Lidl App privacy notice

(Version 1.0; Date 25th May 2018)

Many thanks for using our Lidl app (hereafter referred to as ‘the app’) and your interest in our privacy notice. The following content will inform you about the nature and scope of the processing of your personal data by Lidl U.K. GmbH (also referred to in this data protection statement as “Lidl, “we” or “us”). Personal data are is data that is or can be directly or indirectly attributed to your person. The General Data Protection Regulation (GDPR) serves in particular as the legal basis for data protection.

Contents

Overview
Downloading our app from the respective App Store
Using our app
Access to functions and sensors on your mobile terminal device
Usage analysis and advertising
Other functions
Recipients outside the EU
Your affected rights
Point of contact
Name and contact details of the controller of the processing and contact details of the company Data Protection Officer

1. Overview
Data processing by Lidl U.K. GmbH within the scope of your use of our app can be divided into three categories:

When you download our app, the necessary data is transmitted to the respective App Store.
To allow you to use our features, e.g. to find Lidl stores in your vicinity, our app requires access to various functions on your mobile device.
When you use our app, data will be exchanged between your device and our server. This may also be personal data. Data collected in this way can for instance be used in order
- to optimise our app and
- to display advertising in the browser on your device or by means of so-called push messages.

2. Downloading our app from the respective App Store
When you download our app, the following data in particular will be automatically processed by the respective operator of the App Store (Apple App Store or Google Play):

user name in the App Store
the e-mail address stored in the App Store,
customer number of your App Store account,
time of the download,
payment information and
the individual device code number.

We have no influence on the collection of this data and are not responsible for it. You can find further information on this data processing in the relevant App Store operator’s privacy policy:

3. Using our app
Purpose of data processing / legal basis:
When you use our app, we will automatically and without any action on your part transmit

the mobile device from which you start our app
the IP address of your mobile terminal device
the date and time of access,
the request from the client,
the HTTP response code.
the amount of data transferred and
the app version used

to our servers, where this information is temporarily stored in a so-called log file for the following purposes:

protection of our systems,
troubleshooting
prevention of abusive or fraudulent behaviour.

The legal basis for the processing of the IP address is Article 6 paragraph 1 let. f) GDPR. Our legitimate interest follows from the above-listed purposes of data processing.

Storage duration / criteria for specifying the storage duration:
The data is stored for a period of fourteen days and afterwards automatically erased.

4. Access to functions on your mobile device
Purpose of data processing / legal basis:
Location data
If you have consented to so-called geolocalisation when using our app or in the settings of your mobile device via the “Allow permission” dialogue, we will use this function in order to be able to offer you individual services related to your current location. We will process your location in this way, particularly as part of the “Search for store” function, based on GPS and your network, in order to be able to show the stores nearest to you.

Photos / media / files on your mobile device / USB memory content (read, modify, delete)
If you create a shopping list using our app, depending on the installation location of the app and the available memory, these will be stored directly in the memory of your mobile device or stored on a connected storage medium.

Camera (recording images and videos)
The camera on your mobile device will be used for the scanning of QR codes.

WiFi connection information
Our app uses the Wi-Fi connection on your mobile device in order to set up a connection to the Internet.

Other device functions
Accessing the other functions of your mobile device allows our app in particular to retrieve data from the Internet and error messages to be processed. In addition, it also enables our app to run on start-up and to deactivate the idle state of the device. Finally, as long as you have given your consent, our app can also send you so-called push messages, to keep you informed about current offers and promotions.

The legal basis for the processing of your location data is your consent pursuant to Article 6 para. 1 let. a) GDPR.

Storage duration / criteria for specifying the storage duration:
Your location data will be deleted after closing our app.

5. Usage analysis and advertising
Purpose of data processing / legal basis:
In order to improve the functions of our app, as well as our offer and the marketing thereof, we create pseudonymised user profiles to determine user behaviour. The legal basis for this is Article 6 para. 1 (f)GDPR. The demand-oriented design and continuous optimisation of our app for a better shopping experience and the avoidance of advertisements that are of no interest to you is in your interest here as well as ours and is thus to be considered legitimate in terms of the aforementioned provision. We use the following services for the usage analysis and advertising:

Google Analytics
Within the scope of this app, Google Analytics, a service of Google LLC (“Google”), is used to analyse user behaviour. Google processes the following information:

the mobile device from which you start our app
browser type and version,
operating system used,
IP address,
time of server request.

The information is used to

evaluate the use of our app,
to compile reports about app activities and
to perform further services connected with app usage and internet usage for the purposes of market research and the demand-oriented design of these websites.

