Data Protection Policy E-Charging Station
July 2024
Thank you for using our e-charging stations and your interest in our data protection policy.
The following data protection policy informs you about the type and scope of the processing of your personal data by Lidl Great Britain Limited, Lidl House, 14 Kingston Road, Surbiton, England, KT5 9NU (also referred to as "Lidl", "we" or "us" in the context of these data protection provisions); partly also in joint responsibility (see paragraph 5 below). Personal data is information that can be directly or indirectly attributed to you or can be attributed to you. The legal basis for data protection is in particular the General Data Protection Regulation (GDPR).
1. Charging Station Locator
Purposes of data processing/legal basis:
Using the "charging station locator" function of the Lidl Plus app, you can display our charging stations on a map of the various map services (Google Maps, Apple Maps and Huawei Map) and have routes to selected charging stations calculated. For more information, please see the Lidl Plus data protection policy.
2. Processing Order
Purposes of data processing/legal basis:
To process your charging transaction accordingly, we receive from Lidl Stiftung & Co. KG the following customer master data of yours:
• First name,
• surname,
• e-mail address,
• address (Street, number, postal code, city),
• country,
• processing of the Lidl Pay transaction
The legal basis for the processing of the above-mentioned data is Art. 6 Par. 1 b) GDPR, i.e., we process the data based on the contractual relationship between you and us.
Recipients / categories of recipients:
For the management of your customer master data, this is also processed on our behalf by processors from the areas of hosting, information management and e-mobility. These are each carefully selected, audited by us, and are also contractually obligated in accordance with Article 28 GDPR.
Storage period/ criteria for determining the storage period:
We store the data collected for the processing of the contract until the expiry of the statutory or possible contractual warranty and guarantee rights. After expiration of this period, we retain the information of the contractual relationship required by commercial and tax law for the periods determined by law. For this period (usually twelve years from the conclusion of the contract), the data is processed again solely in the event of an audit by the tax authorities and in the event of customer inquiries.
In the event that the contract is not concluded, we will delete the customer master data transmitted to us within one week.
3. Handling/billing and analysis of charging processes
Purposes of data processing/legal basis:
To start the charging process at one of our charging stations, you must log in to the corresponding charging station in the Lidl Plus app and start the charging process. During the charging process, in addition to general data on the status of the charging station, the following data is processed with reference to your customer ID for internal booking purposes:
• Date of the charging process,
• Charging quantity (kWh),
• Charging power (kW),
• Start of the charging process (time),
• End of charging process (time),
• Type of charging plug used.
The legal basis for the processing of your charging process for booking purposes is Art. 6 Par. 1 c) GDPR, as this is necessary to comply with our tax law retention obligations.
If you do not use our charging stations as part of a free subscription, we also process your billing and payment data for billing purposes in addition to the data mentioned in section 3, which you must provide when concluding a paid subscription via Lidl Pay:
• Debit- or credit card information
You can manage your payment data via Lidl Pay.
The legal basis for this is Art. 6 Par 1 b) GDPR, i.e., we process the above data based on the contractual relationship between you and us.
We evaluate the data of your charging process with reference to the customer ID in order to determine the utilization of charging stations and to plan the further expansion of charging stations.
The legal basis for this data processing is Art. 6 Par 1 f) GDPR. Our and your concurrent (legitimate) interest in this data processing results from the goal of improving the charging station infrastructure. For this purpose, your above-mentioned data will be transferred into anonymized statistics on the use of the charging stations.
Recipients / categories of recipients:
As part of the charging process, your data is also processed on our behalf by processors from the e-mobility sector. These are carefully selected in each case, are audited by us, and are also contractually obligated in accordance with Article 28 GDPR.
In addition, we transmit your charging behavior, as well as your billing data to Lidl Stiftung & Co KG for the purpose of displaying the order confirmation and increasing the informative value of your user profile in the Lidl Plus app, as well as billing via Lidl Pay. For more information, please see the Lidl Plus data protection policy.
Storage period/ criteria for determining the storage period:
If we use your data for data analyses to further develop our offer, we delete this data or remove the personal reference as soon as the respective purpose of the measure has been achieved. Insofar as we do not use your data for these purposes, we will store the data collected for contract processing until you unsubscribe from Lidl Plus or until the expiry of the statutory or possible contractual warranty and guarantee rights. Further information can be found in the Lidl Plus data protection policy.
After the expiry of these periods, we retain the information of the contractual relationship required by commercial and tax law for the periods determined by law. For this period (usually twelve years from the conclusion of the contract), the data is processed again solely in the event of a review by the tax authorities and in the event of customer inquiries.
4. Customer Service
Purposes of data processing/legal basis:
Personal data that you provide to us when filling out contact forms, by phone, by e-mail or via social media, e.g., when making inquiries to our customer service, is of course treated confidentially. We use your data to process your inquiry. The legal basis for data processing is Art. 6 Par. 1 f) or Art. 6 Par. 1 b) GDPR. Our and your concurrent (legitimate) interest in this data processing results from the goal of answering your inquiries, solving any problems that may exist, and thus maintaining and promoting your satisfaction as a user of our service.
