DATA PROTECTION & PRIVACY STATEMENT

Purposes of data processing / legal bases:
We use cookies on our website. Your consent includes the use of cookies and other technologies to process usage data on all (sub) domains at and under www.lidl.asia.

Cookies are small text files that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any damage to your device and do not contain any viruses, Trojans or other malware. Information relating to the specific device used is stored in the cookie. However, this does not mean that we gain immediate knowledge of your identity.

The use of cookies and other technologies for processing usage data serves the following purposes, depending on the category of the cookie or other technology:

• Technically necessary: These are cookies and similar methods without which you cannot use our services (for example, to display our website correctly/ functions you want to use, to save your login in the login area).
• Ease of use: With the help of this technology, we can take into account your actual or presumed preferences for easy use of our career website. For example, your settings allow us to display our careers website in a language that works best for you. In addition, we avoid showing you options that may not be available in your region.
• Statistics: allow us to compile pseudonymized statistics on the use of our services. This allows us to determine, for example, how we can adapt our career website even better to suit the needs of the website users.
• Marketing: This allows us to display advertising content that suits you based on the analysis of your usage behavior. Your usage behavior can also be tracked via different websites, browsers or devices using a user ID (unique identifier).

You can find an overview of information on the cookies and other technologies used, along with the respective processing purposes, storage periods and any third-party providers involved here.

When using cookies and similar techniques for processing usage data, the following types of personal data are processed for the following purposes:

Technically necessary:

• Setting cookie preferences.

Comfort:

• Settings that serve to optimize the output of the cards.
• Output of recently viewed jobs.
• Output of saved jobs.

Statistics:

• Pseudonymised usage profiles with information about the use of our website. These include in particular:
  o    browser type / version,
  o    operating system used,
  o    Referrer URL (the previously visited page),
  o    host name of the accessing computer (IP address),
  o    time of the server request,
  o    individual user ID and
  o    Events triggered on the website (surfing behavior).
• The IP address is regularly anonymized so that it cannot be traced back to you.
• No conclusions can be drawn about your person from the user ID itself.

The legal basis for the use of cookies is your consent. By using this website, you consent to the use of cookies.

You can revoke / modify your consent at any time with effect for the future. Just click here and make your selection. By removing the corresponding tick, you can easily revoke your consent for the respective processing purposes.

Recipients / categories of recipients:
In the context of data processing by means of cookies and similar technologies for processing usage data, we may use specialized service providers, in particular from the area of online marketing. These process your data on our behalf as Data Processors, are each carefully selected and contractually bound. All of the companies listed as providers in our cookie policy act as Data Processors for us.

Storage period / criteria for determining the storage period:
The storage period for cookies can be found in our cookie policy. Insofar as the information “persistent” is given in the “Expiry” column, the cookie is stored permanently until the corresponding consent is revoked. The storage period of the session storage is limited to the respective session and ends when the browser is closed.

We would like to give you the opportunity to conveniently apply internationally to all Lidl companies from one portal. Having created your profile in the Lidl recruiting portal enables us to stay in touch beyond your application and offer you additional services related to "Working at Lidl". For example, after visiting a career fair, completing an internship or a student job, you have the opportunity to register in the recruiting portal without having to apply for a specific position.

We process:

• the data that you make available to us during registration and in the recruiting portal;
• at least your e-mail address, password, first name, last name, country/ region of your place of residence

The processing of your profile data takes place on the basis of the user contract for the recruiting portal according to Art. 6 lit. b GDPR.

When you register in our recruiting portal with the corresponding visibility settings of your profile ("Visibility for all recruiters of the Lidl Group"), we can consider you for other positions based on your qualifications. In addition, this gives you the opportunity to be taken into account in the activities of our Talent Relationship Management (e.g. exciting insights from the Lidl working world).

When you visit the recruiting portal, log files are generated with the following content:

• your IP address
• the path of the page
• a description of the type of user agent used (e.g., your web browser)
• the website from which you came to the current page (referrer)
• as well as the date and time of the query.

Lidl Stiftung & Co. KG, Stiftsbergstraße 1, 74172 Neckarsulm, is responsible for the processing of your data within the framework of the recruiting portal/ candidate profile.

If you register with a candidate profile in our recruiting portal (also possible without actively applying), we will process your data in order to offer you additional services of your choice. This is done on the basis of the user contract accepted by you in accordance with Article 6 (1) (b) GDPR.

If you have applied for a specific position and would also like to be seen by all recruiters of the Lidl Group or within your country of origin, you can choose this setting at any time in “Data protection and search options“ in your profile or when you create a profile you can select "Visibility for all recruiters in the Lidl Group" or "Visibility for all recruiters in my country of origin". The recruiters of all companies may then view the data in your profile in accordance with Article 6 (1) (a) GDPR in order to suggest positions that suit you. If there is a suitable position, we will contact you by e-mail and invite you to apply for this position. You decide whether you want to apply.

If you select the option "Visibility for all recruiters worldwide",  you consent to your profile being visible to all recruiters and, where applicable, managers of all Lidl national organizations and Regional Distribution Centers as well as Lidl Stiftung & Co. KG and Lidl Digital International GmbH & Co. KG across all Lidl countries.

If you select "Visibility for all recruiters within my country of origin", you consent to your profile being visible to all recruiters and, where applicable, managers of the Lidl national organization and the associated Regional Distribution Centers in your country of origin.

These two options mean that all responsible employees have access to your profile. If you have selected one of these options, you will be considered for later vacancies once the application process has ended.

Note: If data is transmitted to a Lidl company that is headquartered in non-EU/ non-EEA countries ("third countries"), the data protection level in this third country may be lower compared to that in the EU/ EEA, which may mean that the rights of data subjects may not be enforced at all or not in the same way. If we transfer personal data to data recipients outside the EU/ EEA, the transfer will only take place if an adequate level of data protection in the third country has been confirmed by the EU Commission, an appropriate level of data protection has been agreed with the data recipient (e.g. by means of EU standard contractual clauses) or you have given us your express consent.

Withdrawal of consent

You can revoke your consent to the worldwide or national visibility of your profile at any time with effect for the future. The legality of the processing that has already taken place up until the receipt of your withdrawal is not affected by this. In your profile, you can adjust the setting at any time in "Data protection and search options". Please note that this setting applies to all of your submitted and still active applications. Only the recruiting teams responsible for the respective positions for which you have an active application can then access your job-related data. Besides these specific positions, we can no longer consider you without an application for other positions.

If you select the visibility option “Only the recruiting team responsible for the position”, only the recruiters and managers responsible for filling the position can see your profile in accordance with Article 6 (1) (b) GDPR. Your data will not be forwarded, even for other suitable positions. Your profile will not be included in Talent Relationship Management.

Cookies and Other Technologies

In our recruiting portal, technically necessary cookies and other technically necessary technologies are used to process usage data (for example, to display our website correctly/ functions you require, to save your login in the login area).

You can find an information overview of the cookies and other technologies used here, along with the respective processing purposes, storage periods and any third-party providers involved.

The legal basis for the use of technically necessary cookies is Article 6 (1) (f) GDPR, i.e. we process your data on the basis of our legitimate interest in being able to present the website with its statements in a fully functional manner.

Log files

Log files are stored for the following purposes:

• Ensuring a smooth connection,
• Ensuring comfortable use of our website/ application,
• Evaluation of system security and stability.

The legal basis for processing the log files is Article 6 (1) (f) GDPR. Our legitimate interest lies in the purposes of data processing listed above.

The transfer of your data to external service providers who support our application process in individual cases will only take place after careful selection and contractual obligation. External IT and consulting service providers as well as companies of the Schwarz Group support us in the provision of the system and may receive access to your data in individual cases as part of the service provision. These are the following service providers:

• Schwarz IT KG, Stiftsbergstraße 1, 74172 Neckarsulm, Germany

You can delete your candidate profile and the saved attachments at any time in the profile settings. You are the owner of your data.

In the event of inactivity, your account will be deleted 12 months after the last login.

If you have decided to be included in our Talent Relationship Management, you will receive a reminder e-mail before your account is deleted.

If you initiate the deletion yourself, the deletion will take place within 24 hours, provided that this does not conflict with retention requirements or our legitimate interests.

If the terms of use are changed, please note that you will be prompted to accept the changed license agreement the next time you log in. If this consent is not given within 28 days, your profile and your data will be deleted and no longer processed. If you reject, your data will be deleted within 24 hours and no longer processed, unless this is contrary to retention requirements or legitimate interests on our end. Existing applications will be treated as withdrawn and will also be deleted according to these deadlines.

The retention period for cookies can be found in our cookie policy. If the information “persistent” is indicated in the “Expiration” column, the cookie is stored permanently until the corresponding consent is revoked. The retention period of the session storage is limited to the respective session and ends when the browser is closed.

Log files are stored for a period of seven days and then automatically deleted.

There is no legal or contractual obligation on your part to provide us with personal data. Without the data, we cannot contact you or carry out an application process.

9.5.1 Overview
In addition to the right to withdraw your consent, you are entitled to the following additional rights if the respective legal requirements are met:

• Right to information about your personal data stored by us in accordance with Article 15 GDPR;
• Right to correct incorrect or complete  incomplete data in accordance with Article 16 GDPR;
• Right to deletion of your data stored by us in accordance with Article 17 GDPR;
• Right to restrict the processing of your data in accordance with Article 18 GDPR;
• Right to data portability under Article 20 GDPR; and
• Right of objection under Article 21 GDPR.

