We would hereby like to inform you about how we handle your data in our pages in social networks in accordance with Article 13 of the General Data Protection Regulation (GDPR) and the national legislation on data protection and any subsidiary legislation issued under the same as may be amended from time to time.

1. Data controller

The data collection and processing described below is controlled partly by us,

Lidl Cyprus

Industrial Area, 2 Pigasou Street, CY-7100 Aradippou, Larnaca

Telephone: 00357 800 94 404

Email: info@lidl.com.cy

and partly by the corresponding social network platform operator (hereinafter: platforms). With respect to certain processing, both we and the platform operators act together as joint controllers within the meaning of Article 26 GDPR (processing under point 4).

We, Lidl Cyprus (hereinafter: Lidl), operate on the following network pages:

Facebook: https://www.facebook.com/lidlcy/

Instagram: https://www.instagram.com/lidl_cyprus

Twitter: https://www.twitter.com/Lidl_Cyprus_

YouTube: https://www.youtube.com/user/lidlcyprus

LinkedIn: https://www.linkedin.com/company/lidl-cyprus

2. Data Processing by the Platform Operator

As Data Controller, the platform operator is responsible for the data processing (e.g. handling of the users and of the shared information) carried out by himself on the social media platform. Where possible, we try to ensure that the operator of the social media platform processes the data in accordance with the data protection legislation. In many cases, however, we cannot influence data processing by platform operators and thus do not know exactly what data they are processing.

The platform operator manages the overall IT infrastructure of the service, observes its own data protection standards and maintains its own relationship with you as a user (if you are a registered user of the social networks). Moreover, the platform operator is solely responsible for all questions regarding the user profile data, to which Lidl has no access.

Further information on data processing carried out by the platform providers including information on how to object can be found in the providers’ privacy policies:

Facebook: https://www.facebook.com/privacy/explanation

Instagram: https://help.instagram.com/519522125107875

Twitter: https://twitter.com/en/privacy

YouTube: https://www.youtube.com/yt/about/policies/

LinkedIn: https://www.linkedin.com/legal/privacy-policy

When using the platform, your personal data is usually also processed by the respective platform operator on servers in third countries, in particular in the USA.

3. Data Processing by us

(a) Our presences on social networks

Purpose of data processing by us / Legal basis

The purpose of data processing by us, in our pages, is to inform customers about offers, products, services, promotions, prize draws, factual issues, company news, as well as to interact with pages visitors on these topics, and to respond to similar queries, praise or criticism.

We reserve the right to delete various contents only if necessary. This may be the case, for example, in the event of infringing or illegal posts, hate speech, bullying (inappropriate sexual content) or attachments (e.g. images or videos) that may infringe copyrights, personality rights, criminal laws or ethical rules of Lidl.

We are likely to share your content on our pages, where this is a function of the platforms, and contact you via platforms. The legal basis is Article 6 (1)(f) GDPR. Data processing takes place in the interest of our promotion and communication.

The platform operator cannot influence the processing of your data performed by Lidl Cyprus within the scope of customer communication or prize draws.

As we have already mentioned, we make sure that, where allowed by the platform operators, we develop our pages so as to be in line, as much as possible, with data protection legislation.

The data you provide to us on our pages, such as comments, videos, images, likes, public messages, etc. are made public for that purpose on the platform and never used or processed by us for other purposes at any time.

Recipients / categories of recipients

We may share your contents on our page and communicate via social networks if this is a platform function. If you submit a request through the platform, we may refer you to other secure communication channels that guarantee confidentiality depending on the response required. You can always send us confidential enquiries to the address indicated in point 1 or here.

With respect to data we receive in a confidential way (e.g. through a private message, letter, or email), we generally exclude the transmission of data to third parties outside the Lidl Group. Exceptionally, some data is processed by processors following our instructions. Those processors are carefully selected, controlled by us and contractually bound in accordance with Article 28 GDPR.

In addition, it may be necessary to send your requests to our contracted partners (e.g. suppliers, in the case of product-related questions) for processing. If your personal information must be forwarded, we will inform you in advance and ask for your consent.

Storage duration/criteria for determining storage duration:

All the personal data that you provide us in inquiries (suggestions, praise, or criticism) are erased or securely anonymised in their majority within 90 days from the date we send you our final response. Retention for 90 days is justified by the fact that, in individual cases, you may return as a customer after the response you receive and contact us again on the same issue, in which case we should be able to look back at the previous correspondence. In our experience, we generally receive no further inquiries to our responses after 90 days.