Recipients / categories of recipients:
When responding to your inquiries, your data is also processed on our behalf by processors from the areas of customer service, hosting and e-mobility. These are each carefully selected, audited by us, and also contractually obligated in accordance with Article 28 GDPR.
Storage period/ criteria for determining the storage period:
All personal information that you provide to us in response to inquiries (suggestions, praise or criticism) via this website or by e-mail will be deleted or anonymized by us no later than 3 years after the final response is given. Experience has shown that, as a rule, there are no more queries about our answers after 90 days. If you assert your rights as a data subject (see below), your personal data will be stored for 3 years after the final response to prove that we have provided you with comprehensive information and that the legal requirements have been met.
5. Your data subject rights
5.1 Right of access according to Article 15 GDPR
In accordance with Art. 15 Par. 1) GDPR, you have the right to request information free of charge about the personal data we have stored about you. This includes in particular:
• the purposes for which the personal data are processed;
• the categories of personal data which are processed;
• the recipients or categories of recipients to whom the personal data relating to you have been or will be disclosed;
• the planned duration of the storage of the personal data relating to you or, if specific information on this is not possible, criteria for determining the storage period;
• the existence of a right to obtain the rectification or erasure of personal data concerning you, a right to obtain the restriction of processing by the controller or a right to object to such processing;
• the existence of a right of appeal to a supervisory authority;
• any available information on the origin of the data, if the personal data is not collected from the data subject;
• the existence of automated decision-making, including profiling, pursuant to Art. 22 Par. 1) and 4) GDPR and, at least in those cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.
If personal data are transferred to a third country or to an international organization, you have the right to be informed about the appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer.
5.2 Right of rectification according to Article 16 GDPR
You have the right to request that we correct any inaccurate personal data relating to you without undue delay. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data, including by means of a supplementary declaration.
6.3 Right to erasure according to Article 17 GDPR
You have the right to request that we delete personal data concerning you without delay, provided that one of the following reasons applies:
• the personal data is no longer necessary for the purposes for which they were collected or otherwise processed;
• you withdraw your consent on which the processing was based according to Art. 6 Par. 1 a) or Art. 9 Par. 2 a) GDPR and there is no other legal basis for the processing;
• you object to the processing according to Art. 21 Par. 1) or (2) GDPR and there are no overriding legitimate grounds for the processing in the case of Art. 21 Par. 1) GDPR;
• the personal data have been processed unlawfully;
• erasure of the personal data is necessary for compliance with a legal obligation;
• the personal data has been collected in relation to information society services offered according to Art. 8 Par. 1) GDPR.
Where we have made the personal data public and are obliged to erase it, we shall take reasonable steps, taking into account the available technology and the costs of implementation, to inform the third parties processing your data that you also require them to erase all links to, or copies or replications of, that personal data.
5.4 Right to restriction of processing according to Article 18 GDPR
You have the right to demand that we restrict processing if one of the following conditions is met:
• the accuracy of the personal data is questioned by you;
• the processing is unlawful, and you request the restriction of the use of the personal data instead of erasure;
• the controller no longer needs the personal data for the purposes of processing, but the data subject needs them for the establishment, exercise or defense of legal claims; or
• you have objected to the processing according to Art. 21 Par. 1) GDPR, as long as it has not yet been determined whether the legitimate grounds of the controller override those of the data subject.
5.5 Right to data portability Article 20 GDPR
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and you have the right to transfer this data to another controller without hindrance from us, provided that
• the processing is based on consent according to Art. 6 Par. 1 a) or Art. 9 Par. 2 a) or on a contract according to Art. 6 Par. 1 b) GDPR and
• the processing is carried out with the aid of automated procedures.
When exercising your right to data portability, you have the right to obtain that the personal data be transferred directly from us to another controller, where technically feasible.
5.6 Right to object according to Article 21 GDPR
Under the conditions of Art. 21 Par. 1) and (2) GDPR, you may object to the processing of data for the pursuit of legitimate interests.
We will stop processing your personal data in this case. We are not obliged to do so, provided that we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the assertion, exercise or defense of legal claims.
5.7 Right to lodge a complaint with a supervisory authority according to Article 77 GDPR
You also have the right to lodge a complaint with the competent data protection supervisory authority at any time. For this purpose, you can contact the data protection supervisory authority in the UK, the Information Commission Office, at ico.org.uk.
6. Name and contact details of the controller and contact details of the company´s data protection officer
This data protection policy applies to data processing by Lidl Great Britain Limited, Lidl House, 14 Kingston Road, Surbiton, England, KT5 9NU ("data controller"). The company data protection officer of Lidl Great Britain Limited can be reached at the above address or at dataprotection@lidlplus.co.uk.