We would hereby like to inform you about how we handle your data in accordance with Article 13 of the General Data Protection Regulation (GDPR).
The responsibility for the collection and processing of the following data lies partly with us,
2 Pigasou Street, Industrial Area
CY-7100 Aradippou, Larnaca
Telephone: 00357 800 94 404
and partly with the corresponding social media platform operator. With respect to certain processing, both we and the platform operators work together as joint controllers within the meaning of Article 26 GDPR (processing under point 4).
We, Lidl Cyprus, (hereinafter: Lidl Cyprus) use the following social media pages:
Facebook: https:// www.facebook.com/lidlcy/
2. Responsibility of social media platform operators
In terms of data processing by the social media platform operators (e.g. management of members and information provided), we have only limited influence. In the areas where we can exert influence and set the terms of data processing, we act within the scope of our capabilities to ensure data handling by the social media platform operators in accordance with the data protection law. In many areas, however, we cannot influence data processing by social media platform operators and thus do not know exactly what data they are processing.
The platform operator manages the overall IT infrastructure of the service, observes its own data protection standards and maintains its own relationship with you as a user (if you are a registered member of the social media service). Moreover, the platform operator is solely responsible for all questions regarding the user profile data, to which we, as a business, have no access.
More information on data processing by the social media platform providers and other options to oppose can be found in the providers’ privacy policies:
3. Our responsibility
(a) Purpose of data processing by us / Legal basis
The purpose of data processing by us, in our presence on social media, is to inform customers about offers, products, services, promotions, contests, special issues, business news, as well as to interact with social media visitors about these issues, and to respond to similar queries, praise or criticism.
We reserve the right to delete various contents only if necessary. We are likely to share your content on our pages, where this is a function of the social media platforms, and contact you via platforms on social media. The legal basis is Article 6 (1)(f) GDPR. Data processing takes place in the interest of our promotion and communication.
The platform operator cannot influence the processing of your data performed by Lidl Cyprus as part of the communication with customers or contests.
As we have already mentioned, we make sure that, where allowed by the social media platform operators, we develop our pages on social media so as to be in line, as much as possible, with data protection.
(b) Receiver / categories of receivers
The data you provide to us on social media pages, such as comments, videos, images, likes, public messages, etc. are made public for that purpose on the social media platform and never used or processed by us for other purposes. We reserve the right to delete any illegal content if this is deemed necessary. This may be the case, for example, in the event of unlawful or illegal posts, hate speech, bullying (inappropriate sexual content) or attachments (e.g. images or videos) that may infringe copyrights, personality rights, criminal laws or ethical rules of Lidl Cyprus.
Sometimes we publish your contents on our website, where this is a social media platform function, and post them on the social media. If you submit a request through the social media platform, we may forward you to other secure means of communication that guarantee confidentiality depending on the required response. You can always send us confidential enquiries to the address indicated in point 1 or at https://www.lidl.com.cy/el/stoixeia-etairias.htm.
With respect to data we receive in a confidential way (e.g. through a private message, letter, or email), we generally exclude the transmission of data to third parties outside the Lidl Group. Exceptionally, some data is processed by processors following our instructions. Those processors are carefully selected, controlled by us and contractually bound in accordance with Article 28 GDPR.
In addition, it may be necessary to send your requests to our contracted partners (e.g. suppliers, in the case of product-related questions) from processing. If your personal information must be forwarded, we will inform you in advance and ask for your consent.
(c) Storage duration/criteria for determining storage duration:
All personal data you send us as part of private messages (suggestions, praise, or criticism) are erased or securely anonymised in their majority within 90 days from the date we send you our final response. Retention for 90 days is justified by the fact that, in individual cases, you may return as a customer after the response you receive and contact us again on the same issue, in which case we should be able to look back at the previous correspondence. Experience has shown that, as a rule, we do not receive any additional enquiries with respect to our responses after a 90-day period.
