform. Campaign Manager uses cookies to target advertising based on what's relevant to a user, optimize advertising campaigns, and to avoid showing ads the user has already seen. Using cookie IDs, a device can be recognized on other web pages and targeted ads displayed there based on previous user activity. The following data in particular is stored in cookies: IP address, the date and time you visit our website, the language used, browser type, and operating system. Campaign Manager cookies may also record whether you perform certain actions on our website and what content you interact with, in order to then be able to show you personalised ads (including cross-domain). In addition, Campaign Manager may use cookie IDs to collect information on so-called website conversions when users interact with ads. This is the case, for example, when a user sees a Campaign Manager ad and later uses the same browser to access the advertiser's website and buy something there. Legal basis for processing your data is legitimate interest . It is in your interest as well as ours not to bother you with ads which do not interest you.
Recipients / categories of recipient:
Based on the marketing tools used, your browser automatically establishes a direct connection with the Google server – including in the U.S. Integration with Campaign Manager means that Google is notified when you access our website or click on one of our ads. Find more information here on the Google Marketing Platform, and on data privacy generally at Google. Alternatively you may visit the Network Advertising Initiative (NAI) website. Google complies with the EU-U.S. Privacy Shield.
Opting out:
There are several ways to opt out from using Campaign Manager and Display & Video 360:
a) by setting your browser software accordingly, in particular by blocking third-party cookies as outlined in section 14.1 of this Privacy Notice, you will not receive any ads from third-party providers;
b) by disabling conversion tracking cookies by setting your browser to block cookies from the www.googleadservices.com domain; this setting will be deleted when you delete your cookies;
c) by disabling interest-based advertising by the providers that are part of the "About Ads" self-regulatory program; this setting will be deleted when you delete your cookies;
d) by permanently disabling the plugin in your Firefox, Internet Explorer or Google Chrome browsers here.
e) You can view, remove, or add the Google categories that this technology can use to display interest-based advertising to you using Google's Ads Preferences Manager. At the link above, you can download and install the browser plugin to disable cookies for ad preferences in order to prevent Google from collecting the data on your use of the web pages that is generated by the cookies.
15.4 Possibility to object / opt-out
You have the possibility to prevent interest-based personalised advertising in general with the aid of the so-called Preference Manager Preference Manager or by clearing cookies in your browser settings.
If we transmit data to recipients in a third country (based outside the European Economic Area), you can find more information on the recipients / categories of recipients in the description of the respective data processing activity. The European Commission certifies that some third countries have a data protection standard that is comparable to the level in the European Economic Area. These are called adequacy decisions. A list of these countries can be found here.
If the data protection standard in a country should not be adequate, we ensure that data protection is guaranteed by other measures, for example binding company regulations, standard contractual clauses of the European Commission for the protection of personal data, certificates, or recognised codes of conduct. Please contact our Data Protection Officer (Section 19) if you would like to find out more information on this.
17.1 Overview
Besides the right to revoke the consent you have given us, you have the following further rights if the respective legal requirements are met:
• The right to request information about your personal data stored with us
• The right to request rectification of incorrect data or completion of incomplete data
• The right to request deletion of your personal data stored with us
• The right to request restriction of processing of your data
• The right to request data portability
• The Right to object to the processing of your personal data
17.2 Right to be informed
You have the right to receive, upon request, information about the personal data stored with us about you, free of charge. This includes in particular:
• the purposes for which the personal data are processed;
• the categories of personal data that are processed;
• the recipients or the categories of recipients to whom the personal data concerned have been disclosed or are still being disclosed;
• the planned duration of storage of the personal data concerning you or, if specific details of this are not possible, criteria for the specification of the retention period;
• the existence of a right of rectification or deletion of personal data concerning you or of a restriction on processing by the data controller or of a right to object to such processing;
• the existence of a right of appeal to a supervisory authority;
• all available information about the origin of the data, if the personal data was not collected from the person concerned;
• the existence of an automated decision-making process, including profiling. In these cases, at the least, receiving meaningful information about the logic involved as well as the scope and desired impact of such processing for the person concerned.
