Last revised: June 2025

Version: 2.1

Lidl Plus Data Protection Notice

Contents

1. Overview

2. Contact details of the controller and the data protection officer

3. Processing purposes, legal bases and recipients

3.1 Registration for Lidl Plus and account management

3.2 Store visits

3.3 Determining your product interests and personalised advertising approach

3.4 Advertising optimisation measures, the store network and store design

3.5 Google reCaptcha

3.6 Competitions

3.7 Reservation of products

3.8 Partner offers

3.9 My Deposits

3.10 Lidl Pay

4. To which other recipients do we pass on your personal data?

4.1 Overview

4.2 Transfer within the Lidl Group

4.3 Transfers to recipients in third countries

5. How long do we store your personal data?

6. What rights do you have with regard to the processing of your data?

1. Overview

Lidl Plus is a loyalty programme (hereinafter referred to as "Service" or "Lidl Plus") that offers you of-fers and specials tailored to your interests from the Lidl Group companies and selected partners.

You can use Lidl Plus by registering for selected online services of the Lidl Group ("Online Services", e.g. online shop, click and collect service, apps). Please note that some functionalities are only available via the Lidl App. For example, you must identify yourself with the Lidl App at the till so that your purchases in Lidl stores are assigned to your Lidl Plus profile.

2. Contact details of the controller and the data protection officer

Unless otherwise stated below, Lidl Stiftung & Co. KG, Stiftsbergstraße 1, 74172 Neckarsulm ("Lidl Stiftung", "we", "us") is responsible for the processing of your data in the context of Lidl Plus.

The data protection officer of Lidl Stiftung can be contacted at the above postal address or at da-ta.controller@lidl.ie

3. Processing purposes, legal bases and recipients

3.1 Registration for Lidl Plus and account management

Purposes of data processing/legal basis

Once you have registered, you can use Lidl Plus in all connected Online Services with the same user name and password and access your customer master data, shopping history and Lidl Plus functions in your Lidl Plus account.

The following data is processed when registering for Lidl Plus:

 First name,

 Date of birth,

 E-mail address,

 Mobile phone number,

 Password,

 Title (optional),

 Gender (optional),

We need your date of birth, as participation in Lidl Plus requires a minimum age of 18 years (see section 2 of the Lidl Plus Terms of Use and for certain products (e.g. alcoholic beverages) age limits under youth protection laws must be taken into account.

You can also optionally enter your address and surname in your Lidl Plus account. However, this data will be mandatory for certain functions.

If you have registered for Lidl Plus in the Lidl App, we will also process the store you have selected there. In addition to the above-mentioned data, we receive information from the Online Service you use – if available – about the payment methods stored there and your purchase and order history. You can access this data in your Lidl Plus account. You can find out which Online Services transfer your pay-ment history to your Lidl Plus account in the data protection notices of the Online Services.

If you have registered with our Family Club programme, the information on benefits granted will also be saved and displayed in your Lidl Plus account.

We process the data collected during registration for the following specific purposes:

 Communicating with you,

 Verifying your identity as the account holder (e.g. when resetting the password),

 Uniquely assigning your purchase and usage behaviour to your customer profile.

We also use your e-mail address to send you a notification when your account is accessed via a new device.

The legal basis for this is Article 6(1)(b) GDPR, i.e. we process the above-mentioned data on the basis of the contractual relationship between you and us.

The following data is processed to secure the registration/login procedure:

 E-mail address or mobile phone number,

 IP address,

 Mouse movements,

 Duration of your visit to the registration page,

 Online identifiers such as device ID,

 Browser details (browser name and version),

 Name and version of the operating system of the device on which the browser is installed,

 Network-based location of your device when you log in,

 Date and time of the registration/login attempt,

 Information on whether registration/login attempts were successful.

If you wish to use our Lidl Pay payment service, "two-factor authentication" will be integrated into the login process with your consent. When you register for your Lidl Plus account, a verification code will be sent to the mobile phone number or e-mail address you registered with. This ensures that only you have access to your account, even if your password is known to third parties. Two-factor authentica-tion can be deactivated at any time via our customer service department. In this case, you will no long-er be able to use Lidl Pay.

The legal basis for the above-mentioned data processing is Article 6(1) (f) GDPR. Our legitimate interest is based on the purposes of data processing described above.

