B. Information on and Privacy Policy for Our Social Media Sites
B 1. Social Media Legal Notices
Site operator for the following network sites
is
Lidl Stiftung & Co.KG
Stiftsbergstraße 1
74167 Neckarsulm
Germany
Local Court (Amtsgericht) of Stuttgart, HRA 102314
VAT ID no.: DE145803808
Lidl Stiftung & Co. KG is represented by LSt Stiftung, registered office in Dresden, State Directorate (Landesdirektion) of Saxony, ref. 20-2245/501, which in turn is represented by two directors, including Kenneth McGrath and Pierre Schalbe, who are authorised to represent the company acting jointly.
Contact:
Tel.: 07132 / 94-2000
E-mail: kontakt@lidl.com
B 2. The Platform Operator as Controller
We have only limited control over the processing of data by the operators of the platforms (e.g., the management of members and the information shared). In the situations in which we are able to have influence and can set parameters for the data processing, we endeavour to ensure within the confines of the options available to us that the platform operator deals with the data in accordance with data protection law requirements. In many cases, however, we are unable to influence the way in which platform operators process data and also do not know exactly which data they process.
Platform operators operate the entire IT infrastructure of the service, have their own privacy policies and maintain their own user agreements with you (where you are a registered user of the social media service). The operator is also solely responsible for all questions relating to the data that makes up your user profile, which we as a company have no access to.
You will find further information about the data processing performed by platform operators and your rights to object in the individual operator's privacy policy.
Within the scope of platform use, your personal data is also generally processed by the respective platform operator on servers in third countries, in particular in the United States and the United Kingdom.
B 3. Data Processing for which We are Responsible
a) Our Social Media Sites
Purpose of the Processing We Perform and Legal Basis
We process data on our sites for the purpose of providing information to customers about offers, products, services, promotions, prize draws, specific topics and latest company news, to interact with visitors to our sites on these topics, and to respond to relevant enquiries and positive or negative feedback.
We merely reserve the right to delete content if it becomes necessary to do so. We may share your content on our site if this is one of the functions of the platform, and communicate with you through the platform. The legal basis is Article 6(1)(f) GDPR. The processing is carried out for the purpose of our public relations work and communications.
Operators have no ability to influence Lidl's processing of your data in connection with customer communications or prize draws.
As already mentioned, where platform operators give us the option, we make sure we design our sites to be as compliant as possible with data protection laws.
Recipients/Categories of Recipients:
The data entered by you on our sites, such as comments, videos, images, likes, public messages, etc., is published by the platforms and is not used or processed by us for other purposes at any time. We merely reserve the right to delete unlawful content if it becomes necessary to do so. This would be the case, for example, for posts that infringe rights or violate the law, comments that incite hatred, offensive comments (sexually explicit content) or attachments (e.g., images or videos), which may be in violation of copyright laws, moral rights/rights of publicity, criminal law or Lidl's ethical principles.
We may share your content on our site if this is one of the functions of the platform, and communicate with you through the social media services. If you post an enquiry on the social media platform, we may also, depending on the required response, refer you to other more secure modes of communication that guarantee confidentiality. You always have the option of sending confidential enquiries to us at our address listed under clause A 1. above or in the "legal notice" section of our website.
Data that you send to us via a confidential channel (e.g., by private message, letter or e-mail) will not be transferred to third parties outside Lidl Group. In exceptional cases, we will have a processor process the data on our behalf. Such processors are carefully selected, audited by us and bound by contract in accordance with Article 28 GDPR. Furthermore, it may be necessary for us to pass on extracts of your confidential enquiry to contractual partners (e.g., suppliers in the case of product-specific enquiries) for the purpose of processing your enquiry. In these cases, however, your enquiry will be anonymised in advance, meaning that third parties will not be able to identify you. Should it be necessary to pass on your personal information in individual cases, we will notify you in advance and obtain your consent.
Storage Time/Criteria for Determining Storage Time:
We delete or securely anonymise all information we receive from you when you make enquiries (positive/negative comments or suggestions) via a secure message no later than 90 days after the final response is sent to you. The information is retained for 90 days in case you contact us again as a customer after receiving a response from us on the same matter and we need to refer to our previous correspondence. Based on experience, we generally do not receive any questions concerning our responses after 90 days.
All public posts that you put on this site remain in the timeline for an indefinite period, unless we delete them as part of updating the information on the topic, they violate the law or breach our guidelines or policies, or you delete the post yourself.
We have no control over the deletion of your data by the operator itself. The privacy policy of the relevant operator therefore also applies in relation to the storage period.
b) Social Listening and Social Media Monitoring
Purposes of the Processing/Legal Bases:
In addition to the information you provide us directly via platforms, we also use "social listening" and social media monitoring tools to get a picture of how our marketing activities are perceived and to identify any opportunities for improvement. Posts on platforms are analysed via search requests (e.g., for a new product line) or certain indicators (e.g., page views, number of clicks). Only those posts are viewed which you have made freely available to the public.