If personal data is transferred to a third country or to an international organisation, you have the right to be informed about the appropriate safe guards in connection with the transfer.
17.3 Right to rectification
You have the right to seek the immediate rectification by us of inaccuracies in your personal data. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data and add newly available supplementary information.
17.4 Right to deletion
You have the right to request from us that personal data concerning yourself is immediately deleted, if one of the following grounds applies:
• the personal data are no longer necessary for the purposes for which they have been collected or have been processed in any other way;
• you revoke your consent, which supported the processing originally, and there is no other legal basis for processing;
• You object to the processing where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• the personal data has been unlawfully processed;
• the deletion of the personal data is necessary for the fulfilment of a legal obligation;
• the personal data has been collected in relation to services offered by information society services as referred to in Article 8 paragraph 1 GDPR
Insofar as we have made the personal data public and are obliged to delete it, we will take appropriate measures taking into account the available technology and the costs of implementation, in order to inform the third parties who are processing your data that you also request from them that they delete all links to the personal data and copies or replications of the personal data.
17.5 Right to restriction of processing
You have the right to request from us a restriction of the processing, if one of the following requirements exist:
• the correctness of the personal data is disputed by you;
• the processing is illegal and you request a restriction of the use of the personal data rather than its deletion;
• the data controller no longer requires the personal data for the purposes of the processing, but the person concerned requires them in order to enforce, exercise or defend legal claims or
• you have raised an objection to the processing, so long as it is not certain whether the legitimate grounds of the data controller outweigh those of the person concerned.
17.6 Right to data portability
You have the right to receive the personal data that concern you, which you have provided to us, in a structured, common and machine-readable format, and you have the right to transfer these data to another data controller without hindrance by us, insofar as
• the processing is based on consent or on a contract and
• the processing takes place with the aid of automated procedures.
When exercising your right to data portability, you have the right to ensure that the personal data is transferred directly by us to another data controller, insofar as this is technically feasible.
17.7 Right to object
In particular instances, you may object to data processing for reasons arising from your particular situation.
The above general right of objection applies to all processing purposes described in these data protection regulations, which are processed on the basis of legitimate interests. Unlike the special right to object towards data processing for advertising purposes, we are only obliged by the GDPR to implement such a general objection, if you give us reasons of paramount importance for this, e.g. a possible risk to life or health. Furthermore, there is the possibility to contact the supervisory authority responsible for Lidl U.K. GmbH and Lidl Great Britain Limited
18.1 Point of contact in case of questionsIn the case of questions on the website, other Lidl platforms and related to marketing information or to exercise your rights with regard to the processing of your data (data protection rights) you can contact customer services:
https://customer-service.lidl.co.uk/SelfServiceUK/s/
0800 977 7766 / 0370 444 1234
18.2 Point of contact in case of questions regarding data protection
If you have further questions regarding the processing of your data, you can contact the company data protection officer on Data.Protection@lidl.co.uk
18.3 Right to complain to the supervisory data protection authority
In addition, you have the right to complain at any time to the responsible supervisory data protection authority. The supervisory authority for data protection in the United Kingdom is the Information Commissioners Office (ICO). Further advice and guidance can be found on their website at www.ico.org.uk or by contacting their helpline on +44 (0)303 123 1113.
Name and contact details of the controller:
Lidl Great Britain Limited
19 Worple Road
Wimbledon
London
SW19 4JS
+44 (0)208 971 1100
Lidl Great Britain Limited (registered company number 02816429) and ICO reference number Z6682144
At Lidl GB we work with contracted and trusted partners both in store, and online as part of our marketing activities. Each of these partners are listed below, with a link to their privacy policy:
NTC
https://www.nct.org.uk/privacy
NTS
https://www.nts.org.uk/privacy-data-protection
Tough Mudder
https://toughmudder.co.uk/privacy-policy-uk
NSPCC
https://www.nspcc.org.uk/cookies-policy
Baby Show
https://www.thebabyshow.co.uk/privacy-policy
Neighbourly