Recipients/categories of recipients

If you log in to Online Services as a Lidl Plus user, we pass on to the respective operator of the Online Service the data required to provide the Service you have requested. These data vary depending on the offer and can include:

 Verified login data (e.g. e-mail address, password, mobile phone number),

 Master data (e.g. name, address, date of birth),

 Stored payment methods,

 Information stored in the "About me" section,

 Information about your participation in the Family Club programme.

3.2 Store visits

Purposes of data processing/legal basis

If you use Lidl Plus, you can either identify yourself at the self-checkout or at the till when you visit a store. In this case, we collect the following data:

 The store you have visited,

 The products you have purchased or returned by type, quantity and price,

 The coupons and vouchers you have redeemed,

 The purchase receipt amount,

 The time of the payment transaction and which means of payment you used.

When making purchases in Lidl stores, you can collect digital points and exchange them for reward coupons in Lidl Plus. The points collected are assigned to your customer number for the reward ex-change. Product returns are also taken into account when calculating the points balance.

The legal basis for this is Article 6(1)(b) GDPR, i.e. we process the above-mentioned data on the basis of the contractual relationship between you and us.

In order to prevent economic damage to Lidl Group companies, we analyse your purchasing behaviour for fraud prevention purposes. In particular, we analyse whether and how often items are returned. The legal basis for this is Article 6(1)(f) GDPR. Our legitimate interest is based on the purposes of processing described above.

In the event of product recalls, we will check whether you have purchased the affected product so that we can inform you of the recall. This processing is carried out to protect your health (Article 6(1)(d) GDPR) and because we have a legitimate interest in informing you of any product recalls (Article 6(1)(f) GDPR).

3.3 Determining your product interests and personalised advertising approach

Purposes of data processing/legal basis

In Lidl Plus, we determine which products, promotions and services could potentially be of interest and relevance to you. This is done in particular on the basis of the following data:

 Store purchases (e.g. products purchased or returned by type, quantity and price),

 Demographic information (e.g. age, gender, place of residence),

 Data stored in the Lidl Plus account,

 Information about life circumstances and interests, which are stored in the "About me" section,

 Activated and/or redeemed coupons,

 Participation in competitions and promotions,

 Reservations,

 Use of our partner offers (e.g. time, quantity, location),

 Use of the Digital Services (e.g. information about your access authorisation to services of our partners, length of use of the services, termination date of the free month, activation and use of the discount collector for Digital Services),

 Use of functions in Lidl Plus (e.g., Shopping List),

 Use of our Lidl Pay payment service.

In addition, the following information from Online Services is processed to determine your interests:

 Usage data of the Lidl App, e.g.

o Visited app sections,

o Viewed articles,

o Version of the operating system,

o Device labelling,

o System language and selected country,

o Lidl App version used,

 Tracking data, e.g.

o advertising identifiers (iOS IDFA, Android advertising ID or Huawei ID, e-mail address, address, mobile phone number),

o IP/MAC address,

o HTTP header,

o Fingerprint of your end device,

o Information about the use of apps and websites (links clicked on, areas visited, dura-tion and frequency of use, number of clicks and scrolls),

o App and event tokens,

 Information from the Online Service of the Lidl Group companies, e.g.

o Products purchased/reserved in Online Services by type, quantity and price,

o Receipt amount and time of payment,

o Payment method used,

o Selected delivery method,

o Participation in surveys and competitions,

o Products stored in the shopping cart,

o Frequency of purchase transactions,

o Web tracking data of the Online Services,

 Your usage behaviour in relation to marketing communication of Online Services, e.g.

o Time of opening the newsletter,

o Links or areas clicked on,

o Duration and frequency of use.

We use mathematical-statistical methods to determine your interests. For this purpose, your personal data is also compared with the data of other customers. Based on this comparison, we can deduce which products and campaigns are relevant for customers with similar interests.

We use this information to provide you and other customers of the Online Services with personalised advertising tailored to your interests and to offer you the best possible individual offers and discounts. Where possible, you will also receive personalised information about products, promotions, competi-tions, new services, online recipes, customer surveys and the latest streaming, store, online shop, flow-er, photo and travel offers. We also use these findings to optimise the Lidl Plus programme.

