Legal Information
Data protection notice for our social networks
Lidl Stiftung & Co. KG
Stiftsbergstraße 1
74167 Neckarsulm
Germany
Local Court (Amtsgericht) of Stuttgart: HRA 102314
Lidl Stiftung & Co. KG is represented by LSt Stiftung, with its registered office in Dresden, regional council of Saxony, AZ 20-2245/501, which is in turn represented by two directors, including Mr Kenneth McGrath and Dr Christian Groh who are authorized to represent the company acting jointly.
VAT ID no.: DE145803808
Contact us:
Phone: +49 (0)7132 / 94-2000
Email: kontakt@lidl.com
In the following, we would like to inform you about how your data is handled on our social networks in accordance with Article 13 of the General Data Protection Regulation (GDPR).
We, Lidl Stiftung & Co. KG, Stiftbergstraße 1, 74167 Neckarsulm, and in some cases the respective operators of the network platforms (the “platforms”) are responsible for the data collection and processing described below.
For certain processing operations, we and the platform operators also act as joint controllers within the meaning of Article 26 GDPR (processing operations pursuant to clause 4).
We, Stiftung & Co. KG ("Lidl"), operate the following network sites ("Sites"):
We have only limited control over the data processing by the platform operators (e.g., management of members and shared information). Where we can exert influence and parameterize data processing, we work to ensure that the platform operator uses the data in accordance with data protection requirements. In many cases, however, we cannot influence the data processing by the platform operator and we do not know exactly which data are processed by the platform operator.
The platform operator operates the entire IT infrastructure of the service, maintains its own data protection provisions and maintains its own user relationship with you (if you are a registered user of the social network). In addition, the operator is solely responsible for all questions relating to the data in your user profile, to which we as a company do not have access.
For more information about data processing by the platform provider and other options to object, see the provider's privacy policy:
When using the platform, your personal data will generally also be processed by the respective platform operator on servers in third countries, in particular in the USA and the United Kingdom.
Purpose of data processing by us / legal basis:
The purpose of data processing by us on our website is to inform customers about offers, products, services, promotions, prize draws, factual topics, company news and to interact with visitors to the websites on these topics, as well as to respond to corresponding questions, praise or criticism.
We only reserve the right to delete content if necessary. We may share your content on our site if this is a function of the platform and communicate with you via the platform. The legal basis is Article 6 (1) (f) GDPR. The data are processed in the interest of our public relations work and communication.
The operator has no influence on the processing of your data by Lidl in the context of customer communication or prize draws.
As already mentioned, where the platform provider gives us the opportunity, we ensure that our pages are designed to be as compliant with data protection law as possible.
Recipients / categories of recipients:
The data you enter on our website, such as: For this purpose, e.g. comments, videos, images, likes, public messages, etc., are published by the platform and are not used or processed by us for other purposes at any time. We only reserve the right to delete illegal content if necessary. This is the case, for example, in the case of infringing or unlawful posts, hateful comments, lewd comments (explicitly sexual content) or attachments (e.g., images or videos) that may violate copyrights, personal rights, criminal law or Lidl's ethical principles.
We may share your content on our site if this is a function of the platform and communicate via the social networks. If you submit a request to us on the platform, depending on the required response, we may also refer you to other secure means of communication that guarantee confidentiality. You always have the option of sending confidential inquiries to the address specified in clause 1 or in the legal notice.
We do not generally disclose data to third parties outside the Lidl Group with regard to data that you provide to us in a confidential manner (e.g., by private message, letter or e-mail). In exceptional cases, data will be processed by processors on our behalf. These are carefully selected, audited by us and bound by contract in accordance with Article 28 GDPR. It may also be necessary for us to pass on excerpts of your confidential inquiry to contractual partners (e.g., suppliers in the case of product-specific inquiries) in order to process your inquiry. In these cases, however, the request will be anonymized beforehand so that the third party cannot establish any reference to you. If it is necessary to disclose your personal information in individual cases, we will inform you in advance and obtain your consent.
