- We use cookies to improve your experience on our website. By continuing to browse this website you consent to our use of cookies in accordance with our cookies policy.
(Version 1.0; Date 25th May 2018)
Many thanks for using our Lidl app (hereafter referred to as ‘the app’) and your interest in our privacy notice. The following content will inform you about the nature and scope of the processing of your personal data by Lidl U.K. GmbH (also referred to in this data protection statement as “Lidl, “we” or “us”). Personal data are is data that is or can be directly or indirectly attributed to your person. The General Data Protection Regulation (GDPR) serves in particular as the legal basis for data protection.
Contents
1. Overview
Data processing by Lidl U.K. GmbH within the scope of your use of our app can be divided into three categories:
2. Downloading our app from the respective App Store
When you download our app, the following data in particular will be automatically processed by the respective operator of the App Store (Apple App Store or Google Play):
We have no influence on the collection of this data and are not responsible for it. You can find further information on this data processing in the relevant App Store operator’s privacy policy:
3. Using our app
Purpose of data processing / legal basis:
When you use our app, we will automatically and without any action on your part transmit
to our servers, where this information is temporarily stored in a so-called log file for the following purposes:
The legal basis for the processing of the IP address is Article 6 paragraph 1 let. f) GDPR. Our legitimate interest follows from the above-listed purposes of data processing.
Storage duration / criteria for specifying the storage duration:
The data is stored for a period of fourteen days and afterwards automatically erased.
4. Access to functions on your mobile device
Purpose of data processing / legal basis:
Location data
If you have consented to so-called geolocalisation when using our app or in the settings of your mobile device via the “Allow permission” dialogue, we will use this function in order to be able to offer you individual services related to your current location. We will process your location in this way, particularly as part of the “Search for store” function, based on GPS and your network, in order to be able to show the stores nearest to you.
Photos / media / files on your mobile device / USB memory content (read, modify, delete)
If you create a shopping list using our app, depending on the installation location of the app and the available memory, these will be stored directly in the memory of your mobile device or stored on a connected storage medium.
Camera (recording images and videos)
The camera on your mobile device will be used for the scanning of QR codes.
WiFi connection information
Our app uses the Wi-Fi connection on your mobile device in order to set up a connection to the Internet.
Other device functions
Accessing the other functions of your mobile device allows our app in particular to retrieve data from the Internet and error messages to be processed. In addition, it also enables our app to run on start-up and to deactivate the idle state of the device. Finally, as long as you have given your consent, our app can also send you so-called push messages, to keep you informed about current offers and promotions.
The legal basis for the processing of your location data is your consent pursuant to Article 6 para. 1 let. a) GDPR.
Storage duration / criteria for specifying the storage duration:
Your location data will be deleted after closing our app.
5. Usage analysis and advertising
Purpose of data processing / legal basis:
In order to improve the functions of our app, as well as our offer and the marketing thereof, we create pseudonymised user profiles to determine user behaviour. The legal basis for this is Article 6 para. 1 (f)GDPR. The demand-oriented design and continuous optimisation of our app for a better shopping experience and the avoidance of advertisements that are of no interest to you is in your interest here as well as ours and is thus to be considered legitimate in terms of the aforementioned provision. We use the following services for the usage analysis and advertising:
Google Analytics
Within the scope of this app, Google Analytics, a service of Google LLC (“Google”), is used to analyse user behaviour. Google processes the following information:
The information is used to
The IP addresses are anonymised, so that attribution is not possible (so-called IP masking). You can revoke the use of Google Analytics in the menu item “Legal information / Tracking" in this app at any time and with effect for the future.
adjust
Furthermore, our app uses the adjust Analysis Service, a product of adjust GmbH. When you install our app, adjust stores installation and event data (e.g. app usage). In this way, we can understand how you interact with our app. Furthermore, it allows us to analyse and improve our mobile advertising campaigns. For this analysis, adjust uses
This data is anonymised before processing for the aforementioned purposes, i.e. it is possible neither for us nor adjust to identify you using these data.
You can reset or disable the IDFA and the Android advertising ID at any time via your operating system.
If you do not wish to be tracked by adjust, you can revoke it in the menu item “Legal Notices / Google Analytics & adjust” in this app at any time and with effect for the future.
Recipients / Categories of recipients:
The data generated by Google Analytics about your usage will as a rule be transmitted to a server at Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 in the USA and stored there. Google will under no circumstances associate your IP address with other data. The data generated by adjust about your usage will be transmitted to servers at adjust GmbH, Saarbrücker Str. 38a, D-10405 Berlin and stored there. This data may also be disclosed to third parties in so far as this is required by law or if third parties process the data on someone’s behalf, bound by their instructions.
Storage duration / criteria for specifying the storage duration:
Once your personal data has been anonymised, a conclusion as to your person is no longer possible. The statistically prepared data will be erased in Google Analytics, and in the adjust software after 26 months. In reports generated on the basis of Google Analytics or adjust, there is no longer any reference to individuals.
