Customer Privacy Notice

Please activate Javascript

About us
Customer Privacy Notice

Privacy Notice

CUSTOMER PRIVACY NOTICE

Data protection at Lidl

In interacting with you, our customers, we will at times collect and process various categories of your personal data. This is only ever the right bits of your data, the right amount of it and for the right reasons as explained in this notice. We do so in order to provide you with the best possible Lidl experience and we commit to protect your personal data that is collected and processed when interacting with us and always tell you about what is being collected. When you interact with us you should never feel anything less than safe and secure in how your data is handled.

The following data protection information will inform you about the nature and scope of the processing of your personal data by Lidl Great Britain Limited (hereafter referred to as Lidl).

Personal data relates to information that is or can be directly or indirectly attributed to your person. The General Data Protection Regulation (GDPR) serves in particular as the legal foundation for data protection.

Read our Supplier Privacy Notice here.

Version 25.05.07

Data processing by Lidl can essentially be divided into various categories:

- For contract processing purposes all data will be processed that is necessary for the implementation of a contract with Lidl. If external service providers are also involved in the execution of the contract, for instance logistics companies, agencies or service providers, your data will be passed to them to the extent necessary and processed by them for the specific purpose concerned.

- When you access the Lidl website, app and other Lidl platforms, certain information is exchanged between your device and our server. This may also be personal data. Data collected in this way can for instance be used to optimise our website or to display advertising in the browser of your device.

Purpose of data processing / legal basis and recipients / categories of recipients:
Personal information that you provide us with when filling out contact forms, by telephone, by e-mail or via social media is treated confidentially. We use third parties to manage customer enquiries and store associated data. As with all service providers we work with, we only share the information required to provide the service, and they are required to meet our own high standards of security. We use your data solely for the purpose of responding to your customer request. In order to identify you as a customer or to process your request, we may use data that you have provided to us. We collect more than one means of contact to enable us to deal with your query as efficiently as possible. This is done on the basis of legitimate business interests to ensure we can provide prompt query resolution, provide store/product information, handle comments/complaints and respond to product quality concerns in the most efficient way possible to maintain customer satisfaction as a cornerstone of our business.
Calls may be recorded for quality and training purposes. Calls are recorded at random and stored for 30 days on a secure password protected system only accessible by dedicated users and are used for training matters or when requested by government authorities. Where you may not wish for a call recording, you are welcome to utilise one of the other channels on offer to get in touch with us (in writing), alternatively notify a customer service agent in our call centre who can then call you back.

By interacting with you and fielding your customer query we may collect and process the following information depending on the category of your query (availability, stores, quality, suggestions etc.) and the information you provide to us:

• Personal details
• Email address
• Residential address
• Voice recordings of telephonic conversations held with customer service staff

Further information (till receipts, local store and shopping habits etc.) may be gathered to further evidence or enhance your query. You may provide further details relating to your person that were not prompted but this would not be processed unless relevant to the query at hand.

It may be necessary for us to forward extracts of your request within our business or to our business partners (e.g. suppliers for product-specific enquiries or our Quality Assurance department to investigate product concerns) in order to process your request. In these cases, however, the request will be anonymised beforehand, so that the third party cannot make any connection to you. If, in individual cases, the disclosure of your personal information should be required, we will inform you about this in advance and obtain your consent.

Storage duration / criteria for specifying the storage duration:
Customer service cases are classified according to a predefined retention schedule based on what is deemed necessary for each category of query.

These retention periods allow us to further support you with your query, for a limited period, after your case is closed. In other instances, there may be required legal reasons for retention, in which case we would not store data for longer than the statutory retention requirements call for.

As a general rule, where voice recordings have been made, they will be kept for 30 days before being deleted.

If you raise a query through enforcing your data subject rights (as outlined in point 16 of this notice) then the response to your request will be stored for a period of 3 years. The period begins with the final reply to you.

Should any excessive or irrelevant information be received by customer services (e.g. job applications), it will be deleted upon receipt and where possible the customer will be redirected to the correct avenue to handle such a query.

