Data Protection Provisions

Thank you for visiting the data protection section of our website. We want you to feel comfortable and safe when you visit our website, and to know that one of the things that sets us apart is our commitment to protecting our customers' data.

The following data protection notice is designed to inform you about how and to what extent your personal data is processed when you visit our website. Personal data is information that identifies you or could identify you directly or indirectly. The statutory basis for data protection is, in particular, the General Data Protection Regulation (GDPR).

1. General

When you access our website, various information is exchanged between your end device and our server. This may also involve personal data. The information collected in this way is used to optimize our website or to display ads in your end device's browser.

2. Accessing our website
Zwecke der Datenverarbeitung/ Rechtsgrundlagen:

Purposes of the data processing/ legal bases:

When accessing our website, the browser used on your end device will – automatically and without any action on your part – send

  • the IP address of the accessing Internet-enabled device,
  • the date and time of access,
  • the name and URL of the requested file,
  • the website/ application from which the access occurred (referrer URL),
  • the browser and, where relevant, the operating system of your Internet-enabled computer as well as the name of your access provider to our website server and be stored temporarily in what is known as a log-file for the following purposes
  • to ensure a fault-free connection,
  • to ensure the comfortable use of our website/ application,
  • to analyze system security and stability.

The legal basis for the processing of the IP address is Art. 6(1)(f) GDPR. The purposes of data processing listed above constitute our legitimate interest. If data is used for purposes of preparing a contract, the legal basis for the data processing is Article 6(1)(b) GDPR.

Storage time/ criteria for determining storage time:

Data will be stored for a period of seven days and be automatically deleted thereafter. If you stop using our website, the geolocalization data will be deleted.

3. Website and website optimization
3.1 Cookies – general information

We use cookies on our website in accordance with Art. 6(1)(f) GDPR. Our interest in optimizing our website constitutes a legitimate interest for the purposes of the above provision. Cookies are small files that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any harm to your end device, nor do they contain any viruses, Trojans or other malware. Cookies store certain information that relates to the specific end device used. However, this does not mean that we will become immediately aware of your identity. Using cookies enables us to make the use of our offers more comfortable for you. To that end, we employ what are known as session cookies,which allow us to detect that you have already visited certain pages on our website. These are automatically deleted when you leave our website. In addition, we use temporary cookies to improve user-friendliness, which are stored on your end device for a specific period. When you revisit our website to use our services, the cookies automatically detect that you have previously visited us which details you have entered/ which settings you used; this saves you from having to repeat these improve user-friendliness, which are stored on your end device for a specific period. When you revisit our website to use our services, the cookies automatically detect that you have previously visited us which details you have entered/ which settings you used; this saves you from having to repeat these actions.

We also use cookies to record the use of our website for statistical purposes,in order to optimize our offers and to display information specifically tailored towards you. These cookies allow us to detect automatically that you have visited us previously, when you revisit our website. These cookies are automatically deleted after a defined period. Most browsers accept cookies automatically. You may, however, configure your browser to prevent any cookies being stored on your computer or to ensure that a notice appears every time a new cookie is placed. However, a full deactivation of cookies may mean that you are not able to use all of our website's functions.

You can find a summary of the cookies used together with further information (e.g. storage time) in our Cookie Policy.

3.2 Google Analytics
Purposes of the data processing/ legal bases:

For the purposes of demand-driven design and ongoing optimization of our websites, we use Google Analytics, a web analysis service provided by Google LLC (“Google”), based on Art. 6(1)(f) GDPR. Our legitimate interest follows from the purposes set out above. In this context, pseudonymized user profiles are created and cookies are used. The cookies create the following information about your use of this website:

  • Browser type/ version,
  • Operating system used,
  • Referrer URL (i.e. the page previously visited),
  • Host name of the accessing computer (IP address),
  • Time of the server request.

This information will be used to evaluate the use of our website, to compile reports about website activities and to provide services associated with the use of the website and the use of the Internet for purposes of market research and demand-driven design of these websites. IP addresses are anonymized to ensure that identification is not possible (known as IP masking).

