Merlin Hub

Basic information of data protection – Privacy Policy  

Party responsible for data processing: MERLIN PROPERTIES SOCIMI, S.A., (hereinafter referred to as “Merlin”). Address: Paseo de la Castellana, 257, 28046, Madrid (Sp).Email: Main purpose of the data processing: Your data will be used to establish, maintain and manage the commercial, contractual or pre-contractual relationship, processing your inquiries and mailing marketing material and commercial information. Legitimate basis: Depending on the case, the data will be processed based on obtaining consent, the execution of the agreement between you and Merlin, or the application of contractual or pre-contractual measures. Potential data recipients:– Third parties to which Merlin is forced to transfer information, like public authorities.– Companies within the company group to which MERLIN PROPERTIES SOCIMI, S.A., belongs to and which are in the real estate sector. Data protection rights: You may revoke at any time the consent given for the personal data processing activities by Merlin, as well as exercise, should you be interested in it, your rights of access, rectification, suppression, limitation or opposition to the data processing, the portability of data we well as not being subject to automated decisions. You can do this through a request to MERLIN PROPERTIES SOCIMI, S.A. in Paseo de la Castellana, 257, 28046, Madrid (Spain), or to the following email address:, annexing a copy of your ID or identity documentation.

1. Information about Merlin

This document regulates the privacy policy of Merlin’s proprietary Website (hereinafter referred to as “Website”).

Merlin is one of the main real estate companies listed in the Spanish Stock Exchange (IBEX-35), mainly dedicated to the acquisition and management of tertiary real estate assets in Spain and Portugal. Merlin operates in three main markets: offices, retail and logistics. Below you can find the identification details of the company for your information:

Corporate name: MERLIN PROPERTIES SOCIMI, S.A., (hereinafter referred to as “Merlin”).

Tax ID No.: A-86977790

Address: Paseo de la Castellana, 257, 28046, Madrid (Spain).


Registration details: Registered in the Companies Registry of Madrid, on volume 32.065, sheet 206, page M-577.086.

1.1. Application of this Privacy Policy

This Privacy Policy regulates the data processing carried out by Merlin concerning the users that access or contact Merlin through its Website, The latter would cover the personal data of i) clients and/or potential clients, ii) suppliers and/or possible suppliers, iii) investors and/or potential investors, iv) employees or candidates and v) any other user that accesses or transfers information through the Website. Therefore, this Privacy Policy reflects the information regarding the processing with respect to the different stakeholder categories that have been indicated.

2. 2. Personal data processed by Merlin, purpose and legitimation

You are hereby informed that all data Merlin requests or may request are necessary for the purposes described in this Privacy Policy and the act of not providing them might imply the inability to contact you or manage the request you’ve submitted to Merlin. Also, Merlin reserves the right not to answer or deal with requests that do not include the data requested.

You guarantee the truthfulness of the personal data provided to Merlin. Merlin may request that you review and update the personal data they hold of you regularly.

In the Website, you can find useful information to be keep yourself up to date on the services provided by Merlin. In that regard, Merlin will only request and process the data necessary to deal with the inquiry you made, provide the services hired or establish or maintain a commercial, contractual or pre-contractual relationship with you.

We describe below the different purposes for which your personal data is processed and the legitimate basis for such processing:

  • Legitimated by the execution of an agreement formalized by you and Merlin or the application of pre-contractual measures:  
  1. Managing the commercial relationship with potential clients, suppliers and/or investors, answering to the requests of information about products and services offered by Merlin.
  2. Managing the contractual relationship with clients, suppliers and/or investors of Merlin, which includes the management of inquiries Merlin receives therefrom and the follow-up of such established relationship.
  • Legitimated by express consent:
  1. In case you authorize it, mailing of advertising and commercial information related to the different companies of MERLIN PROPERTIES Group, their activities, products, services, offers, special promotions and documentation of various kinds by any means, including electronically.
  2. In case you authorize it, transfer your data to companies of the MERLIN PROPERTIES Group with the purpose of sending you business communications related to the activity sector of each of them (real estate, infrastructure development and management, financial, management of parking and/or shopping centers or wealth management) by any means, including electronically.
  3. In case you authorize so, carry out a profile on your consumption habits through internal and external information, to provide special offers of products or services tailored to your needs.

