The browser is not supported
To display the website correctly, please use one of the following browsers.CautionPlease update your browser, if you proceed with this browser, your shopping experience might not be successful!

    Customer Privacy Notice

    Data protection at Lidl


    Last revised: October 2026


    Overview

    Your personal data may be used by Lidl in a variety of ways. We will always be as transparent as possible as to how we use your data whether in the context of your in-store experience, or using any of our online services.


    When you access the Lidl website, app and other Lidl platforms, certain information may be exchanged between your device and our server with your consent. This may contain personal data. Data collected in this way can for instance be used to optimise our website or to display advertising in the browser of your device.


    At Lidl we ensure that customer satisfaction is at the heart of everything we do. We know your privacy is important to you so we want you to know that we will treat your personal information with respect.


    1. Contact details of the controller and the data protection officer

    Unless otherwise stated in the following clauses, Lidl Great Britain limited, 14 Kingston Road, Surbiton, KT5 9NU (“Lidl GB”) and Lidl Stiftung & Co. KG, Stiftsbergstraße 1, 74172 Neckarsulm ("Lidl Stiftung", and together with Lidl GB "we", "us") are joint controllers of the processing of your data on the website www.lidl.co.uk, customer.care.lidl.co.uk ,recipes.lidl.co.uk and in the Lidl app (the "Services").


    The data protection officers of Lidl GB and Lidl Stiftung can be contacted at the above postal addresses or at data.protection@lidl.co.uk


    2. Involvement of third parties as data processors

    Unless otherwise stated, the recipients or categories of recipients named below act as data processors. They are carefully selected and contractually bound in accordance with Article 28 UK GDPR. This means that they may only process personal data on the basis of our instructions and not for purposes other than those stated.


    3. Transfers to recipients in third countries

    Under certain circumstances, it may be necessary for us to transfer your personal data to recipients in a third country or several third countries outside the UK.


    The UK Data Protection Authority has certified some third countries as having a level of data protection comparable to the UK GDPR by means of an adequacy decision. You can find an overview of third countries with an adequacy decision here. For service providers based in the USA, this only applies if they are certified in accordance with the UK Extension to the EU-US Data Privacy Framework.


    If there is no adequacy decision, we secure the transfer by other measures. These can be, for example, binding company regulations, standard contractual clauses, certificates or recognised codes of conduct.


    Unless otherwise stated below, the transfer to a third country takes place either on the basis of an adequacy decision or one of the measures listed above. If you have any questions, please contact our data protection officer.


    4. Accessing our Services

    Purposes of data processing/legal basis

    When you access our Services automatically and without your intervention, your browser sends the


    • IP address of the end device used,
    • Date and time of access,
    • Name and URL of the retrieved file,
    • Website/application from which access is made (referrer URL),
    • Browser and, if applicable, operating system of your end device,
    • Name of your access provider

    to our server and temporarily stores them in a log file for the following purposes:


    • To ensure a smooth connection set-up,
    • To ensure convenient/appropriate use of our website/application,
    • To evaluate system security and stability.

    If you agree to geolocalisation on your end device, we process your real-time location data when you use certain functions of our Services (e.g. displaying the location of the nearest Lidl store in the store finder).


    • In order to be able to display product videos on our website
    • the IP address of the end device used,
    • video ID (internal designation of the video),
    • browser and, if applicable, the operating system of your device,
    • and the user agent string (interface between user and website)

    are processed and transmitted to the service provider named below in order to display the product video to you in a compatible format.


    The legal basis for data processing is Article 6(1)(1)(f) UK GDPR. Our legitimate interest lies in the correct presentation of our Services, the protection of our systems and the prevention of unauthorised access to our website. If the presentation serves to prepare a contract, the legal basis for data processing is Article 6(1)(b) UK GDPR.


    Recipients/categories of recipients


    Under certain circumstances, we may need to disclose your personal data to other recipients.


    To defend against cyberattacks and unauthorized access, and to ensure system security, we integrate IT security and network infrastructure services from specialized service providers.


    Storage period/criteria for determining the storage period


    The log files are stored for a period of seven days and then automatically deleted. The log files of the website recipes.lidl.co.uk are stored for a period of 90 days and then deleted.


    The security measures (designed to defend against cyberattacks and unauthorized access and to ensure system security) do not involve the permanent storage of personal data.


    5. Contact form, email contact, telephone calls, social media and customer surveys


    Purposes of data processing/legal basis


    Personal data that you provide to us when filling out contact forms, by telephone, by email or via social media will only be used for the purpose of processing your enquiry.


    If you take part in one of our customer surveys, you do so voluntarily. In these anonymous surveys, no information is stored that allows conclusions to be drawn about the participants. Only the date and time of your participation will be saved. You can specify your details using free-text fields or by creating screenshots. You can also voluntarily agree to be invited to participate in user studies on a regular basis. These are conducted by telephone interviews, written surveys or tests on the user-friendliness of our applications. For this purpose, we store your first name, surname and email address. Any additional personal information you provide in surveys or user studies will be considered to have been provided voluntarily and will be stored in accordance with the UK GDPR. When using free-text fields and screenshots, please refrain from submitting personal data about yourself or another individual.


