Data protection at www.monsieur-cuisine.com

(Version 1.0; last updated 11 01, 2021)

Thank you for visiting www.monsieur-cuisine.com. The following privacy policy is designed to inform you about how and to what extent your personal data is processed when you visit our website. Personal data is information that identifies you or could identify you directly or indirectly. The statutory basis is, in particular, the EU General Data Protection Regulation (GDPR).

1. Accessing our website

Purposes of the processing/legal bases:

When accessing our website, the browser used on your end device will – automatically and without any action on your part – send

• the IP address of the accessing Internet-enabled device;
• the date and time (GMT) of access;
• the name and URL of the requested file;
• the website/application from which the access occurred (referrer URL);
• the browser (incl. language and browser software version), 
• where relevant, the operating system and interface of your device;
• the access status/ HTTP status code; and
• the transferred bytes of the requested URL

to our website server and be stored temporarily in what is known as a log file for the following purposes:

• to ensure a fault-free connection;
• to ensure the comfortable use of our website/application; and
• to analyze system security and stability.

The legal basis for the processing of the IP address is Article 6(1)(f) GDPR. The purposes of data processing listed above constitute our legitimate interest. If data is used for purposes of preparing a contract, the legal basis for the data processing is Article 6(1)(b) GDPR.

Recipients/categories of recipient:

In connection with the aforementioned processing, your data will also be processed on our behalf by processors in order to operate and enhance the website. Such processors are carefully selected, audited by us and bound by contract in accordance with Article 28 GDPR.

In the context of our cooperation with our processors for support with respect to the aforementioned purposes, your data is generally also processed on servers located in China.

Storage time/criteria for determining storage time:

We anonymize the data we process for the aforementioned purposes after 14 days and store it in anonymized form for a period of 90 days. The data is automatically deleted thereafter.

2. Registering and using your Monsieur Cuisine customer account

Purposes of the processing/legal bases:

You can use your Monsieur Cuisine Connect kitchen appliance to create a user account and subsequently use this account to log in on your appliance, on the website (www.monsieur-cuisine.com) and in the Monsieur Cuisine App to use certain features (e.g., to select your favorite recipes). You can then synchronize your account on your appliance, your App, and the website.

Once you enter your chosen access data on the appliance, you will be sent an activation link, which you can use to activate your account. To complete the registration process, your e-mail address provided in this context must be validated and registration then confirmed by us. 

During the registration process, the following data will be collected:

• pseudonym ("nickname");
• e-mail address;
• password and
• automatically generated user ID.

The data provided by you during the registration process must be substantively correct. Third party data may not be used.

In addition, you can complete your profile with the following voluntary information:

• profile picture;
• appliance model;
• own recipes (website only);
• pictures of own recipes (website only) and
• comments on recipes.

We also use your e-mail address to

• assist you with any account problems you may encounter, and
• inform you about changes to our Terms of Use, or, where necessary, changes to this privacy policy.

The legal basis for storing your data is Article 6(1)(b) GDPR, i.e., we process your data as part of initiating and performing a contractual relationship.

Recipients/categories of recipient:

We use service providers to process your data. These service providers provide us with storage capacity, database systems or the like, technical support, and marketing and technical consultancy. All of our processors are carefully selected, audited by us and bound by contract in accordance with Article 28 GDPR.

Your list of favorite recipes can only be viewed by you. The recipes you create and upload, along with any comments you add, can be viewed by third parties together with your nickname and, if applicable, profile picture.

In the context of our cooperation with our processors for support with respect to the aforementioned purposes, your data is generally also processed on servers located in China.

Storage time/criteria for determining storage time:

We will erase your data if you request the deletion of your Monsieur Cuisine account. Any comments and recipes you may have uploaded to date will then be anonymized and can continue to be viewed by visitors to the website and other users of the MC app. If you wish to have the comments and recipes you have uploaded deleted completely, please inform us of this in a separate request to our customer service (section 12). We will then completely delete your recipes and comments.     

3. Making contact

Purposes of the processing/legal bases:

We treat all personal data which you provide us with by telephone, e-mail or in the online chat (e.g., when you contact customer service) confidentially. We use your data solely for the limited purpose of processing your inquiry. The legal basis for the data processing is Article 6(1)(f) and Article 6(1)(b) GDPR. Our shared (legitimate) interest in this data processing arises from the objective of answering any inquiries and resolving any issues you may have and thus ensuring and improving your level of satisfaction as a customer or other user of our website.