2.1. Data processing associated to the Website navigation itself

Generally, the navigation of the Website shall not imply the processing of your personal data beyond your IP address and navigation-related data in specific cases, with the purpose of managing and optimizing the Website and legitimated by Merlin’s legitimate interest of preserving the security and integrity of the Website.

3. Third parties to which your data can be transferred

The personal data you provide to Merlin could be communicated to the following categories of recipients:

– Third parties to which Merlin must transfer information, such as public authorities, for the purpose of complying with the requirements of said authorities and the applicable regulations, where appropriate.

– Companies that comprise the MERLIN PROPERTIES Group, with the purpose of properly manage their contractual or pre-contractual relationship, as a consequence of the centralization of administrative and IT processes that exist in the Group, as well as for commercial purposes in case you have given your consent thereto.

4. Data security

Merlin has the appropriate policies and technical and organizational measures to safeguard and protect its personal data against illegal or unauthorized access, accidental loss or destruction, damage, illegal or unauthorized use and disclosure.

We will also take any reasonable precautions to ensure that our staff and employees who have access to your data have received the appropriate training.

In any case, we inform the user that any data transfer made through the Internet is not completely safe and, as such, is carried out at their own risk. Although we will do our best to protect your personal data, Merlin cannot guarantee the safety of personal data transferred through our Website.

5. Data retention

The data retention period shall be determined depending on the length of the relationship with Merlin and the length of periods established by law. In this sense, the criteria used by Merlin to establish the retention period of your data have been determined according to the requirements established in the applicable legislation, regulations and policy guidelines and Merlin’s operational requirements relating to the correct management of the existing relationship with the different categories of stakeholders.

In this sense, your data will be retained for as long as you have a business or contractual relationship with Merlin.

Once such relationship is finished, your personal data will be eliminated at the moment in which all the necessary actions have been carried out to manage and resolve any obligation that may remain between the parties have been taken, carrying out during this period all the necessary administrative paperwork, except in those cases in which you have given us your express consent to send you business communications, in which case your data will be retained until you oppose.

Notwithstanding the foregoing, your data shall be retained while being appropriately blocked as long as responsibilities can be derived from the execution of our contractual or pre-contractual relationship, as well as for the compliance of other legal obligations under the responsibility of Merlin.

In this regard, Merlin guarantees that it will not process data unless it is necessary for the formulation, exercise, or defense of claims or when it is required to hand them over to the Public Administration, Judges and Courts during the period of limitation of your legal rights or obligations.

6. Your data protection rights

You may contact Merlin at your own discretion while exercising your rights of access, rectification, suppression, limitation and opposition, as well as the right to the portability of your data and not be subject to automated decisions, by means of a request addressed to MERLIN PROPERTIES SOCIMI, S.A. at Paseo de la Castellana, 257, 28046, Madrid (Spain), or to the following email address:, annexing a copy of your ID or identity documentation.

Likewise, you are informed that you may revoke the consents granted when you wish, by contacting MERLIN PROPERTIES SOCIMI, S.A. at the address or by the email provided above.

Finally, in the event that you want more information about your data protection rights or need to file a claim, you can contact the Spanish Agency for Data Protection, established at Calle Jorge Juan, 6, 28001, Madrid, in order to safeguard your rights.

7. Contact Merlin

If you have any questions you want to communicate to Merlin regarding the processing of your personal data, you can write to MERLIN PROPERTIES SOCIMI, S.A. at the following postal address: Paseo de la Castellana, 257, 28046, Madrid (Spain), or send an email to

© 2018 MERLIN Properties SOCIMI, S.A. All rights reserved.