Data Protection is important to us
Thank you for visiting our website.
We, Lidl Hong Kong Limited (“Lidl Hong Kong”), are committed to protecting the privacy, confidentiality and security of the personal data we hold of you and strive to fully inform you about the collection, use, disclosure and processing of your personal data, and how we comply with the requirements of the Personal Data (Privacy) Ordinance (“PDPO”) with respect to your personal data.
Personal data that you provide us with is treated confidentially. We use your data solely for the Purposes (as defined below). In order to do so, we may use and transfer data that you have provided to us within our business or to our Affiliates and Data Processors for those Purposes.
We will not retain your personal data for longer than is necessary to fulfil the purpose for which you have provided your personal data to us or to satisfy such other legal or statutory requirements which we need to comply with.
To the extent that you choose to provide personal data in connection with our social media platforms outside of our website (for example, through our LinkedIn page), any information you provide to us on those platforms is also subject to this Policy. Further, you may also be subject to the retention policies of those social media platforms.
1. Collection of personal data
1.1 Types of personal data we may collect
The types of personal data we collect may include:
- your name
- your contact information such as your telephone number, email address or mailing address
- information automatically collected as specified below
and other personal data you voluntarily provide to us.
Please note that it is not mandatory for you to provide personal data to us.
1.2 How we collect information from you
In general, we collect your personal data directly from you. We may obtain your personal data in a number of ways, such as information provided to us in forms filled out by individuals, face to face meetings, telephone conversations, email messages and other correspondence, including when you report a problem or request further services.
We may also obtain other personal data that you choose to provide to us in connection with your use of our website as well as records and copies of your correspondence and other data comparable with the aforementioned categories. We also collect personal data provided by third parties.
1.3 Information automatically collected
We collect information about you when you visit our website. Our website gathers statistical and other analytical information of all visitors to our website. Every data file contains the following information:
- The website from which you came when visiting us
- The IP address
- Time and date of website access
- Statistics on the web pages visited
- Number of new or returning visitors
- User agent
- HTTP code
- Bytes served
- Information on which browser and operating system you are using
The purposes for collecting the data above are to facilitate website access and compile aggregate statistics on website usage. The data is stored for the duration of navigation on our website and automatically deleted thereafter. For more information, please see the “Online presence and website optimisation” section below.
We will not provide your personal data to third parties for direct marketing or other unrelated purposes.
2. Use of personal data
We may collect personal data from business partners, personnel, contractors and other individuals through our websites or provided by third parties. We collect these personal data when it is necessary for our business purposes (as specified below) or to meet the purposes for which the individuals have submitted the information.
Generally, we do not collect your personal data unless it is provided to us voluntarily by you and only after (i) you have been notified of the purposes for which the data is collected, and (ii) you have provided consent to the collection and usage of your personal data for those purposes. We may also collect your personal data without your consent if there is an applicable consent exception under applicable data protection laws.
Your personal data may be used for one or more of the following purposes ("Purposes"):
(a) communicating with you;
(b) verifying your identity;
(c) handling and responding to your inquiries, suggestions or complaints;
(d) conducting analysis to help us better understand our customers and to improve our services and products;
(e) designing targeted promotional offers;
(f) fulfilling our obligation to maintain records of processing activities;
(g) meeting legal, regulatory or compliance requirements, dealing with enquires from law enforcement or regulatory bodies or for the purpose of obtaining legal advice;
(h) facilitating website access and compiling aggregate statistics on website usage;
(i) the purposes as described in the "Google Analytics" section below; and
(j) any other purposes directly related to any of the above purposes.
We only collect personal data we actually need for or directly related to the Purposes. If we intend to use your personal data for purposes other than the above, we will seek your consent prior to using your personal data.
3. Disclosure of personal data
Where we are required by applicable data protection laws to do so, we will obtain your express and voluntary consent to disclose your personal data to other parties, except when an applicable consent exception under applicable data protection laws applies.
We also disclose your personal data to our Data Processors, which are third parties engaged by us to assist us with our business activities. Any such third parties whom we engage will be bound contractually to keep all information confidential and will only process your personal data on behalf of us upon our instructions.
