Stores Privacy Notice

Last revised October 2026

1. Contact details of the controller and the data protection officer

The responsible entity is the respective Lidl Great Britain Limited, Lidl House, 14 Kingston Road, Surbiton, KT5 9NU (registered company number 02816429). Please refer to the notice in the store for contact details or contact our customer service at customer.care@lidl.co.uk.If you have any questions, please contact the data protection officer of the responsible body. You can reach them at data.protection@lidl.co.uk.

2.CCTV and loss prevention technologies

How and why do we process personal data?

We use CCTV in all Lidl sites which include our Stores, Distribution Centres, Property Offices and our Head Office. The CCTV footage captures images of customers, suppliers, staff and other persons entering Lidl Sites.

Security personnel and selected store colleagues may also wear and operate body worn cameras which will be activated in high-risk situations. Both audio and video are recorded. Personnel and colleagues wearing these cameras are identified by badges on their uniform or other visible signs demonstrating their use.

In addition to the CCTV and body worn camera footage, associated records and witness statements related to the relevant incidents may be created. These will include details of the incident including date, location, nature of the incident and names of individuals involved where they are known.

Some of our CCTV cameras use image processing to identify and categorise objects, such as people and vehicles, converting those detections into searchable data.

When an investigation is required or we receive a Subject Access Request (SAR), this metadata allows us to quickly locate the relevant footage pertaining to a specific individual. This targeted approach significantly reduces the time required to process requests, eliminating the need to manually review vast amounts of video footage.

CCTV footage, body worn camera footage and these associated records are captured and processed on the basis of Lidl’s legitimate business interests for the following purposes:

• Safety and security of our customers, staff and security guards.

• Safety and security of our premises and property.

• Health and safety and to investigate accidents or claims.

• Protection against, detection of and evidencing of criminal activities.

• Proactive and reactive queue management in Stores

• The reduction of company losses and inventory discrepancies and

• The Replenishment of stock.

Many of our premises hold alcohol licenses which require CCTV to be in operation. For these premises, the processing is necessary for Lidl to comply with its legal obligations.

Some stores use shelf cameras powered by AI technology to help keep shelves stocked and ensure products are available, to facilitate store operations. These cameras are focused on products and shelf conditions, not on customers or any other individuals in stores. Any image of individuals that is accidentally captured is automatically deleted within seconds. No image of individuals is stored or shared by the shelf cameras.

Non-scan detection cameras used at our checkouts and self-checkouts are only used to identify non-scanned items, prevent inventory loss, and will always involve human intervention. All facial images collected as part of our non-scan detection cameras are pixelated and no facial recognition technologies are used. Only non-scanned footage will be recorded for the duration of your checkout transaction to replay a recording for you identifying any item not scanned or scanned incorrectly.

CCTV recordings are used for queue management. For instance, by analysing the number of customers in Store at a given time, how much time customers spent in Store, and the length of queues at checkouts. We use AI software to help us determine peak Store times and provide efficient queue management procedures.

CCTV footage may at times be used in evidencing legal/ongoing disputes where all requirements for the access and storage of such data have been met as laid out in our internal investigation procedures.

The physical technological infrastructure and recordings are stored and backed-up internally.

Who can access your personal data?

As a general rule, we will not disclose CCTV recordings to third parties except where required or permitted by law.

Third Party service providers who are under strict contract with us may have access to CCTV recordings as part of CCTV installation, configuration and maintenance support.

CCTV footage of suspected criminal activities such as violent behaviour or theft will be stored on a third-party crime reporting platform provided by Auror. We use the Auror platform for recording and monitoring safety and security incidents in stores for the prevention and detection of crime and prosecution of offenders in order to protect both our customers and colleagues.

The data stored on the platform will be made available to Auror. For more information on how Auror will use this data please visit https://www.auror.co/privacy-policy-uk

The data is used to assist Lidl in identifying repeat offenders by suggesting connections between incidents carried out at Lidl stores. This data will also be used to provide Lidl with aggregated insights about an individual offender's behaviour across Lidl stores and other retailers' stores. This happens through matching data points across different security incidents recorded on the Auror platform by Lidl and other retailers using the Auror platform. Information recorded by Lidl about an offender will be included in the aggregated data and made available to other retailers who are users of the Auror platform.

Lidl will always cooperate with the local police or law enforcement agencies and will provide CCTV footage upon their request when it is lawful to do so. This will include providing relevant police and law enforcement agencies with access to the information held by Lidl on the Auror platform when it reports crime to the police and other law enforcement.

We may share CCTV footage or images with our internal or external advisors (including but not limited to lawyers, consultants, insurance companies) as may be necessary for the establishment and defence of our legal rights.

How long do we store your personal data?

CCTV footage is kept for a period of up to 31 days from the time of recording unless specified separately under licence requirements.

In the event of an incident, potential or ongoing investigation or claim, then footage may be retained for a period of up to 3 years from the date of the incident or from when the investigation or claim is finalised.

