Privacy policy

Thank you for your interest in the “Customer Experience Survey”.

The protection of your personal data is very important to us. We therefore strive to ensure your right to informational self-determination.

The following privacy policy will inform you of how and to what extent Lidl Malta Limited (hereinafter also ‘Lidl’), having registered office in Vassallo Business Park, Burmarrad Road, Naxxar NXR 6345, Malta (as a Data Controller), processes your personal data. ‘Personal data’ refers to information that can be directly or indirectly attributable to or assigned to you (as a Data Subject).

The processing of personal data in this context is carried out in accordance with the Regulation (EU) 2016/679 (hereinafter ‘GDPR’) and the national legislation on data protection namely, the Maltese Data Protection Act (Chapter 586 of the Laws of Malta) and any subsidiary legislation issued under the same as may be amended from time to time.

1. Data Controller

Unless otherwise stated in the sections of this privacy policy, the Data Controller pursuant to article 4, paragraph 1, number 7) of the GDPR is:

Lidl Malta Ltd.

with registered office in Vassallo Business Park, Burmarrad Road,

Naxxar NXR 6345, Malta

e-mail: privacymt@lidl.com.mt

2. Use of the evaluation form

2.1. Access to our website

Purpose of data processing and legal basis:

When you visit our website, the browser used on your device sends the following information automatically and without any action on your part to our website’s server:

• the IP address of the requesting web-enabled device,
• the date and time of access,
• the name and URL of the viewed file,
• the website/application from which access is made (referrer URL),
• the browser you are using and, if applicable, the operating system of your Internet-enabled computer and the name of your access provider,
• a unique user ID,
• the number of times you have previously participated in surveys,
• the time required to answer the surveys,
• in general, your browsing data in accordance with the Cookie Policy available at section 2.2 of this privacy policy.

The aforementioned personal data are temporarily stored in a so-called log file for the following purposes:

• to browse the website,
• to ensure a smooth connection and that our website is easy to use,
• to prevent fraudulent survey responses,
• to evaluate system security and stability,
• to comply with legal obligations.

Please note that during the first 7 days after the end of the survey, it is theoretically possible for us to identify the IP address you used in Store finder. However, we will not use this option which is also excluded by internal guidelines.

The processing of the aforementioned personal data is necessary as essential in order to provide the service requested by you through the features available on our website (article 6, paragraph 1, letter b) GDPR) and fulfil the obligation to comply with the applicable legislation (article 6, paragraph 1, letter c) GDPR).

Recipients / Categories of recipients:

For the aforementioned purposes, your personal data may be transferred to the following categories of recipients: (i) third-party suppliers of assistance and advice for Lidl with reference (e.g.) to the following sectors: technological, accounting, administrative, legal, insurance, IT; (ii) companies of the group to which Lidl belongs; (iii) subjects and authorities which right of access to personal data is recognized by law, regulations or provisions issued by the competent authorities. Depending on the specific case, these recipients will process such personal data as data controllers or processors. All of the companies listed as providers in our cookie list act as data processors according to article 28 GDPR.

Storage period / Criteria for determining the storage period:

The data collected with reference to the time required to answer the surveys will be archived after 90 days and then permanently deleted 14 days later. This is necessary to allow a long-term evaluation of the surveys and preclude any fraudulent survey responses. The remaining log files will be archived after 7 days and permanently deleted after 14 days. Thus, the data will be stored for the period necessary to pursue the purposes set out in this policy, except in case where the storage for a further period is required for any claims, requests from the competent authorities or for compliance with a legal obligation.

2.2. Use of cookies and similar technologies for processing usage data

Data Controller, purpose of data processing and legal basis:

Lidl Malta Ltd., with registered office in Vassallo Business Park, Burmarrad Road, Naxxar NXR 6345, Malta, as Data Controller, makes use of the so-called cookies and other similar technologies for processing usage data on all (sub-) domains under https://survey2.medallia.eu/?lidl-mt-feedless&country=MT&language=MT-EN.