The legal basis for this is Article 6(1)(b) GDPR, i.e. we process the above-mentioned data on the basis of the contractual relationship between you and us.

Recipients/categories of recipients

In addition, we may transfer the data described in this paragraph to other Lidl Group companies or oth-er third parties if there is a legal basis for this (in particular your consent to the use of tracking technol-ogies in our Online Services).

3.4 Advertising optimisation measures, the store network and store design

Purposes of data processing/legal basis

If you provide us with your address as part of the registration process or at a later date in your Lidl Plus account, we use it to optimise advertising measures (e.g. leaflet distribution, poster advertising) and to optimise the store network.

This data is processed on the basis of our legitimate interest in optimising sales channels (Article 6(1)(f) GDPR).

3.5 Google reCaptcha

Purposes of data processing/legal basis

We use Google reCaptcha to protect our registration/login process from attacks or misuse by auto-mated programs (so-called bots). Bots are used, for example, to try to obtain passwords for customer accounts or to restrict the functionality of the website through mass data transfers.

Google reCaptcha determines whether the interaction with the website is by a human user or a bot. For this purpose, usage behaviour (time spent on the page or mouse movements made) is analysed and the IP address is read by Google and checked to see whether it could have been assigned to a bot in the past. If the IP address has already been assigned to a bot, Google transmits this information to us. We then store these IP addresses for defence against future attacks. This analysis starts automatically as soon as you open the registration page.

The legal basis for this data processing is Article 6(1)(1)(f) GDPR. Our legitimate interest is based on the purposes of processing mentioned above.

Recipients/categories of recipients

When using Google reCaptcha, the above-mentioned data is also processed by Google LLC, 1600 Am-phitheatre Parkway, Mountain View, California 94043, USA to provide the Service. We have no influ-ence over the processing and use of data by Google. Further information on data processing by Google can be found here: https://policies.google.com/privacyh

3.6 Competitions

Purposes of data processing/legal basis

As a Lidl Plus user, you can take part in various competitions. Unless otherwise specified in the respec-tive competition, your data will be used in the context of your participation in the competition in order to run the competition (e.g. determining the winner, notifying the winner, sending the prize) and for the purposes described under Section 3.4 to determine your interests as described in Section 3.3.

The legal basis for this is Article 6(1)(b) GDPR, i.e. we process the above-mentioned data on the basis of the contractual relationship between you and us.

Recipients/categories of recipients

A transfer to the Lidl group of companies or third parties will only take place outside the above-mentioned determination of your interests and the personalized advertising approach, insofar as this is necessary for the processing of the competition (e.g. sending the prize via a logistics company). The legal basis for this transfer is Article 6(1)(f) GDPR.

3.7 Reservation of products

Purposes of data processing/legal basis

If you reserve products via Lidl Plus and purchase them in the store at a later date, we process this in-formation in order to

 enable you to make a subsequent purchase in a Lidl store,

 to display a history of reservations,

 to offer you special offers tailored to your preferences and interests and to enable you to par-ticipate in activities.

The legal basis for this is Article 6(1)(b) GDPR, i.e. we process the above-mentioned data on the basis of the contractual relationship between you and us.

Recipients/categories of recipients

We will send a list of the reserved products and your order number to the relevant Lidl Group company. The Lidl company uses this data under its own responsibility for the subsequent processing of the pur-chase contract.

3.8 Partner offers

Purposes of data processing/legal basis

Lidl Plus gives you the opportunity to take advantage of discounted offers from selected partners. Some of these offers require you to identify yourself as a Lidl Plus customer with your digital customer card. In this case, the partner informs us about your use of the special offer including the associated information (e.g. time, quantity, location).

If special offers are offered within Lidl Plus for contracts concluded with our partners, we will receive your contact details (e.g. e-mail address and mobile phone number) from them so that we can correctly assign the special offer to your account.

We use the information on the use of the partner offers to determine your interests as described above and to display personalised advertising.

The legal basis for this is Article 6(1)(b) GDPR, i.e. we process the above-mentioned data on the basis of the contractual relationship between you and us.

Recipients/categories of recipients

If you make use of partner offers via Lidl Plus, we only send the partner the information that you are a Lidl Plus user so that the partner can assign the corresponding offer to you.