    The legal basis for data processing is Article 6(1)(f) or Article 6(1)(b) UK GDPR. Our and your concurrent (legitimate) interest in this data processing arises from the aim of answering your enquiries, solving any problems you may have and thus maintaining and increasing your satisfaction as a customer or user of our website. If you give your consent as part of a customer survey or user study, Article 6(1)(a) UK GDPR is the legal basis for data processing based on consent. You can withdraw this consent at any time with effect for the future. Further details on this are set out in the data protection notices of the customer surveys and user studies. The legal basis for the processing of data protection requests is Article 6(1)(c) UK GDPR, as this is necessary to comply with legal obligations.


    If you identify yourself as a Lidl Plus customer, the responsible Lidl company will receive your contact details, which are required for the customer service department to process an enquiry or for a product-specific enquiry with suppliers. The legal basis for this is Article 6(1)(b) UK GDPR.


    Recipients/categories of recipients


    When answering your enquiries and analysing customer surveys, your data will also be processed on our behalf by data processors from the customer service department and customer survey department.


    If necessary to process your complaint, the data you provide may be passed on to companies within the Lidl Group. If your customer service enquiry leads to a further request, we will use your previously collected data for this request so that you do not have to enter your data again.


    In order to process your complaint, it may also be necessary to pass on your contact details to our service partners, who will contact you regarding the next steps (e.g. arranging a collection or repair appointment). We will inform you of the name of the specific service partner as part of our communication. The transfer of data is necessary to fulfil warranty claims and thus to perform the contractual relationship with you in accordance with Article 6(1)(b) UK GDPR.


    Storage period/criteria for determining the storage period


    We will delete or anonymise all personal data that you provide to us in response to enquiries (suggestions, praise or criticism) no later than 60 days after the final response. Experience has shown that there are usually no more queries after 60 days. If you assert your rights as a data subject under data protection law, your personal data will be processed for the following purposes for three years after the final response to prove that we have complied with legal requirements. The storage period for personal data collected as part of customer surveys is communicated in advance as part of the specific customer survey.


    6. Competitions and Prize Draws

    Controller


    The controller for data processing in connection with the organisation of competitions is Lidl Great Britain limited, 14 Kingston Road, Surbiton, KT5 9NU (“Lidl GB”)


    Purposes of data processing/legal basis


    You have the opportunity to take part in various competitions on our website, from our newsletter or via the Lidl app. Unless otherwise specified in the respective competition, the personal data you provide to us when participating in the competition will be used exclusively for the purposes of organising the competition (e.g. determining the winner, notifying the winner, sending the prize).


    The legal basis for data processing in the context of competitions is Article 6(1)(b) UK GDPR.


    Recipients/categories of recipients


    The data will only be passed if this is necessary to conduct the competition (e.g. sending the prize via a logistics company).


    Storage period/criteria for determining the storage period


    After the competition ends and the winners are announced, the participants’ personal data will be deleted. In the case of non-cash prizes, the winners’ data will be retained for the duration of the statutory warranty claims in order to arrange for rectification or replacement in the event of a defect.


    7. Sending of advertising


    Purposes of data processing/legal basis


    You can sign up for our marketing communications on our website, in our mobile applications, the websites or mobile applications of partner companies and via embedded content on our social media presences. If you have expressly consented to receiving our Lidl marketing communications (email, SMS, WhatsApp, push notifications), we will use your email address or mobile phone number and, if applicable, your name to send you information (see Section "Advertising content"), taking into account your user profile (see Section "Personalised user profile").


    In order to ensure that no errors have been made when entering the email address, we use the double opt-in procedure. After you have entered your email address in the registration field, we will send you a confirmation link. Only when you click on this confirmation link will your email address be added to our mailing list. We will do the same with your mobile phone number if you have provided it to us as part of the Lidl Plus registration process.


    You can withdraw your consent to receiving marketing communications, including the creation of personalised user profiles, at any time with effect for the future, e.g. at the end of each newsletter, in your Lidl Plus account or via our customer service department at customer.care@lidl.co.uk When you unsubscribe, we consider your consent to the creation of this personalised user profile and the receipt of newsletters based on it to be withdrawn.


    The legal basis for the aforementioned processing is Article 6(1)(f) UK GDPR or, if consent has been given, Article 6(1)(a) UK GDPR. The processing of existing customer data for our own advertising purposes or for the advertising purposes of third parties is a legitimate interest within the meaning of the first-mentioned provision.


    Recipients/categories of recipients


    The recipients include the operators of social networks, advertising partners and specialised service providers who process personal data on our behalf in accordance with our instructions.


    If external data processors are used to carry out marketing communications, they are contractually obliged in accordance with Article 28 UK GDPR.


    Storage period/criteria for determining the storage period


    If you withdraw your consent to individual advertising measures or object to certain advertising measures, your data will be deleted from the corresponding (email) distribution lists within 72hours for technical reasons.


    If you file an objection, your contact address will be blocked for further advertising data processing. We would like to point out that in exceptional cases, advertising material may still be sent or advertising campaigns displayed temporarily even after we have received your objection. This is technically due to the necessary lead time for adverts and does not mean that we will not implement your objection.


