(version 1.0 dated 27.12.2023)
1. Data Controller
The data controller pursuant to article 4, paragraph 1, number 7) of the GDPR is Lidl Malta Ltd., with registered office in Vassallo Business Park, Burmarrad Road, Naxxar NXR 6345, Malta, and can be contacted by email at firstname.lastname@example.org.
2. Purpose, legal basis and manner of data processing
The processing concerning your personal data, namely your telephone number and your WhatsApp username, will be carried out exclusively for the purpose of fulfilling your request for further information about the Service and to provide you, after your express consent, with a link to our digital flyer via the WhatsApp application.
In order to register for the Service, you can access the dedicated WhatsApp chat by means of the link or QR code that you can find on the website www.lidl.com.mt. After opening the chat, you can confirm your request for further information by sending the default message. Once you have received further information about the Service, you can provide your consent for the processing of personal data described in this Policy by sending the "Start" message or by clicking on the "Start" button.
The processing of personal data for the aforementioned purposes is therefore carried out pursuant to article 6, paragraph 1, letter b) (replying to your request for further information) and article 6, paragraph 1, letter a) of the GDPR (providing the link to the digital flyer on a regular basis).
The processing of your personal data as set out above is necessary in order to reply to your request for further information regarding the Service and your express consent is a necessary condition for us to be able to provide you with the requested Service afterwards.
You may withdraw your consent at any time and future effect, without prejudice to the lawfulness of the processing carried out until your consent is withdrawn. In order to do so, it will be sufficient to send the message "Stop" within the WhatsApp chat or to contact Lidl by means of the contact details listed in section 6 of this Policy.
3. Storage period / Criteria for determining the storage period:
If, after receiving the further information and this policy, you choose not to consent to the processing, your data collected for the purpose of replying to your request for further information will be stored for 30 days and then deleted.
If you have provided your consent ("Start") and have therefore subscribed to the Service, we will process your personal data until you withdraw your consent. Your personal data will be permanently deleted from our systems no later than 30 days after you withdraw your consent.
4. Recipients / Categories of recipients
For the aforementioned purposes, your personal data may be transferred to the following categories of recipients: (i) third-party suppliers of assistance and advice for Lidl with reference (e.g.) to the following sectors: technological, accounting, administrative, legal, insurance, IT; (ii) companies of the group to which Lidl belongs. Depending on the specific case, these recipients will process such personal data as data controllers or our processor(s) as the case may be.
Within the scope of our cooperation with WhatsApp Ireland Limited with registered office at 4 Grand Canal Quay, Dublin 2, Ireland ("WhatsApp"), your personal data processed for the purpose of the provision of instant messaging services by WhatsApp and other companies belonging to the same group (Meta Platforms) are generally also stored on servers located in the United States of America or other third countries outside the European Union (EU) or the European Economic Area (EEA). Some third countries are certified by the European Commission through the so-called adequacy decisions, when they guarantee a level of protection of personal data comparable to that within the EU and the EEA. The list of these third countries is available at the following link https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. If a comparable level of protection is not guaranteed in a third country, it will be our concern to verify that the level of protection of personal data is adequately guaranteed through other measures. These are for example binding corporate rules, standard data protection clauses adopted by the Commission , certificates, or codes of conduct. For more information, please contact our Data Protection Officer.
5. Your rights as Data Subject
In addition to the right to withdraw your consent at any time pursuant to article 7, paragraph 3 of the GDPR, with future effect and without prejudice to the lawfulness of the processing carried out until the withdrawal, you, as a data subject, are entitled to exercise the following rights
Pursuant to article 15, paragraph 1 of the GDPR you have the right to request, free of charge, the disclosure of various information regarding the personal data being processed by the Data Controller.
Furthermore, where legal requirements are met, you also have the right of rectification (article 16 GDPR), erasure (article 17 GDPR) and to restriction of processing (article 18 GDPR) of your personal data.
If you have personally provided the data processed, you have the right to data portability pursuant to article 20 of the RGPD.
Additionally, you have the right to lodge complaints with the appropriate Data Protection Supervisory Authority (Information and Data Protection Commissioner).
If you have any further questions about the Service, please contact our Customer Service either by telephone on the toll free number 800 62 777 or by email at email@example.com .
If you have any questions regarding the processing of your personal data, please contact the Data Protection Officer using the contact details set out in Section 1 above.