EXTRA SPACE STORAGE PRIVACY POLICY

Last Updated: December 30, 2022

This privacy policy (this "Policy") describes the collection of personal information by Extra Space Storage Inc., a Maryland corporation (together with its subsidiaries, "Company," "we," "our," or "us") from users of our website at www.extraspace.com (the "Website"), as well as all related applications, widgets, software, tools, and other services provided by us and on which a link to this Policy is displayed (collectively, together with the Website, our "Services"). This Policy also describes our use and disclosure of such information. This Policy is incorporated by reference into the Company Terms of Use (available at https://www.extraspace.com/policies/terms.aspx) and subject to the provisions of the Terms of Use.

Personal Information

"Personal Information," as used in this Policy, is information that specifically identifies an individual, such as an individual’s name, address, telephone number, or e-mail address. Personal Information also includes information about an individual’s activities, such as information about his or her activity on our Services, and demographic information, such as date of birth, gender, geographic area, and preferences, when any of this information is linked to Personal Information that identifies that individual.

Personal Information does not include "aggregate" or other non-personally identifiable information. Aggregate information is information that we collect about a group or category of products, services, or users that is not personally identifiable or from which individual identities are removed. We may use and disclose aggregate information, and other non-personally identifiable information, for various purposes.

Privacy Principles

We follow the following principles in order to protect your privacy:

• We do not collect any more Personal Information about you than is necessary;

• We only use your Personal Information for the purposes we specify in this Policy, unless you agree otherwise;

• We do not keep your Personal Information if it is no longer needed;

and

• Other than as we specify in this Policy, we do not share your Personal Information with third parties.

Collection of Information

We collect Personal Information from you in the following ways. We do so to fulfill our contractual obligations (such as providing the Services) and for our legitimate business purposes (such as improving the Website and Services). We may also collect Personal Information with your consent.

Voluntarily-Provided Information

We collect Personal Information that our users provide to us in a variety of ways on our Services. These include the following:

• Text Messages. By signing up for Texts from Company, you consent to the collection, storage, and processing of such information. Data obtained through the short code program will not be shared with any third parties for their marketing reasons/purposes.

• E-mail Newsletters. We may offer e-mail newsletters from time to time on our Services. If you sign up to receive a newsletter from us, we collect your e-mail address.

• User Accounts and Profiles. Our Services may give you the ability to register for a Company account or to create and update a user profile on the applicable Service. If we offer user-account or profile functionality on the Services, we will collect the Personal Information that you provide to us in the course of registering for an account or creating or updating a user profile. This information may include, for example, name, postal address, telephone number, e-mail address, and related demographic information about you. We may indicate that some personal information is required for you to register for the account or to create the profile, while some is optional.

• Interactive Features. Our Services may contain interactive functionality that allows you to engage with other users on the Services, post comments to forums, to upload user information and other content (the "User Materials") to your account, participate in surveys, and otherwise to interact with the Services and with other users. If you use any interactive functionality on our Services that request or permit you to provide us with personal information (including, for example, any services that allow you to post User Materials on any of our Services), we collect the Personal Information that you provide to us in the course of using these interactive features.

• Correspondence. If you contact us by e-mail, using a contact form on the Services, or by mail, fax, or other means, we collect the Personal Information contained within, and associated with, your correspondence.

• Contests and Sweepstakes. We or our advertisers and other business partners may conduct or sponsor special contests, sweepstakes, and other promotions that users may enter or otherwise participate in on our Services. Certain of these promotions may be co-branded with one of our advertisers or other business partners. In these instances, the collection of your Personal Information may occur directly by the third-party partner on its website or other online service and may be shared with us. The promotion will state the privacy policy or policies governing the collection of such personal information.

Passively-Collected Information

When you visit our Services, some information is collected automatically. For example, when you access our Services, we automatically collect your browser’s Internet Protocol (IP) address, your browser type, the nature of the device from which you are visiting the Services (e.g., a personal computer or a mobile device), the identifier for any handheld or mobile device that you may be using, the website that you visited immediately prior to accessing any Web-based Services, the actions you take on our Services, and the content, features, and activities that you access and participate in on our Services. We also may collect information regarding your interaction with e-mail messages, such as whether you opened, clicked on, or forwarded a message.

We may collect this information passively using technologies such as standard server logs, cookies, and clear GIFs (also known as "Web beacons"). We use passively-collected information to administer, operate, and improve the Website and our other services and systems, to improve the effectiveness of advertising on our Services, and to provide advertisements and other content that is tailored to you. We may also use cookies on the Website in order to deliver our online advertising through third-party vendors, including Google, on a variety of sites on the internet. If we link or associate any information gathered through passive means with Personal Information, or if applicable laws require us to treat any information gathered through passive means as Personal Information, we treat the combined information as Personal Information under this Policy. Otherwise, we use and disclose information collected by passive means in aggregate form or otherwise in a non-personally identifiable form.

