No browser support

No support for your browser

Data Protection Policy at www.lidl.com.cy

Data protection policy terms

We are very pleased for your interest regarding data protection on our website. We want you to feel satisfied and safe when visiting our website and to consider the application of data protection a customer-oriented quality characteristic.

Through the following data protection notifications we will inform you how Lidl Cyprus processes personal data as well as the range of that processing. Personal data are information that is categorised or can be categorised directly or indirectly regarding your person. The main legislative framework governing data protection is the General Data Protection Regulation (GDPR). 

Content overview

1. Overview

Upon entering the website of Lidl Cyprus, various items of data are exchanged between your terminal and our server. In this event, personal data may also be processed. Data collected in this manner will also be used to improve our website or for advertisement on your terminal’s web browser.  

2. Entering our website

Purpose of data processing / Legal basis:

Upon entering our website your terminal’s web browser will automatically send, with no action on your part,

  • the IP address of the device with internet access from which the request was submitted,
  • the date and time of access,
  • the name and the URL of the file requested,
  • the website/ application from which the access was carried out (referrer-URL),
  • the browser used and the operating system of the computer you are using with Internet access, as well as the access provider

to our website’s server; this information will temporarily be stored on a log file for the following reasons:

  • to guarantee a correct connection,
  • to guarantee comfortable use of our website/ application, 
  • to evaluate the security and stability of our system. 

If you have consented to geolocation on your browser or your operating system or in other settings on your terminal, we will use this function to be able to provide you with tailored services regarding your current position (e.g. the location of our nearest store). We will process your location data that was received in this way exclusively for this function.
The legal basis for processing your IP address is Article 6(1)(f) of the General Data Protection Regulation (hereinafter: GDPR). Our legitimate interest arises from the data processing aims mentioned above.

Recipients/ Categories of recipients:

As a rule, we do not transfer this data to third parties.

Duration of storage/ criteria for determining the duration of storage:

The data are temporarily stored during the session and then automatically deleted. As soon as you stop using our website your geolocation data are deleted.

3. Contact form/ Communication by e-mail/ Telephone calls/ Customer surveys

Purpose of data processing / legal basis:

The personal data you provide while filling out a contact form, by telephone or e-mail, will automatically be treated confidentially by us. We will use your data exclusively for the specific purpose of processing your request. The legal basis for data processing is Article 6(1)(f) of the GDPR. Both our and your concurrent (legitimate) interest in the processing in question derives from the goal of offering you an answer and, possibly, resolving any problems you may be facing, and in this way maintaining and providing further satisfaction to you as a customer or a user of our website.

If you participate in our customer surveys, this is purely on a voluntary basis. During such anonymous surveys, data that will allow conclusions to be drawn regarding the survey participant are not stored. Only the date and time of your participation is stored. All personal data provided in your responses to our survey will be considered to have been provided voluntarily and will be stored in accordance with the GDPR. Please do not mention your name or other similar information which will allow for conclusions to be drawn regarding yourself or other persons in the free text fields. If you provide your consent in the framework of a customer survey, the legal basis for data processing based on consent is Article 6(1)(a) of the  GDPR. If you have provided your consent in the framework of a customer survey, the consent in question can be withdrawn at any moment henceforth. More detailed provisions regarding these cases can be found in the special data protection principles of each customer survey.

Recipients/ Categories of recipients:

As a rule, we do not transfer data to third parties. Exceptionally, the data may be processed by third parties at our request.  Those parties are selected carefully each time, checked by us, and are contractually bound in accordance with Article 28 of the GDPR.

Furthermore, we may be required to transfer excerpts of your request to parties contracted with us (e.g. suppliers, with respect to requests regarding products), in order to process your request.  If transmission of your personal data is required in isolated cases we will contact you in order to obtain your consent.

As a rule, the results of our customer surveys are only used for internal evaluations. As a rule, we do not transfer data to third parties. We do not transfer your personal data to third parties, unless we receive your explicit consent.

Duration of storage/ criteria for determining the duration of storage:

All personal data you provide us with in the framework of requests (proposals, praise, or criticism) through this website or via e-mail, will be deleted by us or will become anonymous 90 days after the final reply provided. Our experience has shown that, as a rule, no further clarifications regarding your answers are requested after 90 days.

