Data protection on
(Status 17.05.2021)
Your privacy is important to us
Thank you for visiting The following data protection notice is designed to inform you about how and to what extent your personal data is processed when you visit our website. Personal data is information that identifies you or could identify you directly or indirectly. The statutory basis is, in particular, the General Data Protection Regulation (GDPR), the national legislation on data protection and any subsidiary legislation issued under the same as may be amended from time to time.

1.Accessing our website

Purposes of the processing/legal bases:
When accessing our website, the browser used on your end device will – automatically and without any action on your part – send

• the IP address of the accessing Internet-enabled device;
• the date and time of access;
• the name and URL of the requested file;
• the website/application from which the access occurred (referrer URL);
• the browser and, where relevant, the operating system of your Internet-enabled computer; and
• the name of your Internet service provider

to our website server and be stored temporarily in what is known as a log-file for the following purposes:

• to ensure a fault-free connection;
• to ensure the comfortable use of our website/application; and
• to analyze system security and stability.

The legal basis for the processing of the IP address is Article 6(1)(f) GDPR. The purposes of data processing listed above constitute our legitimate interest.

Recipients/categories of recipients:
In connection with the aforementioned processing, your data will also be processed on our behalf by processors in the IT hosting services sector. Such processors are carefully selected, audited by us and bound by contract in accordance with Article 28 GDPR.
Storage time/criteria for determining storage time:
Data will be stored for a period of seven days and automatically deleted thereafter.

2. Contact form
Purposes of the processing/legal bases:
It goes without saying that we treat the personal data which you provide to us when you complete our contact form as confidential. We use your data solely for the limited purpose of processing your inquiry. The legal basis for the data processing is Article 6(1)(f) and Article 6(1)(b) GDPR. The purpose of this processing is to respond to your inquiries and resolve any issues, which serves both our and your shared (legitimate) interest.

Recipients/categories of recipients:
Your data is not shared with third parties. Lidl will only allow access to your information to those members of staff that require it in order to respond to your request.
Storage time/criteria for determining storage time:
The data you provide us when you submit our contact form is stored by us and the recipients for the time required in order to process your inquiry provided that there is no further legal obligation in keeping them.


3. Participation in competitions

Purpose of data processing / legal basis:
In our website you have the opportunity to participate in competitions in order to attend seminars/events. The personal data you provided us within the scope of application for participation in the competition will be used exclusively for processing of the competition (e.g. identifying the winner, informing the winners, providing the prize). The legal basis for the data processing is based on consent. Participants may revoke this consent at any time. More detailed information can be found in the data protection information provided in the terms of each competition.

Recipients or categories of recipients:
In the context of the above processing, your data will be processed in particular for the purposes of running the competition (e.g. notifying the winners, providing the prize to the winners) by the company GNOMI LTD (Panteli Katelari 16, 1097, Nicosia, Cyprus), which acts in in this case as data processor on our behalf, audited by us and bound by contract in accordance with Article 28 GDPR.

Storage duration / criteria for specifying the storage duration:
Personal data gathered by consent will generally be deleted upon the completion of a competition and receipt of the prize by the winners.

4. Use of cookies and similar techniques for processing usage data
4.1 Use of cookies and similar techniques

Purposes of data processing/legal basis
We, Lidl Cyprus, Industrial Area, 2 Pigasou Street, CY- 7100 Aradippou – Larnaca, are the controller with respect to data processing in connection with the use of “cookies” under

Cookies are small text files that are stored on your device (laptop, tablet, smartphone or similar) when you visit our website. Cookies do not cause any damage to your terminal device, do not contain viruses, trojans or other malware. The cookie saves information in relation to your specifically used end device. This does not however mean that we directly obtain knowledge of your identity through this.

The use of cookies and other technologies for processing usage data serves – depending on the category of the cookie or the other technology – the following purposes:

Technically necessary: These are cookies and similar methods without which you cannot use our services (for example, for the correct display of our website/functions requested by you).

Marketing: These technologies enable us to display advertising content that is suitable for you, based on the analysis of your pattern of use. In this context, your pattern of use can also be tracked via different websites, browsers or terminal devices using a User ID (unique identifier).

You can find an overview of the cookies and other technologies used, together with the respective processing purposes, the storage periods and any third-party providers involved, here.

Depending on the purpose, the use of cookies to process usage data involves processing the following types of personal data in particular:

Technically necessary:

• Optimizing response times by distributing traffic on the website among multiple servers;
• User inputs to store the user’s consent status for the current domain (e.g., cookie consent).
Marketing: Pseudonymized user profiles with information about the use of our website. These include in particular:
• IP address,
• individual user ID,
• potential product interest and
• triggered events on the website (browsing patterns).

The IP address is anonymized, so that it cannot be traced back to your person.
Based solely on the user ID itself, we cannot drawn any conclusions about your person.

