LIDL CHRISTMAS LOTTERY - 2026

Any capitalized terms used in this Privacy Policy are to be attributed with the same meaning attributed thereto under LIDL CHRISTMAS LOTTERY 2026’s Terms and Conditions available at

https://www.lidl.com.mt/christmas-lottery-TC unless otherwise defined herein.

For the purposes of this Privacy Policy, the terms “We”, “Us”, “Our” refer to LIDL Malta Limited. This Privacy Policy applies to your participation in Our Lidl Christmas Lottery 2026. This Privacy Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”).

For the protection of your and Our rights and to ensure compliance with any and all applicable legal requirements, we may update and/or amend this Privacy Policy in our sole discretion and, should We elect to do so, We shall contact you by email at the email address associated with your LIDL Plus account.

The controller of your personal data is Lidl Malta Limited, a company registered in Malta, bearing company registration number C36317 and registered office at Vassallo Business Park, Burmarrad Road, Naxxar NXR 6345, Malta.

We may be contacted at the abovementioned address, by email at info@lidl.com.mt or via the form found at the following link: https://customer-service.lidl.com.mt/SelfServiceMT/s/contactsupport Our Data Protection Officer may be contacted at the e-mail address dpo@lidl.it.

The term “personal data” refers to any and all personally identifiable information about you and includes all the information you provide to Us, and which is identifiable by Us, when participating in Our Lottery, as well as all other information which may arise that can be identified with you personally.

This includes your:

a. name & surname;

b. date of birth;

c. mobile phone number;

d. email address;

e. Lidl Plus client ID;

f. purchase data, namely the description of the items, the unit price and the number of units purchased at any LIDL store in Malta or Gozo from the moment you register as a participant, which is processed solely to identify the Promotional Products purchased and to calculate your chances to win; and g. the chances to win and tickets generated and the date and time of your participation You will only be asked to provide additional information if you are a winner of a prize, in order to verify your eligibility and to claim your prize. This will include a declaration signed by you stating that you are not an employee of Lidl and that you have reached the age of 18 before entering the Lottery. You may also be asked to confirm the email address to which your Prize is to be delivered. In addition, at Our sole discretion, you may be required to send an image of your ID Card, Passport or Driver’s Licence in order to verify your age, in which case the image will be deleted immediately once the details are confirmed, without any copy being retained. If you win the first prize, the Travel Agent may also ask you to present a valid identity document when you redeem the Travel Voucher.

Your data will only be processed for the Intended Purposes under this policy or as may be required to defend any legal claim that may be brought against Us or any of the listed processors of your personal data; or as may be ordered by any judicial or quasi-judicial authority or any government authority.

The Intended Purposes of processing of your personal data are:

• (i) Giving effect to the Terms & Conditions (T&Cs) concluded with Us (including the taking of any and all steps necessary to enter into the T&Cs or to implement any updates or amendments thereto) with regard to your participation in the Prize Draw, including the calculation of your chances to win, the conduct of the Draw, the verification of your eligibility, and the delivery and redemption of your Prize, or anything relative or ancillary thereto;
• (ii) where you are a winner and have given your consent, the publication of your full name or initials on Our website and on Our official Facebook and Instagram pages.

Our legal bases of processing your personal data are:

• (i) Entering into and performance of a contract as a result of your participation in Our Lottery and subsequent entry into Our Prize Draw. Providing such Personal Data is necessary for your participation in Our Prize Draw. The consequence of not carrying out such processing would be that you would be unable to participate in the Prize Draw;
• (ii) Your consent, which is relied upon solely for the publication of winners’ details as described in the Consent Form – in which case, Our processing shall be limited to the purposes specifically indicated when your consent was requested;
• (iii) Compliance with legal obligations imposed on Us; and
• (iv) Our or a third party’s legitimate interest.

We might also have to process your data to exercise or defend legal claims. Such processing would be carried out in reliance on Our, or a third-party legitimate interest. In such a scenario, We shall ensure that your interests and fundamental rights and freedoms which require protection of personal data are respected.

