Privacy Policy on the processing of personal data – Returns Policy

Lidl Malta Limited with registered office in Vassallo Business Park, Burmarrad Road, Naxxar NXR 6345, Malta (hereinafter “Lidl”), as the Controller of personal data, informs you, pursuant to art. 13 and 14 of the Regulation (EU) 2016/679 (hereinafter “GDPR”) and the Data Protection Act (Chapt. 586 of the Laws of Malta), about the manners and purposes for which we process your personal data in the context of the returns policy.

The Data Controller, according to Article 4, paragraph 1, number 7) GDPR, is Lidl Malta Ltd. with registered office in Vassallo Business Park, Burmarrad Road, Naxxar NXR 6345, Malta and may be contacted at the e-mail address privacymt@lidl.com.mt. The Data Protection Officer can be contacted at the e-mail address privacymt@lidl.com.mt .

Your personal data provided in order to return a product purchased in a store and consisting of name and surname will be processed to: (a) handle your request and therefore refund the amount of the purchased product, b) fulfill our obligations deriving from applicable legislation, including the execution of communications towards and/or comply with requests made by competent authorities and supervisory bodies (hereinafter jointly referred to as the "Contractual Purposes"), (c) assert or defend Lidl’s rights, (d) carry out a potential merger, sale of assets, sale of a company or business unit by disclosing and transferring personal data to the third party involved (hereinafter jointly referred to as the "Purposes of Legitimate Interest").

The processing of your personal data for the Contractual Purposes is necessary as essentiality in order to handle your request (Article 6, paragraph 1, letter b) GDPR) and fulfill the obligation to comply with the applicable legislation (Article 6, paragraph 1, letter c) GDPR). If you do not provide your personal data for the contractual purposes, it will not be possible to handle the return of the product purchased by you.

The processing of your personal data for the Purposes of Legitimate Interest is carried out for the pursuit of Lidl’s legitimate interest, which is equally balanced with your legitimate interest, as the processing of your personal data is limited to what is strictly necessary for the execution of the related purposes (Article 6, paragraph 1, letter f) of the GDPR).

The processing for the Purposes of Legitimate Interest is not mandatory and you may oppose to such processing in the manner set out in this privacy policy and in such case, your data cannot be used for the Purposes of Legitimate Interest, except for those in which Lidl demonstrates the presence of overriding legitimate reasons or the exercise or defense of a right pursuant to Article 21 GDPR.

For the aforementioned purposes, your personal data may be transferred to the following categories of recipients situated within the European Union: (a) third-party suppliers of assistance and advice for Lidl, (b) companies of the group to which Lidl belongs, (c) subjects and/or authorities which right of access to personal data is recognized by law, regulations or provisions issued by the competent authorities. Depending on the specific case, these recipients will process such personal data as data controllers or processors. A complete list of external data processors can be requested to the Data Controller at the address mentioned under paragraph 1 of the present privacy policy.

Your personal data will be processed with the aid of electronic means, suitable in order to guarantee the highest security, confidentiality and to avoid unauthorized access, disclosure, modifications and subtractions of data, thanks to the adoption of adequate technical, physical and organizational security measures, in compliance with the aforementioned legislation and the related confidentiality obligations and, in any case, according to the purposes and methods set out in this privacy policy.

The aforesaid personal data will be retained for the period of time necessary to pursue the purposes referred to in this privacy policy and therefore retained for 10 years after the handling of the returns policy, without prejudice to such cases in which the storage for a further period is required in order to handle any disputes, requests from the competent authorities or for compliance with a legal obligation.

Pursuant to art. 15, paragraph 1 of the GDPR, you have the right to: (a) obtain confirmation from Lidl whether or not personal data concerning yourself are being processed and be informed about the content and source, verify their accuracy and request their integration, updating or modification; (b) obtain the cancellation or transformation into anonymous form of personal data without undue delay or blocking of personal data that may be processed in violation of the applicable law; (c) object in whole or in part, for legitimate reasons, to the processing; (d) ask Lidl to limit the processing of your personal data in the event that: (i) you contest the accuracy of personal data, for the period necessary for Lidl to verify the accuracy of such personal data; (ii) the processing is unlawful and you object to the deletion of personal data and instead request that its use must be limited; (iii) although Lidl no longer needs such data for processing purposes, personal data are necessary for the ascertainment, exercise or defense of a right in court; (e) receive a copy of the personal data in electronic format, if you wish to transfer it to yourself or to a different controller, in the event that Lidl processes personal data as the processing is necessary to allow the execution of the measures and activities referred to in the above authorization form and the personal data are processed using automated means; (f) lodge a complaint with the competent supervisory authority (in particular, in the Member State of the European Union where your habitual residence is located, or where the alleged violation has occurred). To exercise the aforementioned rights, you can contact Lidl’s Data Protection Officer at the address mentioned under paragraph 1 of the present privacy policy.