DATA PRIVACY SOCIAL MEDIA

A. Information About Our Prize Draws

Privacy Policy for Prize Draws

In addition to our Privacy Policy, we would like to inform you below about the data processed in connection with our prize draws.

A 1. Controller

Unless otherwise indicated below, the controller (Article 4(7) UK GDPR) for the data processing detailed in the following is:

Lidl Stiftung & Co. KG
Stiftsbergstr. 1
74167 Neckarsulm
Germany
E-mail: kontakt@lidl.com

Should you have any general questions, you can also reach us at contact@parkside-diy.com.
Our company Data Protection Officer can be contacted at the above address for the attention of the Data Protection Officer or by e-mail at Privacy_gb@parkside-diy.com.

A 2. Data Processing in Connection with Prize Draws

Purposes and Legal Bases

You can take part in various prize draws on our website, via our newsletter or on our social media sites. Unless otherwise provided in the given prize draw, or unless you have given us further explicit consent, the personal data you provide to us in the context of participating in the prize draw will be used solely for the purpose of conducting the prize draw (e.g., drawing and notifying winners, sending the prize, announcing winners anonymously, where applicable). If you use your real name on the social network or can be recognised from photos in your profile, we cannot rule out that other users will be able to identify you.

We process your e-mail address, name and surname, social media account name, postal address and other necessary information relating to the award of the prize (e.g., clothing size) in order to conduct the prize draw, in particular to determine and contact the winner and to fulfil our obligations to the winner arising from the prize. The legal basis for the processing in the context of prize draws is generally Article 6(1)(b) UK GDPR.

In the event that consent is given in the context of a prize draw, Article 6(1)(a) UK GDPR is the legal basis for any data processing carried out on the basis of such consent. Where you have given consent to enter a prize draw, you can withdraw it at any time. Withdrawing your consent will only apply to future processing and will not impact any actions taken before your request

Recipients/Categories of Recipients:

We use additional service providers for this data processing to assist us with conducting prize draws. For this purpose, the above-mentioned personal data will be made available to the service provider, e.g., for the determination of winnings or the dispatch of prizes.

Please note that on some social media sites, you may also be able to participate directly on the publicly visible websites (e.g., on the wall or via comments), so that other users will be able to see that you are participating when you publicly interact with us. In these cases, it will also be apparent on the respective site when you win the prize draw. If you use your real name on the social network or can be recognised from photos in your profile, we cannot rule out that other users will be able to identify you.

For tax reasons, we will transfer the winner data to Schwarz Corporate Solutions KG, Stiftsbergstr. 1, 74172 Neckarsulm, Germany

Storage Time/Criteria for Determining Storage Time:

At the end of the prize draw and following the announcement of the winners, participants' personal data will be deleted within two weeks after the prize has been dispatched. We retain data concerning the winners for six years for tax purposes.
If you participate in a prize draw on a social media site (e.g., by post or comment), we have no control over the deletion of your data by the operator. The privacy policy of the relevant operator of the social media site therefore also applies in relation to the storage period (see clause B 2.).

A 3. Obligation to Provide Data/Automated Decision-making

The provision of personal data is required to participate in the prize draw. You will not be able to participate in the prize draw if you do not provide this data.
No automated decision-making including profiling pursuant to Article 22(1) and (4) GDPR takes place.

A 4. Your Rights as a Data Subject

You may withdraw consent at any time with effect for the future without this affecting the lawfulness of the previous processing.

You also have the following rights: Right to obtain information about the personal data stored about you, a right to rectification, erasure and restriction of processing of your personal data (Articles 15–18 GDPR). Provided the requirements of Article 20 GDPR are met, you have a right to data portability in accordance with Article 20 GDPR.
In the case of data processing on the basis of Article 6(1) sentence 1(f) GDPR (processing on the basis of a legitimate interest), you have the right to object in accordance with Article 21 GDPR.
You also have a right to lodge a complaint with a data protection supervisory authority at any time.
You can find detailed information on these rights and on exercising your rights as a data subject in our Privacy Policy.
The company data protection officer of Lidl Stiftung & Co. KG can be contacted at the address provided above under A 1. for the attention of the data protection officer or at datenschutz@lidl.com.

B. Information on and Privacy Policy for Our Social Media Sites

B 1. Social Media Legal Notices

Site operator for the following network sites

is

Lidl Stiftung & Co.KG

Stiftsbergstraße 1
74167 Neckarsulm
Germany
Local Court (Amtsgericht) of Stuttgart, HRA 102314
VAT ID no.: DE145803808

Lidl Stiftung & Co. KG is represented by LSt Stiftung, registered office in Dresden, State Directorate (Landesdirektion) of Saxony, ref. 20-2245/501, which in turn is represented by two directors, including Kenneth McGrath and Pierre Schalbe, who are authorised to represent the company acting jointly.