Possibility to object / opt-out
If you do not wish to be tracked, you may object to all the aforementioned or individual tracking measures at any time and with effect for the future, as follows:
6. Other functions
6.1 Websites you can access via the in-app browser
If you run another function using our app such as selecting special offers via the in-app browser (iOS: Safari / Android: Chrome) you will reach the appropriate sub-pages of our website www.lidl.co.uk or the partner websites located there. Our app offer and our online content that is accessible via the in-app browser may under certain circumstances also contain links to other websites.
If you access websites from the in-app browser (e.g. via links), your personal data will be processed on these websites in deviation from this privacy policy. This privacy policy only applies to our app. Please note the privacy policies of the linked websites. We assume no responsibility for external contents which are provided through links and are specially highlighted and we do not adopt their content as our own. The provider of the website who is referred to is alone responsible for illegal, incorrect or incomplete content and for damages resulting from the use or non-use of the data.
7. Recipients outside the EU
With the exception of the processing by Google Analytics described in Section 5, we will not pass your data to recipients established outside the European Union or the European Economic Area. The processing mentioned causes the data to be transmitted to the servers of Google Inc. in the USA. In a decision of 12 July 2016, the European Commission decided for the USA that an adequate level of data protection exists under the regulations of the EU-U.S. Privacy Shield (so-called “Adequacy Decision” pursuant to Art. 45 GDPR). We use the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, which is certified in accordance with the EU-U.S. Privacy Shield.
8. Your affected rights
8.1 Overview Besides the right to revoke the consent you have given us, you have the following further rights if the respective legal requirements are met:
8.2 Right to information as referred to in Article 15 GDPR
You have the right as referred to in Art.15 paragraph 1 GDPR to receive upon request information about the personal data stored with us about you, free of charge. This includes in particular:
If personal data are transferred to a third country or to an international organisation, you have the right to be informed about the appropriate guarantees as referred to in Article 46 GDPR in connection with the transfer.
8.3 Right to rectification as referred to in Article 16 GDPR
You have the right to seek the immediate rectification by us of inaccuracies in your personal data. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data - also by means of a supplementary declaration.
8.4 Right to erasure as referred to in Article 17 GDPR
You have the right to request from us that personal data concerning yourself is immediately erased, if one of the following grounds applies:
Insofar as we have made the personal data public and are obliged to erase them, we will take appropriate measures taking into account the available technology and the costs of implementation, in order to inform the third parties who are processing your data that you also request from them that they delete all links to these personal data and copies or replications of these personal data.
8.5 Right to restriction of processing pursuant to Article 18 GDPR
You have the right to request from us a restriction of the processing, if one of the following requirements exist:
8.6 Right to data portability as referred to in Article 20 GDPR
You have the right to receive the personal data that concern you, which you have provided to us, in a structured, common and machine-readable format, and you have the right to transfer these data to another data controller without hindrance by us, insofar as
When exercising your right to data portability, you have the right to ensure that the personal data are transferred directly by us to another data controller, insofar as this is technically feasible.
8.7 Right to object as referred to in Article 21 GDPR
Under the conditions laid down in Article 21 paragraph 1 GDPR, you may object to data processing for reasons arising from your particular situation.
The above general right of objection applies to all processing purposes described in this privacy policy, which are processed on the basis of Article 6 paragraph 1 (f) GDPR. Unlike the special right to object oriented towards data processing for advertising purposes (compare above in particular Sections 9 and 11.6), we are only obliged by the GDPR to implement such a general objection, if you give us reasons of paramount importance for this, e.g. a possible risk to life or health. Furthermore, there is the possibility to contact the supervisory authority responsible for Lidl U.K. GmbH.
9. Point of contact
9.1 Point of contact in case of questions or to exercise your data protection rights
In the case of questions on the website or the Lidl online shop or to exercise your rights with regard to the processing of your data (data protection rights) you can contact our customer service.
9.2 Point of contact in case of questions regarding data protection
If you have further questions regarding the processing of your data, you can contact Lidl’s company data protection officer (see Section 10).
9.3 Right of complaint to the supervisory data protection authority
In addition, you have the right to complain at any time to the responsible supervisory data protection authority. For this, you can contact the Information Commissioner’s Office (ICO).
10. Name and contact details of the controller of the processing and contact details of the company Data Protection Officer
This privacy notice applies to data processing by Lidl U.K. GmbH and Lidl Great Britain Limited, 19 Worple Road, Wimbledon, London, SW19 4JS (“Data Controller”) and the Lidl App. The Company Data Protection Officer of Lidl U.K. GmbH can be contacted at the above-mentioned address, c/o the Data Protection Officer or at Data.Protection@lidl.co.uk.
