Quality for less.
Top Employer

Data Protection Policy

Data Protection Policy

We are very pleased by your interest regarding data protection on our website. We want you to feel satisfied and safe during your visit to our website and to consider the application of data protection a customer-oriented quality characteristic.

Through the following data protection notifications we will inform you how we processes personal data and the range of that processing. Personal data are information that is categorised or can be categorised directly or indirectly regarding your person. The main legislative framework governing data protection is the General Data Protection Regulation (GDPR). 

Content overview:

1. Overview
2. Entering our website
3. Online presence and website optimisation
4. Email contact
5. Social media plugins
6. Recipients outside the EU
7. Integrated content
8. Your rights as data subjects
9. Parties responsible for communication  
10. Name and contact information of the party responsible for processing, as well as the contact information of the party responsible for data protection in the company.

 

1. Overview

Upon entering our website, various items of data are exchanged between your terminal and our server. In this event, personal data may also be processed. Data collected in this manner will also be used to improve our website or for advertisement on your terminal’s web browser.

 

2. Entering our website

Purpose of data processing / legal basis:
Upon entering our website your terminal’s web browser will automatically send, with no action on your part,

  • the IP address of the devices with internet access from which the request was submitted, 
  • the date and time of access,
  • the name and the URL of the file requested,
  • the website/ application from which access was carried out (referrer-URL),
  • the browser used and the operating system of the computer you are using with Internet access, as well as the access provider

to our website’s server; this information will temporarily be stored on a log file for the following reasons:

  • to guarantee a correct connection,
  • to guarantee comfortable use of our website/ application 
  • to evaluate the security and stability of our system. 

The legal basis for the processing of the IP address is Article 6 (1) (f) GDPR. Our legitimate interest is in the above listed data processing purposes. If the purpose of the presentation is the preparation of a contract, the legal basis for the data processing is Article 6 (1) (b) GDPR.

Duration of storage/ criteria for determining the duration of storage:

This data will be stored for a time period of 7 days and will then be deleted automatically. As soon as you stop using our website your geolocation data are deleted.

 

3. Online presence and website optimisation

3.1 Cookies – General information

On our websites we use cookies, based on Article 6(1)(f) of the GDPR. Our interest in optimising our website must be considered legitimate, in the sense of the aforementioned provision. Cookies are small files which are stored on your terminal (laptop, tablet, smart phone, etc.) when you visit our website. Cookies do not harm your device, they do not contain viruses, trojans, or other harmful programmes. Cookies collect data which are produced separately in relation to the specific device used. This does not mean that we have direct knowledge of your identity due to them. The use of cookies aims, on the one hand, at offering you more comfortable use. For that reason we use so-called session cookies to recognise that you have already visited separate pages on our website. They are automatically deleted when you leave our website. Apart from that, we use temporary cookies in order to facilitate use, which are stored for a determined period of time on your device. If you visit our website again in order to use our services, we automatically recognise that you have already visited us in the past, what entries you made / settings you changed, so that you don’t have to execute the same actions again.  

On the other hand, we use cookies to statistically analyse the use of our website, aiming at optimising our offers, as well as promoting information that is tailored to you. The cookies in question allow us to automatically recognise that you have visited us before upon your next visit to our website. The cookies in question are automatically deleted after a predetermined period of time. Most browsers automatically accept cookies. However, you can adjust the settings on your browser in such a way that they do not save cookies on your computer or that a notification appears before every new cookie is saved. However, full deactivation of cookies may result in the inability to use certain functions of our website. 

You will find a summary of the cookies used with additional information (e.g. how long they will be saved for) and the possibility to objection to the Cookie Terms.

 

3.2 Google Analytics 

Purpose of data processing / legal bases:
In order to constantly optimise and adjust our websites in accordance with your needs, we use Google Analytics, an online analysis service of Google Inc. (‘Google') based on Article 6, paragraph 1, item f) of the GDPR. Our legitimate interest originates from the aforementioned aims. In this context, 'pseudonymised' usage profiles are created and cookies are used. Cookies record the following data regarding the use of this website:

  • type/ edition of browser
  • operating system used
  • Referrer-URL (the previous website you visited),
  • Host name of access computer (IP address), 
  • time of server request.