    Your registration data will then be stored for ten years as proof that we have complied with legal requirements. When registering for the newsletter on a social media site, the data protection information of the respective operator of the social media site also applies.


    Further data processing for advertising purposes


    Furthermore, we process data concerning you for advertising purposes using cookies and similar technologies as described in Section 8 in more detail.

    7.1 Personalised user profile


    With your consent, we and the following operators of Lidl websites and Lidl apps, as well as the senders of Lidl newsletters, record your user behaviour:

    • Lidl Stiftung & Co. KG,
    • Lidl Great Britain Limited,

    The evaluation of user behaviour includes the following information in particular:

    • Activated links,
    • Time of opening,

    In addition, if you are only a registered Lidl Plus user, the evaluation of user behaviour also includes:

    • Used areas of the respective website, the mobile apps or the newsletter,
    • Products selected or added to the shopping basket,
    • Time, duration and frequency of use,
    • Participation in surveys,
    • Redeemed vouchers,
    • Purchase data,
    • Frequency and timeliness/timing of your store purchases when using Lidl Plus.

    We use this data to create personalised user profiles by assigning your person and/or email address or mobile phone number in order to be able to better tailor advertising to your personal interests by means of newsletters, SMS, WhatsApp/push notifications, on-site advertising and print advertising, and to improve our offers and digital presence.


    We can also enrich this user profile with information about your age and gender if you have given us your consent to do so.


    If you have filled in the "About me" section in Lidl Plus, this data will also be used to customise our Services to your interests. The legal basis for this is Article 6(1)(b) UK GDPR (contract between Lidl Stiftung and you).


    7.2 Advertising content


    The content of our marketing communications includes information about promotions, products and services (e.g. offers, discount promotions, competitions, Lidl Plus programme benefits, streaming offers, services, surveys, product reviews) from our website, the Lidl app, store operations and from the operators of the Lidl websites and Lidl apps. These are currently in particular:

    • Lidl Great Britain Limited (www.lidl.co.uk)
    • Lidl Stiftung & Co. KG (www.lidlplus.co.uk)

    7.3 Push notifications


    Purposes of data processing/legal basis


    To receive regular information on news, offers, promotions, you can register to receive push notifications.


    To do this, you must confirm the request from the end device to receive push notifications. The login time and a push token or your device ID are then saved. This data is used to send push notifications and as proof of registration.


    The Lidl app only uses push notifications if you activate push notifications when installing the app or at a later time in the settings of your device. You can deactivate the receipt of push notifications at any time in the Lidl app.


    We analyse push messages statistically in order to determine whether and when push messages were displayed and clicked on. This enables us to determine the presumed interests of the recipients and thus optimise the push messages.


    The legal basis for processing your data to send push notifications is your consent in accordance with Article 6(1)(a) UK GDPR.


    Recipients/categories of recipients


    If external data processors are used to send push notifications, they are contractually obliged to do so in accordance with Article 28 UK GDPR.


    Storage period/criteria for determining the storage period


    Your data will be stored as long as you have activated push notifications.


    8.Use of cookies and similar technologies to process usage data


    The use of cookies and similar technologies for processing usage data (in particular local storage) means that when you visit our website (https://www.lidl.co.uk/) and some of the web pages embedded there (in particular account.lidl.com) and the Lidl app (collectively “Lidl services”), files are stored locally on your end device (laptop, tablet, smartphone or similar). Sometimes a so-called tag is used to display personalized advertising, which is integrated into the Lidl services (hereinafter referred to as “similar technologies for processing usage data”). This is a code that collects usage data.


    8.1 Responsibility


    Lidl GB and Lidl Stiftung are joint controllers for most data processing in connection with the use of cookies and other similar technologies (uniformly referred to as "cookies") to process usage data on the Lidl services.

    Beyond this, the responsibility relationships are as follows:


    8.2 Responsibility for cookies for Marketing purposes


    For some of the data processing associated with the marketing cookies for marketing (see cookies under the category "Marketing" in our cookie notices), in addition to us, the following are also involved:

    • Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (Facebook),
    • RTB House GmbH, Kurfürstendamm 226, 10719 Berlin, Germany (RTB House),
    • TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, EC1A 9HP, United Kingdom (TikTok),

    They are joint controllers pursuant to Article 26 GDPR.


    We also use the following services for self-promotion in our Lidl services

    • Microsoft Advertising and Microsoft Clarity of the provider Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (Microsoft) and the
    • Google Ads Service of the provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google) for self-promotion in our Services.

    Microsoft also processes your data as part of the Microsoft Advertising Services under their own responsibility.


    We use the so-called “Meta Pixel” within the Lidl website and Meta’s “Facebook Custom Audience” service in the Lidl app. In this regard, we are joint controllers with Meta pursuant to Article 26 of the GDPR and have entered into a joint controller agreement with Meta (https://de-de.facebook.com/legal/controller_addendum). In this agreement, we have agreed with Meta that we will provide you with the necessary information regarding data processing, and that Meta is responsible for ensuring the rights of data subjects following the conclusion of the joint controllership arrangement (i.e., for all data processing carried out by Meta after we have transferred the data to Meta).