You may withdraw/modify your consent at any time with effect for the future without this affecting the lawfulness of the processing based on consent before its withdrawal. To do this, simply click here and make your selection. By removing the corresponding check marks, you revoke your consent in an easy and uncomplicated way for the relevant processing purpose.

Additionally, our site includes third party content. These third parties may use, with prior consent (where necessary), their own cookies as part of the content integrated on our site. Although these cookies are included in the overview of the cookies and other technologies used, we have no access to these cookies and we are in no way (joint) data controllers. For more information see paragraph 5 of this privacy policy.

Recipients/Categories of Recipients
Within the scope of data processing by means of cookies and similar technologies, we use specialised service providers, especially from the sector of online marketing. These service providers process your data on our behalf as data processors, are in each case carefully selected and contractually obliged in accordance with article 28 GDPR, except for those third parties identified under paragraph 5 of this privacy policy.

As part of our cooperation with Google LLC, the aforementioned data is usually also processed on servers in the USA for statistical purposes.

Storage duration / criteria for determining the storage duration
You can find the storage period for cookies and other similar technologies in our Cookie Policy. If “persistent” is stated in the “expiration” column, the cookie or other similar technology is stored permanently until the corresponding consent is revoked.

4.2 Google Analytics

Purpose of data processing / Legal bases:
In order to constantly optimise and adjust our websites in accordance with your needs, we use Google Analytics, an online analysis service of Google Inc. (‘Google’) based on Article 6, paragraph 1, item f) of the GDPR. Our legitimate interest originates from the aforementioned aims. In this context, ‘pseudonymised’ usage profiles are created and cookies are used. Cookies record the following data regarding the use of this website:

• type/ edition of browser
• operating system used
• Referrer-URL (the previous website you visited),
• Host name of access computer (IP address),
• time of server request.

The information is used to evaluate the use of our websites, to compile reports regarding website activity, and to provide additional services connected to website and internet use for purposes of market research and to adjust the websites in question depending on the needs. IP addresses are made anonymous, so that it is impossible to match them (so-called IP masking).

You can obstruct cookie installation through the corresponding setting on your browser programme. However, we should point out that in such a case you may not be able to use all the functions of that website. You can also obstruct data analysis created by cookies concerning the use of this website (including the IP address) as well as the processing of the data in question by Google, if you load and install this browser extension. Instead of this browser extension you can also stop analysis by Google Analytics, especially on mobile device browsers, if you click on this link. An opt-out cookie is created which blocks future analysis of your data during your visit to this website. The opt-out cookie is only in effect in this browser and only for our website and is only stored on your device. If you delete the cookies from this browser you must save the opt-out cookie again. More information regarding data protection in relation to Google Analytics can be found at the Google Analytics website.

Recipients/ Categories of recipients:
Data created by cookies are transmitted to a Google server in the USA and are stored there. In no case is your IP address merged with other Google data. Also, the data in question may be transferred to third parties if it is foreseen by law or if the third parties have been authorised to process these data.

Duration of storage/ Criteria for determining the duration of storage:
After the masking of the IP address it is no longer possible for it to be connected to your person. The data created for statistical reasons are deleted by Google Analytics after 50 months. The reports compiled based on Google Analytics no longer refer to individuals.

5. Third party content on our website
5.1 YouTube videos

YouTube videos, which are saved on, are made available and can be viewed directly from our website. These are included in the “advanced privacy mode”, which means that your personal data is not stored by YouTube if it does not play the videos.

Further information about the purposes and methods of the processing of personal data carried out through YouTube, also on server located in the USA, can be found in the provider’s privacy policy. It also contains information relating to your rights and system settings to protect your privacy. YouTube address and privacy policy: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,

5.2. Google Maps

On our website we use the services offered by Google Maps. In this way you can view and use the interactive maps directly from our website to find easily and quickly, for example Lidl Food Academy facilities in relation to your location.

Google Maps is used to make it easier to find the places indicated by us on our website. This represents a legitimate interest within the meaning of article 6, paragraph 1, letter f) GDPR.

As part of browsing our website, the Google Maps provider, i.e. Google, receives the information if you access the relevant page on our website. To use the Google Maps functions, it is necessary to process your IP address. As a rule, this is processed on a Google server in the USA. We have no possibility to influence the processing carried out through Google Maps.

Further information about the purposes and methods of the personal data processing carried out by Google Maps can be found in the provider’s privacy policy. It also contains information relating to your rights and system settings to protect your privacy. Address and privacy policy of the Google Maps service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,

6. Data transfers to recipients in a third country
If we transfer data to recipients in a third country (registered office outside the European Economic Area), you can refer to the information on the recipients/categories of recipients in the description of the respective data processing. For some third countries, the European Commission certifies by means of so-called adequacy decisions a data protection standard that is comparable to the level in the European economic area. A list of these countries can be found at If there is no comparable data protection standard in a country, we ensure that data protection is adequately guaranteed by other measures. This is possible, for example, via binding company regulations, standard contractual clauses of the European Commission for the protection of personal data, certificates, or recognized codes of conduct. Please contact our data protection officer (Section 8) if you would like more information.