Contact:

Tel.: 07132 / 94-2000
E-mail: kontakt@lidl.com

B 2. The Platform Operator as Controller

We have only limited control over the processing of data by the operators of the platforms (e.g., the management of members and the information shared). In the situations in which we are able to have influence and can set parameters for the data processing, we endeavour to ensure within the confines of the options available to us that the platform operator deals with the data in accordance with data protection law requirements. In many cases, however, we are unable to influence the way in which platform operators process data and also do not know exactly which data they process.

Platform operators operate the entire IT infrastructure of the service, have their own privacy policies and maintain their own user agreements with you (where you are a registered user of the social media service). The operator is also solely responsible for all questions relating to the data that makes up your user profile, which we as a company have no access to.

You will find further information about the data processing performed by platform operators and your rights to object in the individual operator's privacy policy.

Within the scope of platform use, your personal data is also generally processed by the respective platform operator on servers in third countries, in particular in the United States and the United Kingdom.

B 3. Data Processing for which We are Responsible

a) Our Social Media Sites

Purpose of the Processing We Perform and Legal Basis

We process data on our sites for the purpose of providing information to customers about offers, products, services, promotions, prize draws, specific topics and latest company news, to interact with visitors to our sites on these topics, and to respond to relevant enquiries and positive or negative feedback.

We merely reserve the right to delete content if it becomes necessary to do so. We may share your content on our site if this is one of the functions of the platform, and communicate with you through the platform. The legal basis is Article 6(1)(f) GDPR. The processing is carried out for the purpose of our public relations work and communications.

Operators have no ability to influence Lidl's processing of your data in connection with customer communications or prize draws.

As already mentioned, where platform operators give us the option, we make sure we design our sites to be as compliant as possible with data protection laws.

Recipients/Categories of Recipients:

The data entered by you on our sites, such as comments, videos, images, likes, public messages, etc., is published by the platforms and is not used or processed by us for other purposes at any time. We merely reserve the right to delete unlawful content if it becomes necessary to do so. This would be the case, for example, for posts that infringe rights or violate the law, comments that incite hatred, offensive comments (sexually explicit content) or attachments (e.g., images or videos), which may be in violation of copyright laws, moral rights/rights of publicity, criminal law or Lidl's ethical principles.

We may share your content on our site if this is one of the functions of the platform, and communicate with you through the social media services. If you post an enquiry on the social media platform, we may also, depending on the required response, refer you to other more secure modes of communication that guarantee confidentiality. You always have the option of sending confidential enquiries to us at our address listed under clause A 1. above or in the "legal notice" section of our website.

Data that you send to us via a confidential channel (e.g., by private message, letter or e-mail) will not be transferred to third parties outside Lidl Group. In exceptional cases, we will have a processor process the data on our behalf. Such processors are carefully selected, audited by us and bound by contract in accordance with Article 28 GDPR. Furthermore, it may be necessary for us to pass on extracts of your confidential enquiry to contractual partners (e.g., suppliers in the case of product-specific enquiries) for the purpose of processing your enquiry. In these cases, however, your enquiry will be anonymised in advance, meaning that third parties will not be able to identify you. Should it be necessary to pass on your personal information in individual cases, we will notify you in advance and obtain your consent.

Storage Time/Criteria for Determining Storage Time:

We delete or securely anonymise all information we receive from you when you make enquiries (positive/negative comments or suggestions) via a secure message no later than 90 days after the final response is sent to you. The information is retained for 90 days in case you contact us again as a customer after receiving a response from us on the same matter and we need to refer to our previous correspondence. Based on experience, we generally do not receive any questions concerning our responses after 90 days.

All public posts that you put on this site remain in the timeline for an indefinite period, unless we delete them as part of updating the information on the topic, they violate the law or breach our guidelines or policies, or you delete the post yourself.

We have no control over the deletion of your data by the operator itself. The privacy policy of the relevant operator therefore also applies in relation to the storage period.

b) Social Listening and Social Media Monitoring

Purposes of the Processing/Legal Bases:

In addition to the information you provide us directly via platforms, we also use "social listening" and social media monitoring tools to get a picture of how our marketing activities are perceived and to identify any opportunities for improvement. Posts on platforms are analysed via search requests (e.g., for a new product line) or certain indicators (e.g., page views, number of clicks). Only those posts are viewed which you have made freely available to the public.

The scope of the data collected is determined primarily by the type and content of the respective post. For example, a post in text form or an uploaded image file may be affected. In some cases, the specific user ID may also be relevant, for instance when Lidl wishes to offer assistance with any problems. Sometimes we also receive information from the respective platform operators about the coverage of the relevant posts.

