Last updated: 2026-07
In compliance with Regulation (EU) 2016/679 General Data Protection Regulation (GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we inform you about the processing of your personal data.
We collect personal data depending on the user's interaction with our services:
| Context | Data collected |
|---|---|
| Reservation at Hiru (restaurant) | Name, email, phone, date, time, number of guests, occasion, allergies, special requests |
| Reservation at Enjoy (lounge) | Name, email, phone, date, time, number of guests, area type, occasion |
| Ticket purchase / VIP booking at Outxide | Name, email, phone, payment data (processed by external gateway), date of birth (age verification) |
| Group newsletter | Email, name (optional), preferred venue |
| Contact form | Name, email, subject, message |
Only after explicit acceptance via the cookie banner may we collect browsing data through analytics and marketing cookies (see Cookie Policy):
| Purpose | Legal basis | Retention period |
|---|---|---|
| Reservation management (Hiru / Enjoy) | Performance of a contract (Art. 6.1.b GDPR) | Duration of the reservation + 1 year |
| Ticket sales and VIP bookings (Outxide) | Performance of a contract (Art. 6.1.b GDPR) | Duration of the event + 5 years (tax obligation) |
| Newsletter | Explicit consent (Art. 6.1.a GDPR) | Until consent is withdrawn |
| Web analytics (GA4) | Explicit consent (Art. 6.1.a GDPR) | 14 months (GA4 setting) |
| Marketing and remarketing (Meta Pixel, TikTok Pixel) | Explicit consent (Art. 6.1.a GDPR) | Until consent is withdrawn |
| Handling enquiries / contact | Legitimate interest (Art. 6.1.f GDPR) | Resolution of the enquiry + 1 year |
| Compliance with legal obligations | Legal obligation (Art. 6.1.c GDPR) | Applicable legal periods (tax: 5 years) |
Your personal data may be shared with the following recipients:
| Recipient | Purpose | Location |
|---|---|---|
| Vercel Inc. | Web hosting and edge functions | USA (Data Privacy Framework) |
| Google LLC (Google Analytics 4) | Web analytics (consent only) | USA (Data Privacy Framework) |
| Meta Platforms Inc. (Meta Pixel) | Marketing and remarketing (consent only) | USA (Data Privacy Framework) |
| TikTok (ByteDance) | Marketing and remarketing (consent only) | USA/Singapore (Standard Contractual Clauses) |
| Resend Inc. | Transactional email delivery | USA (Data Privacy Framework) |
| FourVenues S.L. | Ticketing and reservation system (Outxide) | Spain (EU) |
All international data transfers are carried out under the EU-US Data Privacy Framework or through Standard Contractual Clauses approved by the European Commission, ensuring a level of protection equivalent to the GDPR.
In accordance with Articles 15 to 22 of the GDPR, you have the right to:
To exercise these rights, you may send a request to [email protected], stating your full name and stating the right you wish to exercise. We will only ask you to prove your identity if there are reasonable doubts about it. We will respond within one month, extendable by two further months where justified by the complexity or number of requests (Art. 12.3 GDPR).
If you believe your data is not being processed in accordance with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es.
We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
Our services are not aimed at persons under 16 years of age. We do not intentionally collect data from persons under 16. Access to the Outxide Club microsite requires age verification (18 years) in compliance with nightlife venue regulations.
We reserve the right to amend this Privacy Policy to adapt to legislative changes or changes in our practices. Any material changes will be notified through the Website. We recommend reviewing this page periodically.