4. Competitions

Purpose of data processing / Legal basis:

You can participate in competitions through our website, our newsletter or the Lidl application. If there is no other provision in the special data protection principles of each competition, or if you have not additionally provided us with your explicit consent, the personal data that you transfer to us in the context of your participation in the competition will be used exclusively in order to carry out the competition (e.g. announce the winners, inform the winners, send the prize). The legal basis for data processing is primarily Article 6(1)(b) of the GDPR. If you provide your consent in the context of a competition, Article 6(1)(a) of the GDPR is the legal basis for data processing based on consent. If you provided your consent in the context of a competition, you may withdraw your consent at any time, with effect for the future. More detailed provisions regarding these cases can be found in the special data protection principles of each customer competition.

Recipients/ Categories of recipients:

Transfer to third parties is only carried out if it is necessary for the implementation of the competition (e.g. despatching the prize via a cooperating company). As a rule, we do not transfer data to further third parties.

Duration of storage/ Criteria for determining the duration of storage:

After the end of the competition and the announcement of the winners, the personal data of the participants are deleted. If the prize is a material item, winner data are saved for as long as there are legitimate guarantee claims, so that it is possible to repair or exchange the item in case of a defect at a later date.

5. Data processing for advertisement reasons

Purpose of data processing / Legal basis:

With your consent we analyse user behaviour in the framework of our online presence, as well as in the newsletters we send you. User behaviour evaluation, more specifically, includes the sections of the website that you visit and which links you use there.  With this information we create tailored usage profiles that are categorised by person and/or e-mail address, in order for the advertisement offers of Lidl Cyprus in the form of newsletters, advertisement messages on our website and our printed advertisements to be better adapted to your personal interests and to improve our online offers.

The legal basis for the aforementioned processing is Article 6(1)(f) of the GDPR, or, in the case of consent provided in the same context, Article 6(1)(a) of the GDPR. Processing the data of existing customers for advertisement reasons or advertisement reasons of third parties, must be perceived as being of legitimate interest.

Right to object

You can object to the processing of your data for the aforementioned reasons at any time and at no cost, separately for each channel of communication, with effect for the future. All you have to do is send an e-mail message or a letter addressed to the contact information found in section 14.

Recipients/ Categories of recipients:

As a rule, we do not transfer these data to third parties.

Duration of storage/ criteria for determining the duration of storage:

If you withdraw your consent to individual advertisement media or if you object to certain advertisement media, your data will be deleted from the corresponding e-mail delivery systems.

If you object, the contact address in question will be blocked from future advertisement data processing. We would like to point out that in exceptional cases we may temporarily continue to send advertisement material even after receiving the opt-out request.  This is technically dependent on the required delivery time of advertisement messages and it does not mean that we are not complying with your request to object. Thank you for your understanding.

6. Newsletter dispatch 

Purpose of data processing / Legal basis:

On our website we provide you with the opportunity to subscribe to our newsletter. If you consent to receiving our newsletter we will use your e-mail address and, possibly, your name in order to send (if it is possible, personalised) information regarding products, promotional actions, competitions and news regarding offers of live streaming, branches, as well as regarding customer satisfaction surveys. We will save and process these data in order to send newsletters.

The contents of the newsletter include promotional actions (offers, discounts, competitions, etc.), as well as products and services of Lidl Cyprus branches.


With your consent we analyse your user behaviour on websites connected to www.lidl.com.cy, mobile telephone applications, as well as in our newsletters. User behaviour evaluation includes all sections of each website, mobile phone application or newsletter on which you stayed and whose links you activated. With this information we create usage profiles which are categorised by person and/or e-mail address, in order for the advertisement offers of Lidl Cyprus in the form of newsletters, advertisement messages on our website and our printed advertisements to be better adapted to your personal interests and to improve our online offers.

The legal framework for the processing of data in the framework of newsletter dispatches is consent in accordance with Article 6(1)(a) of the GDPR.

In order to ensure that you have not made an error while entering your e-mail address, we have put into place a double-opt-in process: After entering your e-mail address in the specified field, we send you a confirmation link. Only if you select the confirmation link in question will your e-mail address be sent to our delivery systems.

You may withdraw your consent for receiving our newsletter, for participating in customer satisfaction questionnaires, and in the creation of personalised usage profiles at any time henceforth, e.g. if you unsubscribe from our newsletter through our website. The link to the page where you can unsubscribe can be found here or at the end of every newsletter. By unsubscribing from our newsletter you are revoking your consent for the creation of a personalised usage profile and receiving the tailored newsletter. In this event, your data are deleted by us.

Recipients/ Categories of recipients:

If external delivery systems are used to dispatch newsletters, they must be contractually bound in accordance with Article 28 of the GDPR. As a rule, we do not transfer data to further third parties.