Recipients/categories of recipient:

When responding to your requests, we will also have processors specializing in customer service process your data on our behalf. Such processors are carefully selected, audited by us and bound by contract in accordance with Article 28 GDPR.

Furthermore, it may be necessary for us to pass on excerpts of your inquiry to contractual partners (e.g., suppliers in the case of product-specific inquiries) for the purpose of processing your inquiry. In these cases, your inquiry will be anonymized in advance, meaning that third parties will not be able to identify you. Should it be necessary to pass on your personal data in individual cases, we will notify you in advance and ask you for your consent. We will not share your data with third parties for these purposes without your consent.

Storage time/criteria for determining storage time:

We delete or anonymize all personal data we receive from you when you make inquiries (positive/negative comments or suggestions) via the website, by e-mail or in the online chat no later than 95 days after the final response is sent. Based on experience, we generally do not receive any questions concerning our responses after 95 days. If you assert your rights as a data subject (see section 10), your personal data will be stored for three years after the final response in order to document the fact that we provided you with comprehensive information and that the legal requirements have been met.

4. Use of cookies and other similar technologies to process usage data

Purposes of the processing/legal bases:

We, Lidl Stiftung & Co. KG, Stiftsbergstraße 1, 74172 Neckarsulm, Germany, are the controller with respect to data processing in connection with the use of "cookies" and other similar technologies to process usage data on www.monsieur-cuisine.com and some of the websites embedded there.

Cookies are small text files that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any harm to your end device, nor do they contain any viruses, trojans or other malware. The cookie stores certain information that results in connection with the specific end device deployed. This does not, however, mean that we will immediately become aware of your identity.

Cookies and the other technologies used to process usage data are deployed for the following purposes, depending on the categories of cookie/other technologies:

• Technically necessary: these are cookies and similar technologies without which you cannot use our services (e.g., for the correct display of our website/functions requested by you, to record you signing in, etc.).
• Preferences: using these methods, we can take into account your actual or perceived preferences to enhance the user experience. For example, we can use your settings to display our website in a language relevant to you.
• Statistics: these technologies enable us to tailor the design of our services by producing anonymized statistics about how they are used. For example, we can use them to determine how better to adapt our website to user habits.
• Marketing: these enable us to display relevant advertising content based on an analysis of your usage behavior. Your usage behavior can also be tracked over various websites, browsers or devices via a user ID (unique identifier).

Please click here for an overview of the cookies and other technologies we use, including their function, expiration, and any third party providers involved.

Depending on the purpose, the use of cookies and similar technologies to process usage data involves processing the following types of personal data in particular:

Technically necessary:

• Authentication data to identify a user after signing in, enabling you to access authorized content on subsequent visits (e.g., access to your customer account);
• security-related events (e.g., identifying repeat failed sign-in attempts);
• consent to the use of cookies.

Statistics:

• pseudonymized usage profiles containing information on the use of our website. These contain in particular:
• browser type/browser version;
• operating system used;
• referrer URL (i.e., the previously visited page);
• host name of the accessing computer (IP address);
• time of the server request;
• events triggered on the website (web browsing behavior).
• The IP address is routinely anonymized, which in principle means it is no longer possible to identify you.

The legal basis for using preference, statistics and marketing cookies is your consent given pursuant to Article 6(1)(a) GDPR. The legal basis for using technical cookies is Article 6(1)(b) GDPR, i.e., we process your data in order to prepare our services as part of initiating and performing the contract.

Recipients/categories of recipient:

When using cookies and similar technologies to process usage data, we may on occasion retain specialized service providers, particularly from the field of online marketing, to process data. They process your data on our behalf as processors. Each has been carefully selected and bound by contract in accordance with Article 28 GDPR. All of the companies listed as service providers in our  cookie policy act as processors on our behalf, to the extent they are not named as (joint) controllers at the beginning of this section.

In the context of our cooperation with Google LLC, the aforementioned data is generally also processed for statistical and marketing purposes on servers located in the U.S. For purposes of support in implementing the aforementioned technologies by our processors, your data may also be processed on servers located in China.

If you have consented to processing for marketing purposes, we may potentially share your User ID and the associated user profiles with third parties via the providers of advertising networks.