You can prevent cookies being installed by adjusting the settings of your browser software accordingly; however, please note that you may then not be able to make use of the full scope of functions available on this website. You can also prevent collection and processing of the data generated by the cookie about your use of the website (including your IP address) by Google by downloading and installing this browser add-on. As an alternative to the browser add-on, in particular when using browsers on mobile devices, you may prevent the collection of data by Google Analytics by clicking on this Link. This creates an opt-out cookie to prevent any future collection of your data when you visit this website. The opt-out cookie only applies in this browser and only for our website, and is stored on your device. If you delete the cookies in this browser, you will have to reset the opt-out cookie. Further information about data protection with regard to Google Analytics is available on the Google Analytics website.

Recipients/ categories of recipients:

The information created in the cookie is transferred to a Google server in the U.S. and stored there. To the best of our knowledge, your IP address will never be combined with other data held by Google. Where appropriate, this information may be transferred to third parties if required by law or if third parties process this data on behalf of the data controller.

Storage time/ criteria for determining storage time:

After your IP address has been anonymized, this can no longer be used to identify you. The data prepared for statistical purposes will be deleted in Google Analytics after 24 months. The reports compiled based on Google Analytics do no longer contain any reference to individuals.

4. E-mail contact

We treat all personal data that we receive from you by e-mail confidentially. We use your data solely for processing your request. The legal basis for the data processing is Art. 6(1)(f) GDPR. Both our and your (legitimate) interest in processing is served by responding to your request.

Recipients/ categories of recipients:

As a rule, we do not transfer the data to third parties. In exceptional cases, we will have a processor process the data on our behalf. Such processors are carefully selected, audited by us and bound by contract pursuant to Article 28 GDPR.

Storage time/ criteria for determining storage time:

We delete or anonymize all personal data we receive from you when you make inquiries by e-mail no later than 90 days after the final response is sent.

5. Recipients outside of the EU

Except for the processing activities set out in clause 3.2, we will not pass your personal data on to recipients located outside of the European Union or the European Economic Area. The processing activities listed in clause 3.2 involve a data transfer to servers of Google LLC. Some of these servers are located in the U.S. The European Commission has held in its Decision of July 12, 2016 that under provisions of the EU-U.S. Privacy Shield there is an adequate level of data protection in the U.S. (known as an "adequacy decision" in accordance with Article 45 GDPR). The service provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and the recipients specified in clause 5 are certified in accordance with the EU-U.S. Privacy Shield.

6. Embedded content

We have embedded YouTube videos on our website, which are stored at and can be played directly from our website. All videos are embedded with "privacy-enhanced mode" enabled, which means that no data about you as the user is transferred to YouTube if you do not play the videos. Data is only transferred if you play the videos. We do not have any control over this transfer of data.

You will find further information on the purpose and scope of data collection and how YouTube processes data in YouTube's privacy policy. You will also find further information there about your rights in this regard and settings to protect your privacy. YouTube address and privacy policy: Google LLC, 1600 Amphitheatre Parkway. Mountain View, CA 94043, USA;

7. Your rights as data subject
7.1 General
In addition to the right to withdraw any consent you have granted to us, you also have the following rights provided the respective statutory requirements are met:
  • The right of access to your personal data stored with us pursuant to Art. 15 GDPR and Section 34 German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG),
  • The right of rectification of inaccurate personal data and the right to have incomplete personal data completed pursuant to Art. 16 GDPR,
  • The right of erasure of your personal data stored with us pursuant to Art.17 GDPR,
  • The right of restriction of processing of your data pursuant to Art. 18 GDPR,
  • The right of data portability pursuant to Art. 20 GDPR, and
  • Theright to object pursuant to Art. 21 GDPR.
7.2 Right of access pursuant to Art. 15 GDPR
Pursuant to Art. 15(1) GDPR, you have the right to request information, free of charge, on the personal data stored about you. This includes in particular:
  • The purposes for which personal data is being processed;
  • The categories of personal data that are being processed;
  • The recipients or categories of recipients to whom personal data concerning you has been or will be disclosed;
  • The planned duration of the storage of your personal data or, if it is not possible to give any specific details, the criteria used to determine the storage duration;
  • The existence of a right to rectification or erasure of your personal data, a right to request from the controller that processing be restricted or a right to object to this processing;
  • The right to lodge a complaint with a supervisory authority;
  • any available information about the origin of the data if the personal data is not being collected from the data subject;
  • The existence of any automated decision-making processes including profiling pursuant to Art. 22(1) and (4) GDPR and - at least in these cases - meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