The scope of the data collected is determined primarily by the type and content of the respective post. For example, a post in text form or an uploaded image file may be affected. In some cases, the specific user ID may also be relevant, for instance when Lidl wishes to offer assistance with any problems. Sometimes we also receive information from the respective platform operators about the coverage of the relevant posts.
The legal basis for processing personal data in the context of social listening is Article 6(1)(f) GDPR because we have a legitimate interest in being able to listen to what our audience is saying, identify any weaknesses in our products and services and respond to them appropriately.
Recipients/Categories of Recipients:
To the extent we use external processors in relation to social listening or social media monitoring, such processors will be bound by contract in accordance with Article 28 GDPR. In the context of our cooperation with our processors, the aforementioned data is generally also processed for social media monitoring purposes on servers located in the United States. Please see clause B 5. for more information on how we ensure the security of data transfers to recipients in a third country.
Storage Time/Criteria for Determining Storage Time:
The relevant data will not be stored permanently by Lidl, it will only be analysed for the specific purpose of identifying countermeasures that may need to be taken. Where necessary, we may continue to retain your data for annual comparative evaluations for up to two years if you have not already deleted your data from the platform yourself.
B 4. Joint Controllers, Article 26(1) GDPR
We and Facebook, https://en-gb.facebook.com/legal/terms/page_controller_addendum, act as joint controllers as defined in Article 26(1) GDPR.
We and the platform operator act as joint controllers with regard to the web tracking methods used by the platform operator. Web tracking can occur regardless of whether you are logged in or registered on the platform. As already explained, unfortunately we have almost no control over the web tracking methods used by platforms. We are unable, for example, to switch web tracking off.
The legal basis for the aforementioned web tracking methods is your consent pursuant to Article 6(1)(a) GDPR.
For further information about recipients and categories of recipients and the duration of data storage and the criteria for determining the storage period, please refer to the privacy policies of the platform operators. We do not have any control over this.
You will find information on the rights available to you to prevent these web tracking methods or to revoke your consent in the privacy policies of the platform operators set out in clause B 2. You can also contact the platform operators about this using the contact details provided in the legal notice section of their respective websites.
We have only a very limited ability to influence and prevent the provision of statistics to us by platform operators. However, we do make sure that we do not receive any additional optional statistics.
Please note also that the platform provider uses your profile and behaviour data in accordance with its terms of use and privacy policy to analyse your habits, personal relationships and preferences. Lidl has no control over the processing or disclosure of your data by platform operators.
B 5. International Data Transfers (Processing Outside the UK)
If we transfer your personal data to recipients located outside the United Kingdom, this will be highlighted under the respective processing description.
Certain countries, territories, or specific sectors outside the UK have been officially recognised by the UK Government as providing an adequate level of data protection comparable to UK standards (known as UK adequacy regulations or "data bridges"). This includes countries within the European Economic Area (EEA).
Where a country does not benefit from UK adequacy regulations, we ensure that an adequate level of data protection is guaranteed by putting in place appropriate legal safeguards required by Article 46 of the UK GDPR. These safeguards may include:
- The UK International Data Transfer Agreement (IDTA) or the UK Addendum to international transfer clauses;
- Binding Corporate Rules (BCRs) approved by the UK Information Commissioner's Office (ICO); or
- Approved codes of conduct or certification mechanisms.
For further information on international data transfers or to request details on the specific safeguards used, please contact our Data Protection Officer (clause A 1.).
Your use of third-party platforms linked to our service may result in those operators processing your data outside the UK under their own responsibility. Please consult the respective platform's privacy policy (referred to in clause B 2.) for details on their international data transfer practices.
B 6. Your Rights as a Data Subject
If the data processing is carried out on the basis of consent granted under Article 6(1) (a) or Article 9(2)(a) UK GDPR, you may revoke that consent at any time with effect for the future without this affecting the lawfulness of the previous processing.
Pursuant to Article 15(1) UK GDPR, you have the right to request information, free of charge, on the personal data stored about you.
If the statutory requirements are met, you also have a right to rectification (Article 16 UK GDPR), erasure (Article 17 UK GDPR) and restriction of processing (Article 18 UK GDPR) of your personal data.
If you have provided the processed data yourself, you have a right to data portability under Article 20 UK GDPR.
| If the basis of processing is Article 6 (1) (f) UK GDPR, you have a right to object under Article 21 UK GDPR. If you object to processing, your data will only be processed thereafter if we can demonstrate compelling legitimate grounds for the processing which override your interests in the objection. |
If you have any questions or wish to exercise your rights, you can contact the Data Protection Officer in writing or by e-mail (see section 1). You also have a right to lodge a complaint. If you reside in the United Kingdom and wish to raise a concern regarding how we handle your data, please use our complaints form. We aim to respond to all complaints within one calendar month. If you remain unhappy with our final response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO) via their website at www.ico.org.uk or by calling 0303 123 1113.