Storage time/criteria for determining storage time:

For information on the duration of storage for cookies, see our cookie policy. If "persistent" is entered in the "expiration" column, the cookie will be stored permanently until the corresponding consent is withdrawn.

5. Opportunities to withdraw your consent/opt out

In addition to the options referred to in section 5, you can also prevent the targeting technologies specified section 5 by changing your browser settings, e.g., to refuse some or all cookies. However, please be advised that doing so may prevent you from using all the functions of this website.

6. Social Media plugins

Purposes of the processing/legal bases:

We use social media plugins on our website on the basis of Article 6(1)(f) GDPR for the social network Facebook to build our public profile. The underlying promotional purpose constitutes a legitimate interest within the meaning of the GDPR. The respective provider is responsible for ensuring that its site is operated in compliances with data protection laws.

We have no control over the data collected or the processing operations, nor do we have any knowledge as to the full scope of data collection or the purposes of processing.

The plugin provider stores the data collected about you as user profiles and uses them for the purposes of advertising, market research and/or tailoring its website to users' needs. This type of analysis is performed in particular (including for users who are not logged in) for the purpose of presenting interest-based advertising and to inform other users of the social network about your activities on our website. You have a right to object to the creation of such user profiles, but must contact the respective plugin provider to exercise this right. The plugins we offer allow you to interact with the social networks and other users, so that we can optimize our services and make them more attractive to you as a user.

The data is transmitted regardless of whether you have an account with the plugin provider and are logged in there If you are logged in with the plugin provider, the data we collect will be directly assigned to your account with the plugin provider. If you click on the button and, e.g., link the page, the plugin provider will also save this information in your user account and publicly share it with your contacts. We recommend that you log out after using a social network generally to avoid being assigned to your profile with the plugin provider.

You will find further information on the purpose and scope of data collection and how Facebook processes data in the provider's privacy policy.

• Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland: https://www.facebook.com/privacy/explanation

Recipients/categories of recipient:

We use social media plugins on our website for specialized providers, specifically Facebook Ireland Limited. As far as we are aware, your data is generally also processed on services located in the U.S.

Storage time/criteria for determining storage time:

For further information on deleting data collected by the plugin provider, see the privacy policy of the respective plugin provider (see above).

7. Data transfers to recipients in a third country

If we transfer data to recipients in a third country (located outside of the European Economic Area), this will be evident in the information on the recipients/categories of recipient in the description of the respective data processing. Some third countries have been certified by the European Commission through so-called adequacy decisions as having a level of data protection comparable to that offered in the European Economic Area. You can find a list of these countries here. Where no comparable data protection standard exists in a given country, we take other measures to ensure that an adequate level of data protection is guaranteed by other means, such as binding corporate rules, the European Commission's standard contractual clauses on the protection of personal data, certificates or recognized codes of conduct. For further information, please contact our data protection officer (section 12).

8. Embedded third party content

We have embedded YouTube videos on our website, which are stored at http://www.youtube.com and can be played directly from our website. All videos are embedded with "privacy-enhanced mode" enabled, which means that no data about you as the user is transferred to YouTube if you do not play the videos. Data is only transferred if you play the videos. We do not have any control over this transfer of data.

You will find further information on the purpose and scope of data collection and how YouTube processes data in the provider's privacy policy. You will also find further information there about your rights in this regard and settings to protect your privacy. YouTube's Address and privacy policies: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; https://www.google.de/intl/de/policies/privacy/.

9. No obligation to provide personal data

The provision of personal data is neither legally nor contractually required, nor is it required in order to enter into an agreement. You are under no obligation to provide personal data. However, if you choose to not provide your personal data you may not be able to (fully) use our website.

10. Your rights as the data subject

Overview

In addition, to the right to withdraw any consent you have granted to us, you have the following additional rights provided the respective statutory conditions are met:

• right of access to your personal data stored with us pursuant to Article 15 GDPR and section 34 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG);
• right to rectification of inaccurate personal data and the right to have incomplete personal data completed pursuant to Article 16 GDPR;
• right to erasure of your personal data stored with us pursuant to Article 17 GDPR and section 35 BDSG;
• right to a restriction of processing of your data pursuant to Article 18 GDPR;
• right to data portability pursuant to Article 20 GDPR;
• right to object pursuant to Article 21 GDPR.