When exercising your rights as data subjects, the response to your request will be retained for a period of 3 years. The retention period starts from the final response to you. The storage of such data is used to document compliance with legal requirements.

There are cases where it is necessary to store your data for longer where, for example, it is required by law or for the comprehensive handling of your case. In such cases, we do not store your data for longer than required by legal retention periods or until your case is fully processed.

All your public posts on our page remain on the timeline for an unlimited time, unless we delete them as a result of an update to the subject matter, a violation of the law, or a breach of our guidelines, or if you delete the post yourself.

Lidl has no influence on the deletion of your data by the operator itself. The data protection provisions of the respective operator therefore also additionally apply.

(b) Prize draws

Purpose of data processing / legal bases:

You may participate in prize draws through our website, our newsletter or through our pages on social networks. Unless otherwise specified in the privacy policy for the prize draw or if you have not given us your explicit consent, the personal data you provided to us when entering the prize draw will be processed exclusively to execute the prize draw (e.g. determination of the winner(s), notification of the winner(s), sending of the prize, possible anonymous winner announcement). If you operate under your real name in the relevant social network or are identifiable through photos in your profile, we cannot exclude identification by other users.

The legal basis for data processing as part of the prize draws is in principle Article 6(1)(b) GDPR. Where consent is given in a prize draw, Article 6(1)(a) GDPR is the legal basis for the consent-based data processing. If you have given consent in a prize draw, you may withdraw such consent at any time with effect for the future.

Recipients/categories of recipients:

Your personal data are shared with third parties only if this is necessary for running the prize draw or sending the prize (e.g. for the promoter of a prize draw to send the prize or sharing the data with a logistics company) or you have given us your express consent to do so. Please note that in some cases of our pages on social networks, participation may even be possible directly through our publicly visible online presence (possibly via board or comments) and in a way that other users can see that you have participated due to your public interaction with us. It is also possible that in those cases your win will appear on our respective page. If you operate under your real name in the relevant social network or are identifiable through photos in your profile, we cannot exclude identification by other users.

Storage duration/criteria for determining storage duration:

After the end of the prize draw and the announcement of the winners, the winners' personal data are erased within 90 days after the prize has been delivered or given to them. In case of material prizes, the data of the winners are stored for the duration of the statutory warranty claims in order to arrange for rectification or replacement if there is any defect in the prize. When you participate in a prize draw on a page (e.g. via a post or comment), we are not able to influence the erasure of your data by the platform operator. The data protection provisions of the respective operator of the social media site therefore also additionally apply.

(c) Newsletter

Purpose of data processing/legal bases:

You can sign up to our newsletter via online frames available on our pages. If you consent to receiving our newsletter, we will use your email address and possibly your name to send (separate, if possible) product information, promotions, prize draws and news on stores, flowers and plants as well as customer satisfaction surveys. We store and process such data for the purpose of sending the newsletter.

The content of the newsletters includes actions (promotions, discounts, prize draws, etc.) as well as information about the products and services of the (partner) companies affiliated with www.lidl.com.cy. These are currently in particular:

Lidl Stiftung & Co. KG (https://www.lidl.com.cy/en)

With your consent, we analyse your user behaviour on websites linked to www.lidl.com.cy, mobile applications, and newsletters. Assessment of user behaviour includes, in particular, the parts of the respective website, mobile application or newsletter of ours and our partner Lidl Stiftung & Co. KG (https://www.lidl.com.cy/en) that you visited, and the links you activated. Based on those data, we create user profiles that are classified by person and/or email address, in order for promotion, more specifically in the form of a newsletter, of advertising messages on the page to be better tailored to your personal interests and for our web offers to be improved.

The legal basis for the data processing referred to above is your consent in accordance with Article 6 (1)(a) GDPR.

In order to ensure that no errors have occurred during entry of your e-mail address we use the double opt-in procedure. We send you a confirmation link after you have entered your e-mail address in the sign-in field. Your e-mail address will not be added to our mailing list until you click on this confirmation link.

You may withdraw your consent to receiving the newsletter incl. creating personalised user profiles at any time with effect for the future, e.g. if you unsubscribe from the newsletter through our website. The link to unsubscribe is at the end of each newsletter. If you unsubscribe, we consider that you have withdrawn your consent for the creation of a personal user profile and the receipt of the newsletter based on said profile. We will erase your user data.

Recipients/categories of recipients:

If external processors are commissioned for the dispatch of the newsletter, these are bound by contract pursuant to article 28 GDPR.