The information is used to evaluate the use of our websites, to compile reports regarding website activity and to provide additional services connected to website and internet use for purposes of market research and to adjust the websites in question depending on the needs. IP addresses are made anonymous, so that it is impossible to match them (so-called IP masking). 

You can obstruct cookie installation through the corresponding setting on your browser programme. However, we should point out that in such a case you may not be able to use all the functions of that website. You can also obstruct data analysis created by cookies concerning the use of this website (including the IP address) as well as the processing of the data in question by Google, if you load and install this browser extension. Instead of this browser extension you can also stop analysis by Google Analytics, especially on mobile device browsers, if you click on this link. An opt-out cookie is created which blocks future analysis of your data during your visit to this website. The opt-out cookie is only in effect in this browser and only for our website and is only stored on your device. If you delete the cookies from this browser you must save the opt-out cookie again. More information regarding data protection in relation to Google Analytics can be found at the Google Analytics website

Recipients/ categories of recipients:

Data created by cookies are transmitted to a Google server in the USA and are stored there. In no case is your IP address merged with other Google data. Also, the data in question may be transferred to third parties if it is foreseen by law or if the third parties have been authorised to process this data. 

Duration of storage/ criteria for determining the duration of storage:

After the masking of the IP address it is no longer possible for it to be connected to your person. The data created for statistical reasons are deleted by Google Analytics after 24 months. The reports compiled based on Google Analytics no longer refer to individuals.

 

3.3 Targeting on the website and website optimisation

Purpose of data processing / legal bases:

Data may be analysed and evaluated on our website with the use of cookies, in order to optimise our websites and the advertisements shown on them. In this way we ensure that only an advertisement that is tailored to your real or speculated interests will be displayed on your terminal, based on your use up to that point. The information processed to this end will include, for example, data regarding the products you have shown an interest in. The legal basis for processing the data in question is Article 6, paragraph1, item f) of the GDPR. Therefore, the optimisation of our websites in order to improve your shopping experience and avoid displaying advertisements that are of no interest to you, is both in our interest and yours. Analysis and evaluation is carried out exclusively using a nickname and does not allow us to identify you. Specifically, the data is not merged with your personal data.

Recipients/ categories of recipients:

Data recipients are the aforementioned service providers who process your data on a contractual basis, only for a specific destination and in accordance with our guidelines.

Duration of storage/ criteria for determining the duration of storage:

The Cookies used here and the data contained in them are stored in accordance with the Cookie Terms and are deleted immediately if you object.

 

3.4 Re-targeting

Purpose of data processing / Legal Basis:

We also use re-targeting technology from various providers. This allows us to shape our online offer in a way that is interesting to you. To that end a cookie is created which collects data that are of interest with the use of a nickname. Specifically, data are anonymously collected regarding web browsing for commercial promotion aims and are stored in cookie data files on your computer and analysed via an algorithm. Then targeted product recommendations and tailored banners with products of ours that may be of interest to you can be displayed on the websites of our partners. In no case can these data be used to identify visitors to the website. No processing of direct personal data is carried out and usage profiles are not merged with personal data. The processing in question is carried out based on Article 6(1)(f) of the GDPR. With the use of targeting measures we aim to ensure that only advertisements that are tailored to your real or speculated interests will be displayed on your terminals. It is both in our interest and yours not to encumber you with advertisements of no interest to you.

If, however, you do not wish to see Lidl’s tailored banners displayed, you can object to the collection and storage of data in question in the future by carrying out the following action:

  • By clicking on the symbol that appears on each advertisement banner (e.g.  “i”) you can jump to the website of each individual provider. The systematics of re-targeting technology is clarified anew there and the possibility to opt out is made available. If you unsubscribe from a provider, the so-called opt-out cookie is saved on your computer, which blocks the display of each provider’s advertisement banner in the future. Please take into account that opting out can only be carried out from your computer and that the opt-out cookies may not be deleted from your computer.
  • Alternatively, you can use the opt out options presented in section 3.5 of the data protection terms.

Recipients/ Categories of recipients:

We use re-targeting technologies on our websites from various providers who process the aforementioned data in the framework of re-targeting. You can find further information regarding the cookies used by the providers in question in the Cookie Terms.