Duration of storage/ Criteria for determining the duration of storage:

If you withdraw your consent for receiving Lidl’s newsletter, your e-mail address will be “locked out” of receiving our newsletter. Your data will be deleted after 6 months by the corresponding e-mail delivery systems.

7. Online presence and website optimisation

7.1 Cookies – General information

On our websites we use cookies, based on Article 6(1)(f) of the GDPR. Our interest in optimising our website must be considered legitimate, in the sense of the aforementioned provision. Cookies are small files which are stored on your terminal (laptop, tablet, smart phone, etc.) when you visit our website. Cookies do not harm your device, they do not contain viruses, trojans, or other harmful programmes. Cookies collect data which are produced separately in relation to the specific device used. This does not mean that we have direct knowledge of your identity through them. The use of cookies aims, on the one hand, at offering you a more comfortable use. For that reason we use the so-called session cookies to recognise that you have already visited separate pages on our website. They are automatically deleted when you leave our website. Apart from that, we use temporary cookies in order to facilitate use, which are stored for a determined period of time on your device. If you visit our website again in order to use our services, we automatically recognise that you have already visited us in the past, what entries you made / settings you changed, so that you don’t have to execute the same actions again.  

On the other hand, we use cookies to statistically analyse the use of our website, aiming at optimising our offers, as well as promoting information that is tailored to you. The cookies in question allow us to automatically recognise that you have visited us before upon your next visit to our website. The cookies in question are automatically deleted after a predetermined period of time. Most browsers automatically accept cookies. However, you can adjust the settings on your browser in such a way that they do not save cookies on your computer or that a notification appears before every new cookie is saved. However, full deactivation of cookies may result in the inability to use certain functions of our website. 

You will find a summary of the cookies used with additional information (e.g. how long they will be saved for) and the possibility to object to the Cookie Terms.

7.2 Google Analytics 

Purpose of data processing / Legal bases:

In order to constantly optimise and adjust our websites in accordance with your needs, we use Google Analytics, an online analysis service of Google Inc. (‘Google') based on Article 6, paragraph 1, item f) of the GDPR. Our legitimate interest originates from the aforementioned aims. In this context, 'pseudonymised' usage profiles are created and cookies are used. Cookies record the following data regarding the use of this website:

  • type/ edition of browser
  • operating system used
  • Referrer-URL (the previous website you visited),
  • Host name of access computer (IP address), 
  • time of server request.

The information is used to evaluate the use of our websites, to compile reports regarding website activity, and to provide additional services connected to website and internet use for purposes of market research and to adjust the websites in question depending on the needs. IP addresses are made anonymous, so that it is impossible to match them (so-called IP masking). 

You can obstruct cookie installation through the corresponding setting on your browser programme. However, we should point out that in such a case you may not be able to use all the functions of that website. You can also obstruct data analysis created by cookies concerning the use of this website (including the IP address) as well as the processing of the data in question by Google, if you load and install this browser extension. Instead of this browser extension you can also stop analysis by Google Analytics, especially on mobile device browsers, if you click on this link. An opt-out cookie is created which blocks future analysis of your data during your visit to this website. The opt-out cookie is only in effect in this browser and only for our website and is only stored on your device. If you delete the cookies from this browser you must save the opt-out cookie again. More information regarding data protection in relation to Google Analytics can be found at the Google Analytics website

Recipients/ Categories of recipients:

Data created by cookies are transmitted to a Google server in the USA and are stored there. In no case is your IP address merged with other Google data. Also, the data in question may be transferred to third parties if it is foreseen by law or if the third parties have been authorised to process these data. 

Duration of storage/ Criteria for determining the duration of storage:

After the masking of the IP address it is no longer possible for it to be connected to your person. The data created for statistical reasons are deleted by Google Analytics after 50 months. The reports compiled based on Google Analytics no longer refer to individuals.

7.3 Targeting on the website and website optimisation

Purpose of data processing / legal bases:

Data may be analysed and evaluated on our website with the use of cookies, in order to optimise our websites and the advertisements shown on them. In this way we ensure that only an advertisement that is tailored to your real or speculated interests will be displayed on your terminal, based on your use up to that point. The information processed to this end will include, for example, data regarding the products you have shown an interest in. The legal basis for processing the data in question is Article 6, paragraph1, item f) of the GDPR. Therefore, the optimisation of our websites in order to improve your shopping experience and avoid displaying advertisements that are of no interest to you, is both in our interest and yours. Analysis and evaluation is carried out exclusively using a nickname and does not allow us to identify you. Specifically, the data is not merged with your personal data.

