Privacy Policy
Meridiana attaches the utmost importance to the protection of personal data. This Privacy Policy explains how we process the data we collect through the website www.inversionmeridiana.com, its forms and registration for our trade fairs and events, in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD) and Law 34/2002 (LSSI-CE).
1. Data controller
Meridiana is not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. You may nonetheless address any data protection matter to the email above.
- Controller: CÍRCULO INMOBILIARIO MERIDIANA, S.L.
- Tax ID (CIF): B-61885133.
- Address: C/ Marina 311, entlo. 1, 08025 Barcelona (Spain).
- Telephone: +34 935 324 023.
- Data protection email: privacidad@inversionmeridiana.com.
2. Data we process and its source
Depending on the service you use, we may process the following categories of data:
- Identification and contact data: name and surname, email address, telephone number.
- Professional data: company or organisation and job title.
- Event registration data: selected event and, where applicable, t-shirt size or other logistical data, as well as the attendance (check-in) record.
- Communication data: subject and content of the messages you send us.
- Browsing and device data: IP address, cookie identifiers, device and browser type, pages visited, approximate location derived from the IP address, and the date and time of consent to communications or cookies.
- Image data: photographs and recordings taken at in-person events.
Source of the data
The data comes directly from the user through the Website forms, by email or through participation in events. Browsing data is obtained from your device through cookies and similar technologies, subject to acceptance where required. We do not generally obtain data from third-party sources.
3. Purposes, legal bases and retention periods
We process your data for the purposes set out below. The table summarises the legal basis and retention period for each processing activity:
| Purpose | Legal basis (GDPR) | Retention |
|---|---|---|
| Handle information and contact requests | Consent of the data subject (Art. 6(1)(a)) and/or pre-contractual measures at the data subject's request (Art. 6(1)(b)) | Up to 1 year from the last contact, unless a service relationship begins |
| Manage the newsletter subscription and send commercial communications about trade fairs, events and services | Consent of the data subject (Art. 6(1)(a)), confirmed by double opt-in | Until you withdraw consent or unsubscribe; proof of consent is kept for as long as liability may arise |
| Manage registration and participation in trade fairs and events: issuing tickets and passes, reminders, access control and attendee support | Performance of a service requested by the data subject (Art. 6(1)(b)) and consent for ancillary processing (Art. 6(1)(a)) | For the duration of the event and up to 24 months afterwards; the data is then anonymised or deleted |
| Send Meridiana's commercial information when you tick the specific box in event or contact forms | Consent of the data subject (Art. 6(1)(a)) | Until you withdraw consent |
| Audience measurement and analysis of Website use to maintain and improve the service | Consent for non-technical cookies (Art. 6(1)(a) GDPR and Art. 22(2) LSSI); legitimate interest in analysis using aggregated and anonymised data (Art. 6(1)(f)) | Data associated with cookies is kept according to the periods in the Cookie Policy (maximum 24 months); aggregated and anonymised information may be kept indefinitely |
| Ensure the security of the Website and prevent fraudulent or abusive use (for example, access logs and rate limiting) | Meridiana's legitimate interest in the security of its systems (Art. 6(1)(f)) | Up to 12 months |
| Comply with legal obligations (accounting, tax and handling of rights requests) | Compliance with a legal obligation (Art. 6(1)(c)) | The legally prescribed periods: generally 6 years (Art. 30 of the Spanish Commercial Code) and 4 years for tax matters |
| Manage and respond to the exercise of your data protection rights | Compliance with a legal obligation (Art. 6(1)(c)) | Up to 3 years from resolution of the request |
3.1. About retention and the improvement of our services
As a general rule, we keep identifiable data for 1 to 2 years, depending on the processing activity, and always for as long as necessary to fulfil the purpose for which it was collected and to deal with possible liabilities. Once that period ends, the data is deleted or anonymised.
Anonymised and aggregated data — which no longer allows you to be identified — may be kept indefinitely for statistical purposes and to improve our services and activities. This use is not subject to data protection law, precisely because the information is no longer personal.