Duration of storage/ criteria for determining the duration of storage:

The cookies used for re-targeting and the data contained in them are stored for the amount of time mentioned in the Cookie Terms and are then deleted automatically.

 

3.5 Online interest-based advertising

To ensure that only ads relevant to you are shown, our website evaluates your usage behavior with the help of 'pseudonymised' cookies. In this way, we can provide you with products and services according to your interests. To this end, with the help of service providers listed in section 3, we assess which products you have seen on our website.

To prevent the assessment of your usage behavior listed in section 3, you can use the Opposition Features listed there. In addition, you may prohibit interest-based advertising at http://www.youronlinechoices.com/uk/ for a large number of self-regulatory members of the European Interactive Digital Advertising Alliance (www.edaa.eu/european-principles/), including Lidl, through the so-called Preference management. Note that for this purpose you will have to store the so-called opt-out cookie on your computer. If you delete it, interest-based advertising will be shown again.

 

3.6 Opting-out

You can block the targeting technologies analysed in sections 3.3 and 3.4 by adjusting the cookie settings on your browser (see also section 3.1). At the same time you have the opportunity to block interest based tailored advertisements with the help of a so-called Preference manager or the activation of opt-out cookies submitted in accordance with section 3.5.

 

4. E-Mail-contact

We treat personal data that you communicate to us by e-mail as confidential. We shall use your data solely for handling your enquiry. The legal basis for the data processing is Article 6 (1) (f) GDPR. Our and your parallel (legitimate) interest in processing the data arises in this case from the aim of replying to your enquiry,

Recipients/categories of recipient:

In principle, we shall not pass on data to third parties. In exceptional circumstances, external processors process data on our account. They are carefully selected, audited by us and bound by contract pursuant to Article 28 GDPR.

Storage period/criteria for the establishment of the storage period:

All personal data that accompanies enquires and that you send to us by e-mail shall be deleted and anonymised by us no more than 90 days after the final reply has been given.

 

5. Social media plugins

Data processing purposes/legal bases:

On our website, based on Article 6 (1) (f) GDPR, we use social media plugins of the social networks Facebook, Google+, Twitter, LinkedIn and Instagram in order to increase our company’s profile. The promotional purpose behind this must be seen as legitimate interest within the meaning of GDPR. Their current provider must ensure the responsibility for data protection compliance. These plugins are integrated by us using the so-called double-click method, in order to protect visitors to our website as much as possible. By means of the double-click method, it is possible for you to activate the deactivated social media plugins. This activation can be deactivated at any time. The deactivation process does not mean that previously transmitted data held by the corresponding social media provider is deleted. The social media plugins integrated on our website are deactivated first. You can activate the plugins by simply clicking on the plugin symbol. Only after activation is personal data transmitted to the relevant social media service provider. The plugin activated by you establishes – directly via your browser - a connection to the server of the social media provider selected by you.

We have no influence on the data collected and data processing operations used, nor do we know the full extent of the data collection and the purposes for which it is processed.

The plugin provider stores the data collected about you as a usage profile and uses this for the purposes of advertising, market research and/or the targeted design of its website. This evaluation is conducted in particular (including for users who are not logged in) to display targeted advertising and to inform other users of the social network about your activities on our website. You have a right of objection to the creation of this user profile. If you wish to exercise this right, you must contact the relevant plugin provider. Via the plugins we give you the opportunity to interact with the social networks and with other users so that we improve our service and structure it in a way that is more interesting for you as a user.

Data is transmitted regardless of whether you have an account with the plugin provider and are logged in to it. If you are logged in to the plugin provider, the data that we have collected about you shall be directly assigned to your account with the plugin provider. If you click on the activated button and, for example, link to the page, the plugin provider also stores this information in your user account and openly shares it with your contacts. We recommend that you regularly log out after using a social network, and in particular, before activating the button, as in this way you can prevent such an assignment to your profile with the plugin provider.

Recipients/categories of recipient:

On our website, we use social media plugins of the following providers:

Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; http://www.facebook.com/policy.php; for more information about data collection: http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications and http://www.facebook.com/about/privacy/your-info#everyoneinfo. Facebook has certified to the ES-US Privacy Shield Framework, https://www.privacyshield.gov/EU-US-Framework.