Cookies are small text files that are placed on your device (laptop, tablet, smartphone or similar) when you visit our websites. Cookies do not cause any damage to your device, do not contain viruses, trojans or other types of malware. In the cookie, information is stored which is related to the specific device you use. This does not mean though, that we are directly informed about your identity. The other similar technologies for processing usage data are in particular the pixel tracker and the local storage.

The use of technically necessary cookies and other similar technically necessary technologies serves to ensure the conduct of the survey.

For an overview of the cookies and other technologies we use, including the respective purposes of processing, storage periods and any third-party providers involved, see our cookie list below.

Within the scope of the use of technically necessary cookies and similar necessary technologies, depending on the purpose, the following categories of personal data are processed:

• user inputs, in order to retain inputs across multiple sub-pages (e.g., saving your cookie settings- consent),
• security-relevant events (detection of fraudulent input behaviour).

The legal basis for the use of technically necessary cookies and similar technologies is article 6, paragraph 1, letter b) GDPR, i.e. considering that it is necessary in order to provide you with our services.

Cookies can be blocked at a general level. However, this block would have an impact on the use of the website and the services offered therein. All the latest browsers allow you to change the settings on cookies that are usually found in the menu of your browser under 'options' or 'preferences'. To understand how to set them up, you can consult the following links:

• Google Chrome
• Mozilla Firefox
• Internet Explorer
• Safari browser

For information on how to manage cookies through other browsers, it is useful to consult the online help files. If this information is not sufficient, we advise you to consult the "Help" section of the browser for more details.

Recipients / Categories of recipients:

Within the scope of data processing by means of cookies and similar technologies, we use specialised service providers, especially from the sector of customer survey. These service providers have been carefully selected and contractually obliged to process your data on our behalf as processors in accordance with article 28 GDPR. All the companies identified as service providers within the above list of cookies act as data processors.

Storage period / Criteria to determine the storage period:

The storage period of each cookie and other similar technology is available the above list of cookies.

3. Customer experience survey

Purpose of data processing and legal basis:

Within the customer survey we collect personal data relating to your shopping experience. The aim is to continuously improve the shopping experience in our stores.

We ask you to provide your receipt number to ensure that you only take part in the customer survey once for each purchase. The receipt number does not give us any information about you personally, even if you pay by debit or credit card.

The legal basis for this specific processing is article 6, paragraph 1, letter b) GDPR.

Recipients / Categories of recipients:

For the aforementioned purposes, your personal data may be transferred to the following categories of recipients: (i) third-party suppliers of assistance and advice for Lidl with reference (e.g.) to the following sectors: technological, accounting, administrative, legal, insurance, IT; (ii) companies of the group to which Lidl belongs; (iii) subjects and authorities which right of access to personal data is recognized by law, regulations or provisions issued by the competent authorities. Depending on the specific case, these recipients will process such personal data as data controllers or processors.

Storage period / Criteria for determining the storage period:

Your personal data will be deleted, no later than 90 days after the final response is sent, or anonymized, excepting for the case in which storage for a further period is required for any claims, requests by the competent authorities or for compliance with a legal obligation.

The survey results are stored for 12 months, after which all data is aggregated to the beginning of the month in which the survey is conducted, so that the survey cannot be tied to any specific date/time.

4. Contact by customer service

Purpose of data processing and legal basis:

Should you request to be contacted by our Customer Service and therefore provide your personal data such as name, surname, e-mail address or telephone number, these data will be processed for the sole purpose of fulfilling your request. For this specific data processing, article 6, paragraph 1, letter b) GDPR is the legal basis.

Recipients / Categories of recipients:

For the aforementioned purposes, your personal data may be transferred to the following categories of recipients: (i) third-party suppliers of assistance and advice for Lidl with reference (e.g.) to the following sectors: technological, accounting, administrative, legal, insurance, IT; (ii) companies of the group to which Lidl belongs; (iii) subjects and authorities which right of access to personal data is recognized by law, regulations or provisions issued by the competent authorities. Depending on the specific case, these recipients will process such personal data as data controllers or processors.

Storage period / Criteria for determining the storage period:

Your personal data will be stored as long as necessary to pursue the purposes set out in the present privacy policy and will be deleted, no later than 90 days after the final response is sent (closure of the case), or anonymized except in case where the storage for a further period is required for any claims, requests from the competent authorities or for compliance with a legal obligation. In our experience, we generally receive no further inquiries to our responses after 90 days.