    8.2.1 Responsibility for advertising and performance measurement using the IAB TCF


    As part of the data processing associated with the marketing cookies for advertising and performance measurement using the IAB TCF (see cookies under the category "Marketing – Advertising and performance measurement using the IAB TCF" in our cookie notices), we work with (Criteo), and Virtual Minds GmbH, Ellen-Gottlieb-Straße 16, D-79106 Freiburg im Breisgau, Germany, as joint controllers with us in accordance with Article 26 GDPR for the display of personalised advertising outside of our services.


    In this context, data about you will also be partially processed by the advertising partner (TTD), as the separately responsible party for the display of personalised advertising and for measuring success.


    When using the special identification procedures "Utiq" and "EUID", we work together with Utiq SA/NV, Rue aux Laines 70, 1000 Brussels, Belgium, in the case of Utiq, and with TTD, in the case of EUID, as joint controllers with us in accordance with Article 26 GDPR. In the case of Utiq, your IP address will be forwarded to your telecommunications network operator if it participates in Utiq. The latter then creates a unique online identifier, the so-called network signal, from the IP address you use and an internal network reference, such as your mobile phone number, for further use in connection with Utiq. In the data protection notices of Utiq SA/NV and the data protection notices of TTD regarding EUID, you will find further information on data processing and how you can assert your rights as a data subject.


    The transmission and further processing of your hashed e-mail address described under the purpose of "storing or accessing information on a terminal device" is generally carried out under joint responsibility with Criteo. Criteo is solely responsible for a possible link with other identifiers / identifiers assigned to you.


    8.3 Purposes/data processing


    8.3.1 General presentation


    We place cookies on your end device, by means of which the data specified below is collected and then processed for the purposes stated below.

    • Technically necessary: These are cookies and similar technologies without which you cannot use our Services (for example, to display our Lidl services correctly, including font and colour, to provide the functions you have requested and to take your settings into account, to save your registration in the login area, etc.).
    • Convenience: These technologies allow us to take into account your preferences to offer you the best user experience on our Lidl services. For example, we can use your settings to display our Services in a language that suits you. In this way, we also avoid showing you products that may not be available in your region.
    • Statistics: These technologies enable us to compile pseudonymised/anonymised statistics on the use of our Services. This allows us to determine, for example, how we can customise our services even better to users’ habits..
    • Marketing: This allows us to show you and other users of the Lidl services and other responsible parties (see above) suitable advertising content in the apps and on third-party websites. This personalization is based on the analysis of pseudonymous usage behavior (e.g. by measuring the sales you have generated during check-out, clicked areas, etc.) and information from your customer account (age, gender, purchasing behavior in the Lidl services; if applicable, store shopping data from the Lidl Plus service). Your usage behavior can also be tracked via various websites, apps, browsers, Lidl services or end devices using a user ID (unique identifier, e.g. hashed e-mail address) (see Section 8.4 of this Privacy Policy for details). We can also optimize our advertising measures on this basis. If you are a user of the Lidl Plus service, this information may also be included in your advertising profile, for example to identify suitable advertising channels.
    • Marketing - Advertising and performance measurement using the IAB TCF: This includes data processing for the purpose of personalized advertising and performance measurement using the advertising network IAB Europe Transparency & Consent Framework, in which we participate via a service provider commissioned by us (ID 1184) and whose specifications and guidelines are taken into account.

    Further details on the processing purposes can be found in the preferences manager.


    8.3.2 Selected Services


    Google Analytics/Firebase


    We use the analytics tools Google Analytics 4 and Google Firebase in our Lidl services. In this context, pseudonymous user profiles are created, and cookies and similar technologies are used. The information collected in this way about the use of our Lidl services (e.g., the IP address of the accessing computer, time of access, referrer URL, and information about the browser and operating system used) is processed by Google on our behalf to evaluate the use of the Lidl services and to compile reports on Lidl service activity. Based on the insights from these analyses, we continuously optimize the offerings within the Lidl Services and tailor them to meet user needs.


    The IP address processed by Google Analytics and Google Firebase is automatically truncated. In this process, the last three digits of your IP address are replaced with a “0,” which prevents identification. In addition, we use the “Google Signals” feature to supplement the statistical reports we generate with a cross-device analysis of visitor traffic. This includes, for example, cross-device reports for Google users who are signed in. Google Signals applies only to users who are signed in to a Google Account. Through Google Signals, we receive general demographic information (gender, age group), potential interests, and, where applicable, information on whether Lidl stores have been visited. For more information on how to customize your Google ad settings, visit https://support.google.com/ads/answer/2662856.


    Google Ads

    We use the Google Ads service to design, statistically record, optimize and display advertising content in line with requirements. To this end, we use Google Ads both to measure the success of advertisements and for remarketing purposes.