Purpose of data processing / legal basis:

CCTV recording is active in most Lidl stores. Such recordings are captured and processed in the legitimate business interests of;

• The safety and security of our customers

• The safety and security of our staff

• The safety and security of our premises and property

• The protection against, detection of and evidencing of criminal activities and

• The reduction of company losses and inventory discrepancies

In so far as a particular premises licence requires such CCTV, then the requirements of such recordings are performed under the legal basis of the licence requirements.

Recipients or categories of recipients:

CCTV footage of customers is recorded by cameras as laid out in our internal CCTV policy and camera layout procedures. The physical technological infrastructure and recordings are stored and backed-up internally.

As a general rule we will not disclose this data to third parties unless required to be provided to legal authorities when we have a statutory obligation to provide such recordings. Recordings may at times be used in evidencing legal/ongoing disputes where all requirements for the access and storage of such data have been met as laid out in our internal investigation procedures.

Storage duration / criteria for specifying the storage duration:

CCTV footage is kept for a period of up to 28 days from the time of recording unless specified separately under licence requirements. As so far as there is a potential/ongoing claim then footage may be retained for a period of up to 3 years or until the claim is finalised. Where there has been access requests successfully provided to recipients then still images shall be securely filed to evidence further correspondence on such footage for a period of 3 years.

Purpose of data processing / legal basis:
You have the possibility to participate in various competitions on our website, My Lidl Community, at Lidl events, from our newsletter or via the Lidl App. If not otherwise specified in special data protection principles at the point of entering the respective competition, or you have not given us further explicit consent, the personal data forwarded by you to us within the scope of participation in the competition will be used exclusively for processing the competition (e.g. identifying the winner, informing the winners, despatching the prize). The legal basis for the data processing within the scope of competitions is principally for the fulfilment of the competition contract as set out in the terms and conditions of the respective contract. In the event of the submission of a declaration of consent within the scope of a competition, then the legal basis for the data processing will be based on such consent. You have the possibility to revoke this consent at any time. In some cases, further details will be provided in the specific data protection information at the point of consent of the particular competition.

The name and county of major prize-winners will either be published or made available on request. For this reason a full name of the winner will be required.

Recipients or categories of recipients:
Data will only be forwarded to third parties if this is necessary for processing the competition (e.g. despatching the prize via a logistics company). We categorically exclude any further dissemination of this data to third parties.

Storage duration / criteria for specifying the storage duration:
After six months following the end of the competition and announcement of the winners, the personal data of the participants will be deleted. In the case of material prizes, the data of the winners will be kept for the duration of the statutory warranty claims, in order to arrange for repair or replacement in the case of a defect.

Purpose of data processing / legal basis:
On our website, on the Lidl Community page, through the Lidl app, at the point of certain competitions and through dedicated event communications we offer you the possibility to register for our newsletter. If you have consented to receive our newsletter, we will use your e-mail address and possibly your name in order to send you information about products, special offers, competitions and news, photography as well as for customer satisfaction surveys. We will store and process this data for the purpose of sending the newsletter until such time as you request for this to not be the case.

The content of the newsletter includes promotions (offers, discount promotions, competitions, etc.) as well as goods and services of the Lidl stores. With your consent we use email tracking technology (pixels) to collect data such as newsletter opens and click-throughs in order to create personalised usage profiles. This information is assigned to your email address in order to ensure the offers you receive are as relevant as possible to your interests. You may revoke your consent at any time by clicking on the unsubscribe link at the bottom of our newsletter.

The legal basis for data processing within the scope of the distribution of newsletters is your consent.

To ensure that no errors occur when entering your e-mail address, we use the so-called double opt-in procedure: After you have entered your e-mail address in the log-in field, we will send you a confirmation link. Only when you click this confirmation link will your e-mail address be added to our distribution list.

You may revoke your consent to the receipt of the newsletter at any time in the future, e.g. by unsubscribing from the newsletter on our website. You can find the link to unsubscribe at the end of each newsletter. When you revoke your consent all the collected user data will be deleted.

Recipients or categories of recipients:
We use a third party email provider to send our newsletter and store our email database. As with all service providers we work with, we only share the information required to provide the service, and they are required to meet our own high standards of security. They are under a contractual obligation in accordance with Article 28 of GDPR. We categorically exclude any further dissemination of this data to third parties.

Storage duration / criteria for specifying the storage duration:
If you revoke your consent to receipt of the Lidl newsletter, your data will be deleted from the corresponding (e-mail) distribution lists.