3.9 My Deposits

Purposes of data processing/legal basis:

To save the digital vouchers in your Lidl App and redeem them at the till, you must identify yourself at the deposit voucher machine and at the till. When storing and redeeming digital vouchers, we process the following data with reference to your customer number and transmit it to the respective national company:

 Deposit ID,

 Final amount of the deposit vouchers,

 Date of creation and redemption of the deposit voucher,

 Store,

 Type of deposit item (bottle, can, glass, etc.),

 Type of redemption (automatic, manual).

The legal basis for this is Article 6(1)(b) GDPR, i.e. we process the above-mentioned data on the basis of the contractual relationship between you and us.

Recipients/categories of recipients

If you wish to redeem your digital vouchers at the till in Lidl Plus as part of the My Deposits Service, we will send the vouchers you have selected to the Lidl Group company, which will pay out the value of the voucher.

3.10 Lidl Pay

Credit card/ Debit card

Purposes of data processing/legal basis

As a Lidl Plus user, you can choose to register your credit or debit card with our mobile payment Service "Lidl Pay" and make payments (e.g. in Lidl stores) conveniently using your mobile device. The registra-tion and use of Lidl Pay requires the provision of data, such as the credit or debit card number, CVV/CSV code, first and last name, and the card's expiration date. This data is entered and stored in encrypted form directly in the PCI-DSS & PCI 3DS-certified systems of our payment platform. To ensure that you are indeed the holder of the credit/debit card, your data will be compared with the information of the card-issuing company.

If the registration for Lidl Pay is successful, the payment platform sends us a token as confirmation. We then associate this token with your customer account.

The legal basis for this is Article 6(1)(b) GDPR, i.e. we process the above-mentioned data based on the contractual relationship between you and us.

Recipients/categories of recipients

Once you use Lidl Pay in a Lidl store, your credit or debit card data will be forwarded to the respective Lidl Group company for payment processing, which will process the data for its own purposes (e.g. for tax verification obligations).

In order to carry out the payment process in accordance with the statutory provisions of Directive (EU) 2015/2366 ("PSD 2"), the applicable national implementing legislation and Delegated Regulation (EU) 2018/389, we also exchange specific information (e.g. data about you, the transaction and your pay-ment behaviour) with your credit institution or the issuer of your means of payment (e.g. your debit or credit card) with the help of our service providers.

These processing operations are carried out based on Article 6(1)(b) GDPR (execution of payment) and Article 6(1)(c) GDPR (fulfilment of the above-mentioned legal obligations).

To prevent fraud, we process your mobile phone number in the registration, pre-authentication and payment process and transmit it to the payment service provider. The legal basis for this is Article 6(1)(f) GDPR, whereby our legitimate interest lies in the prevention of fraud.

3.11 Map Services

Purpose of Data Processing and Legal Basis

If, as part of your use of the Lidl App or through the settings on your mobile device, you have consented to geolocation via the "Allow Permission" dialog, we use this function to provide you with location-based, personalized services and marketing communication. Specifically, we process your location via GPS and network-based data as part of features like "Store Search," "Country Switch," "Charging Sta-tion Search," and "Self-Scanning" to display the nearest stores or services related to your current loca-tion.

To use the map services, it is necessary to process your IP address as part of internet communication. This is usually processed on a server of the respective operating system provider. We do not have con-trol over this specific data processing. For more information on the purpose and scope of data pro-cessing, please refer to the privacy notices of the respective provider. There, you will also find further information on your rights and settings regarding the protection of your privacy.

Provider Addresses and Privacy Policies:

• Google Maps

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Privacy Policy: https://www.google.com/policies/privacy/

Terms of Service: https://maps.google.com/help/terms_maps.html

• Apple Maps

Apple Inc, One Apple Park Way, Cupertino, California, USA

Privacy Policy: https://www.apple.com/legal/privacy/de-ww/

Terms of Service: https://www.apple.com/legal/internet-services/maps/terms-de.html

• Huawei Maps Kit

Huawei Aspiegel SE, 1F, Simmonscourt House, Ballsbridge, Dublin D04 W9H6, Ireland

Privacy Policy: https://www.huawei.com/es/privacy-policy

Terms of Service: https://developer.huawei.com/consumer/es/hms/huawei-MapKit/

The use of map services is based on our contractual relationship with you, Article 6(1)(b) GDPR, as well as our legitimate interest, Article 6(1)(f) GDPR, in presenting our offerings attractively and ensuring the easy location of the stores listed in the app.

