Extra Space Storage U.S. Privacy Statement

This Privacy Statement (the “Privacy Statement” or “Policy”) explains how Extra Space Storage, Inc. (“Extra Space Storage”, “we” or “our”) and our affiliated companies and subsidiaries (unless they have published their own privacy statement), collect, process, use, protect, and share your personal information ("Information" or “Personal Information”), as well as your privacy rights under certain privacy laws and how you can exercise those rights.

Extra Space may collect information from users of our website at www.extraspace.com (the “Website”), as well as any related applications, widgets, software, tools, and other services provided by us and on which a link to this Policy is displayed (collectively, together with the Website, our “Services”). This Policy is incorporated by reference into the Company Terms of Use (available at https://www.extraspace.com/policies/terms/) and subject to the provisions of the Terms of Use.

We adhere to the following principles in order to protect your privacy:

• We do not collect any more Personal Information about you than is necessary;

• We only use your Personal Information for the purposes we specify in this Policy, unless you agree otherwise;

• We do not keep your Personal Information if it is no longer needed to fulfill the business purpose underlying the nature of the Extra Space’s relation with you as a consumer or does not serve Extra Space’s legitimate business purpose; and

• Other than as we specify in this Policy, we do not share, sell, or distribute your Personal Information to third parties.

Overview of Our Privacy Practices

We have highlighted key details about our privacy practices in the table below:

In addition to the summary provided above, please see the following for the full language of our Privacy Policy.

Privacy Principles

• We follow the following principles in order to protect your privacy:

• We do not collect any more Personal Information about you than is necessary;

• We only use your Personal Information for the purposes we specify in this Policy, unless you agree otherwise;

• We do not keep your Personal Information if it is no longer needed; and

• Other than as we specify in this Policy, we do not share your Personal Information with third parties.

Information We Collect About You

We collect Personal Information from you through (I) voluntarily-provided, (II) passively-collected, or (III) third-party-forwarded methods.

"Personal Information," as used in this Policy, is information that specifically identifies an individual, such as an individual’s name, address, telephone number, or e-mail address.

Personal Information also includes information about an individual’s activities, such as information about his or her activity on our Services, and demographic information, such as date of birth, gender, geographic area, and preferences, when any of this information is linked to Personal Information that identifies that individual.

Personal Information does not include "aggregate" or other non-personally identifiable information. Aggregate information is information that we collect about a group or category of products, services, or users that is not personally identifiable or from which individual identities are removed.

When you visit our Services, some information is collected automatically. For example, when you access our Services, we automatically collect your browser’s Internet Protocol (IP) address, your browser type, the nature of the device from which you are visiting the Services (e.g., a personal computer or a mobile device), the identifier for any handheld or mobile device that you may be using, the website that you visited immediately prior to accessing any Web-based Services, the actions you take on our Services, and the content, features, and activities that you access and participate in on our Services. We also may collect information regarding your interaction with e-mail messages, such as whether you opened, clicked on, or forwarded a message.

We also may collect information regarding your interaction with email messages, such as whether you opened, clicked on, or forwarded a message.

How We Collect Information

We collect Personal Information from you through (I) voluntarily-provided, (II) passively-collected, or (III) third-party-forwarded methods. We do so to fulfill our contractual obligations (such as providing the Services) and for our legitimate business purposes (such as improving the Website and Services). We may also collect Personal Information with your consent.

Voluntarily-Provided Information

We collect Personal Information that our users provide to us in a variety of ways on our Services. These include the following:

• Text Messages. By signing up for Texts from Company, you consent to the collection, storage, and processing of such information. Data obtained through the short code program will not be shared with any third parties for their marketing reasons/purposes.

• E-mail Newsletters. We may offer e-mail newsletters from time to time on our Services. If you sign up to receive a newsletter from us, we collect your e-mail address.

• User Accounts and Profiles. Our Services may give you the ability to register for a Company account or to create and update a user profile on the applicable Service. If we offer user-account or profile functionality on the Services, we will collect the Personal Information that you provide to us in the course of registering for an account or creating or updating a user profile. This information may include, for example, name, postal address, telephone number, e-mail address, and related demographic information about you. We may indicate that some personal information is required for you to register for the account or to create the profile, while some Is optional.

• Interactive Features. Our Services may contain interactive functionality that allows you to engage with other users on the Services, post comments to forums, to upload user information and other content (the “User Materials”) to your account, participate in surveys, and otherwise to interact with the Services and with other users. If you use any interactive functionality on our Services that request or permit you to provide us with personal information (including, for example, any services that allow you to post User Materials on any of our Services), we collect the Personal Information that you provide to us in the course of using these interactive features.

• Correspondence. If you contact us by e-mail, using a contact form on the Services, or by mail, fax, or other means, we collect the Personal Information contained within, and associated with, your correspondence.

• Contests and Sweepstakes. We or our advertisers and other business partners may conduct or sponsor special contests, sweepstakes, and other promotions that users may enter or otherwise participate in on our Services. Certain of these promotions may be co-branded with one of our advertisers or other business partners. In these instances, the collection of your Personal Information may occur directly by the third-party partner on its website or other online service and may be shared with us. The promotion will state the privacy policy or policies governing the collection of such personal information.

Passively-Collected Information

When you visit our Services, some information is collected automatically. For example, when you access our Services, we automatically collect your browser’s Internet Protocol (IP) address, your browser type, the nature of the device from which you are visiting the Services (e.g., a personal computer or a mobile device), the identifier for any handheld or mobile device that you may be using, the website that you visited immediately prior to accessing any Web-based Services, the actions you take on our Services, and the content, features, and activities that you access and participate in on our Services. We also may collect information regarding your interaction with e-mail messages, such as whether you opened, clicked on, or forwarded a message.

We may use passively-collected information like standard server logs, cookies, pixels, and clear GIFs (also known as “Web beacons”) to administer, operate, and improve the Website and our other services and systems, to improve the effectiveness of advertising on our Services, and to provide advertisements and other content that is tailored to you. We may also use cookies on the Website in order to deliver our online advertising through third-party vendors, including Google, on a variety of sites on the internet. If we link or associate any information gathered through passive means with Personal Information, or if applicable laws require us to treat any information gathered through passive means as Personal Information, we treat the combined information as Personal Information under this Policy. Otherwise, we use and disclose information collected by passive means in aggregate form or otherwise in a non-personally identifiable form.

Third-Party-Forwarded Information and Information from Other Sources

We may receive information about you, including Personal Information, from third parties, and may combine this information with other Personal Information we maintain about you. If we do so, this Policy governs any combined information that we maintain in personally-identifiable format.

We protect information obtained from third parties according to the privacy practices as described in this Privacy Statement. These third-party sources can change, and may include:

• Service providers from which we obtain information you provide to them;

• Data brokers from which we purchase demographic data to supplement the information we collected about you.

• Communication services, including email providers and social networks, when you give permission to access your information on such third-party services or networks.

• Partners with which we offer co-branded products or services, or engage in joint-marketing activities.

• Publicly available sources such as open government databases.

Why We Collect Information

We collect Personal Information to fulfill our contractual obligations (such as providing the Services) and for our legitimate business purposes (such as improving the Website and Services). We may also collect additional Personal Information with your consent to further assist Extra Space in improving its business operations.

Additionally, we use passively-collected information to administer, operate, and improve the Website and our other services and systems, to improve the effectiveness of advertising on our Services, and to provide advertisements and other content that is tailored to you.

We may also use cookies on the Website in order to deliver our online advertising through third-party vendors, including Google, on a variety of sites on the internet.

How We Use and Share Your Information

USE:

We use Personal Information to provide services and information that you request; to enhance, improve, operate, and maintain our Services, our programs, services, websites, and other systems; to prevent fraudulent use of our Services and other systems; to prevent or take action against activities that are, or may be, in violation of our Terms of Use or applicable law; to tailor advertisements, content, and other aspects of your experience on and in connection with the Services; to maintain a record of our dealings with you; for other administrative purposes; and for any other purposes that we may disclose to you at the point at which we request your Personal Information, and pursuant to your consent.

We may also use Personal Information you provide at any time during your visit to the Website to contact you regarding products, services, and offers, both from ourselves and from third parties, that we believe you may find of interest. We allow you to opt-out from receiving marketing communications from us as described in the "Choice" section below. We may send you a shopping cart reminder email and or text message if you submit your personal information online but do not finish the rental process within two hours of submitting your personal information. Once a customer has submitted the info needed to send a shopping cart reminder email and or text message, logic runs every two hours that looks for an expiration date. The expiration date means two hours have passed since the customer started the checkout process. The logic looks for customers that should be expired. The system expires those rentals and then triggers the rapid rental abandonment email or text message.

If we link or associate any information gathered through passive means with Personal Information, or if applicable laws require us to treat any information gathered through passive means as Personal Information, we treat the combined information as Personal Information under this Policy. Otherwise, we use and disclose information collected by passive means in aggregate form or otherwise in a non-personally identifiable form.

If we receive information about you, including Personal Information, from third parties, and combine this information with other Personal Information we maintain about you, this Policy governs any combined information that we maintain in personally-identifiable format.

We may use your personal information for purposes such as:

• Providing you with our products and services and enhancing the quality of your customer support;

• Tailoring your customer experience. For example, by making product or service recommendations to you;

• Improving our products and services;

• Complying with applicable laws; and

• Improving the safety and security of our website, products and services. For example, by detecting, preventing, investigating and responding to risks that could harm you or Extra Space.

SHARE:

While Extra Space does not sell your Personal Information for financial benefit, some states define the “sell” of Personal Information as disclosing or sharing your Personal Information to a third party. You may learn more about your rights as a resident of a certain state by referring to the relevant state sections provided in this Policy. Accordingly, in addition to providing you with the below summary of Extra Space’s potential share and/or disclosure of your Personal Information, Extra Space provides a Notice of Right to Opt-out of Sale/Sharing and maintains a portal through which you may exercise your right to opt-out here.

We may share your personal information with our affiliated companies and Business Partners to perform functions and fulfill purposes necessary to our business relationship with you as a consumer, such as assisting us with completing any transactions, sharing information about our products and services, or offering you our latest deals and promotions. Additionally, we may share your personal information with Service Providers, Third-Party Advertising and Analytics provides, during Business Transfers, to Protect our Interests, and to Comply with any applicable Laws.

Except as described in this Policy, we will not disclose your Personal Information that we collect on the Services to third parties without your consent. Otherwise, we may disclose information to third parties if you consent to us doing so, as well as in the following circumstances:

• Service Providers: We may disclose Personal Information to third-party service providers (e.g., payment processing and data storage and processing facilities) that assist us in our work. We limit the Personal Information provided to these service providers to that which is reasonably necessary for them to perform their functions, and we require them to agree to maintain the confidentiality of such Personal Information.

• Third-Party Advertising and Analytics: We may disclose your Personal Information, including certain identifiers, like cookies and IP addresses, or hashed email addresses, with third parties to improve Extra Space’s Services through internal analytics and usage statistics and provide you with relevant advertising on third-party sites and applications. To learn more about how we use your information for personalization and tracking, please visit Our Use of Cookies and Other Technologies.

• Business Transfers: We may disclose Personal Information and otherwise transfer the Personal Information to an acquirer, or successor or assignee as part of any merger, acquisition, debt financing, sale of company assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which Personal Information is transferred to one or more third parties as one of our business assets.

• To Protect our Interests: We also disclose Personal Information if we believe that doing so is in our interest to protect our property or other legal rights (including, but not limited to, enforcement of our agreements), or the rights or property of others, or otherwise to help protect the safety or security of our Services and other users of the Services.

• Compliance with Law: We may disclose Personal Information as required by law, including but not limited to for the purposes of complying with a subpoena or other legal process or responding to a government request.

Extra Space does not use or disclose sensitive personal information for purposes other than those expressly permitted by law, including Section 7027 of the CPPA regulations.

Our Use of Cookies and Other Technologies

When you interact with Extra Space’s Services, we may use cookies and similar technologies (pixels, tags, etc.) owned by us or a third-party to help us tailor your experience, better understand your preferences, tell us which parts of our websites you have visited, facilitate and measure the effectiveness of our interest-based advertisements and web searches. We also use web beacons to help deliver cookies and gather data about our site performance and user journeys to and on our website.

We may also use cookies on the Website in order to deliver our online advertising through third-party vendors, including Google, on a variety of sites on the internet.

You may opt out of receiving cookie-based advertising from Google by visiting the Google advertising opt-out page and/or from other third party vendors by visiting the Advertising Initiative opt out page. You may also modify your cookie settings in your browser through your browser settings. Please note that if you set your browser to disable cookies you may not be able to fully access and use the Services.

Also, please be aware that third parties, such as companies displaying advertisements on the Services or sites or services provided by third parties (“Third-Party Sites”) that may be linked to from the Services, may set cookies on your hard drive or use other means of passively collecting information about your use of their services, Third-Party Sites or content. We do not have access to, or control over, these third-party means of passive data collection.

Please consult Extra Space’s “Cookie Notice” for more information on our use of, storage, and your rights concerning cookies.

Your Consumer Privacy Rights

Consumer privacy rights vary depending on where you reside, but Extra Space Storage will make reasonable efforts to honor your request even if you are a resident of a country or state that does not require us to do so under applicable law. You may have the following consumer privacy rights under applicable state laws:

• Right to Know: you may have the right to request information about the personal information we have collected about you and for what purpose, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom the business discloses personal information, and the specific pieces of personal information the business has collected about the consumer.