Purpose of data processing / legal basis:
In the process of planning for new Lidl stores we may undertake certain consultations with local residents and customers in prospective areas (within a defined radius) to open conversations, work with local councils and insure greater information and transparency preventing any objections at the submissions stage. This serves at the legitimate business interest in hosting meetings or interacting with said individuals. This is performed via public consultation/ town halls with voluntary attendance. Where your data will be processed for reasons other than stated here, your explicit consent will be required and details of the processing activities will be provided at the point of collecting such data.

Recipients or categories of recipients:
The personal details and address along with site specific personal information of chosen individuals is logged on a register for internal record keeping purposes only.

Storage duration / criteria for specifying the storage duration:
Any handwritten information would be captured in a digital format and stored securely and disposed of once the store is built or when the specific requirements for gathering such information have been fulfilled (extension proposals, car park sizes etc.)

Purpose of data processing / legal basis:
For those stores with dedicated car parks, we may use an ANPR car park management system to collect and process certain data. The data collected includes still images of the vehicle, Vehicle Registration Number, date, time and location, in-line with the legitimate business interest of the efficient running of our car parks.

The ANPR cameras situated in any of our car parks collect the above data for every vehicle entering and exiting the car park.

Stores operating with Customer Only restrictions capture the vehicle registration number entered by a customer at the terminal after completing their shop with us.

The data collected can only be accessed, retrieved and deleted exclusively by our contracted ANPR car park management service provider, Athena ANPR Limited for the purpose of operating and managing our car parks.

The data collected is not transferred outside of the EEA.

Storage duration / criteria for specifying the storage duration:
Data captured by the ANPR cameras and terminals is securely stored on the ANPR backend system until the data is securely retrieved and remains on the system for no longer than 48 hours.

Data processed by the Car Park Management companies is stored securely in accordance with legal, DVLA and Parking Code of Practice guidelines.

Recipients or categories of recipients:
Contracted Car Park Management Provider
If a vehicle is identified as having overstayed the respective duration allowed, then our car park management provider will make an application to the DVLA for name and address of the registered keeper, in order to issue a parking charge notice. At no time is information obtained by the ANPR car park management service provider (in the course of the process of administering the incurred parking charge) shared with Lidl.

Government Law Enforcement Agencies
Government Law Enforcement Agencies e.g. Police, are entitled to request information captured by the ANPR system to enable support of criminal investigations.

Further details of the car park management can be found on the signage on-site. In some cases particular sites may have additional service providers managing the car parks.

At the point at which the service providers gather and process further information they would do so in accordance to their respective privacy notices.

Two of our main service providers and the links to their respective privacy notices can be found below:
- Athena ANPR Ltd.
- Euro Car Parks

Further details of the car park management can be found on the signage on-site. In some cases particular sites may have additional service providers managing the car parks.

Purpose of data processing / legal basis:
On our website, newsletter, Lidl App and various other platforms you have the option to voluntarily participate in online feedback surveys. This is based on the business interest of improving the Lidl website experience, customer offering and online services. The data processed would include your age range, gender, location and opinions or additional information provided freely by yourself in free text fields. The information gathered will not be personally identifiable as it will only be used for analytical metrics.

Should any personal data be provided in free text fields by yourself, this will not be processed/stored in line with the purposes of the surveys.

Recipients or categories of recipients:
We contract with a third party service providers who process the information captured in surveys on our behalf in order to provide us with relevant metrics and statistics. This is only ever done in an anonymised format. As with all service providers we work with, we only share the information required to provide the service, and they are required to meet our own high standards of security.

Purpose of data processing / legal basis:

When you access our website, the browser used on your terminal device will, automatically and without any action on your part, send

• the IP address of the requesting web-enabled device,

• the date and time of access,  

• the name and URL of the requested file,  

• the website/ application from which the access was made (referrer URL),

• the browser you are using and possibly the operating system of your web-enabled computer as well as the name of your access provider

to our website server where they are temporarily stored in a so-called log file for the following purposes:

• ensuring a smooth establishment of the connection;

• ensuring convenient use of our website / application;

• evaluation of system security and stability.