The recipients of your personal data will be:

LIDL-CHRISTMAS LOTTERY - 2026 -Privacy Policy Page 2 of Page 2

a. selected individuals within Our company;

b. our intra-group companies and affiliates who process the personal data as data processors, including Lidl Italia S.r.l. a socio unico located at Via Augusto Ruffo 36, 37040 Arcole (VR), Italy, Lidl Stiftung & Co. KG located at Stiftsbergstraße 1, 74172 Neckarsulm (Germany);

c. our agents and third parties that provide services to Us as data processors, including but not limited to J.P. Advertising Limited located at JPA, Msida Valley Road, Msida MSD 9020, Malta, the agency engaged by Us to administer the Lottery;

d. the Malta Gaming Authority as independent data controller, located at the Malta Gaming Authority Building SCM 02-03, Level 4, SmartCity Malta, Ricasoli SCM 1001; and

e. third parties to whom disclosure may be required for your participation in the Prize Draw, and as necessary for the awarding of the prizes (including Planit Travel Services Ltd. located at 187, Nazju Ellul Street, Gzira GZR 1629, Malta (the “Travel Agent”), as an independent data controller, to whom Winners’ data will be disclosed solely to enable the booking and redemption of the first prize Travel Vouchers).

Individuals with access to your personal data shall be subject to the same limitations under this Privacy Policy and are located within the European Union (EU) or the European Economic Area (EEA), including Ireland and the Netherlands where the server hosting the Customer's personal data is located.

The general public who visit the competition section of Our website or Our Facebook and Instagram social media pages will only be able to access your data if you have consented to your data being published there.

The processing of your personal data is not a statutory requirement: it is a requirement in order to register your participation in the Prize Draw. Failure to provide your personal data impedes Us from being in a position to register you and allow you to participate in the Prize Draw.

Your personal data will not be used for any automated decision-making or profiling for the purposes of the Lottery. The calculation of chances to win from your purchases of Promotional Products is carried out automatically by the App, but it does not produce legal effects concerning you or similarly significantly affect you, and the Winners are selected at random.

Your personal data is obtained from the LIDL Plus loyalty programme platform operated by Lidl Stiftung & Co. KG, namely the data you provided on registering for LIDL Plus and the purchase data recorded when you scan your LIDL Plus App at the checkout, and, if you are a winner, directly from you during the validation process.

Your personal data shall be held throughout the duration of the Lottery and in any event, until no later than 30th April 2028. Thereafter, it shall be immediately and irrevocably erased unless We need to keep your personal data to comply with any legal obligation, or to exercise or defend any legal claim. Your identity document, which may be required in order to verify your status will be deleted immediately after the confirmation of the data without any copy being retained.

For as long as We retain your personal data, you may (where applicable):

a. request access to and rectification of personal data where incomplete or inaccurate; b. request erasure of your personal data;

c. request restriction of the processing of your personal data;

d. object to the processing of your personal data;

e. request to be informed of the source from which your personal data originates, if your personal data was not provided to Us directly by you;

f. request that we provide you with any personal data you have provided us, in a structured, commonly used and machine-readable format; and

g. request that we transmit your personal data directly to you or to another controller indicated by you. To the extent that the legal basis for our processing of your personal information is your consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing by Us at any point prior to the withdrawal nor Our right to retain your personal data in terms of Clause 9 above. To exercise the aforementioned rights, the data subject may contact Lidl at the e-mail address privacymt@lidl.com.mt.

If you have any complaints regarding our processing of your personal data, please note that you may contact Us or Our Data Protection Officer at the details indicated above. You also have a right to lodge a complaint with the Office of the Information and Data Protection Commissioner in Malta ( www.idpc.gov.mt).

We will keep this privacy notice under regular review. If there are any changes to this Policy, we will replace this page with an updated version and, where the changes are material, notify you by email as stated at the start of this Policy. At the start of this page, we will tell you when it was last updated.

We suggest that you check on the Policy any time you access our App or this page so as to be aware of any changes which may occur from time to time.

You can find the privacy policy for download as a PDF version here: