Lidl Cyprus

Data protection policy

(dated 21.07.2025)

Data protection is important to us

Thank you for visiting www.corporate.lidl.com.cy. The following data protection notice is designed to inform you about how and to what extent your personal data is processed when you visit our website. Personal data is information that identifies you or could identify you directly or indirectly. This data protection notice is governed by the General Data Protection Regulation (EU) 2016/679 (GDPR) and the entire applicable regulatory framework for data protection, as applicable.

1. Accessing our website

Purposes of data processing/legal bases
When you visit our website, your browser will automatically send the following information to the server of our website:

- the IP address of the requesting internet-enabled device,
- the date and time of access,
- the name and URL of the file called up,
- the website / application from which the access was made (referral URL),
- the browser you are using and, if applicable, the operating system of your internet-enabled device and
- the name of your access provider

This information is temporarily stored in a log file for the following purposes:

- Ensuring a smooth connection,
- Ensuring comfortable use of our website/application and
- Evaluation of system security and stability.

The legal basis for data processing is article 6, paragraph 1, letter f) GDPR. Our legitimate interest lies in the purposes of data processing listed above. If data is used for purposes of preparing a contract, the legal basis for the data processing is Article 6, paragraph 1, letter b) GDPR.

Recipients/ categories of recipients
In connection with the aforementioned processing, your data will also be processed on our behalf by processors in the IT hosting services sector. Such processors are carefully selected, audited by us and bound by contract in accordance with Article 28 GDPR.

Storage duration/ criteria for determining the storage duration
The data is stored for seven (7) days and automatically deleted thereafter.

2. Use of cookies and similar techniques for processing usage data

Purposes of data processing/legal basis
We at Lidl Cyprus, Industrial Area, 2 Pigasou Street, CY- 7100 Aradippou – Larnaca, use cookies and other technologies on our website for processing usage data on all (sub-) domains under www.corporate.lidl.com.cy.

Cookies are small text files that are stored on your device (laptop, tablet, smartphone or similar) when you visit our website. Cookies do not cause any damage to your terminal device, do not contain viruses, trojans or other malware. The cookie saves information in relation to your specifically used end device. This does not however mean that we directly obtain knowledge of your identity through this. The other similar technologies for processing usage data are, in particular, web storage such as local storage, session storage and cache storage.

The use of cookies and other technologies for processing usage data serves – depending on the category of the cookie or the other technology – the following purposes:

Technically necessary: These are cookies and similar methods without which you cannot use our services (for example, to display our website/functions you have requested correctly).

Convenience: These technologies allow us to consider your actual or perceived preferences for the convenience of using our website. For example, your settings allow us to display our website in a language that is appropriate for you.

Statistics: These techniques allow us to create anonymous statistics on the use of our services. This allows us to determine, for example, how we can better adapt our website to the habits of our users.

Marketing cookies: This enables us and other users to be shown suitable advertisements in the most appropriate presentation possible based on use behavior.

Within the scope of the use of cookies and similar techniques for processing usage data, the following types of personal data are processed in particular, depending on the purpose:

Technically necessary:
- User details to maintain the login to various subpages

- Information about the correct appearance of our website, including font and colour, to provide the functionality you want and to take into account your settings, such as your choice of cookies and similar technologies, etc.

- User input to save the user's consent status for cookies of the current domain (e.g. Cookie Consent).

Comfort:
- Settings for user interface customisation (e.g. selection of preferred language)

Statistics:
- Pseudonymized user profiles with information about the use of the website. These include in particular:
- Browser type / version,
- Operating system used,
- Device used,
- Referrer-URL (the previously visited page),
- Host name of the accessing computer (IP address),
- Time of the server request
- Individual user ID and
- Triggered events on the website (surfing behavior).
- The IP address is regularly anonymized, so that a conclusion about your person is generally excluded.

Marketing:

-IP address (this is regularly anonymised so that it cannot be used to identify you personally),

-Individual user ID (including cookie identifier) or other identifiers (email address, telephone number, address); we only merge the user ID with other data from you (e.g. name, email address, age, gender, etc.) with your express consent. The user ID alone does not allow us to draw any conclusions about your person. We may share the user ID and the associated user profiles with third parties via the providers of advertising networks.

-Access information,

-Device identifiers,

-Information about device and browser settings,

-Mouse/scroll movements,

-Triggered events on the website (surfing behaviour).

The legal basis for the use of comfort, statistics and marketing cookies is your consent (article 6, paragraph 1, letter a) GDPR). The legal basis for the use of technically necessary cookies is legitimate interest, since we have a legitimate interest to present our website and its content in a fully functional format (article 6, paragraph 1, letter f) GDPR).