If you have consented to so-called geo-localisation in your browser or in the operating system or other settings of your device, we will use this function in order to be able to offer you individual services related to your current location (e.g. the location of the nearest store). When we process your location data in this way, it is processed exclusively for this function.

The legal basis for the processing of the IP address is for the legitimate interests as explained in the above-listed purposes of data processing.

Recipients or categories of recipients:

We categorically exclude the dissemination of this data to third parties.

Storage duration / criteria for specifying the storage duration:

The data is stored for the duration of navigation on our website and automatically deleted thereafter. After your website session ends, the geo-localisation data for the purposes of store locations is stored until your browser settings are reset/forgotten.

Click here to read the Mini Lidl Privacy Policy.

Click here to read the My Lidl Community Privacy Policy.

Click here to read the Lidl App Privacy Notice .

The Lidl website and other online/mobile sites may use Social Media plug-ins for the social networks;

- Facebook (Facebook Inc., 1601 South California Avenue, Palo Alto, CA 94304, USA)

- Twitter (Twitter, Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA)

- YouTube (YouTube, LLC 901 Cherry Ave., 94066 San Bruno, CA, USA, a subsidiary of Google Inc., Amphitheatre Parkway, Mountain View, CA 94043, USA)

- Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, California 94025, USA, a subsidiary of Facebook Inc., 1601 South California Avenue, Palo Alto, CA 94304, USA)

- LinkedIn (LinkedIn Ireland, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland)

Social Media plug-ins are social network programs that are embedded on other companies’ websites. Embedding a Social Media plug-in causes personal and person-related data to be transmitted to the provider of the social media plug-in. Furthermore, if you are also logged on to a social network, an activated social media plug-in enables your activities to be assigned to your profile.

For data protection reasons, we have decided to initially block the social media plug-ins that are embedded on our website.

We do, however, offer you the possibility of using social media plug-ins if you so desire.

The plug-in is only activated by you clicking on the desired plug-in symbol, which we have pre-connected.

Please note that, when the plug-in you have selected is activated, this results in personal data being transmitted to the respective provider of the social media service.

The plug-in you have activated immediately sets up via your browser a connection to the server of the social media provider you have selected.

We would expressly point out that we have no influence on the scope, type and purpose of the processing of your personal and person-related data by the provider of the social media service and can inform you only according to our level of knowledge at this point.

The personal data collected and processed by the social media providers includes:

• Your IP address

• The address of the website on which the activated social plug-in is located,

• Information about the browser used and the operating system you use,

The date and time our website was accessed or the social media plug-in was activated, respectively

The above-mentioned data is transmitted and stored when the plug-in is activated irrespective of whether you are a Member of the corresponding social media provider.

In addition we would refer you at this point explicitly to the social media provider’s privacy policy.

View Facebook's policy here.

View Twitter's policy here.

View YouTube's policy here.

View Instagram's policy here.

View Linkedin’s policy here.

If at the time of the interaction you are also logged on to a social media provider, such as Facebook, it is capable of learning your user name or, if stored, your real name, and assigning the information underlying the interaction to your profile correspondingly.

The above-mentioned data also makes it possible for the providers of the corresponding social media services to create pseudonymised, and potentially also individualised, usage profiles for their own purposes.

Where there is interaction with the activated plug-in (e.g. Facebook “likes”), the social media provider may possibly cause a cookie to be stored on your PC or device, which also makes it possible to identify your person or your profile.

If the plug-in is activated, your IP address is stored and a cookie saved irrespective of whether you are Member of one of the social media providers.

We would expressly point out that the duration of storage of such cookies is not known to us and we have no influence over it.

In the case of non-members, a usage profile might subsequently be created by any stored cookie, when you log on to a social media provider in the future.

Note:

Please note that when a social media plug-in is activated, your personal data can also be stored, processed and used in countries outside the European Union and thus possibly in countries that do not have an adequate and appropriate level of data protection corresponding to that in the European Union.

You can prevent/delete cookies for our website to prevent the above activities from happening, though it may affect your user experience.

Purposes of data processing / legal basis:

In addition to the information we have directly shared with you through social networks, we also use the option of “social listening”in order to get an idea of perceptions of our products and services and to identify any potential for improvement. Contributions made public by you on online platforms (Twitter, Facebook, LinkedIn etc.) are reviewed and evaluated according to a search request (for example in relation to a new product line). Only contributions that have been made publicly available will be viewed here.