When exercising your rights as data subjects, the response to your request will be retained for a period of 3 years. The retention period starts from the final response to you. The storage of such data is used to document compliance with legal requirements.
There are cases where it is necessary to store your data for longer where, for example, it is required by law or for the comprehensive handling of your case. In such cases, we do not store your data for longer than required by the lawful record keeping obligations or until your case is fully processed.
All your public posts on our social media page remain on the timeline for an unlimited time, unless we delete them as a result of an update to the subject matter, a violation of the law, or a breach of our guidelines, or if you delete the post.
We cannot in any way influence data erasure by the platform operator. Such data erasure is subject to the complementary application of the data protection provisions of the respective platform operator.
Purpose of data processing / legal bases: You may participate in contests through our website, from our newsletter, from our presence on social media or through the Lidl application. Unless otherwise stated in the respective contest, or if you have not given us additional explicit consent, the personal data you have submitted to us as part of your participation in a contest will be used solely for the purpose of completing the contest (e.g. winner announcement, winner notification, sending prize, possible anonymous winner announcement). If you are acting on the social media in question under your legal name or have a distinct profile with photos, being identified by other users cannot be excluded.
The legal basis for data processing as part of the contests is in principle Article 6(1)(b) GDPR. Where consent is given in a contest, Article 6(1)(a) GDPR is the legal basis for the consent-based data processing. If you have given consent in a contest, you may withdraw such consent at any time with effect for the future.
Recipients/categories of recipients: The data will be transferred to third parties only if it is necessary to conduct the contest or send the prize (e.g. sending of a gift by the sponsor of the contest or transferring of data to a haulier) or if you have given us explicit approval for that purpose. Please note that in some cases of our presence on social media, participation may even be possible directly through our publicly visible online presence (possibly via the note board or comments) and in a way that other users can see that you have participated due to your public interaction with us. It is also possible that in those cases your win will appear on our respective social media page. If you are acting on the social media in question under your legal name or have a distinct profile with photos, being identified by other users cannot be excluded.
Storage duration/criteria for determining storage duration: After the end of the contest and the announcement of the winners, the participants’ personal data are erased. In the case of a tangible prize, the winner's data is kept throughout the period of existence of legal warranty claims, to allow for subsequent restoration or exchange in the event of a defect. When you participate in a contest on a social media page (e.g. via a post or comment), we are not able to influence the erasure of your data by the platform operator. Such data erasure is subject to the complementary application of the data protection provisions of the respective social media operator.
Purpose of data processing/legal bases:
You can sign up to our newsletter through our website (lidl.com.cy), using the built-in frames available on our social media pages. If you consent to receiving our newsletter, we will use your email address and possibly your name to send (separate, if possible) product information, promotions, as well as customer satisfaction surveys. We store and process such data for the purpose of sending the newsletter.
The content of the newsletters includes actions (promotions, discounts, contests, etc.).
With your consent, we analyse your user behaviour on websites linked to www.lidl.com.cy, mobile applications, and newsletters. Assessment of user behaviour includes, in particular, the parts of the respective website, mobile application or newsletter that you visited, and the links you activated. Based on those data, we create user profiles that are classified by person and/or email address, in order for promotion, more specifically in the form of a newsletter, of advertising messages on the page to be better tailored to your personal interests and for our web offers to be improved.
The legal basis for the data processing referred to above is your consent in accordance with Article 6 (1)(a) GDPR.
In order to ensure that you did not make an error while entering your email address, we have established a double-opt-in process: Once you have entered your email address in the specified field, we will send you a confirmation link. Your email address will be sent to our distributors only if you select the above confirmation link.
You may withdraw your consent to receiving the newsletter, participating in consumer satisfaction surveys, and creating personalised user profiles at any time with effect for the future, e.g. if you unsubscribe from the newsletter through our website. The link to unsubscribe is here or at the end of each newsletter. If you unsubscribe, we consider that you have withdrawn your consent for the creation of a personal user profile and the receipt of the newsletter based on said profile. We will erase your user details.