You can revoke/ adjust your consent at any time with effect for the future without this affecting the lawfulness of the processing based on consent before its withdrawal. To do this, simply click here and make your selection. By deactivating the respective buttons, you can easily and simply withdraw your consent for the respective processing purposes.

Recipients/Categories of Recipients
Our website includes, in addition to cookies placed directly by our website (first-party cookies), third-party content (third-party cookies).

In the context of data processing using cookies and similar technologies for processing usage data, we may use specialised service providers, in particular in the field of IT. These providers process your data on our behalf as processors, are carefully selected and bound by contract in accordance with Article 28 of the GDPR.

In relation to specific cookies that serve targeted advertising, personalised user experience and marketing automation purposes, we jointly determine with third parties (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (Facebook)) the purposes and means of processing and have entered into an agreement for joint liability for processing in accordance with Article 26 GDPR. In particular, where you provide us with your consent, we use specific technologies so that we can record your browsing/ navigation behaviour and display ads tailored to you or our partners' (Facebook) platform. They may also compare the data collected by these services with their own databases.

We also use the Microsoft Advertising Services of the provider Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (Microsoft) and the Google Advertising Service of the provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google) for self-promotion in our Services. Microsoft and Google also process your data as part of the Microsoft and Google Advertising Services under their own responsibility. Microsoft Advertising and Google Advertising can be used to display targeted advertisements via the Microsoft and Google networks (e.g. in search engines and email programs), optimise them and track the activities of users on our website if they have reached our website via advertisements. We also use Microsoft and Google Advertising Services to collect information that allows us to track target groups using remarketing lists. Microsoft Advertising and Google Advertising can recognise that these Services have been visited and an advertisement can be displayed when Microsoft or Google networks are subsequently used. The information is also used to create conversion statistics, i.e. to record how many users have accessed these Services after clicking on an advert. This tells us the total number of users who clicked on our advert and were redirected to these Services. However, we do not receive any information with which users can be personally identified. You can find more information about how Google uses personal data here.

In addition to the above, other third parties referred to in our Cookie Policy may, with prior consent (where required), use their own cookies as part of the content embedded on our website. Although these cookies are included in the list of all cookies and technologies used, we do not have access to these cookies and are in no way (jointly) responsible for data processing with their providers. These providers act as independent data controllers, solely determining their own independent purposes and means of processing.

In the context of our cooperation with Google Ireland Limited, Meta Platforms Ireland Limited and Microsoft Ireland Operations Limited, the aforementioned data is generally also processed for statistical and marketing purposes on servers in the USA (see the separate information on transfers to third countries in section 7).

Storage duration / criteria for determining the storage duration
You can find the storage duration for cookies in our Cookie Policy. Some cookies are deleted when you close your browser (session cookies) and others have a specific storage period. If "Persistent" is entered in the "Expiration" column, the cookie will be stored permanently until the corresponding consent is withdrawn.

You can deactivate personalised advertising with Microsoft and Google or set it individually. Details can be found on the respective support pages:

§ Microsoft: https://help.ads.microsoft.com/#apex/3/en-en/51029
and https://account.microsoft.com/privacy/ad-settings/signedout.

§ Google: https://support.google.com/My-Ad-Center-Help/answer/12155451.

You can also find setting options for personalised advertising at https://youradchoices.com/.

Further information on data processing by the companies listed below and on exercising your rights as a data subject can also be found in the following data protection policies:

§ Meta (Facebook): https://de-de.facebook.com/policy.php

§ Microsoft: https://privacy.microsoft.com/de-de/privacystatement

§ Google: https://policies.google.com/privacy?hl=de

You can find an overview of the cookies and other technologies used, together with the respective processing purposes, the storage periods and any third-party providers involved, here.

3. Processing of further information

Purpose of data processing/legal basis

In order to maintain an overview of how the information you receive is used as part of our collaboration, we process additional relevant information, including publications, contributions, articles, etc. We obtain your data from generally accessible sources such as, but not limited to, websites or other similar means of communication, such as similar sites or social media platforms.

The legal basis for the processing of personal data for the activity described above is Article 6, paragraph 1, letter f) of the GDPR. Our legitimate interest arises from the data processing purposes mentioned above.

Storage duration/criteria for determining the storage duration:

The data (title, date, etc.) are stored for the aforementioned purposes for as long as the publication is active and generally accessible or until you exercise the right to object to the processing of such data, pursuant to Article 21 of the GDPR.