The IP addresses are anonymised, so that attribution is not possible (so-called IP masking). You can revoke the use of Google Analytics in the menu item “Legal information / Tracking" in this app at any time and with effect for the future.

adjust
Furthermore, our app uses the adjust Analysis Service, a product of adjust GmbH. When you install our app, adjust stores installation and event data (e.g. app usage). In this way, we can understand how you interact with our app. Furthermore, it allows us to analyse and improve our mobile advertising campaigns. For this analysis, adjust uses

the IDFA (Identifier for Advertising on iOS devices) or the Android advertising ID,
the IP or MAC address;
the HTTP header and
a fingerprint of your terminal device (in addition: time of access, country, language, local settings, operating system and version and the app version).

This data is anonymised before processing for the aforementioned purposes, i.e. it is possible neither for us nor adjust to identify you using these data.
You can reset or disable the IDFA and the Android advertising ID at any time via your operating system.
If you do not wish to be tracked by adjust, you can revoke it in the menu item “Legal Notices / Google Analytics & adjust” in this app at any time and with effect for the future.

Recipients / Categories of recipients:
The data generated by Google Analytics about your usage will as a rule be transmitted to a server at Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 in the USA and stored there. Google will under no circumstances associate your IP address with other data. The data generated by adjust about your usage will be transmitted to servers at adjust GmbH, Saarbrücker Str. 38a, D-10405 Berlin and stored there. This data may also be disclosed to third parties in so far as this is required by law or if third parties process the data on someone’s behalf, bound by their instructions.
Storage duration / criteria for specifying the storage duration:

Once your personal data has been anonymised, a conclusion as to your person is no longer possible. The statistically prepared data will be erased in Google Analytics, and in the adjust software after 26 months. In reports generated on the basis of Google Analytics or adjust, there is no longer any reference to individuals.

Possibility to object / opt-out
If you do not wish to be tracked, you may object to all the aforementioned or individual tracking measures at any time and with effect for the future, as follows:

Google Analytics and adjust: by disabling the corresponding check boxes in the menu item “Legal Notices / Google Analytics & adjust” in this app.

6. Other functions
6.1 Websites you can access via the in-app browser
If you run another function using our app such as selecting special offers via the in-app browser (iOS: Safari / Android: Chrome) you will reach the appropriate sub-pages of our website www.lidl.co.uk or the partner websites located there. Our app offer and our online content that is accessible via the in-app browser may under certain circumstances also contain links to other websites.

If you access websites from the in-app browser (e.g. via links), your personal data will be processed on these websites in deviation from this privacy policy. This privacy policy only applies to our app. Please note the privacy policies of the linked websites. We assume no responsibility for external contents which are provided through links and are specially highlighted and we do not adopt their content as our own. The provider of the website who is referred to is alone responsible for illegal, incorrect or incomplete content and for damages resulting from the use or non-use of the data.

7. Recipients outside the EU
With the exception of the processing by Google Analytics described in Section 5, we will not pass your data to recipients established outside the European Union or the European Economic Area. The processing mentioned causes the data to be transmitted to the servers of Google Inc. in the USA. In a decision of 12 July 2016, the European Commission decided for the USA that an adequate level of data protection exists under the regulations of the EU-U.S. Privacy Shield (so-called “Adequacy Decision” pursuant to Art. 45 GDPR). We use the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, which is certified in accordance with the EU-U.S. Privacy Shield.

8. Your affected rights
8.1 Overview Besides the right to revoke the consent you have given us, you have the following further rights if the respective legal requirements are met:

The right to information about your personal data stored with us as referred to in Article 15 GDPR.
The right to rectification of incorrect data or completion of incomplete data as referred to in Article 16 GDPR
The right to erasure of your personal data stored with us as referred to in Article 17 GDPR and.
The right to restriction of processing of your data as referred to in Article 18 GDPR;
The right to data portability as referred to in Article 20 GDPR;
Right to object as referred to in Article 21 GDPR;

8.2 Right to information as referred to in Article 15 GDPR
You have the right as referred to in Art.15 paragraph 1 GDPR to receive upon request information about the personal data stored with us about you, free of charge. This includes in particular:

the purposes for which the personal data are processed;
the categories of personal data that are processed;
the recipients or the categories of recipients to whom the personal data concerned have been disclosed or are still being disclosed;
the planned duration of storage of the personal data concerning you or, if specific details of this are not possible, criteria for the specification of the retention period;
the existence of a right of rectification or deletion of personal data concerning you or of a restriction on processing by the data controller or of a right to object to such processing;
the existence of a right of appeal to a supervisory authority;
all available information about the origin of the data, if the personal data are not collected from the person concerned;
The existence of an automated decision-making process, including profiling, as referred to in Article 22 paragraphs 1 and 4 GDPR and - at least in these cases - meaningful information about the logic involved as well as the scope and desired impact of such processing for the person concerned.

