We would hereby like to inform you about how we handle your data in our pages in social networks in accordance with Article 13 of the General Data Protection Regulation (GDPR).
1. Data controller
The responsibility for the collection and processing of the following data lies partly with us,
Industrial Area, 2 Pigasou Street, CY-7100 Aradippou, Larnaca
Telephone: 00357 800 94 404
and partly with the corresponding social network platform operator (hereinafter: platforms). With respect to certain processing, both we and the platform operators work together as joint controllers within the meaning of Article 26 GDPR (processing under point 4).
We, Lidl Cyprus, (hereinafter: Lidl) use the following network pages:
2. Responsibility of platform operators
In terms of data processing by the platform operators (e.g. management of members and information provided), we have only limited influence. In the areas where we can exert influence, we act within the scope of our capabilities to ensure data handling by the platform operators in accordance with the data protection law. In many areas, however, we cannot influence data processing by platform operators and thus do not know exactly what data they are processing.
The platform operator manages the overall IT infrastructure of the service, observes its own data protection standards and maintains its own relationship with you as a user (if you are a registered member of the social networks). Moreover, the platform operator is solely responsible for all questions regarding the user profile data, to which we, as a business, have no access.
More information on data processing by the platform providers and other options to oppose can be found in the providers’ privacy policies:
When using the platform, your personal data is usually also processed by the respective platform operator on servers in third countries, in particular in the USA.
3. Our responsibility
(a) Our presences on social networks
Purpose of data processing by us / Legal basis
The purpose of data processing by us, in our pages, is to inform customers about offers, products, services, promotions, contests, special issues, business news, as well as to interact with pages visitors about these issues, and to respond to similar queries, praise or criticism.
We reserve the right to delete various contents only if necessary. This may be the case, for example, in the event of unlawful or illegal posts, hate speech, bullying (inappropriate sexual content) or attachments (e.g. images or videos) that may infringe copyrights, personality rights, criminal laws or ethical rules of Lidl.
We are likely to share your content on our pages, where this is a function of the platforms, and contact you via platforms. The legal basis is Article 6 (1)(f) GDPR. Data processing takes place in the interest of our promotion and communication.
The platform operator cannot influence the processing of your data performed by Lidl Cyprus as part of the communication with customers or contests.
As we have already mentioned, we make sure that, where allowed by the platform operators, we develop our pages so as to be in line, as much as possible, with data protection.
The data you provide to us on our pages, such as comments, videos, images, likes, public messages, etc. are made public for that purpose on the platform and never used or processed by us for other purposes.
Recipients / categories of recipients
Sometimes we publish your contents on our website, where this is a platform function, and post them on the social networks. If you submit a request through the platform, we may forward you to other secure means of communication that guarantee confidentiality depending on the required response. You can always send us confidential enquiries to the address indicated in point 1 or here.
With respect to data we receive in a confidential way (e.g. through a private message, letter, or email), we generally exclude the transmission of data to third parties outside the Lidl Group. Exceptionally, some data is processed by processors following our instructions. Those processors are carefully selected, controlled by us and contractually bound in accordance with Article 28 GDPR.
In addition, it may be necessary to send your requests to our contracted partners (e.g. suppliers, in the case of product-related questions) from processing. If your personal information must be forwarded, we will inform you in advance and ask for your consent.
Storage duration/criteria for determining storage duration:
All personal data you send us as part of private messages (suggestions, praise, or criticism) are erased or securely anonymised in their majority within 90 days from the date we send you our final response. Retention for 90 days is justified by the fact that, in individual cases, you may return as a customer after the response you receive and contact us again on the same issue, in which case we should be able to look back at the previous correspondence. Experience has shown that, as a rule, we do not receive any additional enquiries with respect to our responses after a 90-day period.
When exercising your rights as data subjects, the response to your request will be retained for a period of 3 years. The retention period starts from the final response to you. The storage of such data is used to document compliance with legal requirements.
There are cases where it is necessary to store your data for longer where, for example, it is required by law or for the comprehensive handling of your case. In such cases, we do not store your data for longer than required by the lawful record keeping obligations or until your case is fully processed.
All your public posts on our page remain on the timeline for an unlimited time, unless we delete them as a result of an update to the subject matter, a violation of the law, or a breach of our guidelines, or if you delete the post.
We cannot in any way influence data erasure by the platform operator. Such data erasure is subject to the complementary application of the data protection provisions of the respective platform operator.
Purpose of data processing / legal bases:
You may participate in contests through our website, from our newsletter or through our pages on social networks. Unless otherwise stated in the respective contest, or if you have not given us additional explicit consent, the personal data you have submitted to us as part of your participation in a contest will be used solely for the purpose of completing the contest (e.g. winner announcement, winner notification, sending prize, possible anonymous winner announcement). If you are acting on the social networks in question under your legal name or have a distinct profile with photos, being identified by other users cannot be excluded.