You may opt out of receiving cookie-based advertising from Google by visiting the Google advertising opt-out page and/or from other third party vendors by visiting the Advertising Initiative opt out page. You may also modify your cookie settings in your browser through your browser settings. Please note that if you set your browser to disable cookies you may not be able to fully access and use the Services.

Also, please be aware that third parties, such as companies displaying advertisements on the Services or sites or services provided by third parties ("Third-Party Sites") that may be linked to from the Services, may set cookies on your hard drive or use other means of passively collecting information about your use of their services, Third-Party Sites or content. We do not have access to, or control over, these third-party means of passive data collection.

Information from Other Sources

We may receive information about you, including Personal Information, from third parties, and may combine this information with other Personal Information we maintain about you. If we do so, this Policy governs any combined information that we maintain in personally-identifiable format.

Use of Personal Information

We use Personal Information to provide services and information that you request; to enhance, improve, operate, and maintain our Services, our programs, services, websites, and other systems; to prevent fraudulent use of our Services and other systems; to prevent or take action against activities that are, or may be, in violation of our Terms of Use or applicable law; to tailor advertisements, content, and other aspects of your experience on and in connection with the Services; to maintain a record of our dealings with you; for other administrative purposes; and for any other purposes that we may disclose to you at the point at which we request your Personal Information, and pursuant to your consent.

We may also use Personal Information you provide at any time during your visit to the Website to contact you regarding products, services, and offers, both from ourselves and from third parties, that we believe you may find of interest. We allow you to opt-out from receiving marketing communications from us as described in the "Choice" section below. We may send you a shopping cart reminder email and or text message if you submit your personal information online but do not finish the rental process within two hours of submitting your personal information. Once a customer has submitted the info needed to send a shopping cart reminder email and or text message, logic runs every two hours that looks for an expiration date. The expiration date means two hours have passed since the customer started the checkout process. The logic looks for customers that should be expired. The system expires those rentals and then triggers the rapid rental abandonment email or text message.

Disclosure of Personal Information

Except as described in this Policy, we will not disclose your Personal Information that we collect on the Services to third parties without your consent. We may disclose information to third parties if you consent to us doing so, as well as in the following circumstances:

Service Providers

We may disclose Personal Information to third-party service providers (e.g., payment processing and data storage and processing facilities) that assist us in our work. We limit the Personal Information provided to these service providers to that which is reasonably necessary for them to perform their functions, and we require them to agree to maintain the confidentiality of such Personal Information.

Business Transfers

Information about our users, including Personal Information, may be disclosed and otherwise transferred to an acquirer, or successor or assignee as part of any merger, acquisition, debt financing, sale of company assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which Personal Information is transferred to one or more third parties as one of our business assets.

To Protect our Interests

We also disclose Personal Information if we believe that doing so is in our interest to protect our property or other legal rights (including, but not limited to, enforcement of our agreements), or the rights or property of others, or otherwise to help protect the safety or security of our Services and other users of the Services.

Compliance with Law

We may disclose Personal Information required by law, such as to comply with a subpoena or other legal process, or to respond to a government request.

Your Rights

Choice

If you receive promotional e-mail from us, you may unsubscribe at any time by following the instructions contained within the e-mail. You may also opt-out from receiving promotional e-mail from us, and any other promotional communications that we may send to you from time to time (e.g., by postal mail) by sending your request to us by e-mail at privacy@extraspace.com or by writing to us at the address given at the end of this policy. Additionally, if we offer user account functionality on the Services, we may allow you to view and modify settings relating to the nature and frequency of promotional communications that you receive from us.

Please be aware that if you opt-out of receiving promotional e-mail from us, it may take up to ten business days for us to process your opt-out request, and you may receive promotional e-mail from us during that period. Additionally, even after you opt-out from receiving promotional messages from us, you will continue to receive administrative messages from us regarding our Services.

Access

If we offer the ability to create user accounts or profiles on our Services, you may have the ability to access and update many categories of Personal Information that you provide to us by logging in to your account and accessing your account settings. If you wish to access or amend any other Personal Information we hold about you, you may contact us at privacy@extraspace.com . We may request proof of your identity before sharing or updating such Personal Information.

If you request that we delete your Personal Information on any of our Services (via a user settings page, by e-mail, or otherwise), we will do so within a reasonable period of time, but we may need to retain some of your Personal Information in order to satisfy our legal obligations, or where we reasonably believe that we have a legitimate reason to do so.

Additionally, if you are in the European Union, you may reach out to us to request a copy of your personal information, to request a transfer of your Personal Information to a third party in certain circumstances, to withdraw any consents that you have provided for processing your Personal Information, or to request that we cease processing your Personal Information. However, please note that it may not be possible for us to cease processing all of the Personal Information we hold if we have another legal basis or requirement for maintaining such information. You also have the right to make a complaint at any time to the relevant data protection authority in your country.