We may disclose your personal data to our Affiliates (i) for the Purposes as stated above; (ii) in order to meet the purpose for which you have submitted the information or for which the information has been automatically collected; or (iii) to provide you with information at a later date which may be of relevance and interest to you based on the nature and purpose of your voluntary requests.
4. Your rights
4.1 Objection and withdrawing your consent
You have the right to withdraw your consent for us to collect, use and disclose your personal data at anytime. The consent that you provide for the collection, use and disclosure of your personal data will remain valid until such time it is being withdrawn by you in writing. You may withdraw consent and request us to stop using and/or disclosing your personal data for any or all of the purposes listed above by submitting your request in writing to our Data Protection Officer at the contact details provided below.
4.2 Access rights and portability
You have the right to find out what information is held about you, how we use it and who we disclose it to. To obtain a copy of your personal information, please write to our Data Protection Officer.
Upon request, we will provide a copy of your personal data in a format that is structured and machine-readable. We may charge you a reasonable fee for complying with access requests in accordance with applicable data protection laws. If so, we will inform you of the fee before processing your request. We will supply a copy of the requested data to you within 30 calendar days after receiving your data access request.
In some cases, we may not be able to provide you with certain personal data, for instance if providing it would interfere with another person’s rights.
4.3 Correction of personal data
Furthermore, you can have your personal data rectified by submitting your request in writing to our Data Protection Officer.
We will make the necessary correction to your data and supply a copy of the corrected data to you within 30 calendar days after receiving your data correction request. We will not charge you any fee for such correction.
We will also take all practicable steps to supply the third party recipients with a copy of the corrected data accompanied by a notice in writing stating the reasons for such correction if (a) such third parties have received the data during the 12 months immediately preceding the day on which the correction is made; and (b) we have no reason to believe that the third party has ceased using the data for the purpose (any legal or business purpose, including any directly related purpose) for which the data was disclosed to that third party.
4.4 Exercise of rights
If you wish to exercise your rights under this Policy, please write to our Data Protection Officer, stating your request and providing us with proof of identity.
5. Retention of personal data
Unless there is a specific legal requirement for us to keep the personal data, we will take all reasonable steps to erase your personal data that is no longer required for the purposes (including any directly related purpose) for which the personal data was originally collected.
Where there are legal requirements for retention, we would not store personal data for longer than the statutory retention requirements call for.
We will take reasonable steps to ensure that any personal data we hold is not incorrect or misleading and kept up to date by complying with your data correction requests.
7. Protection measures
Technical security measures, which are reviewed on a regular basis, are taken to safeguard your personal data and to prevent unauthorised or accidental access, collection, use, disclosure, processing, copying, modification, erasure, loss, destruction, damage, disposal or similar risks. We have also adopted protective measures such as restricting access of personal data to employees on a "need-to-know" basis, providing relevant training to the employees to handle personal data properly and applying encryption to personal data when necessary.
You should be aware, however, that no method of transmission over the Internet or method of electronic storage is completely secure. While security cannot be guaranteed, we strive to protect the security of your personal data, including constantly reviewing and enhancing our information security measures.
8. Transfer of personal data outside of Hong Kong
Your personal data may be accessed and processed by our personnel, Affiliates, subsidiaries and/or service providers, who operate outside of Hong Kong.
If we rely on your consent as the legal basis for transferring your personal data outside of Hong Kong, we will obtain your valid consent if we transfer your personal data outside of Hong Kong and we will take steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the PDPO.
Alternatively, we may rely on another legal basis under PDPO for transferring your personal data outside of Hong Kong, for example:
(i) such transfer is necessary for the performance of a contract between that individual and the transferring organization and if the transfer is not proceeded with, the individual would suffer significant financial loss;
(ii) there is a data transfer agreement between the transferring organization and the recipient which requires the recipient to provide a standard of protection for the personal data that is at least comparable under PDPO and specifies the countries and territories to which the data may be transferred under the agreement;
(iii) there are binding corporate rules within Lidl group (for intra-group transfer only) which specifies the recipients and the recipient countries and territories; and
(iv) relying on the data protection laws of the recipient jurisdiction if there is in force in that recipient jurisdiction any law which is substantially similar to, or serves the same purposes as the PDPO.