    In particular, we use Google Ads to record how many users have accessed one of our Lidl services after clicking on an advertisement or have carried out a certain defined action within our Lidl service (e.g. completing an order). However, we do not receive any information with which we can identify you personally. The information obtained is used for statistical analysis to optimize the advertisement. In addition, data that we collect for statistical purposes through the use of Google Analytics and Google Firebase is also shared with Google Ads for use in the advertising purposes described above. The sharing and use of this data depend on your individual consent choices and the advertising preference settings within your Google Account.


    Remarketing

    By using Google Ads, we can also recognize that our Lidl service has been visited and subsequently play targeted advertisements within the Google environment (e.g. search engine, YouTube or Gmail) or other websites on which Google Ads content is integrated.


    On the one hand, we use the Google Ads remarketing pixel, which collects information about your usage behavior and enables us to address you again on other websites with content that is relevant to you. On the other hand, we use the "Customer Match" function. This involves us transmitting lists of hashed user data (e.g. names, e-mail addresses, addresses or other customer-specific identifiers) to Google. Google then compares whether and to what extent the transmitted user data matches existing Google account holders. This allows target groups to be created that can be used for the control of target group-oriented advertisements and campaigns (so-called remarketing or retargeting). Once these target groups have been matched and created, the personal data is deleted by Google.


    Microsoft Advertising

    We also use Microsoft Advertising to record how many users have accessed one of our Lidl services after clicking on an advertisement or have carried out a certain defined action within our Lidl service (e.g. execution of an order). However, we do not receive any information with which we can identify you personally. The information obtained is used for a statistical evaluation to optimize advertising. We use the "Microsoft Clarity" function to track and visualize user interactions.


    We also use the Microsoft Ads service to collect information that allows us to track target groups using remarketing lists. Microsoft Ads can be used to recognize that the Lidl services have been visited and an advertisement can be displayed when Microsoft networks are used later.


    Meta Business Tools


    Meta Pixel

    We use Meta’s “Meta Pixel” for analytics purposes. The Meta Pixel is a JavaScript code that enables us to track visitor activity on websites where the pixel is deployed. Among other things, the Meta Pixel collects IP addresses, browser information, source and destination pages, and referrer data, which are also stored in a cookie. In addition, the pixel detects which activities were performed on the website, such as click behavior.


    With the help of the Meta Pixel, we can use measurement tools and analytics services to see how you interact with our ads on Facebook or Instagram—for example, when you click on a link in an ad that leads to our website. This gives us a better understanding of how successful our campaigns on Facebook and Instagram are and allows us to continuously optimize them. The pixel also allows us to recognize you as a visitor to our website. Based on this information, we can display the ads we run on Facebook and Instagram only to users who are likely to be interested in our offerings; either because they have previously visited our website or because they exhibit certain characteristics (e.g., interests in specific topics or products, as determined by the websites they have visited). By transmitting this information, we enable Meta to provide ad delivery and ad targeting.


    Custom Audiences:

    Facebook Custom Audience enables us to create target groups and to design and display personalised advertisements on Facebook in line with requirements.

    This involves uploading lists of user data to Facebook. Facebook then compares whether the transmitted user data matches data from Facebook users and then creates target groups that can be used to target adverts on Facebook. With Custom Audience, we ensure that only people who have previously visited our app or are interested in our products are shown adverts on Facebook. Facebook also uses the data for its own advertising purposes and for the advertising purposes of third parties.


    8.4 Data categories


    When cookies and similar technologies are used to process usage data, the following types of personal data in particular are processed, depending on the purpose:


    Technically necessary:

    • User input to retain input across multiple subpages (e.g. selecting your preferred store in the Lidl store finder);
    • Authentication data to identify a user after login in order to gain access to authorised content on subsequent visits (e.g. access to the Lidl Plus customer account);
    • Security-related events (e.g. detection of frequently failed login attempts);
    • Data required to playback multimedia content (e.g. playback of (product) videos selected by the user);
    • Information to display our website correctly, including font and colour, to provide the functions you have requested and to take your settings into account, such as the choices you have made regarding cookies and similar technologies, to save your registration in the login area, etc.

    Convenience:

    • User interface customisation settings that are not linked to a permanent identifier (e.g. language selection or the specific display of search queries or maps in the store finder).

    Statistics:

    • Browser type/version,
    • Operating system used,
    • Previously visited page (referrer URL),
    • Host name of the accessing computer (IP address; this is regularly anonymised so that it cannot be traced back to you),
    • Time of the server request,
    • Individual user ID and events triggered on the website (surfing/browsing behaviour). We only merge the user ID with other data from you (e.g. name, email address, etc.) with your express consent (see e.g. Section 8 of this Data Protection Notice). The user ID itself does not allow us to draw any conclusions about your person.

    Marketing:

    • Information about the use of the Lidl services, in particular:
    • IP address (this is regularly anonymised so that it cannot be used to identify you personally),
    • Individual user ID (including cookie identifier) or other identifiers (email address in hashed form, mobile phone number and mobile phone number in hashed form, address and address in hashed form, the IP/MAC address in anonymized form); we only merge the user ID with other data from you (e.g. name, email address, age, gender, purchasing behavior in the Lidl services, etc.) with your express consent for marketing purposes. We may share the user ID and the associated user profiles with third parties via the providers of advertising networks.
    • Potential product interests,
    • Access information,
    • Device identifiers,
    • Information about device and browser settings,
    • Mouse/scroll movements,
    • Triggered events on the Lidl services (surfing behaviour).