The extent of the data processed is primarily determined by the nature and content of the respective article; such as e.g. a posting in text form or an uploaded image file will be affected. In individual cases, the respective user ID used may be relevant, if Lidl would like to offer help with any problems. We also receive information from the respective platform operators on the scope of the respective contributions.

The legal basis for the processing of personal data in the context of social listening is our legitimate interest in being able to identify in publicly made comments any deficiencies in our products and services and to react to them in an appropriate manner.

Recipients / categories of recipients:

The personal data processed in the context of social listening will not be disclosed to external third parties who are not subject to suitable contractual agreements in line with legal requirements

Storage duration / criteria for determining the storage duration:

The relevant personal data is not permanently stored by Lidl, but only viewed and analysed to understand where we can potentially take action and do better.

15.1 Cookies – General Information

On our website, we use so-called cookies on the basis of legitimate business interest in optimising our website offering. Cookies are small files that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not harm your computer and do not contain viruses, trojans or any other malicious software. Information is stored in the cookie that results in each case in connection with the specific device used. However, this does not mean that we immediately become aware of your identity. The use of cookies serves on the one hand to make the use of our offer more enjoyable for you. Thus, we use so-called session cookies to recognise that you have already visited individual pages of our website. These will be deleted automatically after you leave our website. Furthermore, we also use temporary cookies for the purpose of usability, which are stored on your device for a certain specified period of time. If you visit our website again in order to take advantage of our services, it will automatically detect that you have already paid us a visit and which inputs/settings you have made so that you do not have to perform these actions again.

On the other hand, we use cookies to statistically record the use of our website for the purposes of optimising our offer and to provide information that is specially tailored to you. When you visit our site again, these cookies enable us to automatically recognise that you have already been there. These cookies will each be automatically deleted after a defined period of time. Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or to always show a message before a new cookie is created. The complete deactivation of cookies may however mean that you will not be able to use all the functions of our website.

For more information on cookies or on instructions on how to stop cookies being installed on your browser, please refer to various specific websites on the internet, such as AboutCookies.

While most of the cookies we use are implemented by default, you can set your browser to not store any cookies and to delete all existing cookies by adjusting your browser settings. If you are using any of the below browsers, you may click the below links to find out how to deactivate the use of cookies:
Google Chrome browser
Microsoft Internet Explorer browser
Mozilla Firefox browser
Apple Safari browser
Opera Web browser

Should you use another internet browser, please check the instruction on your help function on how to disable and delete cookies.

Hint: Blocking cookies might prevent some pages from displaying correctly.

Click here to see a breakdown of cookies used on our site .

15.2 Google Analytics

Purpose of data processing / legal basis:

For the purposes of demand-oriented design and ongoing optimisation of our websites, we use Google Analytics, a web analytics service provided by Google, Inc. ("Google") on the basis of our legitimate interest as follows. Pseudonymised user profiles are created and cookies are used. In the process, the cookie generates the following information about your use of this website:

• Browser type and version,

• Operating system used,

• Referrer URL (the previously visited website),

• Host name of the accessing computer (IP address),

• Time of server request.

The information is used to evaluate the use of our websites, to compile reports about website activities and to perform further services connected with the website usage and internet usage for the purposes of market research and the demand-oriented design of these websites. The IP addresses are anonymised, so that attribution is not possible (so-called IP masking).

You may prevent the installation of cookies by selecting the appropriate settings on your browser. However, please be advised that if you opt out of using cookies, you may not be able to fully use all the features of this website. Furthermore, you can prevent the collection of data generated by the cookie and related to the usage of the website (incl. your IP address) and the processing of the data by Google by downloading and installing this browser add-on. As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent collection of information by Google Analytics by clicking on this link. This sets an opt-out cookie which prevents any future collection of your data when visiting this website. The opt-out cookie applies only in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the ‘opt-out’ to cookies again. Further information on data protection in the context of Google Analytics can be found on the Google Analytics website.

Lidl also uses third party vendor re-marketing tracking cookies, including the Google Adwords tracking cookie. This means we will continue to show ads to you across the internet, specifically on the Google Content Network (CGN). As always, we respect your privacy and are not collecting any identifiable information through the use of Google's or any other third party marketing system.