If personal data are transferred to a third country or to an international organisation, you have the right to be informed about the appropriate guarantees as referred to in Article 46 GDPR in connection with the transfer.

8.3 Right to rectification as referred to in Article 16 GDPR
You have the right to seek the immediate rectification by us of inaccuracies in your personal data. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data - also by means of a supplementary declaration.

8.4 Right to erasure as referred to in Article 17 GDPR
You have the right to request from us that personal data concerning yourself is immediately erased, if one of the following grounds applies:

the personal data are no longer necessary for the purposes for which they have been collected or have been processed in any other way;
you revoke your consent, which supported the processing as referred to in Article 6 paragraph 1(a) or Article 9 paragraph 2(a) GDPR, and there is no other legal basis for processing;
You object to the processing pursuant to Article 21 paragraph 1 or paragraph 2 GDPR, and in the case of Article 21 paragraph 1 GDPR there are no overriding justifiable grounds for the processing;
the personal data have been unlawfully processed;
the deletion of the personal data is necessary for the fulfilment of a legal obligation;
The personal data have been collected in relation to services offered by information society services as referred to in Article 8 paragraph 1 GDPR.

Insofar as we have made the personal data public and are obliged to erase them, we will take appropriate measures taking into account the available technology and the costs of implementation, in order to inform the third parties who are processing your data that you also request from them that they delete all links to these personal data and copies or replications of these personal data.

8.5 Right to restriction of processing pursuant to Article 18 GDPR
You have the right to request from us a restriction of the processing, if one of the following requirements exist:

the correctness of the personal data is disputed by you;
the processing is illegal and you request a restriction of the use of the personal data rather than their erasure;
the data controller no longer requires the personal data for the purposes of the processing, but the person concerned requires them in order to enforce, exercise or defend legal claims or
you have raised an objection to the processing pursuant to Article 21 paragraph 1 GDPR, as long as it is still not certain whether the legitimate grounds of the data controller outweigh those of the person concerned.

8.6 Right to data portability as referred to in Article 20 GDPR
You have the right to receive the personal data that concern you, which you have provided to us, in a structured, common and machine-readable format, and you have the right to transfer these data to another data controller without hindrance by us, insofar as

the processing is based on consent as referred to in Article 6 paragraph 1(a) or Article 9 paragraph 2(a) or on a contract as referred to in Article 6 paragraph 1(b) GDPR and
the processing takes place with the aid of automated procedures.

When exercising your right to data portability, you have the right to ensure that the personal data are transferred directly by us to another data controller, insofar as this is technically feasible.

8.7 Right to object as referred to in Article 21 GDPR
Under the conditions laid down in Article 21 paragraph 1 GDPR, you may object to data processing for reasons arising from your particular situation.
The above general right of objection applies to all processing purposes described in this privacy policy, which are processed on the basis of Article 6 paragraph 1 (f) GDPR. Unlike the special right to object oriented towards data processing for advertising purposes (compare above in particular Sections 9 and 11.6), we are only obliged by the GDPR to implement such a general objection, if you give us reasons of paramount importance for this, e.g. a possible risk to life or health. Furthermore, there is the possibility to contact the supervisory authority responsible for Lidl U.K. GmbH.

9. Point of contact
9.1 Point of contact in case of questions or to exercise your data protection rights
In the case of questions on the website or the Lidl online shop or to exercise your rights with regard to the processing of your data (data protection rights) you can contact our customer service.

9.2 Point of contact in case of questions regarding data protection
If you have further questions regarding the processing of your data, you can contact Lidl’s company data protection officer (see Section 10).
9.3 Right of complaint to the supervisory data protection authority
In addition, you have the right to complain at any time to the responsible supervisory data protection authority. For this, you can contact the Information Commissioner’s Office (ICO).

10. Name and contact details of the controller of the processing and contact details of the company Data Protection Officer
This privacy notice applies to data processing by Lidl U.K. GmbH and Lidl Great Britain Limited, 19 Worple Road, Wimbledon, London, SW19 4JS (“Data Controller”) and the Lidl App. The Company Data Protection Officer of Lidl U.K. GmbH can be contacted at the above-mentioned address, c/o the Data Protection Officer or at Data.Protection@lidl.co.uk.