5. Prize draws

Purpose of data processing and legal basis:

The personal data you provide in the context of participating in a prize draw (first and last name, e-mail address, street, building no., city, zip code) will be used solely in order to operate the prize draw.

The processing of the aforementioned personal data is necessary as essential in order to allow your partecipation in the prize draw (article 6, paragraph 1, letter b), GDPR) and fulfil the obligation to comply with the applicable legislation (article 6, paragraph 1, letter c) GDPR).

Further details are provided in the specific privacy policy for the prize draw.

Recipients / Categories of recipients:

For the aforementioned purposes, your personal data may be transferred to the following categories of recipients: (i) third-party suppliers of assistance and advice for Lidl with reference (e.g.) to the following sectors: technological, accounting, administrative, legal, insurance, IT; (ii) companies of the group to which Lidl belongs; (iii) subjects and authorities which right of access to personal data is recognized by law, regulations or provisions issued by the competent authorities. Depending on the specific case, these recipients will process such personal data as data controllers or processor.

Storage period / Criteria for determining the storage period:

Your personal data processed in the context of the prize draw will be stored as long as necessary to pursue the purposes set out in this policy. After the end of the prize draw and the identification of the winners, the personal data of participants are deleted, except in case where the storage for a further period is required for any claims, requests from the competent authorities or for compliance with a legal obligation. In case of material prizes, the data of the winners are stored for the duration of the statutory warranty claims in order to arrange for rectification or replacement if there is any defect in the prize.

6. Transfers of personal data to third countries

The recipients / categories of recipients, including those located in a third country, outside the European Union (EU) or the European Economic Area (EEA), are indicated in correspondence with each type of processing activity described in this privacy policy. Some third countries are certified by the European Commission through the so-called adequacy decisions, when they guarantee a level of protection of personal data comparable to that within the EU and the EEA. The list of these third countries is available at the following link https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. If a comparable level of protection is not guaranteed in a third country, it will be our concern to verify that the level of protection of personal data is adequately guaranteed through other measures. These are for example binding corporate rules, standard data protection clauses adopted by the Commission, certificates, or codes of conduct. For more information, please contact our Data Protection Officer.

7. Your rights as Data Subject

Pursuant to article 15, paragraph 1 of the GDPR you have the right to request, free of charge, the disclosure of various information regarding the personal data being processed by the Data Controller.

Furthermore, where legal requirements are met, you also have the right of rectification (article 16 GDPR), erasure (article 17 GDPR) and to restriction of processing (article 18 GDPR) of your personal data.

Where the processing of personal data is based on article 6, paragraph 1, letter e) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority) or on article 6, paragraph 1, letter f) (processing is necessary for the purposes of the legitimate interests)of the GDPR or if the processing is carried out for direct marketing purpose, you have the right to object in accordance with article 21 of the GDPR. Where an objection is entered, the processing of data ceases, unless we as Data Controller provide compelling and legitimate grounds requiring the continuation of the data processing, which outweigh the objections raised.

If you have personally provided the data processed, you have the right to data portability pursuant to article 20 of the RGPD.

Insofar as the data processing is based on consent pursuant to article 6, paragraph 1, letter a) or article 9, paragraph 2, letter a) of the GDPR, you have the right to withdraw consent at any time with future effect, without affecting the lawfulness of processing based on consent before its withdrawal.

In the aforementioned cases, for any queries or complaints, please contact the Data Controller in writing or by e-mail at the e-mail address privacymt@lidl.com.mt or to the further contact details indicated below.

Additionally, you have the right to lodge complaints with the appropriate Data Protection Supervisory Authority (Information and Data Protection Commissioner).

8. Further questions

If you have any further questions concerning the processing of your data, you can contact our Data Protection Officer at the following address:

Lidl Malta Ltd.

Vassallo Business Park, Burmarrad Road,

Naxxar NXR 6345, Malta

e-mail address: privacymt@lidl.com.mt

Last updated: 19/05/2021