The legal basis for processing personal data in the context of social listening is Article 6(1)(f) GDPR because we have a legitimate interest in being able to listen to what our audience is saying, identify any weaknesses in our products and services and respond to them appropriately.

Recipients/Categories of Recipients:

To the extent we use external processors in relation to social listening or social media monitoring, such processors will be bound by contract in accordance with Article 28 GDPR. In the context of our cooperation with our processors, the aforementioned data is generally also processed for social media monitoring purposes on servers located in the United States. Please see clause B 5. for more information on how we ensure the security of data transfers to recipients in a third country.

Storage Time/Criteria for Determining Storage Time:

The relevant data will not be stored permanently by Lidl, it will only be analysed for the specific purpose of identifying countermeasures that may need to be taken. Where necessary, we may continue to retain your data for annual comparative evaluations for up to two years if you have not already deleted your data from the platform yourself.

B 4. Joint Controllers, Article 26(1) GDPR

We and Facebook, https://en-gb.facebook.com/legal/terms/page_controller_addendum, act as joint controllers as defined in Article 26(1) GDPR.

We and the platform operator act as joint controllers with regard to the web tracking methods used by the platform operator. Web tracking can occur regardless of whether you are logged in or registered on the platform. As already explained, unfortunately we have almost no control over the web tracking methods used by platforms. We are unable, for example, to switch web tracking off.

The legal basis for the aforementioned web tracking methods is your consent pursuant to Article 6(1)(a) GDPR.

For further information about recipients and categories of recipients and the duration of data storage and the criteria for determining the storage period, please refer to the privacy policies of the platform operators. We do not have any control over this.

You will find information on the rights available to you to prevent these web tracking methods or to revoke your consent in the privacy policies of the platform operators set out in clause B 2. You can also contact the platform operators about this using the contact details provided in the legal notice section of their respective websites.

We have only a very limited ability to influence and prevent the provision of statistics to us by platform operators. However, we do make sure that we do not receive any additional optional statistics.

Please note also that the platform provider uses your profile and behaviour data in accordance with its terms of use and privacy policy to analyse your habits, personal relationships and preferences. Lidl has no control over the processing or disclosure of your data by platform operators.

B 5. International Data Transfers (Processing Outside the UK)

If we transfer your personal data to recipients located outside the United Kingdom, this will be highlighted under the respective processing description.

Certain countries, territories, or specific sectors outside the UK have been officially recognised by the UK Government as providing an adequate level of data protection comparable to UK standards (known as UK adequacy regulations or "data bridges"). This includes countries within the European Economic Area (EEA).

Where a country does not benefit from UK adequacy regulations, we ensure that an adequate level of data protection is guaranteed by putting in place appropriate legal safeguards required by Article 46 of the UK GDPR. These safeguards may include:

  • The UK International Data Transfer Agreement (IDTA) or the UK Addendum to international transfer clauses;
  • Binding Corporate Rules (BCRs) approved by the UK Information Commissioner's Office (ICO); or
  • Approved codes of conduct or certification mechanisms.

For further information on international data transfers or to request details on the specific safeguards used, please contact our Data Protection Officer (clause A 1.).

Your use of third-party platforms linked to our service may result in those operators processing your data outside the UK under their own responsibility. Please consult the respective platform's privacy policy (referred to in clause B 2.) for details on their international data transfer practices.

B 6. Your Rights as a Data Subject

If the data processing is carried out on the basis of consent granted under Article 6(1) (a) or Article 9(2)(a) UK GDPR, you may revoke that consent at any time with effect for the future without this affecting the lawfulness of the previous processing.

Pursuant to Article 15(1) UK GDPR, you have the right to request information, free of charge, on the personal data stored about you.

If the statutory requirements are met, you also have a right to rectification (Article 16 UK GDPR), erasure (Article 17 UK GDPR) and restriction of processing (Article 18 UK GDPR) of your personal data.

If you have provided the processed data yourself, you have a right to data portability under Article 20 UK GDPR.

If the basis of processing is Article 6 (1) (f) UK GDPR, you have a right to object under Article 21 UK GDPR. If you object to processing, your data will only be processed thereafter if we can demonstrate compelling legitimate grounds for the processing which override your interests in the objection.

If you have any questions or wish to exercise your rights, you can contact the Data Protection Officer in writing or by e-mail (see section 1). You also have a right to lodge a complaint. If you reside in the United Kingdom and wish to raise a concern regarding how we handle your data, please use our complaints form. We aim to respond to all complaints within one calendar month. If you remain unhappy with our final response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO) via their website at www.ico.org.uk or by calling 0303 123 1113.