Google Inc., 1600 Amphitheater Parkway, Mountainview, California 94043, USA; https://www.google.com/policies/privacy/partners/?hl=de. Google has certified to the EU-US Privacy Shield Framework, https://www.privacyshield.gov/EU-US-Framework.

Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy. Twitter has certified to the EU-US Privacy Shield Framework, https://www.privacyshield.gov/EU-US-Framework.

LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; http://www.linkedin.com/legal/privacy-policy. LinkedIn has certified to the EU-US Privacy Shield Framework, https://www.privacyshield.gov/EU-US-Framework.

Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; http://instagram.com/about/legal/privacy/ Instagram has certified to the ES-US Privacy Shield Framework, https://www.privacyshield.gov/EU-US-Framework

Storage period/criteria for the establishment of the storage period:

We have no information about the deletion of the data collected by the plugin providers.

 

6. Recipients outside the EU

With the exception of the processing described in section 3.2 and 5, we do not transfer your data to recipients based outside the European Union or the European Economic Area. The processing mentioned in section 3.2 leads to the transmission of data to Google LCC servers. Some servers are located in the US. For the USA, the European Commission has decided on 12.7.2016 that under the EU-US Privacy Shield there is an adequate level of data protection (the so-called "Transfers on the basis of an adequacy decision" in accordance with the Article 45 of the GDPR). H Google LLC, 1600 Amphitheater Parkway, Mountainview, California 94043, USA and the recipients mentioned in section 5 are certified according to the principles of the so-called Privacy Shield.

 

7. Integrated content

We have integrated YouTube videos into our online service. These are stored at http://www.YouTube.com and are directly playable from our website. They are all integrated in the “extended data protection mode”, i.e. no data about you as a YouTube user is transmitted if you do not play the videos. The data is only transmitted if you play the videos. We have no influence over the transmission of this data.

You can find more information about the purpose and scope of data collection and its processing by YouTube in the provider’s privacy policy. This will also give you more information about your rights in this regard and setting options to protect your privacy. Address and privacy policy of YouTube: Google LLC, 1600 Amphitheatre Parkway. Mountain View, CA 94043, USA; https://www.google.de/intl/de/policies/privacy/

 

8. Your rights as data subjects

8.1 Overview

Apart from the right to withdraw the consent you provided to us, you also have the following rights, as long as the legal requirements are in place in each case: 

  • the right to access regarding your own personal data that we store in accordance with Article 15 of the GDPR,
  • the right to correct incorrect or supplement incorrect data in accordance with Article 16 of the GDPR,
  • the right to delete your data which we have stored in accordance with Article 17 of the GDPR,
  • the right to limit the processing of your data in accordance with Article 18 of the GDPR,
  • the right to data portability in accordance with Article 20 of the GDPR,
  • the right to object in accordance with Article 21 of the GDPR.

8.2 The right to access in accordance with Article 15 of the GDPR

You have the right to be informed following a request at no cost, in accordance with Article 15, paragraph 1 of the GDPR, regarding the personal data we have stored regarding your person. Specifically, this includes:

  • the aims of the personal data processing,
  • the relevant categories of personal data that we process,
  • the recipients or the categories of recipients with whom your personal data are being shared or will be shared,
  • if possible, the time period for which your personal data will be stored or, if this is not possible, the criteria that determine the period in question,
  • the existence of the right to request from the party responsible for the processing to correct or delete personal data or limit the processing of personal data that concern the data subject or the right to object to the specific processing,
  • the right to file a complaint with a regulating authority,
  • when the personal data are not collected from the data subject, all available information regarding their origin,
  • the existence of automated decision making, including profiling, referred to in Article 22(1) and (4) of the GDPR, and, at least in these cases, significant information regarding the reasoning followed, as well as the importance and the envisaged consequences of the specific processing for the data subject.

When personal data are transferred to a third country or an international organisation, the data subject has the right to be informed regarding the appropriate guarantees, in accordance with Article 46 of the GDPR regarding transfers.

 

8.3 The right to rectification under Article 16 of the GDPR

You have the right to demand from us without unjustifiable delay to rectify inaccurate personal data concerning you. Keeping in mind the aims of the processing, you have the right to demand that incomplete personal data, including a supplementary statement.