The legal basis for data processing as part of the contests is in principle Article 6(1)(b) GDPR. Where consent is given in a contest, Article 6(1)(a) GDPR is the legal basis for the consent-based data processing. If you have given consent in a contest, you may withdraw such consent at any time with effect for the future.
Recipients/categories of recipients:
The data will be transferred to third parties only if it is necessary to conduct the contest or send the prize (e.g. sending of a gift by the sponsor of the contest or transferring of data to a haulier) or if you have given us explicit approval for that purpose. Please note that in some cases of our pages on social networks, participation may even be possible directly through our publicly visible online presence (possibly via the note board or comments) and in a way that other users can see that you have participated due to your public interaction with us. It is also possible that in those cases your win will appear on our respective page. If you are acting on the social network in question under your legal name or have a distinct profile with photos, being identified by other users cannot be excluded.
Storage duration/criteria for determining storage duration:
After the end of the contest and the announcement of the winners, the participants’ personal data are erased from the management portal within 90 days weeks after the prize has been delivered or given. In the case of a tangible prize, the winner's data is kept throughout the period of existence of legal warranty claims, to allow for subsequent restoration or exchange in the event of a defect. When you participate in a contest on a page (e.g. via a post or comment), we are not able to influence the erasure of your data by the platform operator. Such data erasure is subject to the complementary application of the data protection provisions of the respective page operator.
Purpose of data processing/legal bases:
You can sign up to our newsletter through our pages using the built-in frames available on our pages. If you consent to receiving our newsletter, we will use your email address and possibly your name to send (separate, if possible) product information, promotions, flowers and plants as well as customer satisfaction surveys. We store and process such data for the purpose of sending the newsletter.
The content of the newsletters includes actions (promotions, discounts, contests, etc.) as well as information about the products and services of the (partner) companies affiliated with www.lidl.com.cy. These are currently in particular:
Lidl Stiftung & Co KG (https://www.lidl.com.cy/en)
With your consent, we analyse your user behaviour on websites linked to www.lidl.com.cy, mobile applications, and newsletters. Assessment of user behaviour includes, in particular, the parts of the respective website, mobile application or newsletter of ours and our partner Lidl Stiftung & Co KG (https://www.lidl.com.cy/en) that you visited, and the links you activated. Based on those data, we create user profiles that are classified by person and/or email address, in order for promotion, more specifically in the form of a newsletter, of advertising messages on the page to be better tailored to your personal interests and for our web offers to be improved.
The legal basis for the data processing referred to above is your consent in accordance with Article 6 (1)(a) GDPR.
In order to ensure that you did not make an error while entering your email address, we have established a double-opt-in process: Once you have entered your email address in the specified field, we will send you a confirmation link. Your email address will be sent to our distributors only if you select the above confirmation link.
You may withdraw your consent to receiving the newsletter, participating in consumer satisfaction surveys, and creating personalised user profiles at any time with effect for the future, e.g. if you unsubscribe from the newsletter through our website. The link to unsubscribe is here or at the end of each newsletter. If you unsubscribe, we consider that you have withdrawn your consent for the creation of a personal user profile and the receipt of the newsletter based on said profile. We will erase your user details.
Recipients/categories of recipients:
If external distributors are used to send the newsletter or facilitate the purchase surveys, they must be contractually bound in accordance with Article 28 GDPR.
Storage duration/criteria for determining storage duration:
If you withdraw your consent to receive the Lidl newsletter, your email address will be excluded from receiving the Lidl newsletter. Thereafter, your data will be erased within six months by the respective email distributors. When subscribing to a newsletter on a page, we cannot influence erasure of your data by the platform manager. Such data erasure is subject to the complementary application of the data protection provisions of the respective operator.
d) Social Listening
Purpose of Data Processing / Legal Basis
Apart from the information you share with us directly via the platform, we also use Social Listening tools in order to get a better picture of our products and services, and to identify any areas for improvement. We therefore use online platforms (Facebook, Instagram, etc.), as well as search requests (e.g. for a new range of products). Only your public posts, which are accessible to the broad public, can be shown here.
The extent of the data collected depends mainly on the nature and content of the corresponding post, which can, for example, be in the form of a text or image posted by you. In certain isolated cases, the corresponding user ID may be relevant if Lidl wishes to offer a solution to a potential problem. We also receive information from the platform operators regarding the impact of each of our posts.
The legal basis for the processing of personal data as part of Social Listening is Article 6(1)(f) GDPR, since we have a legitimate interest in identifying any shortcomings in our products and services in openly accessible statements so that we may respond accordingly.
Recipients / Categories of Recipients:
Personal data processed as part of Social Listening are not disclosed to external third parties.
Storage period / Criteria determining the storage period:
The relevant data are not permanently stored by Lidl, but are only analysed in a targeted manner in relation to any required countermeasures.
4. Joint responsibility, Article 26 (1) GDPR
There is a partial relationship with the following platform operators as set forth in Article 26 (1) GDPR (joint controllers).
