Source: https://www.lidl.com.mt/en/privacy.htm
Timestamp: 2019-04-20 22:10:15+00:00

Document:
Thank you for your interest in the data privacy on our website. When you visit our website and/or when you shop with us, we want you to feel safe and comfortable and for you to see our implementation of data protection as a customer-oriented quality feature.
When you visit the website of Lidl Malta Limited, various information is exchanged between your device and our server. This may also include personal data. Information collected in this way is used for reasons including optimizing our website and displaying advertising in your device's browser as well as to pursue the purposes set out in this policy .
If you have consented in your browser or in the operating system or other setting in your device to geolocalization, we use this feature to offer you individualized services related to your current location (e.g. the location of the nearest store). We only process your location data in this way for this function.
The legal basis for processing the IP address is Art. 6 (1) f) GDPR. Our legitimate interest arises from the purposes of data processing listed above.
For the aforementioned purposes, your personal data may be transferred to the following categories of recipients: (i) third-party suppliers of assistance and advice for Lidl Malta Ltd. with reference (e.g.) to the following sectors: technological, accounting, administrative, legal, insurance, IT; (ii) companies of the group to which Lidl Malta Ltd. belongs; (iii) subjects and authorities which right of access to personal data is recognized by law, regulations or provisions issued by the competent authorities. Depending on the specific case, these recipients will process such personal data as data controllers or processors.
The data described in this section will be stored as long as you browse the website and in any case for the period necessary to pursue the purposes set out in this policy. After then the personal data are automatically deleted. When you finish using our website, the geolocalization data is also deleted.
Personal information that you provide to us when filling out contact forms, over the telephone or by e-mail is of course treated confidentially. For this purpose we may process, for example, your name, surname, e-mail address, mailing address, telephone number.
We use your data solely for the purpose of processing your inquiry, resolving complaints and disputes as well as for complying with applicable legal obligations. The legal basis for the data processing is Art. 6 (1) f) GDPR. Our and your concurrent (legitimate) interest in this data processing arises from the aim of responding to your inquiry or resolving any problems and thus maintaining and encouraging your satisfaction as a customer or user of our website.
For the abovementioned purposes, your personal data may be transferred to the following categories of recipients: (i) where necessary contracting parties (e.g. suppliers, where inquiries are product-specific) in order to process your inquiry (in these cases, your inquiry will be anonymized in advance to ensure that the third party cannot relate it to you. If sharing your personal data is necessary in an individual case, we will inform you of this and obtain your consent), (ii) third-party suppliers of assistance and advice for Lidl Malta Ltd. with reference (e.g.) to the following sectors: technological, accounting, administrative, legal, insurance, IT; (iii) companies of the group to which Lidl Malta Ltd. belongs; (iiii) subjects and authorities which right of access to personal data is recognized by law, regulations or provisions issued by the competent authorities. Depending on the specific case, these recipients will process such personal data as data controllers or processor.
All the personal data that you send us in inquiries (suggestions, praise or criticism) via this website or by e-mail will be stored as long as necessary to pursue the purposes set out in this policy and will be deleted, no later than 90 days after the final response is sent, or anonymized, excepting for the case in which storage for a further period is required for any claims, requests by the competent authorities or for compliance with a legal obligation. In our experience, we generally receive no further inquiries to our responses after 90 days. If you exercise your rights as a data subject pursuant to Section 10, your personal data will be stored for a period of 5 years from our response, as evidence of the completeness of the information provided to you and of compliance with legal requirements.
You have the option of taking part in various Lidl prize draws on our website, through our newsletter or via the Lidl app. For this purpose we may process, for example, the following categories of personal data, your name, surname, email address, mailing address.
The personal data collected in the context of the prize draw will be indicated by Lidl Malta Ltd. when you sign up to the draw. Unless otherwise specified in special data protection principles for the prize draw in question or if you have not given us additional express consent, the personal data you provided to us when entering the prize draw will be processed exclusively to execute the prize draw (e.g. determination of the winner(s), notification of the winner(s), sending of the prize) and to comply with applicable law obligations. The legal basis for data processing in the context of prize draws is generally Art. 6 (1) b) GDPR. If a declaration of consent is provided as part of a prize draw, Art. 6 (1) a) GDPR is the legal basis for the data processing based on this consent. If you have declared your consent in the context of a prize draw, you can revoke this consent at any time with effect for the future. Further details are provided in these cases in the specific data protection policy of the relevant prize draw.
Your personal data processed in the context of the prize draw will be stored as long as necessary to pursue the purposes set out in this policy. After the end of the prize draw and the identification of the winners, the personal data of entrants are deleted, except in case where the storage for a further period is required for any claims, requests from the competent authorities or for compliance with a legal obligation. In case of material prizes, the data of the winners are stored for the duration of the statutory warranty claims in order to arrange for rectification or replacement if there is any defect in the prize.