If personal data is transferred to a third country or to an international organization, you have the right to be notified about the appropriate safeguards pursuant to Art. 46 GDPR related to the transfer.

7.3 Right to rectification pursuant to Art. 16 GDPR

You have the right to request from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

7.4 Right to erasure pursuant to Art. 17 GDPR
You have the right to request from us the erasure of any personal data concerning you without undue delay where one of the following grounds applies:
  • The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  • You withdraw your consent on which the processing pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR was based, and there is no other legal ground for the processing;
  • You object to the processing pursuant to Art. 21(1) or (2) GDPR, and in the case of Article 21(1) GDPR there are no overriding legitimate reasons for processing;
  • The personal data has been unlawfully processed;
  • The personal data must be erased to comply with a legal obligation;
  • The personal data has been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.

Where we have made the personal data public and are obliged to erase it, taking account of available technology and the cost of implementation, we will take reasonable steps to inform any third parties processing your personal data of the fact that you have requested the erasure by such third parties of any links to, or copies or replications of, such personal data.

7.5 Right to restriction of processing pursuant to Art. 18 GDPR
You have the right to request from us the restriction of processing where one of the following applies:
  • You contest the accuracy of the personal data;
  • The processing is unlawful and you request the restriction of its use rather than its erasure;
  • The controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defense of legal claims or
  • You have objected to processing pursuant to Art. 21(1) GDPR pending verification of whether the legitimate grounds of the controller override those of the data subject.
7.6 Right to data portability pursuant to Art. 20 GDPR

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, where:

  • The processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) or on a contract pursuant to Art. 6 (1)(b) GDPR; and
  • The processing is carried out by automated means.

In exercising your right to data portability, you have the right to have the personal data transmitted directly from us to another controller, where technically feasible.

7.7 Right to object pursuant to Art. 21 GDPR

Provided the requirements set out in Art. 21(1) GDPR are met, you may object to data processing on grounds relating to your particular situation.

The aforementioned general right to object applies to all the processing grounds set out in these data protection provisions, which are processed based on Art. 6 (1)(f) GDPR. In contrast to the specific right to object regarding data processing for promotional purposes (cf. above, in particular clause 3.6), we are only obliged to implement such a general objection pursuant to the GDPR if you cite grounds of overriding importance, e.g. a possible risk to life or health.

8. Points of contact
8.1 Points of contact for questions or to exercise your data protection rights
If you have any questions regarding the website or in order to exercise your rights in the processing of your data (data protection rights), please contact our customer service:

8.2 Points of contract for any data protection questions

Should you have any further questions concerning the processing of your data, please contact the data protection officer at Lidl (see clause 9).

8.3 Right to lodge a complaint with the data protection supervisory authority

You also have the right to lodge a complaint with the competent data protection supervisory authority at any time. To do this you can contact the data protection supervisory authority of the federal state where you are resident or the authority in Baden-Württemberg as the federal state where Lidl Stiftung & Co. KG is headquartered.

9. Name and contact details of the controller responsible for the processing and contact details of the company's protection officer

These data protection provisions apply to data processing by Lidl Stiftung & Co. KG, Stiftsbergstrasse 1, 74172 Neckarsulm, Germany (“Controller”) and to the website The company protection officer of Lidl Stiftung & Co. KG can be contacted at the address mentioned above for the attention of the data protection officer or at