    For in-app analysis and the display of personalised advertising, we use the following advertising identifiers in addition to the above-mentioned individual user ID and other identifiers:

    • (i) the IDFA (Identifier for Advertising) for iOS devices or (ii) the Android advertising ID or (iii) the Huawei ID,
    • and a fingerprint of your end device (additionally: time of access, country, language, local settings, operating system and version as well as the app version). We also include user device and web activity information as well as app and event tokens in this analysis.
    • You can reset or deactivate the IDFA or Google GAID, the Android advertising ID and the Huawei ID at any time via your operating system. In the event that the IDFA is not available, we use the SkAdNetwork (Apple’s attribution API) to assign the installations of our app to an advertising campaign.
    • The fact that you are a Lidl Plus user and your store purchasing data from the Lidl Plus loyalty programme.

    Marketing – Advertising and performance measurement using the IAB TCF:

    • Data about your use of our website and third-party media, e.g.
    • Contents of websites
    • Click paths
    • Display of and interactions with adverts
    • Your IP address
    • The so-called TC string generated for you (a coded character string that contains information about the granting and scope of your consent)
    • Your location data
    • Data about the end devices you use
    • If a member of your household has also given their consent: Data of your household member, in particular about the end devices they use
    • Characteristics derived from this (e.g. age group, product interest)
    • Data about your purchasing behaviour on the Lidl websites or apps (in particular so-called EAN numbers, i.e. the product labelling, the number of products you have purchased and the time of purchase)
    • Store purchasing data from the Lidl Plus loyalty programme
    • The online IDs assigned to you, including in connection with the identification procedures Utiq (in particular the network signal relating to you, the Consent Pass assigned to you, the martechpass and the adtechpass) and EUID (in particular the EUID calculated for you) as well as your e-mail address in hashed form.

    Specific to the Lidl app:

    In order to display interest-based information to you, we must be able to assign the above-mentioned information to you as a person. For this purpose, we establish a connection to your customer number from the time you complete your Lidl Plus registration. Your consent to the provision of personalised information also covers this processing step.


    8.5 Legal basis/Recipient/Storage period


    Legal bases:

    The legal basis for the use of convenience, statistics and marketing cookies is your consent in accordance with Article 6(1)(a) UK GDPR in conjunction with Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) . The legal basis for the use of technically necessary cookies is Article 6(1)(b) UK GDPR, i.e. we process your data to provide our Services in the course of contract initiation or contract processing.


    We base the data processing for Facebook Custom Audience on the consent you have provided, which may be revoked at any time with future effect, in accordance with Article 6(1)(a) of the UK GDPR.


    Facebook bases the processing of data for Facebook Custom Audience on the consent of Facebook users in accordance with Article 6(1)(a) UK GDPR and the legitimate interests of Facebook in accordance with Article 6(1)(f) UK GDPR in order to ensure accurate and reliable reports and accurate performance statistics for Facebook advertisers. You can find more information on this in Facebook's Privacy Policy or here. You can contact Facebook’s data protection officer here.


    Google bases its independent processing of personal data in the context of Google Ads on consent pursuant to Article 6(1)(a) of the GDPR. This involves the use of Google’s so-called “consent mode,” through which Google fulfills its obligation under the Digital Markets Act to obtain consent for the processing of personal data for advertising purposes in its capacity as a “gatekeeper” (a dominant provider of an online platform).


    Recipients/categories of recipients:

    As part of data processing using cookies and similar technologies for processing usage data, we may use specialist service providers, in particular from the online marketing sector. They process your data on our behalf as data processors, are carefully selected and contractually bound in accordance with Article 28 UK GDPR. All companies listed as providers in our cookie notice are, unless they have been named as (joint) controllers in this data protection notice, acting as data processors for us.


    As part of our cooperation with Google Ireland Limited, Meta Platforms Ireland Limited, The UK Trade Desk Limited, Microsoft Ireland Operations Limited the above-mentioned data is generally also processed on servers in the USA and the UK for statistical and marketing purposes (see the separate explanations on third country transfers under Section 3).


    Storage period/criteria for determining the storage period:

    The storage period for cookies can be found in our cookie notices. If "persistent" is specified in the "Expiry" column, the cookie is stored permanently until the corresponding consent is withdrawn.


    The online identifiers assigned to you are valid as follows: martechpass 90 days, adtechpass 24 hours, consentpass 90 days, network signal 90 days, EUID 30 days – they are then deleted and, depending on your consent, recreated if necessary.


    When using Google Analytics 4 and Google Firebase, the personal data collected is deleted after 14 months


    Your data can remain in a Facebook Custom Audience for a maximum of 180 days. After 180 days, your data belonging to the website’s custom audience will be removed if you do not visit the website again.


    We delete information that we process as a result of the use of cookies and similar technologies in our own systems (e.g. advertising profiles) in accordance with the storage period for cookies, which you can view in the cookie notice.