Recipients/ categories of recipients:

Data recipients are the aforementioned service providers who process your data on a contractual basis, only for a specific destination and in accordance with our guidelines.

Duration of storage/ criteria for determining the duration of storage:

The Cookies used here and the data contained in them are stored in accordance with the Cookie Terms and are deleted immediately if you object.

7.4 Re-targeting

Purpose of data processing / Legal Basis:

We also use re-targeting technology from various providers. This allows us to shape our online offer in a way that is interesting to you. To that end a cookie is created which collects data that are of interest with the use of a nickname. Specifically, data are anonymously collected regarding web browsing for commercial promotion aims and are stored in cookie data files on your computer and analysed via an algorithm. Then targeted product recommendations and tailored banners with products of ours that may be of interest to you can be displayed on the websites of our partners. In no case can these data be used to identify visitors to the website. No processing of direct personal data is carried out and usage profiles are not merged with personal data. The processing in question is carried out based on Article 6(1)(f) of the GDPR. With the use of targeting measures we aim to ensure that only advertisements that are tailored to your real or speculated interests will be displayed on your terminals. It is both in our interest and yours not to encumber you with advertisements of no interest to you.

If, however, you do not wish to see Lidl’s e-shop tailored banners displayed, you can object to the collection and storage of data in question in the future by carrying out the following action:

  • By clicking on the symbol that appears on each advertisement banner (e.g.  “i”) you can jump to the website of each individual provider. The systematics of re-targeting technology is clarified anew there and the possibility to opt out is made available. If you unsubscribe from a provider, the so-called opt-out cookie is saved on your computer, which blocks the display of each provider’s advertisement banner in the future.  Please take into account that opting out can only be carried out from your computer and that the opt-out cookies may not be deleted from your computer.
  • Alternatively, you can use the opt out options presented in section 7.5 of the data protection terms.

Recipients/ Categories of recipients:

We use re-targeting technologies on our websites from various providers who process the aforementioned data in the framework of re-targeting. You can find further information regarding the cookies used by the providers in question in the Cookie Terms.

Duration of storage/ criteria for determining the duration of storage:

The cookies used for re-targeting and the data contained in them are stored for the amount of time mentioned in the Cookie Terms and are then deleted automatically.

7.5 Opting-out

You can block the targeting technologies analysed in sections 7.3 and 7.4 by adjusting the cookie settings on your browser (see also section 7.1). At the same time you have the opportunity to block interest based tailored advertisements  with the help of a so-called Preference manager or the activation of opt-out cookies submitted in accordance with section 7.4.

8. Recipients outside the EU

With the exception of the processing described in section 7, we do not transfer your data to recipients based outside the European Union or the European Economic Area. The processing mentioned in section 7 directs the data transfer of the servers of our authorised tracking and targeting technology providers. Some of the servers are located in the USA  (relevant information is available in the individual reports regarding the specific recipients). Transfer of data is carried out in accordance with the principles of the so-called Privacy Shield as well as based on the so-called Standard contractual clauses of the European Commission.   

9. Your rights as data subjects

9.1 Overview

Apart from the right to withdraw the consent you provided to us, you also have the following rights, as long as the legal requirements are in place in each case: 

  • the right to access regarding your own personal data that we store in accordance with Article 15 of the GDPR,
  • the right to correct incorrect or supplement incorrect data in accordance with Article 16 of the GDPR,
  • the right to delete your data which we have stored in accordance with Article 17 of the GDPR,
  • the right to limit the processing of your data in accordance with Article 18 of the GDPR,
  • the right to data portability in accordance with Article 20 of the GDPR,
  • the right to object in accordance with Article 21 of the GDPR.

9.2 The right to access in accordance with Article 15 of the GDPR

You have the right to be informed following a request and at no cost, in accordance with Article 15, paragraph 1 of the GDPR, regarding the personal data we have stored regarding your person. Specifically, this includes:

  • the aims of the personal data processing,
  • the relevant categories of personal data that we process,
  • the recipients or the categories of recipients with whom your personal data are being shared or will be shared,
  • if possible, the time period for which your personal data will be stored or, if this is not possible, the criteria that determine the period in question,
  • the existence of the right to request from the party responsible for the processing to correct or delete personal data or limit the processing of personal data that concern the data subject or the right to object to the specific processing,
  • the right to file a complaint with a regulating authority,
  • all available information regarding the origin of personal data, when they are not collected from the data subject,
  • the existence of automated decision making, including profiling, referred to in Article 22(1) and (4) of the GDPR, and, at least in these cases, significant information regarding the reasoning followed, as well as the importance and the envisaged consequences of the specific processing for the data subject.