If you have any concerns or feedback about the way your personal data is handled, we welcome you to share these with us. Should you wish to make a complaint about or provide feedback on how we process your personal data, please write to our Data Protection Officer using the point of contact information provided below and we will respond to your query as soon as possible. This does not affect your right to file a complaint with the data protection authority of your jurisdiction.
10. Online presence and website optimisation
What are cookies and how are they used?
For more information on cookies or on instructions on how to stop cookies being installed on your browser, please refer to various specific websites on the internet, such as AboutCookies.
Google Chrome browser
Microsoft Internet Explorer browser
Mozilla Firefox browser
Apple Safari browser
Opera Web browser
Should you use another internet browser, please check the instruction on your help function on how to disable and delete cookies.
Click here to see a breakdown of cookies used on our site.
For the purposes of demand-oriented design and ongoing optimisation of our websites, we use Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Pseudonymised user profiles are created and cookies are used. In the process, the cookie generates the following information about your use of this website:
- Browser type and version,
- Operating system used,
- Referrer URL (the previously visited website),
- Host name of the accessing computer (IP address),
- Time of server request.
The information is used to evaluate the use of our websites, to compile reports about website activities and to perform further services connected with the website usage and internet usage for the purposes of market research and the demand-oriented design of these websites. The IP addresses are anonymised, so that attribution is not possible (so-called IP masking).
You may prevent the installation of cookies by selecting the appropriate settings on your browser. However, please be advised that if you opt out of using cookies, you may not be able to fully use all the features of this website. Furthermore, you can prevent the collection of data generated by the cookie and related to the usage of the website (incl. your IP address) and the processing of the data by Google by downloading and installing this browser add-on. As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent collection of information by Google Analytics by clicking on this link. This sets an opt-out cookie which prevents any future collection of your data when visiting this website. The opt-out cookie applies only in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the ‘opt-out’ to cookies again. Further information on data protection in the context of Google Analytics can be found on the Google Analytics website.
We also use third party vendor re-marketing tracking cookies, including the Google Adwords tracking cookie. This means we will continue to show ads to you across the internet, specifically on the Google Content Network (CGN). As always, we respect your privacy and are not collecting any identifiable information through the use of Google's or any other third party marketing system.
The third party vendors, including Google, whose services we use will place cookies on web browsers in order to serve ads based on past visits to our website. This allows us to make special offers and continue to market our services to those who have showed interest in our service.
Recipients or categories of recipients:
The cookie-generated data is forwarded to a Google server in the USA and stored there. Google will under no circumstances associate your IP address with other data. Google may also pass this information on to third parties in so far as this is required by law or if third parties process the data on Google's behalf.
Storage duration / criteria for specifying the storage duration:
Once the IP address has been anonymised, a conclusion as to your person is no longer possible. The statistically prepared data will be deleted periodically in Google Analytics. In reports generated on the basis of Google Analytics, there is no longer any reference to individuals.
11. Children under the age of 13
Our website is not intended for children under 13 years of age. We do not knowingly collect personal data from children under 13 years of age. If we learn we have collected or received personal data from a child under 13 years of age without verification of parental consent, we will delete that personal data. If you believe we might have any personal data from or about a child under 13 years of age, please write to our Data Protection Officer using the point of contact information provided below.
12. Links to other websites
The Policy posted here on our website is the latest version, so that you will always know what information we gather, how we might use that information and whether we disclose it to anyone. However, we reserve the right to change this Policy without prior notification to you or your prior consent. You may determine if any such revision has taken place by referring to the date on which this Policy was last updated. Your continued use of our services constitutes your acknowledgement and acceptance of such changes.
14. Point of contact
14.1 For questions regarding data protection and our Policy:
If you have further questions regarding the processing of your data in Hong Kong, you can write to our Data Protection Officer at the following address:
Data Privacy Manager
Lidl Hong Kong Limited
Level 25, International Commerce Centre
1 Austin Road West
14.2 For complaints to the supervisory data protection authority:
You may wish to file a complaint at any time to the responsible supervisory data protection authority.
The supervisory authority for data protection in Hong Kong is the Office of the Privacy Commissioner for Personal Data (PCPD). Further advice and guidance can be found on their website at https://www.pcpd.org.hk/ or by contacting them on +852 2827 2827.