4. Communication of the personal data to external media

Purpose of data processing and legal basis:

If, as a party or data subject of one of our communication contributions, you have signed a contract or provided your consent to the disclosure of your personal data to external media (e.g. journalists), the data processing takes place on the basis of the signed contract (article 6, paragraph 1, letter b) GDPR) or on the basis of your express consent (article 6, paragraph 1, letter a) GDPR). The data is only transmitted to the external media specified in the contract or in the declaration of consent, which may proceed with the publication of the contributions as independent Data Controllers.

If the legal basis is your consent, you can decide, at any time and with effect for the future, to withdraw the consent provided by means of a specific communication which must be sent to the e-mail address press@lidl.com.cy, without affecting the lawfulness of the processing based on the consent before its withdrawal. The withdrawal of consent determines the cancellation of your personal data on our part. In this respect, we have no influence on the processing or the cancellation of your personal data by external media.

Recipients / Categories of recipients:

For the aforementioned purposes, your personal data may be transferred to the following categories of recipients: (i) external media (e.g. journalists, editors of newspapers). It should be noted that the external media will act as independent Data Controllers for all subsequent processing activities carried out by them. Furthermore, in the event of publication by the external media, your data may also be viewed by subjects based outside the EU or the EEA (for details, please read the specific privacy policy) and (ii) third-party suppliers of support and advice for us who, as the case may be, will process the personal data in question as controller or processor.

Storage period / Criteria to determine the storage period:

The data are processed for the sole purpose of transmitting them to external media. However, for reasons related to internal documentation, your data are kept for a period of 7 (seven) days, except in the case in which conservation for a further period is required for any disputes, requests from the competent authorities or pursuant to applicable legislation.

In this respect, we have no possibility to influence the retention of data by external media. Further information on the data processing by the external media that may have received the data from us are provided in their own privacy policy.

5. Embedded content

YouTube video

We have integrated YouTube videos into our website, which are available at https://www.youtube.com and can be played directly from these Services. However, when you visit our websites, no content from the third-party provider YouTube (Google LLC) is loaded and the third-party provider does not receive any information from you. Only when you give your consent will content from the third-party provider YouTube (Google LLC) be loaded. YouTube (Google LLC) will then receive the information that you have called up our site as well as the technically required usage data in this context. In addition, YouTube (Google LLC) will then be able to implement tracking technologies. We have no influence on the further data processing by the third-party provider YouTube (Google LLC). The data processing is based on your consent in accordance with Art. 6 (1)(a) GDPR. Your consent is voluntary and includes that the content of the third-party provider may be downloaded and the described data may be transferred to YouTube (Google LLC). For transfers to the USA, an appropriate level of data protection is guaranteed due to the certification of the provider under the adequacy decision (EU-U.S. Data Privacy Framework). Further information on the purpose and scope of data collection and processing by YouTube (Google LLC) can be found in the provider's privacy statement, where you will also find further information on your rights and settings options to protect your privacy. Address and privacy policy of YouTube: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; https://policies.google.com/privacy?hl=en&gl=de

If you have given your consent to the immediate playback of YouTube videos, you have the possibility to revoke this consent at any time. As soon as you have deactivated the following button, your consent will be requested again when you revisit one of our pages containing a YouTube video.

6. Links to other websites and applications

Our website may contain links to other websites and apps operated by other Lidl companies, selected partners or other third parties. If you click on one of these links, you will be redirected to the website/app. The links may also contain special tracking techniques that enable the operators of the websites/applications mentioned to understand and measure where the user has learnt about them. We have no influence over data processing by these websites/apps. We recommend that you check the relevant privacy policy of each website/app you are redirected to in order to understand what information about you is processed by the operator. If we redirect you to one of these websites/apps, we process your personal data in order to fulfil your (technical) request to visit the respective application or website (Article 6(1)(b) GDPR). In some cases, third party providers may further process these data for their own purposes on the basis of their own legitimate interest (Article 6(1)(f) GDPR), for example for advertising purposes. In cases where the transfer and/or further processing of data by third parties is required, it is only carried out with your consent.

7. Data transfers to recipients in a third country

Under certain circumstances, it may be necessary for us to transfer your personal data to recipients in a third country or several third countries outside the European Union (EU)/the European Economic Area (EEA). The EU Commission has certified some third countries as having a level of data protection comparable to the GDPR by means of an adequacy decision. You can find an overview of third countries with an adequacy decision here. For service providers based in the USA, this only applies if they are certified in accordance with the EU-US Data Privacy Framework.