4. To which other recipients do we pass on your personal data?

4.1 Overview

Your personal data will only be passed on without your prior consent in the cases mentioned in Sections 3.1 - 3.13 if this is permitted by law. This is the case, for example, if:

 we have a legitimate interest in sharing your personal data for administrative purposes within the Lidl Group and your rights and interests in protecting your personal data as outlined in Arti-cle 6(1)(f) GDPR do not outweigh this interest

or

 we use third parties as data processors, who we have carefully selected and contractually obliged to process your personal data exclusively in accordance with our instructions.

4.2 Transfer within the Lidl Group companies

The data provided during registration will be shared within the Lidl Group companies internal adminis-trative purposes, including joint customer support.

Any disclosure of personal data is justified by our legitimate interest in disclosing the data for adminis-trative purposes within our Group (Article 6(1)(f) GDPR).

If you are redirected to the Online Services for the purchase of a flash sales product, we will send your product price, item number and transaction ID to the Lidl companies for the provision of the service, particularly for the purchase in Online Services, the display of the correct price in Online Services, the display of the correct stock in Lidl Plus, etc. The relevant Lidl company uses this data under its own re-sponsibility for the subsequent processing of the purchase contract (Article 6(1)(b) GDPR).

4.3 Transfers to recipients in third countries

In some cases, it may be necessary for us to transfer your personal data to recipients in one or more third countries outside the European Union (EU)/the European Economic Area (EEA).

The European Commission has certified some third countries as having a level of data protection com-parable to the GDPR by means of an adequacy decision. You can find an overview of third countries with an adequacy decision here. For service providers based in the USA, this only applies if they are certified in accordance with the EU-US Data Privacy Framework.

If no adequacy decision is available, we ensure the transfer through other measures. These may in-clude, for example, binding corporate rules, standard contractual clauses of the European Commission, certificates, or recognized codes of conduct.

Unless otherwise stated, the transfer to third countries is carried out either based on an adequacy deci-sion or one of the measures listed above. If you have any questions, you can contact our Data Protec-tion Officer (Section 2).

5. How long do we store your personal data?

We delete or anonymise your personal data as soon as it is no longer required for the stated purposes. In general, we store your personal data for the duration of your participation in Lidl Plus. If you remain inactive for 24 months or actively delete your Lidl Plus account, we will notify you of the pending can-cellation. Within 72 hours, you can cancel the deletion by logging in again. If your data needs to be retained for legal retention periods or to secure, assert, or enforce legal claims, we will retain your data beyond account deletion. The data will be stored only as long as retention is legally permissible.

All personal data that you provide to us during customer service enquiries will be deleted or anonymised by us no later than 95 days after the final response. Experience has shown that there are usually no more queries after 95 days. If data subjects assert their rights, personal data will be stored for three years after the final response to prove that we have provided comprehensive information and complied with the legal requirements.

The log files in which we record your interactions with Lidl Plus (e.g., your login, password reset, etc.) are stored for a period of up to 90 days.

6. What rights do you have with regard to the processing of your data?

You have the right, under Article 15(1) GDPR, to request free information about the personal data stored about you.

If the legal requirements are met, you also have the right to rectification (Article 16 GDPR), deletion (Article 17 GDPR) and restriction of processing (Article 18 GDPR). If you have provided us with the pro-cessed data, you have a right to data portability in accordance with Article 20 GDPR.

If data processing is carried out based on Article 6(1)(1)(e) or (f) GDPR, you have the right to object in accordance with Article 21 GDPR. If you object to data processing, it will only be continued if we can demonstrate compelling legitimate grounds for further processing that outweigh your interest in ob-jecting. You can send your objection at any time to data.controller@lidl.ie.

If the data processing is based on consent in accordance with Article 6(1)(1)(a) or Article 9(2)(a) GDPR, you may withdraw your consent at any time with future effects without affecting the lawfulness of the processing carried out prior to the withdrawal.

You also have the right to file a complaint with a data protection supervisory authority. The data pro-tection supervisory authority of the country in which you live or in which the controller has its regis-tered office is responsible.

Data protection notice on download

You can download the Lidl Plus data protection information as a PDF version here.