On our website, we offer you the option of signing up for our newsletter. If you have consented to receiving our newsletters, we use your e-mail address and in certain cases your name for sending information on products, promotions, prize draws and news, on store, photo and travel offerings as well as for customer satisfaction surveys. We store and process this data for purposes of sending the newsletter.
Newsletter content covers promotions (offers, discount promotions, prize draws, etc.) as well as the goods and services of Lidl Malta Limited.
The legal basis for data processing in the context of dispatching newsletters is your consent based on Art. 6 (1) a) GDPR.
We use the double opt-in procedure in order to ensure that no errors have occurred during entry of your e-mail address. We send you a confirmation link after you have entered your e-mail address in the sign-in field. Your e-mail address will not be added to our mailing list until you click on this confirmation link.
You can revoke your consent to receipt of the newsletter or creation of a personalized usage profile at any time with future effect, for instance, by unsubscribing to the newsletter on our website. You can find the link to the unsubscription page here or at the end of every newsletter. Revocation results in deletion of user data collected.
For the aforementioned purposes, your personal data may be transferred to the following categories of recipients: (i) third-party suppliers of assistance and advice for Lidl Malta Ltd. with reference (e.g.) to the following sectors: technological, accounting, administrative, legal, insurance, IT; (ii) service supplier for sending the newsletter; (iii) companies of the group to which Lidl Malta Ltd. belongs. If external processors are commissioned for the dispatch of the newsletter, these are bound by contract pursuant to Art. 28 GDPR. We categorically rule out any further disclosure of the data to third parties.
If you don’t confirm the signing up to our newsletter by the double opt-in procedure, your personal data will be erased after 7 days. If instead you subscribe to the newsletter, your personal data will be processed as long as necessary for the provision of the aforementioned service, without prejudice to such cases in which the storage for a further period is required in order to handle any disputes, requests from the competent authorities or for compliance with a legal obligation. If you instead revoke your consent to receiving the Lidl newsletter, your data are deleted from the relevant (e-mail) mailing list.
With the exception of the processing set out in Section 7, we do not share your data with recipients established outside the European Union or the European Economic Area. The processing specified in Section 7 does not result in any transfer of data to the server of the service providers of tracking or targeting technologies engaged by us. Some of these servers are based in the USA (you can find details on this in the statements related to the specific recipients). The data is transferred in accordance with the principles of the privacy shield and on the basis of the standard contract clauses of the European Commission.
When selling products with age restriction, such as alcohol (17 years) / sale of computer and console games, DVDs, videos with age restriction, a visual check of your personal data (usually an identity card) is carried out by our cashiers in compliance with our legal obligations (Article 6 (1) (c) GDPR).
Occasionally we process your data for the purpose of preventing and detecting criminal offenses (Article 6 (1) (f) GDPR), for the protection of our customers, employees and our property. The use of security cameras is indicated by a clearly visible pictogram in the branches. We store images for 7 days. For installation and maintenance, maintenance companies commissioned by us may have access to stored data.
Every time you make a card payment, we process your personal data as contained on such card and in connection with that transaction for the sole purpose of managing the payment itself (Article 6, paragraph 1, letter b) GDPR). This concerns your card data (IBAN in the case of bank cards, card number, security code, card type as well as the expiration date of the card) and the data referred to the payment (amount, date, time, identification of the card reading device, this means place, company and store where you paid, PIN and, if necessary, your signature as well as your name and surname).
The card data and the data referred to the payment will be immediately transmitted, after the card is read from the card reading terminal (through the terminal manager) by the acquirer bank to your bank. Such data may also be transmitted, in the cases determined by the law, to the law enforcement authorities and to the Financial Intelligence Units.
We do not retain your card data unless this is necessary to ensure the payment transfer. For purposes concerning the document archiving, some data referred to the payment (type of card, date, time, number of the POS terminal, authorization code, place, company, branch, amount and if necessary your signature as well as your name and surname) will be processed according to the provisions of the law to fulfill our legal obligations (Article 6, paragraph 1, letter c) GDPR) and held by us for the duration of the statutory retention periods. However, a card payment is not possible without the data. You can alternatively pay at any time with cash.
The right of access to information about your personal data in accordance with Art. 15 GDPR.
The right to rectification of inaccurate data or to have incomplete data completed in accordance with Art. 16 GDPR.
The right to erasure of your data stored with us in accordance with Art.17 GDPR.
The right to restriction of processing of your data in accordance with Art. 18 GDPR.
The right to object in accordance with Art. 21 GDPR.
In any case you also have the right to lodge complaints at any time with the competent data protection supervisory authority (see 13.3 below).
You also have the right, at any time, to lodge a complaint with the competent data protection supervisory authority. You can contact the Office of the Information and Data Protection Commissioner, the data protection supervisory authority of Malta by email on: idpc.info@idpc.org.mt or by telephone on (+356) 2328 7100.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 15
 Art. 16
 Art.17
 Art. 18
 Art. 21