• Right to Access: you may have the right to request information about how we process your personal information and to obtain a copy of that personal information.

• Right to Portability: you may have the right to receive your personal information, in a structured, commonly used, and machine-readable format and to have that information transmitted to another organization in certain circumstances.

• Right to Correct: you may have the right to correct inaccurate personal information that we maintain about you.

• Right to Deletion: you may have the right to request the deletion of your personal information that we have collected from you, subject to certain exceptions allowed under applicable laws.

• Right to Be Free from Discrimination: Extra Space Storage will not discriminate against you for exercising your consumer privacy rights, including but not limited to an employee’s, applicant’s, or independent contractor’s right to not be retaliated against for exercising their privacy rights.

• Right to Opt-out of Sharing: you may have the right to opt out of Extra Space Storage sharing your personal information with third parties for some purposes, including sharing that may be defined as a sale under certain laws.

• Right to Make Choices About Email Marketing: you may have the right to make choices about receiving email marketing.

Please keep in mind that we may not be able to honor all requests, such as if the information is required to process your payments or returns, to fulfill your order, or to comply with tax, audit, or other regulatory requirements. Please refer to Submitting Access or Deletion Requests to learn how to submit a request.

Choice

If you receive promotional e-mail from us, you may unsubscribe at any time by following the instructions contained within the e-mail. You may also opt-out from receiving promotional e-mail from us, and any other promotional communications that we may send to you from time to time (e.g., by postal mail) by sending your request to us by e-mail at privacy@extraspace.com or by submitting a request via our Request portal here. Additionally, if we offer user account functionality on the Services, we may allow you to view and modify settings relating to the nature and frequency of promotional communications that you receive from us.

Please be aware that if you opt-out of receiving promotional e-mail from us, it may take up to ten business days for us to process your opt-out request, and you may receive promotional e-mail from us during that period. Additionally, even after you opt-out from receiving promotional messages from us, you will continue to receive administrative messages from us regarding our Services.

Access

If we offer the ability to create user accounts or profiles on our Services, you may have the ability to access and update many categories of Personal Information that you provide to us by logging in to your account and accessing your account settings. If you wish to access or amend any other Personal Information we hold about you, you may contact us at privacy@extraspace.com or submit a request at our Request portal here. We may request proof of your identity before sharing or updating such Personal Information.

If you request that we delete your Personal Information on any of our Services (via a user settings page, by e-mail, or otherwise), we will do so within a reasonable period of time, but we may need to retain some of your Personal Information in order to satisfy our legal obligations, or where we reasonably believe that we have a legitimate reason to do so.

California residents can also turn on the Global Privacy Control (GPC) to opt out of the “sale” or sharing of your personal information for each participating browser system that you use or can click on the “Do Not Sell My Personal Information” link at the bottom of our webpage for other options. Learn more at the Global Privacy Control website. Please keep in mind that these opt-out tools are limited to the device and web browser you are using because they work off your device ID or browser ID. If you use another device or browser, you will need to opt-out on each device and browser. If you block or clear cookies from your browser, it may remove the opt-out settings, requiring you to opt-out again.

Submitting Consumer Privacy Right Requests

If you would like to access a copy of, or request deletion of the personal information we may maintain about you, or to exercise any other privacy right as set out above, you may do so by:

1. Sending a written request via email to Privacy@extraspace.com; or

2. Visiting our request portal at https://www.requesteasy.com/5dfe-0377.

Extra Space Storage requires the following information to authenticate you no matter which method you use to make your request:

1. First name

2. Last name

3. Email address

Additionally, Extra Space may require additional information to verify your identity before completing your request. If Extra Space requires such additional information, you will receive an email from Extra Space at our privacy email (privacy@extraspace.com). You may be asked to provide more information, like confirmation of email address, first and last name, and other identifying information.

If you are an agent acting on behalf of someone else, please note that in addition to the information noted above, we will also ask for a copy of your Power of Attorney.

Please be aware that your request does not guarantee complete access or comprehensive removal as the law may not permit or require removal in certain circumstances.

California Residents

The California Consumer Privacy Act (“CCPA”) grants California residents certain rights regarding the personal information that businesses have about them. These include (a) the right to know about personal information categories the business collected about you in the prior 12 months, the source of such information, the purpose for collecting the information and the specific information collected about you (this information is available in our Supplementary Disclosures; (b) the right to request access or deletion of your personal information, (c) the right to request correction of your personal information as well as (e) the right to direct a business to stop selling your personal information. While Extra Space Storage does not sell personal information to third parties for monetary consideration, the CCPA broadly defined “sale” and the certain data collected on our sites by third parties for interest-based advertising purposes may have been considered a “sale” under the CCPA, and would be considered sharing under the California Privacy Rights Act (“CPRA”). Extra Space Storage may be categorized as a “Service Provider” under the CCPA in certain cases, such as in providing products and services to our customers. In other cases, Extra Space Storage may be categorized as a business, such as in our day to day operations. The categories of third parties to whom personal information is disclosed include advertisers and marketing partners and data analytics providers. The categories of information we may share with such parties may include device information and identifiers, such as IP address, and unique advertising identifiers and cookies; usage information, such as browsing history; location information, such as city; and inference data. To opt out, please click the “Do Not Sell or Share My Personal Information” button at the bottom of our webpage, or you or an authorized agent acting on your behalf (subject to our verification of the identity and legal authority associated with such request as required by law) can also send your request to us at Privacy@extraspace.com or access our request portal at or access the request portal here.

California residents can also turn on the Global Privacy Control (GPC) to opt out of the “sale” or sharing of your personal information for each participating browser system that you use. Learn more at the Global Privacy Control website.

Information for California Residents

We collect Personal Data from Consumers under, and seek to comply with, the California Consumer Privacy Act of 2018 and/or the California Privacy Rights Act of 2021 (collectively, and with all amendments thereto, the “CPRA”). In addition to our general Privacy Notice available at https://www.extraspace.com/help/privacy/, this California Privacy Notice applies to California residents (“Consumers,” “you,” or “your”).

For the purposes of this California Privacy Notice, “Personal Data” means information that is linked or reasonably linkable to a particular individual or household. However, the following categories of information are not Personal Data:

• Publicly available information;

• Deidentified or aggregated data; or

• Information otherwise excluded from the scope of the CPRA.

This Privacy Notice provides the following information to California Consumers:

Categories of Personal Data we collect;

• Purposes for which we use Personal Data;

• Categories of Personal Data we disclose to third parties;

• Categories of third parties to which we disclose Personal Data; and

• How Consumers can exercise their rights under the CPRA:

  • The rights to access, correct, or delete Personal Data;

  • The right to obtain a portable copy of Personal Data;

  • The right to limit the use of sensitive personal data in certain circumstances; and

  • The rights to opt out of the sharing of Personal Data for behavioral advertising, sales of personal data, or certain profiling.

Categories of Non-Sensitive Personal Data

The table below outlines the non-sensitive categories of Personal Data Extra Space Storage collects about Consumers and whether and how they are disclosed to third parties.

We collect Non-Sensitive Personal Data from the following sources:

• Directly from our users

• From our affiliates

• From our business partners

Categories of Sensitive Personal Data

The table below outlines the categories of Sensitive Personal Data Extra Space Storage collects about Consumers and whether they are shared with third parties. Extra Space Storage obtains affirmative consent from Consumers to process the Sensitive Personal Data, in compliance with applicable law.

We collect Sensitive Personal Data from the following sources:

• Directly from our users

• From our affiliates

• From our business partners

Use of Personal Data

We use Personal Data for the purposes described in our general Privacy Notice (see https://www.extraspace.com/help/privacy/). Personal Data may also be used or disclosed as otherwise permitted or required by applicable law.

Disclosing Personal Data

We share Personal Data with the following categories of third parties:

• Third-Parties: We use some limited third parties to ensure the function of our website, provide interest-based advertising, and provide you with better resources during the use of our Services, like showing Services opportunities relevant to you.

• Processors: We use processors to securely handle Personal Data on our behalf and only on our instructions. These companies may not use your Personal Data for their own purposes.

• Affiliates: We may share your information with our affiliates, subsidiaries, and representatives as part of providing our services.

• Business Partners: We may share relevant personal data with our business partners to provide you with exclusive offers for products and services that may interest you.

See the tables above for more details about how different categories of Personal Data are shared.

We do not sell Sensitive Personal Data to anyone and do not use Sensitive Personal Data more than reasonably necessary to deliver our Services to you.

Exercising Your Personal Data Rights

California Consumers have the following rights under the CPRA:

• The rights to access, correct, or delete Personal Data;

• The right to obtain a portable copy of Personal Data;

• The right to limit the use of Sensitive Personal Data in certain circumstances; and

• The rights to opt out of the sharing of Personal Data for behavioral advertising, sales of personal data, or certain profiling.

If you are a California Consumer, you can submit a request to exercise your personal data rights under the CPRA (1) by calling: (800) 331-0876, or (2) by visiting our portal: https://www.requesteasy.com/5dfe-0377, or (3) by emailing: privacy@extraspace.com. To protect your privacy, we may need to authenticate your identity before we respond to your rights request. We will use commercially reasonable efforts to verify your identity for this purpose. Any information you provide to authenticate your identity will only be used to process your rights request. Please be aware that we do not accept or process rights requests through other means (e.g., via fax or social media).

After submitting your request online, you will receive a follow-up email, which may include a link you must click on in order to verify your identity. If you do not click on that link, we may be unable to complete your request due to lack of verification. It is important that you provide a valid email address in order for us to be able to process your request.

We will respond to your rights request within 45 days, though in certain cases we may inform you that we will need up to another 45 days to act on your request. If we suspect fraudulent or malicious activity on or from your account, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. Also note that each of the rights are subject to certain exceptions.

We reserve the right to decline to process, or charge a reasonable fee for, requests from a Consumer that are manifestly unfounded, excessive, or repetitive. We also reserve all other rights, including any right to deny any request, as may be granted us under all applicable state and/or federal law.

Limiting the Use of Sensitive Personal Data

The CPRA provides a right to limit some uses of Sensitive Personal Data. In particular, you may direct companies not to use Sensitive Personal Data except as necessary to provide goods or services you have requested. You may submit a request to limit the use of your sensitive Personal Data by submitting a rights request as described above.

Authorized Agent Requests

The CPRA allows you to designate an authorized agent to make a rights request on your behalf. Your authorized agent may submit such a request by following the same method described above. We may require verification of your authorized agent in addition to the information for verification above for Consumers and households.

Contact Us

If you have any questions or concerns regarding this California Privacy Notice, contact us at privacy@extraspace.com.

Colorado Consumers

The Colorado Privacy Act (“CPA”) grants consumers that are residents of the State of Colorado certain rights provided by C.R.S. § 6-1-1-1306 regarding the personal information businesses have about them, subject to certain limitations. These rights are listed in more detail below, and at this time do not extend to individuals acting in commercial or employment contexts.

• The Right of Access: Consumers have the right to confirm the processing of their personal data and to access their personal information, and obtain a copy of it in a readily useable format (to the extent “technically feasible”);

• The Right to Correct Inaccuracies: Consumers may request that inaccuracies in their personal information are corrected, considering the nature of the data and the business’ purposes in using it;

• The Right to Deletion: Consumers have the right to delete personal information concerning the consumer;

• The Right to Data Portability: Consumers have the right to obtain a copy of their data from the controller (Extra Space Storage) in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity up to twice per year;

• The Right to Opt-Out: Consumers have the right to opt out of several different uses of their personal information, including: targeted advertising, sale of their personal information, and profiling for the purpose of making decisions with legal or similarly significant effects concerning the consumers. To opt out of targeted advertising or the sale of your personal information, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal at https://www.requesteasy.com/5dfe-0377.

Extra Space does not sell or share sensitive data as defined in the CPA, or collect sensitive data in ways that may otherwise violate the CPA.

The categories of third parties to whom personal information is shared can be reviewed at "How We Use And Share Your Information". The categories of information we may share with such parties may be reviewed at "Information We Collect About You". To opt out, please click the “Do Not Sell or Share My Personal Information” button at the bottom of our webpage, or you or an authorized agent acting on your behalf (subject to our verification of the identity and legal authority associated with such request as required by law) can also send your request to us at Privacy@extraspace.com.

• Colorado residents can also turn on the Global Privacy Control (GPC) to opt out of the “sale” or sharing of your personal information for each participating browser system that you use. Learn more at the Global Privacy Control website.

• A Colorado resident may also designate another person to act on their behalf as their authorized agent with respect to these rights. We will seek to authenticate that someone claiming to be an authorized agent on behalf of another is in fact an authorized agent for that individual. While this may vary on a case by case basis, some ways we may seek to authenticate an authorized agent is by requesting a power of attorney or other legal document that reflects this relationship.

• Colorado residents may appeal Extra Space Storage’s response to their requests by sending an email to Privacy@extraspace.com or accessing the request portal at https://www.requesteasy.com/5dfe-0377.

Connecticut Consumers

The Connecticut Data Privacy Act or (“CTDPA”) provides Connecticut residents with certain rights. These rights are listed in more detail below, and a consumer may exercise their rights by contacting us at Privacy@extraspace.com or accessing the request portal here. At this time do not extend to individuals acting in commercial or employment contexts.

• Right to Access: Consumers have right to access personal data that a controller has collected about them.

• Right to Correct: Consumers have the right to correct inaccuracies in their personal data.

• Right to Delete: Consumers have the right to delete their personal data, including personal data that a controller collected through third parties.

• Right to Data Portability: Consumers have the right to obtain a copy of their personal data in a portable and readily usable format that allows them to transfer the data to another controller with ease.

• Right to Opt-out: Consumers have the right to opt-out of:

  • the sale of their personal data;

  • the processing of personal data for the purposes of targeted advertising; and

  • profiling that may have a legal or other significant impact.

A Connecticut resident may also designate another person to act on their behalf with respect to these rights.

• Extra Space does not sell or share sensitive data as defined in the CTDPA, or collect sensitive data in ways that may otherwise violate the CTDPA.

• Please note that Extra Space Storage does not sell your personal information as defined by the CTDPA. To opt out of targeted advertising online, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. For other opt-outs or requests, please contact us at Privacy@extraspace.com.

The categories of third parties to whom personal information is shared can be reviewed at "How We Use And Share Your Information". The categories of information we may share with such parties may be reviewed at "Information We Collect About You". Connecticut residents can also turn on the Global Privacy Control (GPC) to opt out of the “sale” or sharing of your personal information for each participating browser system that you use. Learn more at the Global Privacy Control website.

Delaware Consumers

The Delaware Personal Data Privacy Act (“DPDPA”) grants consumers that are residents of the State of Delaware certain rights regarding the personal information businesses have about them, subject to certain limitations. These rights are listed in more detail below, and at this time do not extend to individuals acting in commercial or employment contexts.

• The Right of Access: Consumers have the right to confirm the processing of their personal data and to access their personal information, and obtain a copy of it in a readily useable format (to the extent “technically feasible”);

• The Right to Deletion: Consumers have the right to delete personal information concerning the consumer;

• The Right to Data Portability: Consumers have the right to obtain a copy of their data from the controller (Extra Space Storage) in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity up to once per year;

• The Right to Obtain: Consumers have the right to obtain categories of third parties to whom the Consumer’s Personal Information was disclosed.

• The Right to Opt-Out: Consumers have the right to opt out of several different uses of their personal information, including: targeted advertising and the sale of their personal information To opt out of targeted advertising or the sale of your personal information, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal here.

The categories of third parties to whom personal information is shared can be reviewed at "How We Use And Share Your Information". The categories of information we may share with such parties may be reviewed at "Information We Collect About You".

• A Delaware resident is entitled to one data request per 12-month period, and requests in excess of that time period may incur a reasonable fee.

• Extra Space does not sell or share sensitive data as defined in the DCPA, or collect sensitive data in ways that may otherwise violate the DCPA.

• A Delaware resident may also designate another person to act on their behalf as their authorized agent with respect to these rights. We will seek to authenticate that someone claiming to be an authorized agent on behalf of another is in fact an authorized agent for that individual. While this may vary on a case-by-case basis, some ways we may seek to authenticate an authorized agent is by requesting a power of attorney or other legal document that reflects this relationship.

Iowa Consumers

The Iowa Consumer Data Privacy Act (“ICDPA”) grants consumers that are residents of the State of Iowa certain rights regarding the personal information businesses have about them, subject to certain limitations. These rights are listed in more detail below, and a consumer may exercise their rights by contacting us at Privacy@extraspace.com or accessing the request portal here. At this time do not extend to individuals acting in commercial or employment contexts.

• The Right of Access: Consumers have the right to confirm the processing of their personal data and to access their personal information, and obtain a copy of it in a readily useable format (to the extent “technically feasible”);

• The Right to Deletion: Consumers have the right to delete personal information concerning the consumer;

• The Right to Data Portability: Consumers have the right to obtain a copy of their data from the controller (Extra Space Storage) in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity up to once per year;

• The Right to Opt-Out: Consumers have the right to opt out of several different uses of their personal information, including: targeted advertising and the sale of their personal information. Please understand that Extra Space does not sell your Personal Information as defined under the ICDPA. To opt out of targeted advertising please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal here.

The categories of third parties to whom personal information is shared can be reviewed at "How We Use And Share Your Information". The categories of information we may share with such parties may be reviewed at "Information We Collect About You".

• An Iowa resident is entitled to two data requests per 12-month period, and requests in excess of that time period may incur a reasonable fee.

• Extra Space does not sell or share sensitive data as defined in the ICDPA, or collect sensitive data in ways that may otherwise violate the ICDPA.

• An Iowa resident may also designate another person to act on their behalf as their authorized agent with respect to these rights. We will seek to authenticate that someone claiming to be an authorized agent on behalf of another is in fact an authorized agent for that individual. While this may vary on a case-by-case basis, some ways we may seek to authenticate an authorized agent is by requesting a power of attorney or other legal document that reflects this relationship.

Montana Consumers

The Montana Consumer Data Privacy Act (“MCDPA”) grants consumers that are residents of the State of Montana certain rights regarding the personal information businesses have about them, subject to certain limitations. These rights are listed in more detail below, and at this time do not extend to individuals acting in commercial or employment contexts.

• The Right of Access: Consumers have the right to confirm the processing of their personal data and to access their personal information, and obtain a copy of it in a readily useable format (to the extent “technically feasible”);

• The Right to Deletion: Consumers have the right to delete personal information concerning the consumer;

• The Right to Data Portability: Consumers have the right to obtain a copy of their data from the controller (Extra Space Storage) in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity up to once per year;

• The Right to Opt-Out: Consumers have the right to opt out of several different uses of their personal information, including: targeted advertising and the sale of their personal information. To opt out of targeted advertising online or the sale of your personal information, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal at https://www.requesteasy.com/5dfe-0377.

The categories of third parties to whom personal information is shared can be reviewed at "How We Use And Share Your Information". The categories of information we may share with such parties may be reviewed at "Information We Collect About You".

• Extra Space does not sell or share sensitive data as defined in the MCDPA, or collect sensitive data in ways that may otherwise violate the MCDPA.

• A Montana resident is entitled to one data request per 12-month period, and requests in excess of that time period may incur a reasonable fee.

• A Montana resident may also designate another person to act on their behalf as their authorized agent with respect to these rights. We will seek to authenticate that someone claiming to be an authorized agent on behalf of another is in fact an authorized agent for that individual. While this may vary on a case-by-case basis, some ways we may seek to authenticate an authorized agent is by requesting a power of attorney or other legal document that reflects this relationship.

Nebraska Consumers

The Nebraska Data Privacy Act (“NDPA”) grants consumers that are residents of the State of Nebraska certain rights regarding the personal information businesses have about them, subject to certain limitations. These rights are listed in more detail below, and at this time do not extend to individuals acting in commercial or employment contexts.

• The Right of Access: Consumers have the right to confirm the processing of their personal data and to access their personal information, and obtain a copy of it in a readily useable format (to the extent “technically feasible”);

• The Right to Correct: Consumers have the right to correct inaccuracies in the Consumer’s Personal Information;

• The Right to Deletion: Consumers have the right to delete personal information concerning the consumer;

• The Right to Data Portability: Consumers have the right to obtain a copy of their data from the controller (Extra Space Storage) in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity up to once per year;

• The Right to Opt-Out: Consumers have the right to opt out of several different uses of their personal information, including: targeted advertising and the sale of their personal information. To opt out of targeted advertising or the sale of your personal information, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal here.

The categories of third parties to whom personal information is shared or sold can be reviewed at "How We Use And Share Your Information". The categories of information we may share with such parties may be reviewed at "Information We Collect About You".

• A Nebraska resident is entitled to two data requests per 12-month period, and requests in excess of that time period may incur a reasonable fee.

• Extra Space does not sell or share sensitive data as defined in the NDPA, or collect sensitive data in ways that may otherwise violate the NDPA.

• A Nebraska resident may also designate another person to act on their behalf as their authorized agent with respect to these rights. We will seek to authenticate that someone claiming to be an authorized agent on behalf of another is in fact an authorized agent for that individual. While this may vary on a case-by-case basis, some ways we may seek to authenticate an authorized agent is by requesting a power of attorney or other legal document that reflects this relationship.

New Hampshire Consumers

The New Hampshire Data Privacy Act (“NHDPA”) grants consumers that are residents of the State of New Hampshire certain rights regarding the personal information businesses have about them, subject to certain limitations. These rights are listed in more detail below, and at this time do not extend to individuals acting in commercial or employment contexts.

• The Right of Access: Consumers have the right to confirm the processing of their personal data and to access their personal information, and obtain a copy of it in a readily useable format (to the extent “technically feasible”);

• The Right to Correct: Consumers have the right to correct inaccuracies in the Consumer’s Personal Information;

• The Right to Deletion: Consumers have the right to delete personal information concerning the consumer;

• The Right to Data Portability: Consumers have the right to obtain a copy of their data from the controller (Extra Space Storage) in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity up to once per year;

• The Right to Opt-Out: Consumers have the right to opt out of several different uses of their personal information, including: targeted advertising and the sale of their personal information. To opt out of targeted advertising or the sale of your personal information, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal here.

The categories of third parties to whom personal information is shared can be reviewed at "How We Use And Share Your Information". The categories of information we may share with such parties may be reviewed at "Information We Collect About You".

• A New Hampshire resident is entitled to one data request per 12-month period, and requests in excess of that time period may incur a reasonable fee.

• Extra Space does not sell or share sensitive data as defined in the NHDPA, or collect sensitive data in ways that may otherwise violate the NHDPA.

• A New Hampshire resident may also designate another person to act on their behalf as their authorized agent with respect to these rights. We will seek to authenticate that someone claiming to be an authorized agent on behalf of another is in fact an authorized agent for that individual. While this may vary on a case-by-case basis, some ways we may seek to authenticate an authorized agent is by requesting a power of attorney or other legal document that reflects this relationship.

New Jersey Consumers

The New Jersey Data Privacy Act (“NJDPA”) grants consumers that are residents of the State of New Jersey certain rights regarding the personal information businesses have about them, subject to certain limitations. These rights are listed in more detail below, and at this time do not extend to individuals acting in commercial or employment contexts.

• The Right of Access: Consumers have the right to confirm the processing of their personal data and to access their personal information, and obtain a copy of it in a readily useable format (to the extent “technically feasible”);

• The Right to Correct: Consumers have the right to correct inaccuracies in the Consumer’s Personal Information;

• The Right to Deletion: Consumers have the right to delete personal information concerning the consumer;

• The Right to Data Portability: Consumers have the right to obtain a copy of their data from the controller (Extra Space Storage) in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity up to once per year;

• The Right to Opt-Out: Consumers have the right to opt out of several different uses of their personal information, including: targeted advertising and the sale of their personal information. To opt out of targeted advertising or the sale of your personal information, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal here.

The categories of third parties to whom personal information is shared can be reviewed at "How We Use And Share Your Information". The categories of information we may share with such parties may be reviewed at "Information We Collect About You".

• A New Jersey resident is entitled to one data request per 12-month period, and requests in excess of that time period may incur a reasonable fee.

• Extra Space does not sell or share sensitive data as defined in the NJDPA, or collect sensitive data in ways that may otherwise violate the NJDPA.

• A New Jersey resident may also designate another person to act on their behalf as their authorized agent with respect to these rights. We will seek to authenticate that someone claiming to be an authorized agent on behalf of another is in fact an authorized agent for that individual. While this may vary on a case-by-case basis, some ways we may seek to authenticate an authorized agent is by requesting a power of attorney or other legal document that reflects this relationship.

Oregon Consumers

The Oregon Consumer Privacy Act (“OCPA”) grants consumers that are residents of the State of Oregon certain rights regarding the personal information businesses have about them, subject to certain limitations. These rights are listed in more detail below, and at this time do not extend to individuals acting in commercial or employment contexts.

• The Right of Access and Know: Consumers have the right to confirm the processing of their personal data and to access their personal information, and obtain a copy of it in a readily useable format (to the extent “technically feasible”);

• The Right to Correct: Consumers may submit a request for Extra Space to correct any incorrect or inaccurate personal information it may have in its possession;

• The Right to Deletion: Consumers have the right to delete personal information concerning the consumer;

• The Right to Data Portability: Consumers have the right to obtain a copy of their data from the controller (Extra Space Storage) in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity up to once per year;

• The Right to Opt-Out: Consumers have the right to opt out of several different uses of their personal information, including: targeted advertising and the sale of their personal information. Please note that Extra Space Storage does not sell your personal information as defined by the OCPA. To opt out of targeted advertising or the sale of your personal information, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal here.

The categories of third parties to whom personal information is shared can be reviewed at "How We Use And Share Your Information". The categories of information we may share with such parties may be reviewed at "Information We Collect About You".

• An Oregon resident is entitled to one data request per 12-month period, and requests in excess of that time period may incur a reasonable fee.

• Extra Space does not sell or share sensitive data as defined in the OCPA, or collect sensitive data in ways that may otherwise violate the OCPA.

• An Oregon resident may also designate another person to act on their behalf as their authorized agent with respect to these rights. We will seek to authenticate that someone claiming to be an authorized agent on behalf of another is in fact an authorized agent for that individual. While this may vary on a case-by-case basis, some ways we may seek to authenticate an authorized agent is by requesting a power of attorney or other legal document that reflects this relationship.

Texas Consumers

The Texas Consumer Data Protection Act (“TCDPA”) grants consumers that are residents of the State of Texas certain rights provided by Texas Codes Annotated §541.001 et. seq regarding the personal information businesses have about them, subject to certain limitations. These rights are listed in more detail below, and at this time do not extend to individuals acting in commercial or employment contexts.

