Privacy Policy for Prize Draws
In addition to our Privacy Policy, we would like to inform you below about the data process in connection with our prize draws.
Unless otherwise indicated below, the controller (Article 4(7) GDPR) for the data processing detailed in the following is:
Lidl Stiftung & Co. KG
Stiftsbergstr. 1
74167 Neckarsulm, Germany
E-mail: info@crivit.com
For general questions, you can also contact info@crivit.com.
Our company data protection officer can be contacted at the above address for the attention of the data protection officer or by e-mail at datenschutz@crivit.com.
Purposes and Legal Bases
You can take part in various prize draws on our website, via our newsletter or on our social media sites. Unless otherwise provided in the given prize draw, or unless you have given us further explicit consent, the personal data you provide to us in the context of participating in the prize draw will be used solely for the purpose of conducting the prize draw (e.g., drawing and notifying winners, sending the prize, announcing winners anonymously, where applicable). If you use your real name on the relevant social media site or are recognizable in photos in your profile, we cannot rule out the possibility that you will be identified by other users.
We process your e-mail address, first and last name, social media account name, postal address and other necessary information relating to the award of the prize (e.g., dress size) in order to conduct the prize draw, in particular to determine and contact the winner and to fulfill our obligations to the winner arising from the prize. The legal basis for the processing in the context of prize draws is generally Article 6(1)(b) GDPR.
In the event that consent is given in the context of a prize draw, Article 6(1)(a) GDPR is the legal basis for any data processing carried out on the basis of such consent. Where you have given your consent in the context of a prize draw, you are entitled to withdraw that consent at any time with effect for the future.
Recipients/Categories of Recipients:
We use additional service providers for this data processing to assist us with conducting prize draws. For this purpose, the above-mentioned personal data will be made available to the service provider, e.g., for the determination of winnings or the dispatch of prizes.
Please note that on some social media sites, you may also be able to participate directly on the publicly visible websites (e.g., on the wall or via comments), so that other users will be able to see that you are participating when you publicly interact with us. In these cases it will also be apparent on the respective site when you win the prize draw. If you use your real name on the relevant social media site or are recognizable in photos in your profile, we cannot rule out the possibility that you will be identified by other users.
For tax reasons, we will transfer the winner data to Schwarz Corporate Solutions KG, Stiftsbergstr. 1, 74172 Neckarsulm, Germany
Storage Time/Criteria for Determining Storage Time:
At the end of the prize draw and following the announcement of the winners, participants' personal data will be deleted within two weeks after the prize has been dispatched. We are required to keep data concerning the winners for six years for tax purposes.
If you participate in a prize draw on a social media site (e.g., by post or comment), we have no control over the deletion of your data by the operator. The privacy policy of the relevant operator of the social media site therefore also applies in relation to the storage period (see clause B 2.).
The provision of personal data is required to participate in the prize draw. You will not be able to participate in the prize draw if you do not provide this data.
No automated decision-making including profiling pursuant to Article 22(1) and (4) GDPR takes place.
You may withdraw consent at any time with effect for the future without this affecting the lawfulness of the previous processing.
You also have the following rights: Right to obtain information about the personal data stored about you, a right to rectification, erasure and restriction of processing of your personal data (Articles 15–18 GDPR). Provided the requirements of Article 20 GDPR are met, you have a right to data portability in accordance with Article 20 GDPR.
In the case of data processing on the basis of Article 6(1) sentence 1(f) GDPR (processing on the basis of a legitimate interest), you have the right to object in accordance with Article 21 GDPR.
You also have a right to lodge a complaint with a data protection supervisory authority at any time.
You can find detailed information on these rights and on exercising your rights as a data subject in our Privacy Policy.
The company data protection officer of Lidl Stiftung & Co. KG can be contacted at the address provided above under A 1. for the attention of the data protection officer or at datenschutz@lidl.com.
Site operator for the following network sites
We are
Lidl Stiftung & Co.KG
Stiftsbergstraße 1
74167 Neckarsulm, Germany
Local Court (Amtsgericht) of Stuttgart, HRA 102314
VAT ID no.: DE145803808
Lidl Stiftung & Co. KG is represented by LSt Stiftung, registered office in Dresden, State Directorate (Landesdirektion) of Saxony, ref. 20-2245/501, which in turn is represented by two directors, including Kenneth McGrath and Pierre Schalbe, who are authorized to represent the company acting jointly.