Storage period / criteria for determining the storage period:
We will delete or securely anonymize all personal information that you send us in response to inquiries (suggestions, praise or criticism) by secure message no later than 95 days after the final response has been sent to you. The retention period of 95 days is explained by the fact that it may occasionally happen that you, as a customer, contact us again about the same matter and then we must be able to refer to the previous correspondence. Experience has shown that after 95 days there are generally no more questions about our responses.
All public posts made by you on this page remain in the timeline indefinitely, unless we delete them due to an update of the underlying topic, a breach of the law or a breach of our guidelines, or you delete the post on your own.
We have no control over the deletion of your data by the operator. Therefore, the data protection provisions of the respective operator shall also apply.
Purposes of data processing / legal basis:
You have the opportunity to participate in various prize draws on our social media sites. Unless otherwise stipulated in the respective prize draw, or you have not given us any further express consent, the personal data you provide to us in the context of participating in the prize draw will be used solely for the purposes of processing the prize draw (e.g., winners, notification of winners, sending of the prize, where applicable, anonymous announcement of winners). If you use a real name on the social network concerned or are identifiable by photos in your profile, it cannot be ruled out that you will be identified by other users.
The legal basis for data processing in the context of prize draws is Article 6 (1) (b) GDPR. Where consent is given in the context of a prize draw, Article 6 (1) (a) GDPR is the legal basis for the data processing based on the consent. If you have given your consent in the context of a prize draw, you have the option of withdrawing this consent at any time with effect for the future.
Recipients / categories of recipients:
The data will only be disclosed to third parties if this is necessary for the performance of the prize draw or for the prize to be sent (e.g., the prize is sent by the sponsor of a prize draw or the data is passed on to a logistics company) or if you have given us your express consent to do so. Please note that with some sites on social networks, you may also be able to participate directly on the publicly viewable websites (e.g., on the pin board or via comments) and thus other users can also see the fact of your participation publicly through your interaction with us. In such cases, the fact that you have won may also be visible on the respective page. If you use a real name on the social network concerned or are identifiable by photos in your profile, it cannot be ruled out that you will be identified by other users.
Storage period / criteria for determining the storage period:
Once the prize draw has ended and the winners have been announced, the participants' personal data will be deleted from the prize draw management portal within two weeks of the prize draw. In the case of non-cash prizes, the data of the winners will be stored for the duration of the statutory warranty claims in order to arrange for a repair or replacement if necessary. When participating in a prize draw on a website (e.g., by post or comment), we have no control over the deletion of your data. Therefore, the data protection provisions of the respective operator of the site (see above) shall also apply.
Purposes of data processing / legal basis:
In addition to the information you provide to us directly via the platform, we also use social listening and social media monitoring to gain an idea of how our products and services are perceived, to assess our marketing activities and to identify any potential for improvement. Posts on platforms are evaluated based on a search request (e.g., for a new product line) or specific KPIs (e.g., views, number of clicks). Only those contributions that have been made freely available by you to an unrestricted public will be viewed.
The scope of the collected data is primarily determined by the type and content of the respective contribution; for example, a posting in text form or an uploaded image file may be affected. In individual cases, the user ID used may also be relevant, if Lidl would like to offer help with any problems. In some cases, we also receive information from the respective platform operators about the reach of the relevant posts.
The legal basis for the processing of personal data in the context of social listening is Article 6 (1) (f) GDPR because we have a legitimate interest in being able to identify any deficiencies in our products and services by means of freely visible statements and to be able to respond appropriately.
Recipients / categories of recipients:
If we use external processors in the context of social listening or social media monitoring, they are bound by contract in accordance with Article 28 GDPR. As part of our cooperation with Socialbakers a.s., the aforementioned data is generally also processed on servers in the USA for the purposes of social media monitoring.
Storage period / criteria for determining the storage period:
Lidl does not store the relevant data on a permanent basis, but merely analyzes it in a targeted manner with regard to potentially necessary countermeasures. If necessary, we may retain your data for up to 2 years for annual comparative analyzes if you have not deleted your data from the platform yourself beforehand.