3. Payment Methods

If you pay by card, we as a retailer collect your personal data via the payment terminal and transmit the data to the network operator. The network operator and the respective payment service providers for the authorisation and settlement of the payment transactions (e.g. acquirer) process the data further. The purposes are processing of payment, prevention of card misuse, limiting the risk of payment defaults and legally required purposes, such as combating money laundering and criminal prosecution. For these purposes your data will also be shared with other responsible parties, such as your card-issuing bank. Personal Data is at no time shared with the network operator

We as a retailer and the acquirer are each responsible for processing the data as follows:

We are responsible for operating the payment terminal at the check-out and for our internal network to securely transmit data via Internet or telephone line to the network operator, whilst the acquirer is responsible for the processing and settlement of payment transactions.

We process your card data (card number, expiry date, issue number and cvv) and other payment data (purchase amount, date, time, terminal identification, location, company and store where you pay, as well as your signature). The purpose is the processing of the payment and carrying out the payment process with the payment service provider and, if necessary, to process a cash withdrawal and to check creditworthiness.

The legitimate interest consists in the processing of the cash withdrawal or the payment process. The card data is processed only in hashed form and deleted as soon as it is no longer required for processing the payment and there are no legal retention periods which require to keep the data.

If you pay with debit/credit card, we forward in an encrypted format the following payment information to the network operator Ingenico Retail Enterprise (UK) Limited, registered office is Ingenico House, Rudheath Way, Gadbrook Park, Northwich, Cheshire, CW9 7LT: card number, expiry date, issue number, cvv, date, time, purchase amount, terminal identification, city, company and store.

For more information please refer to their data protection regulations https://www.ingenico.com/legal/ifs/data-processing

If you pay with an American Express card, we will forward your payment information to American Express Services Europe Limited, Belgrave House, 76 Buckingham Palace Road, London, SW1W 9AX, United Kingdom

For more information about the processing of your data by the card provider, please refer to their data protection regulations https://www.americanexpress.com/uk/legal/european-implementing-principles.html

In line with repairing card terminals, the used service provider Ingenico Retail Enterprise (UK) Limited, registered office is Ingenico House, Rudheath Way, Gadbrook Park, Northwich, Cheshire, CW9 7LT, may gain access to the payment data stored on the payment terminals.

If required by law, your data will be transmitted to law enforcement agencies and money laundering reporting offices.

You are neither legally nor contractually obliged to provide us with your data. However, a card payment is not possible without the data. Alternatively, you can pay with cash at any time.

Age verification checks

When selling products with age restrictions, such as alcohol (18 years) / the sale of computer games, DVDs, videos cassettes with age restrictions , our cashier staff will carry out a visual inspection of your ID card for the purpose of age verification in line with our Think25 policy as advertised in our stores. The legal basis is compliance with our legal obligation to not sell age-restricted products to persons under-age and legitimate interest in carrying out due diligence check

4. Automatic Number Plate Recognition (ANPR) In Our Car Parks

Some of our stores have ANPR cameras to prevent overstaying which ensures our customers can always park when shopping with us. For stores where Lidl directly manages its own carparks, these are operated by ParkingEye. You can find out more about how they process your personal data by visiting their privacy policy.

Some of our stores are located within retail parks where ANPR is in operation so these schemes may be operated by other carpark management companies. Please check the signs when parking in all of our stores as this will confirm if ANPR is in operation and who the carpark management company that managed the scheme.

5. Claims Handling

Purposes of data processing / legal basis

When managing and resolving claims or accidents occurring within our stores, we process personal data belonging to potential responsible parties, injured individuals, and witnesses. This data includes identification and contact details, information regarding the damages sustained, and any other relevant documentation necessary for the investigation.

The primary purpose of this processing is the efficient resolution of the claim. This involves clarifying the circumstances of the incident, identifying the parties responsible, establishing communication with those involved, and determining the appropriate level of compensation for any damages caused.

The legal basis for processing this personal data is our compliance with legal obligations to provide compensation where Lidl is found responsible, alongside Lidl’s legitimate interests in resolving such claims.

For special categories of personal data, such as health information, processing is conducted on the basis of establishing, exercising, or defending legal claims. Consequently, this processing does not require your explicit consent as it is necessary for the legal redress of damages.

Recipients / Categories of recipients

We may engage professional subcontractors to assist with data processing. Depending on the specific requirements of a case or insurance claim, data may be shared with experts, legal counsel, medical professionals, insurance providers, loss adjusters, or judicial bodies.

Data retention period/criteria for determining the retention period:

Data relating to the processing of liability claims will be retained for the duration of the claim or a maximum period of 12 years after their registration in our system which one comes first.

6. Accident Data

If you have an accident on Lidl premises, we process personal data based on our legitimate interest to investigate the incident, prevent future occurrences, and defend potential legal claims.

For this purpose we may collect your name and contact details and any accident-related information, including incident description, nature of the event, and health data where relevant.

We may also share your personal data relating to this accident to investigate the incident, prevent future occurrences, and defend potential legal claims.

Where necessary for claims handling or legal obligations, we may share accident data with insurers or relevant public authorities.

Accident records are typically retained for five years, though this period may be extended where necessary for the establishment, exercise, or defence of legal claims.