The third party vendors, including Google, whose services we use will place cookies on web browsers in order to serve ads based on past visits to our website. This allows us to make special offers and continue to market our services to those who have showed interest in our service.

Recipients or categories of recipients:

The cookie-generated data is forwarded to a Google server in the USA and stored there. Google will under no circumstances associate your IP address with other data. Google may also pass this information on to third parties in so far as this is required by law or if third parties process the data on Google's behalf.

Storage duration / criteria for specifying the storage duration:

Once the IP address has been anonymised, a conclusion as to your person is no longer possible. The statistically prepared data will be deleted periodically in Google Analytics. In reports generated on the basis of Google Analytics, there is no longer any reference to individuals.

15.3 Google Marketing Platform

Google Campaign Manager, Display & Video 360, Studio

Purpose of the processing/legal basis:
This website uses the online marketing tools Campaign Manager, Display & Video 360 and Studio, a service of Google as part of the Google Marketing Platform. Campaign Manager uses cookies to target advertising based on what's relevant to a user, optimize advertising campaigns, and to avoid showing ads the user has already seen. Using cookie IDs, a device can be recognized on other web pages and targeted ads displayed there based on previous user activity. The following data in particular is stored in cookies: IP address, the date and time you visit our website, the language used, browser type, and operating system. Campaign Manager cookies may also record whether you perform certain actions on our website and what content you interact with, in order to then be able to show you personalised ads (including cross-domain). In addition, Campaign Manager may use cookie IDs to collect information on so-called website conversions when users interact with ads. This is the case, for example, when a user sees a Campaign Manager ad and later uses the same browser to access the advertiser's website and buy something there. Legal basis for processing your data is legitimate interest . It is in your interest as well as ours not to bother you with ads which do not interest you.

Recipients / categories of recipient:
Based on the marketing tools used, your browser automatically establishes a direct connection with the Google server – including in the U.S. Integration with Campaign Manager means that Google is notified when you access our website or click on one of our ads. Find more information here on the Google Marketing Platform, and on data privacy generally at Google. Alternatively you may visit the Network Advertising Initiative (NAI) website. Google complies with the EU-U.S. Privacy Shield.

Opting out:
There are several ways to opt out from using Campaign Manager and Display & Video 360:
a) by setting your browser software accordingly, in particular by blocking third-party cookies as outlined in section 14.1 of this Privacy Notice, you will not receive any ads from third-party providers;
b) by disabling conversion tracking cookies by setting your browser to block cookies from the www.googleadservices.com domain; this setting will be deleted when you delete your cookies;
c) by disabling interest-based advertising by the providers that are part of the "About Ads" self-regulatory program; this setting will be deleted when you delete your cookies;
d) by permanently disabling the plugin in your Firefox, Internet Explorer or Google Chrome browsers here.
e) You can view, remove, or add the Google categories that this technology can use to display interest-based advertising to you using Google's Ads Preferences Manager. At the link above, you can download and install the browser plugin to disable cookies for ad preferences in order to prevent Google from collecting the data on your use of the web pages that is generated by the cookies.

15.4 Possibility to object / opt-out

You have the possibility to prevent interest-based personalised advertising in general with the aid of the so-called Preference Manager Preference Manager or by clearing cookies in your browser settings.

With the exception of the processing described in Section 13 and 14, we will not forward your data to recipients established outside the European Union or the European Economic Area. The processing mentioned in Section 13 and 14 results in a data transfer to the servers of the providers of tracking or targeting technologies commissioned by us. Some of these servers are located in the USA (for details please refer to respective explanations regarding the specific recipients). The data is transferred according to the principles of the so-called Privacy Shield as well as on the basis of so-called Standard contract clauses of the European Commission.