9.5.2 Right to Right to information under Article 15 GDPR
In accordance with Article 15 (1) GDPR, you have the right to request information about your personal data stored by us free of charge. This includes in particular:

• the purposes for which your personal data is processed;
• the categories of personal data that are processed;
• the recipients or categories of recipients to whom your personal data has been or will be disclosed;
• the planned storage duration of your personal data or, if specific information is not possible, criteria for determining the storage period;
• the existence of a right to rectify or delete your personal data, a right to restrict the processing by the responsible person or a right to object to this processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• all available information about the origin of the data if the personal data is not collected from the data subject;
• The existence of automated decision-making, including profiling, in accordance with Article 22 (1) and (4) GDPR and - at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

If personal data is transferred to a third country or to an international organization, you have the right to be informed about the appropriate guarantees under Article 46 GDPR in connection with the transfer.

9.5.3 Right to rectification under Article 16 GDPR
In the event of incorrect data, you have the right to request that we correct your personal data immediately. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data - also by means of an additional explanation.

9.5.4 Right to deletion according to Article 17 GDPR
You have the right to request that we delete your personal data immediately if one of the following reasons applies:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• You withdraw your consent on which the processing was based in accordance with Article 6 (1) (a) or Article 9 (2) (a) GDPR, and there is no other legal basis for the processing;
• You object to the processing under Article 21 (1) or (2) GDPR and in the case of Article 21 (1) GDPR, there are no overriding legitimate grounds for processing;
• The personal data was processed unlawfully;
• The deletion of the personal data is necessary to fulfill a legal obligation;
  The personal data was collected in relation to the services offered by the information company in accordance with Article 8 (1) GDPR.

If we have made the personal data public and are obliged to delete it, we will take appropriate measures, taking into account the available technology and implementation costs, to inform the third parties processing your data that you wish for them to also delete all links to or copies of your personal data.

9.5.5 Right to restriction of processing according to Article 18 GDPR
You have the right to request that we limit processing if one of the following conditions is met:

• you dispute the accuracy of the personal data;
• The processing is unlawful and you request limited use of the personal data instead of the deletion;
• the responsible person no longer needs the personal data for processing purposes, but you need them to assert, exercise or defend legal claims or
• you have objected to the processing in accordance with Article 21 (1) GDPR, as long as it has not yet been determined whether the legitimate reasons of the person responsible outweigh those of the data subject.

9.5.6 Right to data portability under Article 20 GDPR
You have the right to receive your personal data that you have provided to us in a structured, common and machine-readable format, and you have the right to transfer this data to another responsible person without any hindrance from us, if

• the processing is based on consent in accordance with Article 6 (1) (a) or Article 9 (2) (a) or on a contract in accordance with Article 6 (1) (b) GDPR and
• The processing is carried out using automated procedures.

When exercising your right to data portability, you have the right to have the personal data transmitted directly from us to another person responsible, insofar as this is technically feasible.

9.5.7 Right to object under Article 21 GDPR
Under the conditions of Article 21 (1) GDPR, you can object to data processing for reasons arising from your particular situation.
The above general right of objection applies to all processing purposes described in these data protection provisions, which are processed on the basis of Article 6 (1) (f) GDPR. In contrast to the special right to object to data processing for advertising purposes (see above in particular Section 3), we are only obliged to implement such a general objection under the GDPR if you give us reasons of overriding importance, e.g. a possible danger to life or health.

9.5.8 Right of appeal to the data protection supervisory authority according to Article 77 GDPR
You also have the right to lodge a complaint with the responsible data protection supervisory authority. You can contact the data protection supervisory authority in the country in which you are resident or the authority of the country in which the responsible Lidl company is located.

If you have any questions about the recruiting portal or to exercise your rights in the processing of your data (data subject rights), please reach out to:

Lidl Stiftung & Co. KG
Talent Sourcing International
Stiftsbergstraße 1
74172 Neckarsulm
Germany

You can contact us in writing at the above address or by e-mail at Talent_Sourcing@lidl.com.

Information and contact persons regarding your rights as a data subject can be found in section 12.1 of this Privacy Statement.

If you have additional questions about the processing of your data, you can contact the company data protection officer of Lidl Stiftung & Co. KG (see section 9.7 below).

Lidl Stiftung & Co. KG
Datenschutz International
Stiftsbergstraße 1
74172 Neckarsulm
Germany

The data protection officer of Lidl Stiftung & Co. KG can be reached at the specified address for the attention of the data protection officer or at datenschutz@lidl.com.

Further information and additional contact persons regarding your rights as a data subject can be found in section 12.1 of this Privacy Statement.