When personal data are transferred to a third country or an international organisation, the data subject has the right to be informed regarding the appropriate guarantees, in accordance with Article 46 of the GDPR regarding transfers.

9.3 The right to rectification under Article 16 of the GDPR

You have the right to demand from us without unjustifiable delay to rectify inaccurate personal data concerning you. Keeping in mind the aims of the processing, you have the right to demand that incomplete personal data will be completed, including by means of providing a supplementary statement.

9.4 The right to erasure ('right to be forgotten') under Article 17 of the GDPR

You have the right to ask us to delete personal data without undue delay, if one of the following reasons is in effect:

  • the personal data are no longer necessary in relation to the aims for which they were  collected or submitted in a different way for processing,
  • you withdraw your consent on which processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) of the GDPR and there is no other legal basis for the processing,
  • you object to the processing in accordance with Article 21(1) or (2) of the GDPR and there are no urgent and legal reasons for the processing in accordance with Article 21(2) of the GDPR,
  • the personal data have been submitted for processing illegally,
  • the personal data must be deleted in order to meet a legal obligation
  • the personal data have been collected in relation to the contribution of the services of the information society mentioned in Article 8(1) of the GDPR.

When we have published personal data and we are obligated to delete them, taking into account the technology available and the application cost, we will take reasonable measures to inform the third parties that are processing your personal data that you have demanded and requested from them the deletion of any links with that data or copies or reproductions of said personal data.

9.5 The right to restriction of processing in accordance with Article 18 of the GDPR

You have the right to request from us the restriction of processing when one of the following requirements is met:

  • you question the accuracy of the personal data,
  • the processing is unlawful and you are asking for a restriction of the use of the personal data rather than their deletion,
  • the party in charge of processing no longer requires the personal data for processing reasons, but the data are required by the data subject for the foundation, application and support of legal claims,
  • or if you have objections to the processing in accordance with Article 21(1) of the GDPR, pending verification of the degree to which the lawful reasons of the party in charge of processing overrule the reasons of the data subject.

9.6 The right to data portability in accordance with Article 20 of the GDPR

You have the right to receive personal data pertaining to you and which you have provided to us in a structured, commonly used and machine-readable format, as well as the right to transfer the data in question to another party responsible for processing without dispute on our part, when:

  • the processing is based on consent in accordance with Article 6(1)(a) or Article 9(2)(a) or in a contract in accordance with Article 6(1)(b) of the GDPR and
  • the processing is carried out by automated means.

In exercising your right to data portability you have the right to ask that your personal data be transferred directly by us to another party responsible for processing, if that is technically possible.

9.7 The right to object in accordance with Article 21 of the GDPR

Under the conditions of Article 21(1) of the GDPR you can object to the data processing for other reasons that arise from the particularity of the situation. 

The aforementioned general right to object is valid for all the aims of data processing described in the data protection terms herein, which are being processed by virtue of Article 6(1)(f) of the GDPR. In contrast to the special right to object that concerns data processing for advertisement reasons (see above, especially sections 9 and 7.5), we are obliged, in accordance with the GDPR, to apply the general right to object only if you mention the reasons of higher importance, e.g. a potential danger to life or health. Apart from that, there is the possibility to contact the relevant regulatory authority regarding Lidl Cyprus or the head of data protection of Lidl Cyprus. 

10. Parties responsible for communication  

10.1 The parties responsible for communication regarding questions or exercising your rights concerning data protection

For questions regarding the website or exercising your rights during the processing of your data (data protection rights) you can contact our customer service department:

https://www.lidl.com.cy/en/contact.htm

10.2 Party responsible for communication regarding data protection questions

If you have other questions regarding the processing of your data, you can address the party responsible for data protection via the party responsible for data processing.

10.3 Right to file a complaint with the regulatory authority for data protection

Furthermore, you have the right to file a complaint with the regulatory authority for data protection at any time. You can contact the regulatory authority for data protection, especially in the member-state in which you reside or at your place of work or in the place where the supposed violation has taken place or the authority of the state in which the party responsible for processing is based.

11 . Name and contact information of the party responsible for processing, as well as the contact information of the party responsible for data protection in the company. 

These data protection terms are in effect for data processed via LIDL Cyprus, Industrial Area, Emporiou Street 19, CY- 7100, Aradippou - Larnaca (‘Party responsible for processing’) and for the website www.lidl.com.cy. You can contact the party responsible for data protection for Lidl Cyprus at the above address, attention of  the party responsible for data protection, or at dataprotection@lidl.com.cy.