Contact:
E-mail: kontakt@lidl.com
We have only limited control over the processing of data by the operators of the platforms (e.g., the management of members and the information shared). In the situations in which we are able to have influence and can set parameters for the data processing, we endeavor to ensure within the confines of the options available to us that the platform operator deals with the data in accordance with data protection law requirements. In many cases, however, we are unable to influence the way in which platform operators process data and also do not know exactly which data they process.
Platform operators operate the entire IT infrastructure of the service, have their own privacy policies and maintain their own user agreements with you (where you are a registered user of the social media service). The operator is also solely responsible for all questions relating to the data that makes up your user profile, which we as a company have no access to.
You will find further information about the data processing performed by platform operators and your rights to object in the individual operator's privacy policy.
Within the scope of platform use, your personal data is also generally processed by the respective platform operator on servers in third countries, in particular in the United States and the United Kingdom.
Our Social Media Sites
Purpose of the Processing We Perform and Legal Basis
We process data on our sites for the purpose of providing information to customers about offers, products, services, promotions, prize draws, specific topics and latest company news, to interact with visitors to our sites on these topics, and to respond to relevant inquiries and positive or negative feedback.
We merely reserve the right to delete content if it becomes necessary to do so. We may share your content on our site if this is one of the functions of the platform, and communicate with you through the platform. The legal basis is Article 6(1)(f) GDPR. The processing is carried out for the purpose of our public relations work and communications.
Operators have no ability to influence Lidl's processing of your data in connection with customer communications or prize draws.
As already mentioned, where platform operators give us the option, we make sure we design our sites to be as compliant as possible with data protection laws.
Recipients/Categories of Recipients:
The data entered by you on our sites, such as comments, videos, images, likes, public messages, etc., is published by the platforms and is not used or processed by us for other purposes at any time. We merely reserve the right to delete unlawful content if it becomes necessary to do so. This would be the case, for example, for posts that infringe rights or violate the law, comments that incite hatred, offensive comments (sexually explicit content) or attachments (e.g., images or videos), which may be in violation of copyright laws, moral rights/rights of publicity, criminal law or Lidl's ethical principles.
We may share your content on our site if this is one of the functions of the platform, and communicate with you through the social media services. If you post an inquiry on the platform, we may also, depending on the required response, refer you to other more secure modes of communication that guarantee confidentiality. You always have the option of sending confidential inquiries to us at our address listed under clause A 1 above or in the "legal notice" section of our website.
Data that you send to us via a confidential channel (e.g., by private message, letter or e-mail) will not be transferred to third parties outside Lidl Group. In exceptional cases, we will have a processor process the data on our behalf. Such processors are carefully selected, audited by us and bound by contract in accordance with Article 28 GDPR. Furthermore, it may be necessary for us to pass on excerpts of your confidential inquiry to contractual partners (e.g., suppliers in the case of product-specific inquiries) for the purpose of processing your inquiry. In these cases, however, your inquiry will be anonymized in advance, meaning that third parties will not be able to identify you. Should it be necessary to pass on your personal information in individual cases, we will notify you in advance and obtain your consent.
Storage Time/Criteria for Determining Storage Time:
We delete or securely anonymize all information we receive from you when you make inquiries (positive/negative comments or suggestions) via a secure message no later than 90 days after the final response is sent to you. The information is retained for 90 days in case you contact us again as a customer after receiving a response from us on the same matter and we need to refer to our previous correspondence. Based on experience, we generally do not receive any questions concerning our responses after 90 days.
All public posts that you put on this site remain in the timeline for an indefinite period, unless we delete them as part of updating the information on the topic, they violate the law or breach our guidelines or policies, or you delete the post yourself.
We have no control over the deletion of your data by the operator itself. The privacy policy of the relevant operator therefore also applies in relation to the storage period.
Social Listening and Social Media Monitoring
Purposes of the Processing/Legal Bases:
In addition to the information you provide us directly via platforms, we also use "social listening" and social media monitoring tools to get a picture of how our marketing activities are perceived and to identify any opportunities for improvement. Posts on platforms are analyzed via search requests (e.g., for a new product line) or certain indicators (e.g., page views, number of clicks). Only those posts are viewed which you have made freely available to the public.