• The Right of Access and Know: Consumers have the right to confirm the processing of their personal data and to access their personal information, and obtain a copy of it in a readily useable format (to the extent “technically feasible”);

• The Right to Correct: Consumers may submit a request for Extra Space to correct any incorrect or inaccurate personal information it may have in its possession;

• The Right to Deletion: Consumers have the right to delete personal information concerning the consumer;

• The Right to Data Portability: Consumers have the right to obtain a copy of their data from the controller (Extra Space Storage) in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity up to once per year;

• The Right to Opt-Out: Consumers have the right to opt out of several different uses of their personal information, including: targeted advertising and the sale of their personal information. To opt out of targeted advertising or the sale of your personal information, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal here.

• The Right to Appeal: Consumers have the right to appeal Extra Space Storage’s refusal to take action on a request. Consumers must submit their request via email to privacy@extraspace.com within a reasonable time period after the Consumer’s receipt of the refusal. Extra Space Storage will respond to the appeal within sixty (60) days of receiving a Consumer’s request to appeal. If Extra Space Storage ultimately denies an appeal, the Consumer may submit a request to the Texas Attorney General via the methods provided in Texas Code Annotated §541.152.

The categories of third parties to whom personal information is shared can be reviewed at "How We Use And Share Your Information". The categories of information we may share with such parties may be reviewed at "Information We Collect About You".

• Extra Space does not sell or share sensitive data as defined in the TCDPA, or collect sensitive data in ways that may otherwise violate the TCDPA.

• A Texas resident is entitled to two data requests per 12-month period, and requests in excess of that time period may incur a reasonable fee.

• A Texas resident may also designate another person to act on their behalf as their authorized agent with respect to these rights. We will seek to authenticate that someone claiming to be an authorized agent on behalf of another is in fact an authorized agent for that individual. While this may vary on a case-by-case basis, some ways we may seek to authenticate an authorized agent is by requesting a power of attorney or other legal document that reflects this relationship.

Utah Consumers

The Utah Consumer Privacy Act (“UCPA”) grants consumers that are residents of the State of Utah certain rights provided by U.C.A §13-61-101 et. seq regarding the personal information businesses have about them, subject to certain limitations. These rights are listed in more detail below, and at this time do not extend to individuals acting in commercial or employment contexts.

• The Right of Access: Consumers have the right to confirm the processing of their personal data and to access their personal information, and obtain a copy of it in a readily useable format (to the extent “technically feasible”);

• The Right to Deletion: Consumers have the right to delete personal information concerning the consumer;

• The Right to Data Portability: Consumers have the right to obtain a copy of their data from the controller (Extra Space Storage) in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity up to once per year;

• The Right to Opt-Out: Consumers have the right to opt out of several different uses of their personal information, including: targeted advertising and the sale of their personal information. To opt out of targeted advertising or the sale of your personal information, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal here.

The categories of third parties to whom personal information is shared can be reviewed at "How We Use And Share Your Information". The categories of information we may share with such parties may be reviewed at "Information We Collect About You".

• Extra Space does not sell or share sensitive data as defined in the UCPA, or collect sensitive data in ways that may otherwise violate the UCPA.

• A Utah resident is entitled to two data requests per 12-month period, and requests in excess of that time period may incur a reasonable fee.

• A Utah resident may also designate another person to act on their behalf as their authorized agent with respect to these rights. We will seek to authenticate that someone claiming to be an authorized agent on behalf of another is in fact an authorized agent for that individual. While this may vary on a case-by-case basis, some ways we may seek to authenticate an authorized agent is by requesting a power of attorney or other legal document that reflects this relationship.

Virginia Consumers

The Virginia Consumer Data Protection Act (“VCDPA”) grants consumers that are residents of the Commonwealth of Virginia certain rights regarding the personal information businesses have about them, subject to certain limitations. These rights are listed in more detail below, and at this time do not extend to individuals acting in commercial or employment contexts.

• The Right to Know: Consumers have the right to know whether or not a business processes their personal information;

• The Right of Access: Consumers have the right to access their personal information, and obtain a copy of it in a readily useable format (to the extent “technically feasible”);

• The Right to Correct Inaccuracies: Consumers may request that inaccuracies in their personal information are corrected, considering the nature of the data and the business’ purposes in using it;

• The Right to Data Portability: Consumers have the right to obtain a copy of their data from the controller (Extra Space Storage) in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller;

• The Right to Opt-Out: Consumers have the right to opt out of several different uses of their personal information, including: targeted advertising, sale of their personal information and profiling for the purpose of making decisions with legal or similarly significant effects concerning the consumers. Please note that Extra Space Storage does not sell your personal information as defined by the VCDPA. To opt out of targeted advertising, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal here.

Information for Virginia Residents

We collect Personal Data from Consumers as a “Controller” under, and seek to comply with, the Virginia Consumer Data Protection Act, as amended or superseded from time to time (“VCDPA”). In addition to our Privacy Notice at https://www.extraspace.com/help/privacy/, this VCDPA Privacy Notice applies to Virginia residents (“Consumers,” “you,” or “your”).

For the purposes of this VCDPA Privacy Notice, “Personal Data” means information that is linked or reasonably linkable to a particular individual. However, the following categories of information are not Personal Data:

• Publicly available information;

• Deidentified data; or

• Information otherwise excluded from the scope of the VCDPA.

This Privacy Notice does not apply to the information of individuals acting in a commercial or employment context, such as job applicants to Extra Space Storage (or its affiliates and/or subsidiaries) or employees or contractors of Extra Space Storage. Persons acting in those roles should review the applicable VCDPA Limited Privacy Notice made available by Extra Space Storage.

This Privacy Notice provides the following information to Virginia Consumers:

• Confirms that Extra Space actually processes your personal data;

• Categories of Personal Data we collect;

• Categories of Personal Data we share with third parties;

• Purposes for which we use Personal Data;

• Categories of third parties with whom we share Personal Data; and

• How Consumers can exercise their rights under the VCDPA;

• The rights to access, correct, or delete Personal Data;

• The right to obtain a portable copy of Personal Data; and

• The right to opt out of targeted advertising, sales of personal data, or certain profiling.

Categories of Non-Sensitive Personal Data

The table below outlines the categories of Personal Data Extra Space Storage collects about Consumers and whether they are shared with third parties.

We collect Non-Sensitive Personal Data from the following sources:

• Directly from our users

• From our affiliates

• From our business partners

Categories of Sensitive Personal Data

The table below outlines the categories of Sensitive Personal Data Extra Space Storage collects about Consumers and whether they are shared with third parties. Extra Space Storage obtains affirmative consent from Consumers to process the Sensitive Personal Data, in compliance with applicable law.

We collect Sensitive Personal Data from the following sources:

• Directly from our users

• From our affiliates

• From our business partners

Use of Personal Data

We use Personal Data for the purposes disclosed to Consumers at the time of collection, as described in our general Privacy Notice (see https://www.extraspace.com/help/privacy/). Personal Data may also be used or disclosed as otherwise permitted or required by applicable law.