Storage duration/criteria for determining storage duration:

If you withdraw your consent to receive the Lidl newsletter, your email address will be excluded from receiving the Lidl newsletter. Thereafter, your data will be erased within six months by the respective email distributors. When subscribing to a newsletter on a page, we cannot influence erasure of your data by the platform manager. The data protection provisions of the respective operator regarding data erasure therefore also additionally apply

d) Social Listening and Social Media Monitoring

Purposes of data processing / legal basis:

In addition to the information you provide us directly via the platform, we continue to use the opportunity of so-called social listening and social media monitoring to gain an idea of the perception of our products and services, to be able to evaluate our marketing activities and to identify potential improvements. Contributions on platforms are evaluated according to a search request (e.g. for a new product line) or certain key figures (e.g. views, number of clicks). Only those contributions which have been freely made available by you to an unlimited public are viewed here.

The extent of the data processed is primarily determined by the nature and content of the said contribution such as e.g. a posting in text form or an uploaded image file. In single cases, the respective user ID may also be processed if Lidl would like to offer help with any problems. We also receive information from the platform operators regarding the impact of each of our posts.

The legal basis for the processing of personal data as part of Social Listening is Article 6(1)(f) GDPR, since we have a legitimate interest in identifying any deficiencies in our products and services in openly accessible statements so that we may respond accordingly.

Recipients / Categories of Recipients:

If we use external data processors in the context of social listening or social media monitoring, they are contractually obliged under Article 28 GDPR. Within the scope of our cooperation with Socialbakers a. s., the above data are usually also processed on servers in the USA for the purposes of social media monitoring.

Storage period / Criteria determining the storage period:

The relevant data are not permanently stored by Lidl but are only analysed in a targeted manner in relation to any required countermeasures. If necessary, we may retain your data for annual comparative evaluations for up to 2 years, unless you have deleted your data from the platform beforehand.

4. Joint responsibility, Article 26 (1) GDPR

Lidl has a Joint Controller relationship pursuant to art. 26, paragraph 1 GDPR with the following platform operators:

Facebook: https://en-gb.facebook.com/legal/terms/page_controller_addendum

LinkedIn: https://legal.linkedin.com/pages-joint-controller-addendum

With respect to the web tracking methods used by the platform operator, we act as joint controllers with said platform operator. Web tracking can take place regardless of whether you are logged in or registered to the platform. As already stated above, we are unfortunately unable to influence web tracking methods on platforms. This is something that we cannot, for example, disable.

The legal basis for the web tracking methods is your consent in accordance with article 6, paragraph 1, letter a) GDPR.

Further information on the recipients and categories of recipients, as well as the storage duration or the criteria determining storage duration can be found in the platform's privacy policies. We have no influence on them.

The ability to exercise the exclusion rights for those web tracking methods or to withdraw your consent is provided in the privacy policies of the platform operators listed in point 2. You can also contact the platform operator using their company’s contact details provided in their legal notice.

With reference to the processing activity performed by the social media platform operators for statistical purposes, Lidl has limited possibilities of influence and cannot prevent them. However, we attach great importance to no additional, optional, statistical data being made available to us.

Please also note that the operator of the platform uses your profile and behaviour data in accordance with its usage and data protection provisions to evaluate your habits, personal relationships and preferences. Lidl has no influence on the processing or transfer of your data by the operator of the platform.

5. Processing of data in a third country

If we transfer personal data to recipients in the third-party countries (countries outside of the European Economic Area) you can derive that from the information regarding data processing by our service providers described in the present data protection policy. Through the adoption of adequacy decisions, the European Commission determined whether such third-party country offers an adequate level of data protection. The exact list of the country with an adequacy decision can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. If for a third-party country no adequate protection level has been determined by the European Commission, we ensue that the adequate level of data protection is provided by other measures such as: binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data, certifications mechanism or recognised codes of conduct. Please contact our data protection officer (point 8) in case that you would like to obtain further information.

Your use of the platform may involve the processing of your data in a third country (based outside the European Economic Area) by the platform operator. For more information on the processing of your data in a third country over which Lidl has no influence, please refer to the data protection declarations of the platform operators listed in section 2.