The scope of the data collected is determined primarily by the type and content of the respective post. For example, a post in text form or an uploaded image file may be affected. In some cases, the specific user ID may also be relevant, for instance when Lidl wishes to offer assistance with any problems. Sometimes we also receive information from the respective platform operators about the coverage of the relevant posts.
The legal basis for processing personal data in the context of social listening is Article 6(1)(f) GDPR because we have a legitimate interest in being able to listen to what our audience is saying, identify any weaknesses in our products and services and respond to them appropriately.
Recipients/Categories of Recipients:
To the extent we use external processors in relation to social listening or social media monitoring, such processors will be bound by contract in accordance with Article 28 GDPR. In the context of our cooperation with our processors, the aforementioned data is generally also processed for social media monitoring purposes on servers located in the United States. Please see clause B 5 for more information on how we ensure the security of data transfers to recipients in a third country.
Storage Time/Criteria for Determining Storage Time:
The relevant data will not be stored permanently by Lidl, it will only be analyzed for the specific purpose of identifying countermeasures that may need to be taken. Where necessary, we may continue to retain your data for annual comparative evaluations for up to two years if you have not already deleted your data from the platform yourself.
We and Facebook, https://en-gb.facebook.com/legal/terms/page_controller_addendum, act as joint controllers as defined in Article 26(1) GDPR.
We and the platform operator act as joint controllers with regard to the web tracking methods used by the platform operator. Web tracking can occur regardless of whether you are logged in or registered on the platform. As already explained, unfortunately we have almost no control over the web tracking methods used by platforms. We are unable, for example, to switch web tracking off.
The legal basis for the aforementioned web tracking methods is your consent pursuant to Article 6(1)(a) GDPR.
For further information about recipients and categories of recipients and the duration of data storage and the criteria for determining the storage period, please refer to the privacy policies of the platform operators. We do not have any control over this.
You will find information on the rights available to you to prevent these web tracking methods or to revoke your consent in the privacy policies of the platform operators set out in clause 2. You can also contact the platform operators about this using the contact details provided in the legal notice section of their respective websites.
We have only a very limited ability to influence and also prevent the provision of statistics to us by platform operators. However, we do make sure that we do not receive any additional optional statistics.
Please note also that the platform provider uses your profile and behavior data in accordance with its terms of use and privacy policy to analyze your habits, personal relationships and preferences. Lidl has no control over the processing or disclosure of your data by platform provider.
If we transfer data to recipients in a third country (located outside of the European Economic Area), this will be evident in the information on the recipients/categories of recipient in the description of the respective data processing. Some third countries have been certified by the European Commission through so-called adequacy decisions as having a level of data protection comparable to that offered in the European Economic Area. A list of these countries can be found at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. Where no comparable data protection standard exists in a given country, we take other measures to ensure that an adequate level of data protection is guaranteed by other means, such as binding corporate rules, the European Commission's standard contractual clauses on the protection of personal data, certificates or recognized codes of conduct. For further information, please contact our data protection officer (clause A1).
Your use of the platform may result in the operator processing your data in a third country (registered office outside of the European Economic Area). For further information on the processing of your data in a third country (which is outside Lidl's sphere of influence), please see the respective operators' privacy policies referred to in clause B 2:
If the data processing is carried out on the basis of consent granted under Article 6(1) sentence 1(a) or Article 9(2)(a) GDPR, you may revoke that consent at any time with effect for the future without this affecting the lawfulness of the previous processing.
Pursuant to Article 15(1) GDPR, you have the right to request information, free of charge, on the personal data stored about you.
If the statutory requirements are met, you also have a right to rectification (Article 16 GDPR), erasure (Article 17 GDPR) and restriction of processing (Article 18 GDPR) of your personal data.
If you have provided the processed data yourself, you have a right to data portability under Article 20 GDPR.
| If the basis of processing is Article 6(1) sentence 1(e) or (f) GDPR, you have a right to object under Article 21 GDPR. If you object to processing, your data will only be processed thereafter if we can demonstrate compelling legitimate grounds for the processing which override your interests in the objection. |
If you have any questions or wish to exercise your rights, you can contact the data protection officer in writing or by e-mail (see clause A 1). You also have a right to lodge a complaint with a data protection supervisory authority. The data protection supervisory authority located in the state in which you live or where the controller is domiciled has jurisdiction.