There is a relationship with the following platform operator pursuant to Article 26 (1) GDPR (joint responsibility):
The platform operator and we act as joint controllers for the web tracking methods used by the platform operator. Web tracking can also be performed regardless of whether you are logged in or registered with the platform. As already mentioned, we are unfortunately unable to influence the web tracking methods of the platform. We cannot switch this off, for example.
The legal basis for the web tracking methods is your consent in accordance with Article 6 (1) (a) GDPR.
Further information on the recipients or categories of recipients as well as the storage period or the criteria for determining the storage period can be found in the data protection declarations of the platform operators. We don’t have any control about it.
You can find out how to exercise your rights to prevent these web tracking methods or to withdraw your consent in the platform operator's privacy policy listed in clause 2. You can also contact the platform operator using the contact details provided in the legal notice.
With regard to statistics provided to us by the provider of the platform, we can only influence and prevent them to a limited extent. However, we ensure that no additional optional statistics are made available to us.
Please also note that the provider of the platform uses your profile and behavioral data in accordance with its terms of use and data protection in order to evaluate your habits, personal relationships, preferences, etc. Lidl has no control over the processing or transfer of your data by the platform provider.
If we transfer data to recipients in a third country (registered office outside the European Economic Area), this can be found in the information on the recipients / categories of recipients in the description of the respective data processing. The European Commission has issued so-called adequacy decisions to certify that some third countries have a level of data protection comparable to that in the European Economic Area. A list of these countries is available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. If there is no comparable data protection standard in a given country, we ensure that data protection is adequately guaranteed by other measures. This is possible, for example, through binding corporate regulations, European Commission standard contractual clauses on the protection of personal data, Certificates or recognized codes of conduct. Please contact our data protection officer (clause 8) for further information.
If necessary, your use of the platform may also result in the processing of your data by the platform operator in a third country (domicile outside the European Economic Area). For more information about the processing of your data in a third country over which Lidl has no control, please refer to the privacy policies of the platform operators listed under clause 2.
In addition to the right to revoke your consent given to us, you have the following further rights if the respective legal requirements are met:
Pursuant to Article 15 (1) GDPR, you have the right to request information free of charge about the personal data stored about you. This includes in particular:
If personal data are transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer.
You have the right to demand that we correct any incorrect personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data, including by means of a supplementary statement.
You have the right to request that we erase personal data concerning you without undue delay if one of the following reasons applies:
If we have made the personal data public and are obliged to delete it, we shall take appropriate measures, taking into account the available technology and the implementation costs, to inform the third parties processing your data that you have also requested the deletion of all links to the personal data Request data or copies or replications of such personal data.
You have the right to request that we restrict processing if one of the following conditions applies:
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transfer that data to another controller without hindrance from us, if
When exercising your right to data portability, you have the right to have the personal data transferred directly from us to another controller, insofar as this is technically feasible.
Subject to the requirements of Article 21 (1) GDPR, you may object to data processing for reasons arising from your particular situation. The foregoing general right to object applies to all processing purposes described in this privacy policy, which are processed on the basis of Article 6 (1) (f) GDPR. In contrast to the special right to object to data processing for advertising purposes, under the GDPR we are only obliged to implement such a general objection if you give us reasons of overriding importance, e.g., a possible risk to life or health. It is also possible to contact the supervisory authority responsible for Lidl or the data protection officer of Lidl.
You also have the right to lodge a complaint with the competent data protection supervisory authority at any time. For this purpose, you can contact the data protection supervisory authority of the federal state in which you have your place of residence or the authority of the federal state in which the controller is domiciled.
If you have any questions about our presence on social networks or about exercising your rights as a data subject, please contact our customer service team:
The company data protection officer of Lidl Stiftung & Co. KG can be contacted at the address specified for the companies in clause 1, for the attention of the data protection officer, or at the contact address specified in clause 7.