    9. Cancellation/opt-out option/Further information


    You can withdraw your consent at any time, for example via the preferences manager. You can report your withdrawal either to us or to those jointly responsible with us.


    Website:

    You can also block the technologies explained here by rejecting certain or all cookies in the cookie setting in your browser. We would like to point out that you may then not be able to use all the functions of these Services.


    Lidl app:

    If you wish to withdraw your consent to tracking in the Lidl app, you can do so at any time with effect for the future by doing so after completing registration via the opt-out in the app under "More" -> "Legal information" -> "App Tracking".


    You can object to the use of the Custom Audiences Service globally on the Facebook website. After logging in to your Facebook account, you will be taken to the settings for Facebook adverts.


    You can deactivate personalised advertising with Microsoft and Google or set it individually. Details can be found on the respective support pages:


    Microsoft:https://help.ads.microsoft.com/#apex/3/en-gb/51029

    and https://account.microsoft.com/privacy/ad-settings/signedout


    Google:https://support.google.com/My-Ad-Center-Help/answer/12155451?hl=en-GB&sjid=7378625627942657056-EU


    You can also find setting options for personalised advertising at https://youradchoices.com/ and here.


    You can also revoke your consent regarding Utiq here, and you can also revoke your consent regarding EUID here.


    Further information on data processing by the companies listed below and on exercising your rights as a data subject can also be found in the following data protection policies:

    • Meta (Facebook): https://www.facebook.com/privacy/policy/
    • RTB House: https://www.rtbhouse.com/privacy-center/services-privacy-policy/
    • Microsoft: https://www.microsoft.com/en-gb/privacy/privacystatement
    • Google: https://policies.google.com/privacy?hl=en-UK
    • The UK Trade Desk: https://www.thetradedesk.com/uk

    An information overview of the individual cookies and similar technologies used, together with the respective processing purposes, the respective storage period and any third-party providers involved can be found here. Further details on processing can also be found in the preferences manager.

    9.2 Use of Map Services in Our App


    Purposes of data processing/legal basis


    In our app, you have the option of using the map service of your mobile device’s operating system to find Lidl stores in your local area, for example. This allows interactive maps to be displayed directly in the app.


    In order to be able to use map services, it is necessary to process your IP address as part of the Internet communication. This is usually processed on a server of the respective operating system provider. We have no influence over the specific data processing. Further information on the purpose and scope of data processing can be found in the data protection notice of the respective provider. There you will also find further information about your rights and settings to protect your privacy.


    Providers’ addresses and data protection notices:


    Google Maps Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,

    Privacy Policy: https://www.google.com/policies/privacy/,

    Terms of Service:https://maps.google.com/help/terms_maps.html,

    Apple Maps Apple Inc, One Apple Park Way, Cupertino, California, USA.

    Privacy Policy: https://www.apple.com/legal/privacy/en-ww/

    Terms of Use: https://www.apple.com/legal/internet-services/maps/terms-en.html,

    Huawei Map kit Huawei Aspiegel SE, 1F, Simmonscourt House, Ballsbridge, Dublin D04 W9H6, Ireland Huawei

    Privacy Policy: https://www.huawei.com/en/privacy-policy

    https://developer.huawei.com/consumer/en/hms/huawei-MapKit/.


    The use of map services is based on our contractual relationship with you, Article 6(1)(b) UK GDPR, as well as on our legitimate interest in presenting our offers in an attractive manner and making it easy to find the locations specified by us in the app. This constitutes a legitimate interest within the meaning of Article 6. If you use the map services in the Lidl app or have agreed to geolocalisation in the settings of your mobile device via the "Give permissions" dialogue, we use this function to be able to offer you individual services based on your current location. In particular, we process your GPS and network-based location for the "store search", "e-charging station search" and "partner benefits search" functions in order to show you the stores closest to you. We do not store geolocalisation data permanently.


    10. Map services

    10.1. Map services

    Bing Maps


    Purposes of data processing/legal basis


    On this website we use map material from Bing Maps, a Service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA. This allows us to display interactive maps directly on the website and enables you to conveniently use the map function, e.g. to find Lidl stores in your local area.


    The use of Bing Maps serves to provide an attractive presentation of our offers and an easy method of finding the places indicated by us on the website. This constitutes a legitimate interest within the meaning of Article 6(1)(f) UK GDPR.


    When you visit our website, the provider of Bing Maps, Microsoft Corporation, receives the information that you have accessed the corresponding page of our website. To use the functions of Bing Maps, your IP address is processed as part of the Internet communication. This is usually processed on a Microsoft server in the USA.


    We have no influence over the specific data processed by Bing Maps. Further information on the purpose and scope of data processing by Bing Maps can be found in the https://www.microsoft.com/en-gb/privacy/privacystatement . There you will also receive further information about your rights and the setting options to protect your privacy.


    11. Protection against automated access (Captcha services)


    Purposes of data processing/legal basis


    To protect our websites and applications from misuse, automated access (e.g., by bots), and spam, we use so-called CAPTCHA services to identify human users. When you access protected areas (e.g., contact forms, login areas), technical data such as connection, environmental, and interaction data (e.g., IP address, mouse movements, time spent on the page) are analyzed. Depending on the service used, this may involve a computational task on your device or an analysis of your user behavior.