California Privacy Notice

Information for California Residents

We collect Personal Data from Consumers under, and seek to comply with, the California Consumer Privacy Act of 2018 and/or the California Privacy Rights Act of 2021 (collectively, and with all amendments thereto, the “CPRA”). In addition to our general Privacy Notice available at https://www.extraspace.com/help/privacy/, this California Privacy Notice applies to California residents (“Consumers,” “you,” or “your”).

For the purposes of this California Privacy Notice, “Personal Data” means information that is linked or reasonably linkable to a particular individual or household. However, the following categories of information are not Personal Data:

• Publicly available information;

• Deidentified or aggregated data; or

• Information otherwise excluded from the scope of the CPRA.

This Privacy Notice provides the following information to California Consumers:

• Categories of Personal Data we collect;

• Purposes for which we use Personal Data;

• Categories of Personal Data we disclose to third parties;

• Categories of third parties to which we disclose Personal Data; and

• How Consumers can exercise their rights under the CPRA:

  • The rights to access, correct, or delete Personal Data;

  • The right to obtain a portable copy of Personal Data;

  • The right to limit the use of sensitive personal data in certain circumstances; and

  • The rights to opt out of the sharing of Personal Data for behavioral advertising, sales of personal data, or certain profiling.

Categories of Non-Sensitive Personal Data

The table below outlines the non-sensitive categories of Personal Data Extra Space Storage collects about Consumers and whether and how they are disclosed to third parties.

We collect Non-Sensitive Personal Data from the following sources:

• Directly from our users

• From our affiliates

• From our business partners

Categories of Sensitive Personal Data

The table below outlines the categories of Sensitive Personal Data Extra Space Storage collects about Consumers and whether they are shared with third parties. Extra Space Storage obtains affirmative consent from Consumers to process the Sensitive Personal Data, in compliance with applicable law.

We collect Sensitive Personal Data from the following sources:

• Directly from our users

• From our affiliates

• From our business partners

Use of Personal Data

We use Personal Data for the purposes described in our general Privacy Notice (see https://www.extraspace.com/help/privacy/). Personal Data may also be used or disclosed as otherwise permitted or required by applicable law.

Disclosing Personal Data

We share Personal Data with the following categories of third parties:

• Processors: We use processors to securely handle Personal Data on our behalf and only on our instructions. These companies may not use your Personal Data for their own purposes.

• Affiliates: We may share your information with our affiliates, subsidiaries, and representatives as part of providing our services.

• Business Partners: We may share relevant personal data with our business partners to provide you with exclusive offers for products and services that may interest you.

See the tables above for more details about how different categories of Personal Data are shared.

We do not sell Personal Data to anyone.

Exercising Your Personal Data Rights

California Consumers have the following rights under the CPRA:

• The rights to access, correct, or delete Personal Data;

• The right to obtain a portable copy of Personal Data;

• The right to limit the use of Sensitive Personal Data in certain circumstances; and

• The rights to opt out of the sharing of Personal Data for behavioral advertising, sales of personal data, or certain profiling.

If you are a California Consumer, you can submit a request to exercise your personal data rights under the CPRA (1) by calling: (800) 331-0876, or (2) by visiting our portal: https://www.requesteasy.com/5dfe-0377, or (3) by emailing: privacy@extraspace.com. To protect your privacy, we may need to authenticate your identity before we respond to your rights request. We will use commercially reasonable efforts to verify your identity for this purpose. Any information you provide to authenticate your identity will only be used to process your rights request. Please be aware that we do not accept or process rights requests through other means (e.g., via fax or social media).

After submitting your request online, you will receive a follow-up email, which may include a link you must click on in order to verify your identity. If you do not click on that link, we may be unable to complete your request due to lack of verification. It is important that you provide a valid email address in order for us to be able to process your request.

We will respond to your rights request within 45 days, though in certain cases we may inform you that we will need up to another 45 days to act on your request. If we suspect fraudulent or malicious activity on or from your account, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. Also note that each of the rights are subject to certain exceptions.

We reserve the right to decline to process, or charge a reasonable fee for, requests from a Consumer that are manifestly unfounded, excessive, or repetitive. We also reserve all other rights, including any right to deny any request, as may be granted us under all applicable state and/or federal law.

Limiting the Use of Sensitive Personal Data

The CPRA provides a right to limit some uses of Sensitive Personal Data. In particular, you may direct companies not to use Sensitive Personal Data except as necessary to provide goods or services you have requested. You may submit a request to limit the use of your sensitive Personal Data by submitting a rights request as described above.

Authorized Agent Requests

The CPRA allows you to designate an authorized agent to make a rights request on your behalf. Your authorized agent may submit such a request by following the same method described above. We may require verification of your authorized agent in addition to the information for verification above for Consumers and households.