If there is no adequacy decision, we secure the transfer by other measures. These can be, for example, binding company regulations, standard contractual clauses of the European Commission, certificates or recognised codes of conduct.

Unless otherwise stated below, the transfer to a third country takes place either on the basis of an adequacy decision or one of the measures listed above. If you have any questions, please contact our data protection officer.

8. Your rights as data subject

Overview

In addition to the right to withdraw any consent you have granted to us, you have the following additional rights provided the respective statutory conditions are met:

The right of access to your personal data stored by us, pursuant to Article 15 GDPR.
The right to request rectification of incorrect data or completion of incomplete data, pursuant to Article 16 GDPR
The right to request erasure of your personal data stored by us pursuant to Article 17 GDPR
The right to request restriction of processing of your data pursuant to Article 18 GDPR
The right to request data portability, pursuant to Article 20 GDPR
The right to object to the processing of your personal data, pursuant to Article 21 GDPR

Right of access pursuant to Article 15 GDPR

Pursuant to Article 15(1) of the GDPR, you have the right to request information, free of charge, on the personal data stored about you. This particularly includes:

the purposes for which personal data is being processed;
the categories of personal data that are being processed;
the recipients or categories of recipient to whom personal data concerning you has been or will be disclosed;
the planned duration of the storage of the personal data concerning you or, if it is not possible to give any specific details, the criteria used to determine the storage duration;
the existence of a right to rectification or erasure of the personal data concerning you, a right to request from the controller that processing be restricted or a right to object to this processing;
the right to lodge a complaint with a supervisory authority;
all available information regarding the origin of the data if the personal data is not being collected from the data subject;
the existence of any automated decision-making processes including profiling pursuant to Article 22(1) and (4) GDPR and – at least in these cases –meaningful information regarding the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

If personal data is transferred to a third country or an international organization, you have the right to be notified about appropriate safeguards pursuant Article 46 GDPR in connection with the transfer.

Right to rectification pursuant to Article 16 GDPR

You have the right to request the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure pursuant to Article 17 GDPR

You have the right to require us to erase any personal data concerning you without undue delay where one of the following grounds applies:

the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
you withdraw your consent on which the processing pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR was based and there is no other legal ground for the processing;
you object to the processing pursuant to Article 21(1) or (2) GDPR, and in the case of Article 21(1) GDPR there are no overriding legitimate grounds for the processing;
the personal data was unlawfully processed;
the erasure of personal data is necessary in order to comply with a legal obligation;
the personal data was collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

Where we have made the personal data public and are obliged to erase it, taking account of available technology and the cost of implementation we will take reasonable steps to inform any third parties processing your data of the fact that you have requested the erasure by such third parties of any links to, or copies or replications of, such personal data.

Right to restriction of processing pursuant to Article 18 GDPR

You have the right to require us to restrict the processing where one of the following applies:

you contest the accuracy of the personal data;
the processing is unlawful, and you request the restriction of the use of the personal data rather than its erasure;
the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defense of legal claims or
you have objected to the processing pursuant to Article 21(1) GDPR pending verification of whether the legitimate grounds of the controller override those of the data subject.

Right to data portability pursuant to Article 20 GDPR

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another controller without hindrance by us, where

the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR and
the processing is carried out by automated means.

In exercising your right to data portability, you have the right to have the personal data transmitted directly from us to another controller where technically feasible.

Right to object pursuant to Article 21 GDPR

Provided the requirements of Article 21(1) GDPR are met, you may object to the data processing on grounds relating to your particular situation.

The aforementioned general right to object applies to all processing grounds set out in these data protection information, which are processed on the basis of Article 6(1)(f) GDPR.

Right to lodge a complaint with the data protection supervisory authority pursuant to Article 77 GDPR

You also have a right to lodge a complaint with the competent data protection supervisory authority at any time. Competent supervisory authority for data protection in Cyprus is Office of the Commissioner for Personal Data Protection (15, Kypranoros Str., 1061, Nicosia, Cyprus, https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/home_en/home_en?opendocument, +357 22818456, commissioner@dataprotection.gov.cy).

6. Name and contact details of the controller and contact details of the company's data protection officer

This Data Protection Νotice governs the processing of data by Lidl Cyprus (Industrial Area, 2 Pigasou Street, CY- 7100 Aradippou – Larnaca), ("Controller") and for the website www.corporate.lidl.com.cy. The company data protection officer of Lidl Cyprus can be contacted at the aforementioned address for the attention of the data protection officer or at dataprotection@lidl.com.cy.