7. Rights of data subjects

In addition to the right to withdraw any consent you have granted to us, you have the following additional rights provided the respective statutory conditions are met:

• The right of access to your personal data stored by us, pursuant to Article 15 GDPR.
• The right to request rectification of incorrect data or completion of incomplete data, pursuant to Article 16 GDPR
• The right to request erasure of your personal data stored by us pursuant to Article 17 GDPR
• The right to request restriction of processing of your data pursuant to Article 18 GDPR
• The right to request data portability, pursuant to Article 20 GDPR
• The right to object to the processing of your personal data, pursuant to Article 21 GDPR

Right of access pursuant to Article 15 GDPR
Pursuant to Article 15(1) of the GDPR, you have the right to request information, free of charge, on the personal data stored about you. This particularly includes:

• the purposes for which personal data is being processed;
• the categories of personal data that are being processed;
• the recipients or categories of recipient to whom personal data concerning you has been or will be disclosed;
• the planned duration of the storage of the personal data concerning you or, if it is not possible to give any specific details, the criteria used to determine the storage duration;
• the existence of a right to rectification or erasure of the personal data concerning you, a right to request from the controller that processing be restricted or a right to object to this processing;
• the right to lodge a complaint with a supervisory authority;
• all available information regarding the origin of the data if the personal data is not being collected from the data subject;
• the existence of any automated decision-making processes including profiling pursuant to Article 22(1) and (4) GDPR and – at least in these cases –meaningful information regarding the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

If personal data is transferred to a third country or an international organization, you have the right to be notified about appropriate safeguards pursuant Article 46 GDPR in connection with the transfer.

Right to rectification pursuant to Article 16 GDPR
You have the right to request the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure pursuant to Article 17 GDPR
You have the right to require us to erase any personal data concerning you without undue delay where one of the following grounds applies:

• the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
• you withdraw your consent on which the processing pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR was based and there is no other legal ground for the processing;
• you object to the processing pursuant to Article 21(1) or (2) GDPR, and in the case of Article 21(1) GDPR there are no overriding legitimate grounds for the processing;
• the personal data was unlawfully processed;
• the erasure of personal data is necessary in order to comply with a legal obligation;
• the personal data was collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

Where we have made the personal data public and are obliged to erase it, taking account of available technology and the cost of implementation we will take reasonable steps to inform any third parties processing your data of the fact that you have requested the erasure by such third parties of any links to, or copies or replications of, such personal data.

Right to restriction of processing pursuant to Article 18 GDPR
You have the right to require us to restrict the processing where one of the following applies:

• you contest the accuracy of the personal data;
• the processing is unlawful, and you request the restriction of the use of the personal data rather than its erasure;
• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defense of legal claims or
• you have objected to the processing pursuant to Article 21(1) GDPR pending verification of whether the legitimate grounds of the controller override those of the data subject.

Right to data portability pursuant to Article 20 GDPR
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another controller without hindrance by us, where

• the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR and
• the processing is carried out by automated means.

In exercising your right to data portability, you have the right to have the personal data transmitted directly from us to another controller where technically feasible.

Right to object pursuant to Article 21 GDPR
Provided the requirements of Article 21(1) GDPR are met, you may object to the data processing on grounds relating to your particular situation.
The aforementioned general right to object applies to all processing grounds set out in these data protection information, which are processed on the basis of Article 6(1)(f) GDPR. In contrast to the specific right to object regarding data processing for promotional purposes, we are only obliged to action such general right to object if you cite grounds of overriding importance, e.g. a possible risk to life or health. In addition, you have the option to contact the supervisory authority responsible for Lidl Cyprus or the data protection officer of Lidl Cyprus.

Right to lodge a complaint with the data protection supervisory authority pursuant to Article 77 GDPR
You also have a right to lodge a complaint with the competent data protection supervisory authority at any time. In order to do this, you can contact the data protection supervisory authority where you have your place of residence or habitual residence, place of work or place of the alleged infringement or at the authority of the state in which the controller is headquartered. Competent supervisory authority for data protection in Cyprus is Office of the Commissioner for Personal Data Protection (Iasonos 1, 1082 Nicosia, Cyprus,

8. Name and contact details of the controller and contact details of the company’s data protection officer
This Data Protection Information governs the processing of data by Lidl Cyprus (Industrial Area, 2 Pigasou Street, CY- 7100 Aradippou – Larnaca), (“Controller”) and for the website The company data protection officer of Lidl Cyprus can be contacted at the aforementioned address for the attention of the data protection officer or at