3.2. Consequences of not providing the data
The data marked as mandatory in each form is necessary for the stated purpose (for example, to manage your registration or answer your query). If you do not provide it, we will not be able to provide the corresponding service. All other data is optional.
4. Recipients and processors
To provide its services, Meridiana uses providers that process personal data on Meridiana's behalf (processors) with whom it has signed the corresponding agreements under Article 28 GDPR. The main providers are:
| Provider | Purpose | Location |
|---|---|---|
| Google LLC / Google Ireland Ltd. | Email and office tools (Google Workspace), hosting of the registration database (Firebase / Firestore), audience measurement (Google Analytics 4) and issuance of digital passes (Google Wallet) | European Union and United States |
| Intuit Inc. (Mailchimp) | Newsletter management and sending of commercial communications by email | United States |
| Vercel Inc. | Website hosting and cookieless performance and traffic metrics | United States |
| Apple Inc. | Issuance of digital passes for Apple Wallet | United States |
4.1. Event co-organisers and partners
When you register for a trade fair or event co-organised by Meridiana with third parties, and provided you have given specific consent in the registration form, your registration data may be shared with the co-organisers and official partners of that event, identified in the form itself, for the sole purpose of managing your participation. Those entities act as independent controllers; we recommend that you review their respective privacy policies. Once your data has been shared, Meridiana is not responsible for the subsequent processing carried out by those third parties.
4.2. Other recipients
Your data may be disclosed to courts, law enforcement authorities and competent public administrations where there is a legal obligation to do so. Meridiana does not sell or transfer your personal data to third parties for those third parties' own commercial purposes.
5. International data transfers
Some of the providers listed are located in the United States or may access the data from outside the European Economic Area. In those cases, the transfer is carried out with the appropriate safeguards provided for in Chapter V GDPR, in particular:
- the provider's certification under the EU-U.S. Data Privacy Framework, where applicable; and/or
- the signing of Standard Contractual Clauses approved by the European Commission, supplemented by additional measures where necessary.
You can request more information about these safeguards and obtain a copy of them by writing to privacidad@inversionmeridiana.com.
6. Automated decisions and profiling
Meridiana does not take automated decisions that produce legal effects concerning the user or similarly significantly affect them. Web analytics tools only produce aggregated usage statistics and are not used to make individual decisions.
7. Your rights
You may exercise the following rights in relation to your personal data:
- Access: find out what data we process and obtain a copy of it.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request the deletion of your data where it is no longer necessary or you withdraw your consent.
- Restriction: request that processing be restricted in the cases provided for in the GDPR.
- Objection: object to processing based on legitimate interest and, in any case, to processing for direct marketing purposes.
- Portability: receive your data in a structured, commonly used, machine-readable format, or request its transmission to another controller.
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
7.1. How to exercise them
You may exercise your rights free of charge by writing to privacidad@inversionmeridiana.com or by post to the address in section 1, stating the right you wish to exercise. We may ask you for additional information to verify your identity. We will respond within one month of receiving the request, which may be extended by a further two months for complex requests.
7.2. Complaint to the supervisory authority
If you consider that the processing of your data does not comply with the applicable rules, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, or through its electronic headquarters at www.aepd.es. We would nonetheless be grateful if you would first contact privacidad@inversionmeridiana.com so that we can try to resolve the matter.
8. Security measures
Meridiana implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption of communications (HTTPS), access control, pseudonymisation where possible and the selection of providers that offer sufficient guarantees. No system is completely secure; should a security breach occur that poses a high risk to your rights, we will notify you in accordance with the applicable rules.
9. Minors
The Website services are intended for adults. We do not knowingly collect data from children under 14. If we become aware that a minor's data has been provided without the authorisation of their parents or guardians, we will delete it.
10. Changes to this Policy
Meridiana may update this Privacy Policy to reflect regulatory developments or changes to its processing activities. The version in force is the one published on the Website, stating the date of last update. Where changes affect processing based on your consent, we will ask for new consent where necessary.
11. Contact
For any matter relating to this Privacy Policy or the processing of your data: privacidad@inversionmeridiana.com.
Legal information
