Privacy policy

Lidl only processes personal data that are strictly necessary for managing Lidl’s insurance cover and any accidents that may occur at Lidl premises, and therefore any compensation for damage to injured parties, and for safeguarding Lidl’s property and non-property rights, including in court proceedings, in accordance with the applicable insurance legislation. In particular, Lidl processes the following personal data relating to you: (i) identification data, such as first name, surname and identity document, including the information contained therein; (ii) contact details, such as telephone number and email address; (iii) data relating to your position at work, such as job title, rank/position/role and the Lidl department or office to which you are attached; (iv) bank data, such as bank and payment details; and (v) any other information that may be relevant to Lidl for managing Lidl's insurance cover and any accidents that may occur within its organization and at its premises (for example, car license plates).

To carry out activities related to the management of insurance relationships and any claims and/or damage that may occur, as well as any compensation for the damage, certain types of personal data may need to be processed, as listed in article 9 of the GDPR, in particular data relating to your state of health. In addition, where the assessment of insurance risk and/or management of any claims so require, Lidl may also process data relating to criminal convictions and offenses pursuant to article 10 of the GDPR. Where required, the processing of special categories of personal data and data relating to criminal convictions and offenses, in respect of articles 9 and 10 of the GDPR, will take place strictly within the limits of what is permitted under these articles.

The personal data mentioned above are processed by Lidl to (i) manage any accidents and claims that may occur within the organization and at Lidl's premises, and to quantify any personal injuries that occur and arrange for the related settlement for damage suffered by the parties involved in the accident ("Contractual Purposes"); (ii) comply with any statutory obligations relating to health and safety in the workplace, where Lidl is responsible for taking out insurance to cover risks inherent to the activities carried out during working hours ("Legal Purposes"); (iii) establish the necessary insurance relationships in light of the activity carried out by Lidl and obtain adequate insurance cover for any potential damage, and to protect the rights and legitimate interests of themselves and those involved in such claims, including in court proceedings ("Legitimate Interest Purposes").

Processing of data in respect of (i) Contractual Purposes in the event of an accident or claim is carried out on receipt of any request for compensation for damage, pursuant to article 6, paragraph 1, letter b) of the GDPR, that you may submit; (ii) Legal Purposes is carried out as required for the fulfillment of a legal obligation to which Lidl is subject under article 6, paragraph 1, letter c) of the GDPR; (iii) Legitimate Interest Purposes is carried out in pursuit of Lidl’s legitimate interest in managing insurance claims and obtaining the necessary cover, pursuant to article 6, paragraph 1, letter f) of the GDPR, which is appropriately balanced with your interests in Lidl obtaining adequate cover for accidents and the related compensation for any damage suffered and for which Lidl is responsible.

With specific reference to the processing of special categories of personal data and data relating to criminal convictions and offenses, in respect of articles 9 and 10 of the GDPR, the processing of (i) special categories of data is based on your specific consent, without which Lidl is unable to proceed with the management of your claim or assessment and settlement of any damage suffered; and (ii) data relating to criminal convictions and offenses, is carried out exclusively to ascertain liability for claims or events pertaining to human life that may occur at Lidl premises, and for the prevention, identification and combat of fraud or situations of actual risk for the appropriate exercise of insurance activity within the limits stipulated by the applicable insurance legislation.

If you do not provide personal data for Contractual and Legal Purposes, Lidl will not be able to proceed with management of the accident or settle any claim for damage. Processing of data for Legitimate Interest Purposes, however, is not compulsory and you may object to the processing in the manner set out in this privacy policy, but if you object to the said processing, your personal data cannot be used for Legitimate Interest Purposes unless Lidl demonstrates the existence of prevailing compelling legitimate reasons or the exercise or defense of a right pursuant to article 21 of the GDPR.

Any personal data you provide will be processed using paper and electronic files organized according to various classification systems to ensure maximum security and confidentiality in compliance with the above-mentioned legislation and associated confidentiality obligations, and in accordance with the purposes and manners set out in this privacy policy.

Your data will be stored for the time strictly needed for the above-mentioned processing purposes and for the entire duration of the claim and ten years following its conclusion, except where additional periods of storage are required for disputes or requests from the competent authorities, or to comply with the applicable legislation. By contrast, data for Legal Purposes are stored for the period of time expressly stipulated by the applicable laws and regulations and for which the personal data are collected.

Personal data, including any special categories of data, will be processed by data processors appointed by the Data Controller solely and exclusively for fulfillment of the purposes in section 2 above. The data will not be disseminated in any way but may be disclosed, for the above reasons, to insurance companies, legal and/or insurance advisors, doctors and/or medical experts, suppliers (where the damage is caused by a product purchased from a Lidl branch), or parties and authorities who are expressly permitted to access personal data by law, regulations or provisions from the competent authorities. These parties process the personal data disclosed to them as independent data controllers or data processors, as the case requires. A full list of data processors is available from the Data Controller who can be contacted at the addresses under paragraph 7 below.

Personal data will not be transferred to countries outside the European Economic Area.

In relation to personal data processing, you may exercise your rights under articles 15-21 of the GDPR by sending a request by email to privacymt@lidl.com.mt, in particular the rights to: (i) obtain confirmation from the Data Controller as to whether any personal data relating to you is being processed or not, and if so, to have access to the personal data; (ii) be informed of where the data originated from, the purposes and methods of its processing and the logic applied for any electronic processing; (iii) ask for your personal data to be updated, corrected or integrated; (iv) have any personal data processed in violation of the law erased, made anonymous or blocked, and make a legitimate objection to its processing: (v) ask the Data Controller to restrict the processing of your personal data where (1) you dispute the accuracy of the personal data, for the time necessary for the Data Controller to check the accuracy of the data; (2) the processing is unlawful and you prefer to have use of the data restricted rather than have the data erased; (3) the Data Controller no longer needs the personal data for processing but it is required for the establishment, exercise or defense of a right in legal proceedings; (4) you object to the processing pursuant to article 21, paragraph 1 of the GDPR whilst awaiting verification of whether the Data Controller’s legitimate reasons for processing the data prevail over your own; (vi) object to the processing of your personal data at any time for Legitimate Interest Purposes, except where the Data Controller has overriding legitimate interests or the need to assert or defend a right in legal proceedings; (vii) request the erasure of your personal data without undue delay; (viii) obtain data portability, i.e. the right to receive the personal data in a structured, commonly-used format readable by an automatic device, and the ability to transfer it to another data controller freely and without impediment; (ix) the right to complain to the Data Protection Authority, where the conditions for doing so are met.

The Data Controller is Lidl Malta Ltd., with registered office at with registered office at Vassallo Business Park, Burmarrad Road, Naxxar NXR 6345, Malta. Requests must be sent by registered letter to Lidl Malta Ltd, with registered office at Vassallo Business Park, Burmarrad Road, Naxxar NXR 6345, or by email to privacymt@lidl.com.mt.