Sharing Personal Data

We share Personal Data with the following categories of third parties:

• Third-Parties: We use some limited third parties to ensure the function of our website and provide you with better resources during the use of our Services, like showing Services opportunities relevant to you.

• Processors: We use processors to securely handle Personal Data on our behalf and only on our instructions; these companies may not use your Personal Data for their own purposes.

• Affiliates: We may share your information with our affiliates, subsidiaries, and representatives as part of providing our services.

• Business Partners: We may share relevant personal data with our business partners to provide you with exclusive offers for products and services that may interest you.

See the table above for more details about how different categories of Personal Data are shared.

We do not sell Sensitive Personal Data to anyone or share Sensitive Personal Data more than is reasonably necessary to deliver you with our Services.

Exercising Your Personal Data Rights

Virginia Consumers have the following rights under the VCDPA:

• The rights to access, correct, or delete Personal Data;

• The right to obtain a portable copy of Personal Data; and

• The right to opt out of targeted advertising, sales of personal data, or profiling.

If you are a Virginia Consumer, you can submit a request to exercise your personal data rights under the VCDPA via (1) visiting our online portal at: Privacy Portal, or (2) emailing us at privacy@extraspace.com. You may submit a rights request free of charge up to twice per year. To protect your privacy, you must authenticate your identity before we respond to your rights request. We will use commercially reasonable efforts to verify your identity for this purpose. Any information you provide to authenticate your identity will only be used to process your rights request.

After submitting your request online, you will receive a follow-up email, which may include a link you must click on in order to verify your identity. If you do not click on that link, we may be unable to complete your request due to lack of verification. It is important that you provide a valid email address in order for us to be able to process your request.

We will respond to your rights request within 45 days, though in certain cases we may inform you that we will need up to another 45 days to act on your request. If we suspect fraudulent or malicious activity on or from your account, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. If you believe our response to your rights request is insufficient, you can appeal our decision by contacting Privacy Contact at privacy@extraspace.com and we will inform you of our final decision within 45 days.

We reserve the right to decline to process, or charge a reasonable fee for, requests from a Consumer that are manifestly unfounded, excessive, or repetitive. We also reserve all other rights, including any right to deny any request, as may be granted us under all applicable state and/or federal law.

Targeted Advertising

The VCDPA defines “targeted advertising” as displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict such consumer's preferences or interests. We use some Personal Data for targeted advertising as described above. To opt out of targeted advertising, please adjust your cookies settings to reject marketing cookies as described in Extra Space Storage’s Cookie Notice. Alternatively, please contact us at Privacy@extraspace.com or access the request portal here. Please be aware that we do not accept or process opt-out requests through other means (e.g., via fax or social media).

Contact Us

If you have any questions or concerns regarding this VCDPA Privacy Notice, contact us at privacy@extraspace.com.

Your Marketing Choices

You have choices about how we reach you with marketing offers and about other uses of your information. To update your preferences, you can:

• Click “unsubscribe” in any email marketing communications we send you.

• Go to your MyAccount or visit our Preference Management Center to select your marketing communication choices.

• Submit a request here or email privacy@extraspace.com asking to be removed from receiving marketing-related communications.

Please be aware that it may take up to 10 to 14 business days for your email preferences to take effect.

How We Secure Your Information

We use appropriate technical, organizational, and physical data security safeguards to help protect against unauthorized access to, use or disclosure of your personal information, such as:

• Using encryption when collecting or transferring sensitive information, such as credit card details.

• Designing our data security safeguards to ensure the ongoing security, integrity, availability and resilience of processing systems and services.

• Limiting physical access to our premises.

• Limiting access to the information we collect about you.

• Ensuring that our Business Partners have appropriate safeguards in place to help protect your personal information.

• As required by law, destroying or de-identifying personal information.

We encourage you to keep any passwords you use confidential and to be careful to avoid “phishing” scams where someone may send you an email that appears to be from Extra Space Storage asking for your personal information. Extra Space Storage will not request your ID or password through email.

Notice at Collection

By using Extra Space Storage’s Services and by providing information during the rental application process, you consent to Extra Space Storage's collection of your personal information, including personal identifiers, including your name, address, telephone number, or email address, payment information, internet activity, imprecise geolocational data, government ID data, financial data, and inferred information. This data is used to create a lease for a storage unit, share relevant offers, and provide and better our services. You can learn more about the Information We Collect About You and view our full Privacy Policy here.

Notice of Right to Opt-out of Sale/Sharing

Certain data collection on our sites and applications by third parties for purposes of interest-based advertising and social media tools may be a “sale” or “sharing” under California, Colorado, Delaware, Montana, Nebraska, New Jersey, New Hampshire, Oregon, Texas, and Utah privacy law. As defined by applicable law, we “sold” or “shared” certain data elements within the following categories of personal information: identifiers, demographic information, commercial information, Internet or other electronic network activity information, imprecise geolocational data, and inferences drawn from the above.

The business or commercial purposes of “selling” or “sharing” your Personal Information is to assist us with advertising, marketing, customer measurement, and other functionality on our website and Services.

If you would like to opt out of the sale or sharing of your personal information, you may click the “Do Not Sell or Share My Personal Information” link in our website footers or in our application settings. Please note that your opt-out choice is specific to the device and browser you are using. Additionally, you may exercise your right to opt-out by clicking the link here or by sending a request to privacy@extraspace.com.

Collection and Use of Children's Information

We understand the importance of taking extra precautions to protect the privacy and safety of children using our products, services or our websites. Children under the age of 16 or equivalent minimum age under applicable law, must not share their personal information unless their parent or guardian provides verifiable consent. If at any time a parent or guardian needs to access or delete data associated with their child’s or guardian’s account, they may contact us through one of the options provided in this Privacy Statement. To Extra Space’s knowledge, Extra Space does not sell or share the personal information of minors under the age of 16.

Consent to Share Personal Information When Using Live Chat Function

By using the Live Chat feature, you consent to our collection and analysis of all personal information provided. The Live Chat feature does not use any chatbot or artificial intelligence technology. Rather, each chat takes place with a live representative of the Company. We utilize a vendor called Twilio (“Chat Vendor”) to process, analyze, and store the contents of the chat on our behalf. The Chat Vendor will not sell this data or share it with anyone besides the Company or another vendor engaged to assist in the services provided to the Company. The Chat Vendor will not use or disclose this data for any purpose other than providing services to the Company. For more information on how the Chat Vendor may use or disclose your personal information, please review their Terms of Service here. By using these forms and features, you direct the Company to disclose to and share with the Chat Vendor any personal information you provide.

Contact Us

If you would like to exercise your privacy rights or have a privacy question, concern or complaint, please contact us at Privacy@extraspace.com.

Changes To This Privacy Statement

Effective Date: April 5, 2021

Last Updated: January 3, 2025