 

8.4 The right to erasure ('right to be forgotten') under Article 17 of the GDPR

You have the right to ask us to delete personal data without undue delay, if one of the following reasons is in effect:

  • the personal data are no longer necessary in relation to the aims for which they were  collected or submitted in a different way for processing,
  • you withdraw your consent on which processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) of the GDPR and there is no other legal basis for the processing,
  • you object to the processing in accordance with Article 21(1) or (2) of the GDPR and there are no urgent and legal reasons for the processing in accordance with Article 21(2) of the GDPR,
  • the personal data have been submitted for processing illegally,
  • the personal data must be deleted in order to meet a legal obligation
  • the personal data have been collected in relation to the contribution of the services of the information society mentioned in Article 8(1) of the GDPR.

When we have published personal data and we are obligated to delete it, taking into account the technology available and the application cost, we will take reasonable measures to inform the third parties that are processing your personal data that you have demanded and requested from them the deletion of any links with that data or copies or reproductions of said personal data.

 

8.5 The right to restriction of processing in accordance with Article 18 of the GDPR

You have the right to request from us the restriction of processing when one of the following requirements is met:

  • you question the accuracy of the personal data,
  • the processing is illegal and you are asking for a restriction of the use of the personal data rather than its deletion,
  • the party in charge of processing no longer requires the personal data for processing reasons, but the data are required by the data subject for the foundation, application and support of legal claims,
  • or if you have objections to the processing in accordance with Article 21(1) of the GDPR, pending verification of the degree to which the lawful reasons of the party in charge of processing overrule the reasons of the data subject.

8.6 The right to data portability in accordance with Article 20 of the GDPR

You have the right to receive personal data pertaining to you and which you have provided to us in a structured, commonly used and machine-readable format, as well as the right to transfer the data in question to another party responsible for processing without dispute on our part, when:

  • the processing is based on consent in accordance with Article 6(1)(a) or Article 9(2)(a) or in a contract in accordance with Article 6(1)(b) of the GDPR and
  • the processing is carried out by automated means.

During your exercise of the right to data portability you have the right to ask that your personal data be transferred directly by us to another party responsible for processing, if that is technically possible.

 

8.7 The right to object in accordance with Article 21 of the GDPR

Under the conditions of Article 21(1) of the GDPR you can object to the data processing for other reasons that arise from the particularity of the situation. 

The aforementioned general right to object is valid for all the aims of data processing described in the data protection terms herein, which are being processed by virtue of Article 6(1)(f) of the GDPR. In contrast to the special right to object that concerns data processing for advertisement reasons (see above, especially sections 9 and 11.6), we are obliged, in accordance with the GDPR, to apply the general right to object only if you mention the reasons of higher importance, e.g. a potential danger to life or health. Apart from that, there is the possibility to contact the relevant regulatory authority regarding Lidl Cyprus or the head of data protection of Lidl Cyprus. 

 

9. Parties responsible for communication  

9.1 The parties responsible for communication regarding questions or exercising your rights concerning data protection

For questions regarding the websites or exercising your rights during the processing of your data (data protection rights) you can contact our customer service department:

https://www.lidl.com.cy/el/epikoinonia.htm

9.2 Party responsible for communication regarding data protection questions

If you have other questions regarding the processing of your data, you can addressthe party responsible for data protection for data being processed at the company.

9.3 Right to file a complaint with the regulatory authority for data protection

Furthermore, you have the right to file a complaint with the regulatory authority for data protection at any time. You can contact the regulatory authority for data protection, especially in the member-state in which you reside or at your place of work or in the place where the supposed violation has taken place or the authority of the state in which the party responsible for processing is based.

 

10. Name and contact information of the party responsible for processing, as well as the contact information of the party responsible for data protection in the company. 

These data protection terms are in effect for data processed via LIDL Cyprus, Industrial Area, Emporiou Street 19, CY- 7100, Aradippou - Larnaca (‘Party responsible for processing’) and for the website kariera.lidl.com.cy. You can contact the party responsible for data protection for Lidl Cyprus at the above address, attention of  the party responsible for data protection, or at dataprotection@lidl.com.cy (For job issues, please do not use this email. Relevant emails / resumes sent to this address, are not stored and automatically deleted)