With respect to the web tracking methods used by the platform operator, we act as joint controllers with said platform operator. Web tracking can take place regardless of whether you are logged in or registered to the platform. As already stated above, we are unfortunately unable to influence web tracking methods on platforms. This is something that we cannot, for example, disable.
The legal basis for the web tracking methods is your consent in accordance with article 6, paragraph 1, letter a) GDPR.
Further information on the receivers and categories of receivers, as well as the storage duration or the criteria determining storage duration can be found in the platform's privacy policies. We have no influence on them.
The ability to exercise the exclusion rights for those web tracking methods or to withdraw your consent is provided in the privacy policies of the platform managers referred to in point 2. You can also contact the platform operator using their company’s contact details.
With respect to the statistics provided to us by the platform operators, we can only exert limited influence on them and cannot exclude them. However, we attach great importance to no additional, optional, statistical data being made available to us.
Please also note that the operator of the platform uses your profile and behaviour data in accordance with its usage and data protection provisions to evaluate your habits, personal relationships and preferences. Lidl has no influence on the processing or transfer of your data by the operator of the platform.
5. Processing of data in a third country
Your use of the platform may result in your data being processed in a third country (based outside the European Economic Area) by the platform operator. For more information on the processing of your data in a third country over which Lidl has no influence, please refer to the data protection declarations of the platform operators listed under section 2.
6. Your rights as data subject
Apart from the right to withdraw the consent you provided to us, you also have the following rights, as long as the legal requirements are in place in each case:
b) The right to access in accordance with Article 15 of the GDPR
You have the right to be informed following a request and at no cost, in accordance with Article 15, paragraph 1 of the GDPR, regarding the personal data we have stored regarding your person. Specifically, this includes:
When personal data are transferred to a third country or an international organisation, the data subject has the right to be informed regarding the appropriate guarantees, in accordance with Article 46 of the GDPR regarding transfers.
c) The right to rectification under Article 16 of the GDPR
You have the right to demand from us without unjustifiable delay to rectify inaccurate personal data concerning you. Keeping in mind the aims of the processing, you have the right to demand that incomplete personal data will be completed, including by means of providing a supplementary statement.
d) The right to erasure ('right to be forgotten') under Article 17 of the GDPR
You have the right to ask us to delete personal data without undue delay, if one of the following reasons is in effect:
When we have published personal data and we are obligated to delete them, taking into account the technology available and the application cost, we will take reasonable measures to inform the third parties that are processing your personal data that you have demanded and requested from them the deletion of any links with that data or copies or reproductions of said personal data.
e) The right to restriction of processing in accordance with Article 18 of the GDPR
You have the right to request from us the restriction of processing when one of the following requirements is met:
f) The right to data portability in accordance with Article 20 of the GDPR
You have the right to receive personal data pertaining to you and which you have provided to us in a structured, commonly used and machine-readable format, as well as the right to transfer the data in question to another party responsible for processing without dispute on our part, when:
In exercising your right to data portability you have the right to ask that your personal data be transferred directly by us to another party responsible for processing, if that is technically possible.
g) The right to object in accordance with Article 21 of the GDPR
Under the conditions of Article 21(1) of the GDPR you can object to the data processing for other reasons that arise from the particularity of the situation.
The aforementioned general right to object is valid for all the aims of data processing described in the data protection terms herein, which are being processed by virtue of Article 6(1)(f) of the GDPR. In contrast to the special right to object that concerns data processing for advertisement reasons, we are obliged, in accordance with the GDPR, to apply the general right to object only if you mention the reasons of higher importance, e.g. a potential danger to life or health. Apart from that, there is the possibility to contact the relevant regulatory authority regarding Lidl Cyprus or the head of data protection of Lidl Cyprus.
h) The right to lodge a complaint with the data protection supervisory authority pursuant to Article 77 GDPR
You also have a right to lodge a complaint with the competent data protection supervisory authority at any time. In order to do this, you can contact the data protection supervisory authority where you have your place of residence or habitual residence, place of work or place of the alleged infringement or at the authority of the state in which the controller is headquartered. Competent supervisory authority for data protection in Cyprus is Office of the Commissioner for Personal Data Protection (Iasonos 1, 1082 Nicosia, Cyprus, email@example.com)
7. Contact persons
a) Contact person for questions or to exercise your data protection rights
If you have any questions about our pages in social networks or to exercise your rights when processing your data (data protection rights), you can contact our customer service department:
Industrial Area, 2 Pigasou Street, CY- 7100 Aradippou – Larnaca
b) Contact person for questions regarding Data Protection topics:
If you have any further questions about the processing of your data, you can contact the company's data protection officer:
8. Contact details of the company data protection officer
The company data protection officer of Lidl Cyprus can be reached at the address given in point 1, to the attention of the data protection officer or at firstname.lastname@example.org.