Right of access pursuant to Article 15 GDPR

Pursuant to Article 15(1) of the GDPR, you have the right to request information, free of charge, on the personal data stored about you. This particularly includes:

• the purposes for which personal data is being processed;
• the categories of personal data that are being processed;
• the recipients or categories of recipient to whom personal data concerning you has been or will be disclosed;
• the planned duration of the storage of the personal data concerning you or, if it is not possible to give any specific details, the criteria used to determine the storage duration;
• the existence of a right to rectification or erasure of the personal data concerning you, a right to request from the controller that processing be restricted or a right to object to this processing;
• the right to lodge a complaint with a supervisory authority;
• all available information regarding the origin of the data if the personal data is not being collected from the data subject;
• the existence of any automated decision-making processes including profiling pursuant to Article 22(1) and (4) GDPR and – at least in these cases – meaningful information regarding the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

If personal data is transferred to a third country or an international organization, you have the right to be notified about appropriate safeguards pursuant Article 46 GDPR in connection with the transfer.

Right to rectification pursuant to Article 16 GDPR

You have the right to request the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure pursuant to Article 17 GDPR

You have the right to require us to erase any personal data concerning you without undue delay where one of the following grounds applies:

• the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
• you withdraw your consent on which the processing pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR was based and there is no other legal basis for the processing;
• you object to the processing pursuant to Article 21(1) or (2) GDPR, and in the case of Article 21(1) GDPR there are no overriding legitimate grounds for the processing;
• the personal data was unlawfully processed;
• the erasure of personal data is necessary in order to comply with a legal obligation;
• the personal data was collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

Where we have made the personal data public and are obliged to erase it, taking account of available technology and the cost of implementation we will take reasonable steps to inform any third parties processing your data of the fact that you have requested the erasure by such third parties of any links to, or copies or replications of, such personal data.

Right to restriction of processing pursuant to Article 18 GDPR

You have the right to require us to restrict the processing where one of the following applies:

• you contest the accuracy of the personal data;
• the processing is unlawful and you request the restriction of the use of the personal data rather than its erasure;
• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defense of legal claims; or
• you have objected to the processing pursuant to Article 21(1) GDPR pending verification of whether the legitimate grounds of the controller override those of the data subject.

Right to data portability pursuant to Article 20 GDPR

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another controller without hindrance by us, where

• the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR and
• the processing is carried out by automated means.

In exercising your right to data portability you have the right to have the personal data transmitted directly from us to another controller where technically feasible.

Right to object pursuant to Article 21 GDPR

Provided the requirements of Article 21(1) GDPR are met, you may object to the data processing on grounds relating to your particular situation.

The aforementioned general right to object applies to all processing grounds set out in these data protection provisions, which are processed on the basis of Article 6(1)(f) GDPR. In contrast to the specific right to object regarding data processing for promotional purposes, we are only obliged to action such general right to object if you cite grounds of overriding importance, e.g. a possible risk to life or health. In addition you have the option to contact the supervisory authority responsible for Lidl Stiftung & Co. KG or the data protection officer of Lidl Stiftung & Co. KG.

Right to lodge a complaint with the data protection supervisory authority pursuant to Article 77 GDPR

You also have a right to lodge a complaint with the competent data protection supervisory authority at any time. In order to do this you can contact the data protection supervisory authority of the German Land where you have your place of residence or the authority of the Land of Baden-Württemberg as the Land where Lidl companies are headquartered.

11. Exercising your rights

If you have any questions regarding the website or in order to exercise your rights in the processing of your data (data protection rights) please contact Lidl's customer service:

• Belgium: privacy-mclidlbe
• Germany: datenschutz-mclidlde
• France: protection.donnees-mclidlfr
• United Kingdom: dataprotection-mclidl.couk
• Italy: privacy-mclidlit
• Netherlands: gegevensbescherming-mclidlnl
• Austria: datenschutz-mclidlat
• Poland: ochronadanychosobowych-mclidlpl
• Portugal: protecaodados-mclidlpt
• Switzerland: datenschutz-mclidlch
• Spain: [email protected]
• Czech Republic: ochranadat-mclidlcz

12. Name and contact details of the controller and contact details of the company's data protection officer

With the exception of the processing activities described in section 4, this privacy policy applies to the processing of data by Lidl Stiftung & Co. KG, Stiftsbergstraße 1, 74172 Neckarsulm, Germany, and with respect to the website www.monsieur-cuisine.com.

See clause 11 for the contact details for the company's data protection officer.