17.1 Overview

Besides the right to revoke the consent you have given us, you have the following further rights if the respective legal requirements are met:

• The right to request information about your personal data stored with us

• The right to request rectification of incorrect data or completion of incomplete data

• The right to request deletion of your personal data stored with us

• The right to request restriction of processing of your data

• The right to request data portability

• The Right to object to the processing of your personal data

17.2 Right to be informed

You have the right to receive, upon request, information about the personal data stored with us about you, free of charge. This includes in particular:

• the purposes for which the personal data are processed;

• the categories of personal data that are processed;

• the recipients or the categories of recipients to whom the personal data concerned have been disclosed or are still being disclosed;

• the planned duration of storage of the personal data concerning you or, if specific details of this are not possible, criteria for the specification of the retention period;

• the existence of a right of rectification or deletion of personal data concerning you or of a restriction on processing by the data controller or of a right to object to such processing;

• the existence of a right of appeal to a supervisory authority;

• all available information about the origin of the data, if the personal data was not collected from the person concerned;

• the existence of an automated decision-making process, including profiling. In these cases, at the least, receiving meaningful information about the logic involved as well as the scope and desired impact of such processing for the person concerned.

If personal data is transferred to a third country or to an international organisation, you have the right to be informed about the appropriate safe guards in connection with the transfer.

17.3 Right to rectification

You have the right to seek the immediate rectification by us of inaccuracies in your personal data. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data and add newly available supplementary information.

17.4 Right to deletion

You have the right to request from us that personal data concerning yourself is immediately deleted, if one of the following grounds applies:

• the personal data are no longer necessary for the purposes for which they have been collected or have been processed in any other way;

• you revoke your consent, which supported the processing originally, and there is no other legal basis for processing;

• You object to the processing where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.

• the personal data has been unlawfully processed;

• the deletion of the personal data is necessary for the fulfilment of a legal obligation;

• the personal data has been collected in relation to services offered by information society services as referred to in Article 8 paragraph 1 GDPR

Insofar as we have made the personal data public and are obliged to delete it, we will take appropriate measures taking into account the available technology and the costs of implementation, in order to inform the third parties who are processing your data that you also request from them that they delete all links to the personal data and copies or replications of the personal data.

17.5 Right to restriction of processing

You have the right to request from us a restriction of the processing, if one of the following requirements exist:

• the correctness of the personal data is disputed by you;

• the processing is illegal and you request a restriction of the use of the personal data rather than its deletion;

• the data controller no longer requires the personal data for the purposes of the processing, but the person concerned requires them in order to enforce, exercise or defend legal claims or

• you have raised an objection to the processing, so long as it is not certain whether the legitimate grounds of the data controller outweigh those of the person concerned.

17.6 Right to data portability

You have the right to receive the personal data that concern you, which you have provided to us, in a structured, common and machine-readable format, and you have the right to transfer these data to another data controller without hindrance by us, insofar as

• the processing is based on consent or on a contract and

• the processing takes place with the aid of automated procedures.

When exercising your right to data portability, you have the right to ensure that the personal data is transferred directly by us to another data controller, insofar as this is technically feasible.

17.7 Right to object

In particular instances, you may object to data processing for reasons arising from your particular situation.
The above general right of objection applies to all processing purposes described in these data protection regulations, which are processed on the basis of legitimate interests. Unlike the special right to object towards data processing for advertising purposes, we are only obliged by the GDPR to implement such a general objection, if you give us reasons of paramount importance for this, e.g. a possible risk to life or health. Furthermore, there is the possibility to contact the supervisory authority responsible for Lidl U.K. GmbH and Lidl Great Britain Limited

18.1 Point of contact in case of questionsIn the case of questions on the website, other Lidl platforms and related to marketing information or to exercise your rights with regard to the processing of your data (data protection rights) you can contact customer services:

https://customer-service.lidl.co.uk/SelfServiceUK/s/
0800 977 7766 / 0370 444 1234

18.2 Point of contact in case of questions regarding data protection

If you have further questions regarding the processing of your data, you can contact the company data protection officer on Data.Protection@lidl.co.uk

18.3 Right to complain to the supervisory data protection authority

In addition, you have the right to complain at any time to the responsible supervisory data protection authority. The supervisory authority for data protection in the United Kingdom is the Information Commissioners Office (ICO). Further advice and guidance can be found on their website at www.ico.org.uk or by contacting their helpline on +44 (0)303 123 1113.

Name and contact details of the controller:

Lidl Great Britain Limited
19 Worple Road
Wimbledon
London
SW19 4JS

+44 (0)208 971 1100

Lidl Great Britain Limited (registered company number 02816429) and ICO reference number Z6682144