    The legal basis for this data processing is our legitimate interest in the security of our IT systems and in preventing mass requests pursuant to Article 6(1)(1)(lf) of the GDPR.


    Recipients/categories of recipients


    As part of our protection against automated access, we engage specialized IT service providers (processors) who provide us with the services mentioned above.


    In connection with the use of certain services, the data mentioned above is generally also processed on servers in the United States (see the separate explanations regarding transfers to third countries in Section 3).


    Storage period/criteria for determining the storage period


    The collected data is stored only as long as necessary for the purposes of fraud detection and IT security, generally for up to 50 days.


    12. Links to other websites and application


    Our website and the Lidl app contain links to other websites and apps operated by other Lidl companies, selected partners or other third parties. If you click on one of these links, for example in the Lidl app via an in-app banner, you will be redirected to the website/app or to your respective app store. The links may also contain special tracking techniques that enable the operators of the websites/applications mentioned to understand and measure where the user has learnt about them. We have no influence over data processing by these websites/apps. We recommend that you check the relevant privacy policy of each website/app you are redirected to in order to understand what information about you is processed by the operator.


    If we redirect you to one of these websites/apps, we process your personal data in order to fulfil your (technical) request to visit the respective application or website (Article 6(1)(b)UK GDPR) and on the basis of the operator’s legitimate interest in carrying out advertising (Article 6(1)(f) UK GDPR).


    13. Access to functions and sensors on your mobile device

    Purposes of data processing/legal basis


    Location data

    If you have agreed to geolocalisation via the "Give permissions" dialogue when using the Lidl app or in the settings of your mobile device, we use this function to be able to offer you individual services based on your current location. In particular, we process your GPS and network-based location as part of the "store search" function in order to show you the stores closest to you.


    Photos/media/files on your mobile device/USB memory contents (read, change, delete)

    If you create a shopping list or a shopping basket via the Lidl app, these will be saved directly in the memory of your mobile device or on a connected storage medium, depending on the installation location of the app and the available storage space.


    Camera (taking pictures and videos)

    The camera on your mobile device is used to scan QR codes.


    WLAN connection information

    The Lidl app uses your mobile device’s WLAN connection to establish a connection to the Internet.


    Other device functions or device sensors

    By accessing the other device functions and device sensors of your mobile device, the Lidl app is able to retrieve data from the Internet and process error messages. It also allows the Lidl app to be executed at start-up and the device’s sleep mode to be deactivated. Finally, if you have given your consent, the Lidl app can send you push notifications to inform you about current offers and promotions.


    The legal basis for the processing of your location data is your consent in accordance with Article 6(1)(a) UK GDPR.


    14. Embedded third-party content

    We have integrated YouTube videos into our website, which are available at https://www.youtube.com and can be played directly from these Services. These are all integrated in "extended data protection mode", i.e. no data about you as a user is transferred to YouTube if you do not play the videos. The data is only transferred when you play the videos. We have no influence over the data processing by the operator of YouTube.


    Further information on the purpose and scope of data collection and its processing by YouTube can be found in the provider’s privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy. Address and privacy policy of YouTube: Google LLC, 1600 Amphitheatre Parkway. Mountain View, CA 94043, USA; https://policies.google.com/privacy?hl=en-gb.


    15. What rights do you have with regard to the processing of your data?


    Your rights as a data subject


    If the data processing is based on consent in accordance with Art. 6 (a) or Art. 9(a) UK GDPR, you can revoke your consent at any time with effect for the future without affecting the legality of the previous processing.


    You have the right to receive information about the personal data stored about you free of charge upon request in accordance with Art. 15 UK GDPR.


    In addition, if the legal requirements are met, you have the right to rectification (Art. 16 UK GDPR), erasure (Art. 17 UK GDPR) and restriction of processing (Art. 18 UK GDPR) of your personal data.


    If you have provided the processed data yourself, you have the right to data portability in accordance with Art. 20 UK GDPR.


    If the data processing is carried out on the basis of Art.6 (e)(f) UK GDPR, you have the right to object in accordance with Art. 21 UK GDPR. If you object to data processing, this will only be continued if we can demonstrate compelling legitimate grounds for further processing that outweigh your interest in objecting.


    To exercise your rights as a data subject, if you have any questions or complaints, please contact the data protection officer in writing or by email.


    You have the right to lodge a complaint. If you wish to raise a concern regarding how we handle your data, please use our complaints form. We aim to respond to all complaints within one calendar month. If you remain unhappy with our final response, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO) via their website at www.ico.org.uk or by calling 0303 123 1113.


    We have presented numerous relationships of joint responsibility in accordance with Article 26 UK GDPR in this data protection notice. Upon your request (e.g. via the contact options specified in Section 1), we will be happy to provide you with the essentials of the respective agreement on joint responsibility. To exercise your rights as a data subject, you are welcome to contact us or for the data processing in question those jointly responsible with us.


    Data protection notice on downloads

    You can download a PDF version of the Lidl Plus data protection notice here.