(privacy)

privacy policy

under the eu general data protection regulation (GDPR, regulation 2016/679) and spanish organic law 3/2018 (LOPDGDD). last updated: 13 november 2026.

the short version

we only collect what you give us: your email or whatsapp number for the newsletter, your application if you apply for a job, and your message if you write to us.
we never sell your data or share it for advertising.
this website has no tracking, no analytics and no cookies.
you can leave the newsletter, see your data or have it deleted at any time: write to info@insanerestaurant.com.

1. who is responsible for your data

data controller: INSANE MM10 S.L.
tax id (nif): B05742549
registered office: Calle de María de Molina 10, 28006 Madrid
contact for data protection: info@insanerestaurant.com

2. what we collect, why, and on what legal basis

whatwhylegal basishow long

newsletter: your email or whatsapp number, your first name if you give it, the date you signed up, the page you signed up from and the consent you gave. to send you the insane newsletter: the soft opening invitation, new food drops and news from insane. your consent (art. 6.1.a GDPR), given by ticking the box. you can withdraw it at any time. until you unsubscribe. then we delete your details, keeping only a record of the consent and its withdrawal while we may need to prove it.

job applications: what you send us by email (name, contact details, cv, experience, availability, right to work). to assess your application and contact you about the role. steps taken at your request before a possible employment contract (art. 6.1.b GDPR). until the selection process ends. if you agree, we keep it for up to 12 months for future openings; otherwise we delete it.

messages: what you write to us (for example as a producer), and your contact details. to answer you and, where relevant, to work together. our legitimate interest in answering the people who contact us (art. 6.1.f GDPR), or steps before a contract (art. 6.1.b). as long as the conversation needs it, then the periods the law requires for commercial records.

technical data: when you visit, our hosting provider processes your ip address and basic request data to deliver the page and protect it from attacks. to show you the website and keep it secure. our legitimate interest in running a secure website (art. 6.1.f GDPR). short-lived security logs, kept by the hosting provider under its own retention rules.

we do not make automated decisions or build profiles about you. the newsletter is for people aged 14 or over.

3. who else handles your data

we do not sell or rent your data, and we only share it with the providers we need to run insane, under contracts that oblige them to protect it:

google ireland ltd. (google workspace: email and the spreadsheet where newsletter sign-ups are stored).
cloudflare (hosting and security of this website).
whatsapp ireland ltd. (meta), only if you choose whatsapp for the newsletter.

some of these providers may process data outside the european economic area, including in the united states. where they do, the transfer is covered by the eu–us data privacy framework and/or the european commission's standard contractual clauses. we may also share data with authorities when the law requires it.

4. your rights

you can ask us at any time to:

see the data we hold about you (access);
correct it (rectification) or delete it (erasure);
limit how we use it (restriction) or object to its use (objection);
receive it in a portable format (portability);
withdraw your consent, without affecting what we did before you withdrew it.

write to info@insanerestaurant.com with "data protection" in the subject. we may ask you to confirm your identity, and we answer within one month. to leave the newsletter, you can also reply "stop" to any message.

if you think we have not handled your data properly, you can complain to the spanish data protection authority: agencia española de protección de datos, c/ jorge juan 6, 28001 madrid, aepd.es.

5. cookies

this website does not use cookies, and it has no analytics, advertising or tracking tools. the fonts and videos are served from our own website, not from third parties, and map and social links only take you to those sites when you click them.

to remember whether you picked morning, lunch or evening on the homepage, your browser stores one small setting in this tab only (session storage). it never leaves your device, it is deleted when you close the tab, and it is needed for the feature you asked for, so it does not require consent. if we ever add cookies or analytics, we will update this page and ask for your consent first.

6. security

we protect your data with reasonable technical and organisational measures: encrypted connections (https), access limited to the people who need it, and providers bound by data-protection contracts.

7. changes

if we change this policy we will update this page and the date at the top. if a change matters for how we use your data, we will tell newsletter subscribers.