6. Your rights as data subject

a) Overview

Apart from the right to withdraw the consent you provided to us, you also have the following rights, as long as the legal requirements are in place in each case:

• the right of access to information about your personal data that we store in accordance with Article 15 GDPR,

• the right to rectification of inaccurate data or to have incomplete data completed in accordance with Article 16 GDPR,

• the right to erasure of your data which we have stored in accordance with Article 17 GDPR,

• the right to restriction of processing of your data in accordance with Article 18 GDPR,

• the right to data portability in accordance with Article 20 GDPR,

• the right to object in accordance with Article 21 GDPR.

b) The right of access in accordance with Article 15 GDPR

You have the right to upon request us to confirm whether or not we are processing personal data that concerns you and, if we are, to receive information free of charge on the personal data about you that have been stored with us. This includes in particular:

• the purposes of the personal data processing,

• the relevant categories of personal data that we process,

• the recipients or the categories of recipients with whom your personal data are being disclosed or will be disclosed,

• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,

• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing

• the right to lodge a complaint with a supervisory authority,

• where the personal data are not collected from the you (data subject), any available information as to their source,

• the existence of automated decision making, including profiling, referred to in Article 22(1) and (4) GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

When personal data are transferred to a third country or an international organisation, the data subject has the right to be informed regarding the appropriate safeguards, in accordance with Article 46 GDPR relating to the transfer.

c) The right to rectification under Article 16 GDPR

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement.

d) The right to erasure ('right to be forgotten') under Article 17 GDPR

You have the right to ask us to erase personal data without undue delay, if one of the following reasons applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,

• you withdraw your consent on which processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) of the GDPR and there is no other legal ground for the processing,

• you object to the processing in accordance with Article 21(1) or (2) GDPR and there are no overriding legitimate grounds for the processing in accordance with Article 21(2) GDPR,

• the personal data have been unlawfully processed,

• the personal data must be erased for compliance with a legal obligation

• the personal data have been collected in relation to the offer of information society services to children referred to in Article 8(1) GDPR.

Where we have made the personal data public and are obliged to erase it, we will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform third parties which are processing your personal data that you have requested the erasure by such third parties of any links to, or copy or replication of, that personal data.

e) The right to restriction of processing in accordance with Article 18 of the GDPR

You have the right to request from us the restriction of processing when one of the following requirements is met:

• you question the accuracy of the personal data,

• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,

• the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims,

• or if you have objections to the processing in accordance with Article 21(1) of the GDPR, pending verification whether the legitimate grounds of the controller override those of the data subject.

f) The right to data portability in accordance with Article 20 of the GDPR

You have the right to ask us to provide your personal data (that you shall have provided to us) to you in a structured, commonly used, machine-readable format, or (where technically feasible) to have it 'ported' directly to another data controller, provided this does not adversely affect the rights and freedoms of others. This right shall only apply where:

• The processing is based on your consent or on the performance of a contract with you; and

• The processing is carried out by automated means.

g) The right to object in accordance with Article 21 of the GDPR

Under the conditions set out in article 21, paragraph 1 GDPR, you have the right to object to data processing on grounds relating to your particular situation.

The aforementioned general right to object is valid for all the purposes of data processing described in the data protection terms herein, which are being processed by virtue of Article 6(1)(f) of the GDPR. In contrast to the special right to object that concerns data processing for direct marketing purposes, we are obliged, in accordance with the GDPR, to apply the general right to object only if you give us reasons of overriding importance for this, e. g. a possible risk to life or health. Apart from that, there is the possibility to contact the relevant regulatory authority regarding Lidl Cyprus or the data protection officer of Lidl Cyprus.

h) The right to lodge a complaint with the data protection supervisory authority pursuant to Article 77 GDPR

You also have a right to lodge a complaint with the competent data protection supervisory authority at any time. In order to do this, you can contact the data protection supervisory authority where you have your place of residence or habitual residence, place of work or place of the alleged infringement or at the authority of the state in which the controller is headquartered. Competent supervisory authority for data protection in Cyprus is the Office of the Commissioner for Personal Data Protection (Kipraronos 15, 1061 Nicosia, Cyprus, +357 22 818456, commissioner@dataprotection.gov.cy)

7. Contact persons

a) Contact person for questions or to exercise your data protection rights

If you have any questions about our pages in social networks or would like to exercise your rights with regard to processing of your data (data protection rights), you can contact our customer service department:

LIDL Cyprus

Industrial Area, 2 Pigasou Street, CY- 7100 Aradippou – Larnaca

e-mail: info@lidl.com.cy or tel. 0035 800 94 404 or here via contact form

b) Contact person for questions regarding Data Protection topics:

If you have any further questions concerning the processing of your data, you can contact our data protection officer at the following email address: dataprotection@lidl.com.cy

8. Contact details of the company data protection officer

The company data protection officer of Lidl Cyprus can be reached at the address given in point 1, to the attention of the data protection officer or at dataprotection@lidl.com.cy.