Recipients/categories of recipients:
If external distributors are used to send the newsletter or facilitate the purchase surveys, they must be contractually bound in accordance with Article 28 GDPR.
Storage duration/criteria for determining storage duration:
If you withdraw your consent to receive the Lidl newsletter, your email address will be excluded from receiving the Lidl newsletter. Thereafter, your data will be erased within six months by the respective email distributors. When subscribing to a newsletter on a social media page, we cannot influence erasure of your data by the platform manager. Such data erasure is subject to the complementary application of the data protection provisions of the respective social media operator.
4. Shared responsibility, Article 26 (1) GDPR
There is a partial relationship with the social media operator as set forth in Article 26 (1) GDPR (joint controllers).
With respect to the web tracking methods used by the social media platform operator, we act as joint controllers with said platform operator. Web tracking can take place regardless of whether you are logged in or registered to the social media platform. As already stated above, we are unfortunately unable to influence web tracking methods on social media platforms. This is something that we cannot, for example, disable.
The legal basis for web-tracking methods is Article 6 (1)(f) GDPR. Our interest in improving the social media platform and the corresponding follower page is a legitimate interest within the meaning of the above-mentioned provision.
Further information on the receivers and categories of receivers, as well as the storage duration or the criteria determining storage duration can be found in the platform's privacy policies. We have no influence on them.
The ability to exercise the exclusion rights for those web tracking methods is provided in the privacy policies of the platform managers referred to in point 2. You can also contact the platform operator using their company’s contact details.
With respect to the statistics provided to us by the social media platform operators, we can only exert limited influence on them and cannot exclude them. However, we attach great importance to no additional, optional, statistical data being made available to us.
Please be advised that: It cannot be excluded that your profile and behaviour data will be used by the social media platform operators for the assessment of your habits, interpersonal relationships, preferences, etc. Lidl Cyprus has no influence on the processing or transfer of your data by the social media platform operators.
5. Rights of data subjects
You are entitled, in accordance with Article 15 (1) GDPR, to receive free information about your personal data stored by Lidl Cyprus.
Provided that the relevant legal requirements are met, you have an additional right to rectification (Article 16 GDPR), erasure (Article 17 GDPR) and restriction of processing (Article 18 GDPR) of your personal data.
If data processing is based on Article 6 (1)(e) or (f) GDPR, you have the right to object in accordance with Article 21 GDPR. If you object to the processing of data, it will not occur in the future unless the Controller demonstrates compelling legitimate grounds for the processing which override the interest of the data subject to object.
Where the data processed has been provided by you, you are entitled to data portability in accordance with Article 20 GDPR. However, you can do so on the social media, in principle, only towards the social media platform operator, because only they can access to your profile data.
Where data processing is based on consent in accordance with Article 6 (1)(a) or Article 9 (2)(a) GDPR, you may at any time withdraw your consent with effect for the future without prejudice to the legality of prior processing.
If you have any questions or wish to lodge a complaint about the above, please contact the Data Protection Officer by post or via email.
In addition, you retain the right to lodge a complaint with the supervisory data protection authorities in accordance with Article 77 GDPR. The supervisory authority responsible is particularly in the Member State where you have your habitual residence or place of work or the place where the alleged infringement is committed or at the authority of the State where the controller is established.
If you are affected by a particular data processing operation which is under our sphere of influence and wish to exercise your rights, please contact us. We will then examine your request (e.g. a request for information or an objection) or forward it to the social media platform operator, if required, where your request concerns data processing by the social media platform operator.
6. Contact details of the Data Protection Officer:
The Data Protection Officer is at your disposal at any time for further questions on data protection issues:
Data Protection Officer
19 Emporiou Street, Industrial Area
CY-7100 Aradippou, Larnaca