Contact Us

If you have any questions or concerns regarding this California Privacy Notice, contact us at privacy@extraspace.com.

Virginia Privacy Notice

Information for Virginia Residents

We collect Personal Data from Consumers as a “Controller” under, and seek to comply with, the Virginia Consumer Data Protection Act, as amended or superseded from time to time (“VCDPA”). In addition to our Privacy Notice at https://www.extraspace.com/help/privacy/, this VCDPA Privacy Notice applies to Virginia residents (“Consumers,” “you,” or “your”).

For the purposes of this VCDPA Privacy Notice, “Personal Data” means information that is linked or reasonably linkable to a particular individual. However, the following categories of information are not Personal Data:

Publicly available information;

Deidentified data; or

Information otherwise excluded from the scope of the VCDPA.

This Privacy Notice does not apply to the information of individuals acting in a commercial or employment context, such as job applicants to Extra Space Storage (or its affiliates and/or subsidiaries) or employees or contractors of Extra Space Storage. Persons acting in those roles should review the applicable CPA Limited Privacy Notice made available by Extra Space Storage.

This Privacy Notice provides the following information to Virginia Consumers:

Categories of Personal Data we collect;

Categories of Personal Data we share with third parties;

Purposes for which we use Personal Data;

Categories of third parties with whom we share Personal Data; and

How Consumers can exercise their rights under the CPA:

The rights to access, correct, or delete Personal Data;

The right to obtain a portable copy of Personal Data; and

The right to opt out of targeted advertising, sales of personal data, or certain profiling.

Categories of Non-Sensitive Personal Data

The table below outlines the categories of Personal Data Extra Space Storage collects about Consumers and whether they are shared with third parties.

We collect Non-Sensitive Personal Data from the following sources:

• Directly from our users

• From our affiliates

• From our business partners

Categories of Sensitive Personal Data

We do not process any categories of Sensitive Personal Data

Use of Personal Data

We use Personal Data for the purposes disclosed to Consumers at the time of collection, as described in our general Privacy Notice (see https://www.extraspace.com/help/privacy/). Personal Data may also be used or disclosed as otherwise permitted or required by applicable law.

Sharing Personal Data

We share Personal Data with the following categories of third parties:

• Processors: We use processors to securely handle Personal Data on our behalf and only on our instructions; these companies may not use your Personal Data for their own purposes.

• Affiliates: We may share your information with our affiliates, subsidiaries, and representatives as part of providing our services.

• Business Partners: We may share relevant personal data with our business partners to provide you with exclusive offers for products and services that may interest you.

See the table above for more details about how different categories of Personal Data are shared.

We do not sell Personal Data to anyone.

Exercising Your Personal Data Rights

Virginia Consumers have the following rights under the VCDPA:

• The rights to access, correct, or delete Personal Data;

• The right to obtain a portable copy of Personal Data; and

• The right to opt out of targeted advertising, sales of personal data, or profiling.

If you are a Virginia Consumer, you can submit a request to exercise your personal data rights under the VCDPA via (1) visiting our online portal at: https://www.requesteasy.com/5dfe-0377, or contacting our privacy hotline at (800) 331-0876, or (3) emailing us at privacy@extraspace.com. You may submit a rights request free of charge up to twice per year. To protect your privacy, you must authenticate your identity before we respond to your rights request. We will use commercially reasonable efforts to verify your identity for this purpose. Any information you provide to authenticate your identity will only be used to process your rights request. If you have a password-protected online account with us, we may require you to submit your rights request securely through that account.

After submitting your request online, you will receive a follow-up email, which may include a link you must click on in order to verify your identity. If you do not click on that link, we may be unable to complete your request due to lack of verification. It is important that you provide a valid email address in order for us to be able to process your request.

We will respond to your rights request within 45 days, though in certain cases we may inform you that we will need up to another 45 days to act on your request. If we suspect fraudulent or malicious activity on or from your account, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. If you believe our response to your rights request is insufficient, you can appeal our decision by contacting Privacy Contact at privacy@extraspace.com and we will inform you of our final decision within 45 days.

We reserve the right to decline to process, or charge a reasonable fee for, requests from a Consumer that are manifestly unfounded, excessive, or repetitive. We also reserve all other rights, including any right to deny any request, as may be granted us under all applicable state and/or federal law.

Targeted Advertising

The VCDPA defines “targeted advertising” as displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict such consumer's preferences or interests. We use Personal Data for targeted advertising. You can opt out of the use of your Personal Data for targeted advertising by submitting a rights request as described above. Please be aware that we do not accept or process opt-out requests through other means (e.g., via fax or social media).

Contact Us

If you have any questions or concerns regarding this VCDPA Privacy Notice, contact us at privacy@extraspace.com.