Need help finding the
RIGHT SIZE?
TRY OUR SIZE GUIDE

EXTRA SPACE STORAGE PRIVACY POLICY

Last Updated: December 31, 2019

This privacy policy (this "Policy") describes the collection of personal information by Extra Space Storage Inc., a Maryland corporation ("Company," "we," or "us") from users of our website at www.extraspace.com (the "Website"), as well as all related applications, widgets, software, tools, and other services provided by us and on which a link to this Policy is displayed (collectively, together with the Website, our "Services"). This Policy also describes our use and disclosure of such information. This Policy is incorporated by reference into the Company Terms of Use (available at https://www.extraspace.com/policies/terms.aspx) and subject to the provisions of the Terms of Use.

Personal Information

"Personal Information," as used in this Policy, is information that specifically identifies an individual, such as an individual’s name, address, telephone number, or e-mail address. Personal Information also includes information about an individual’s activities, such as information about his or her activity on our Services, and demographic information, such as date of birth, gender, geographic area, and preferences, when any of this information is linked to Personal Information that identifies that individual.

Personal Information does not include "aggregate" or other non-personally identifiable information. Aggregate information is information that we collect about a group or category of products, services, or users that is not personally identifiable or from which individual identities are removed. We may use and disclose aggregate information, and other non-personally identifiable information, for various purposes.

Privacy Principles

We follow the following principles in order to protect your privacy:

  • We do not collect any more Personal Information about you than is necessary;
  • We only use your Personal Information for the purposes we specify in this Policy, unless you agree otherwise;
  • We do not keep your Personal Information if it is no longer needed;
  • and
  • Other than as we specify in this Policy, we do not share your Personal Information with third parties.

Collection of Information

We collect Personal Information from you in the following ways. We do so to fulfill our contractual obligations (such as providing the Services) and for our legitimate business purposes (such as improving the Website and Services). We may also collect Personal Information with your consent.

Voluntarily-Provided Information

We collect Personal Information that our users provide to us in a variety of ways on our Services. These include the following:

  • E-mail Newsletters. We may offer e-mail newsletters from time to time on our Services. If you sign up to receive a newsletter from us, we collect your e-mail address.
  • User Accounts and Profiles. Our Services may give you the ability to register for a Company account or to create and update a user profile on the applicable Service. If we offer user-account or profile functionality on the Services, we will collect the Personal Information that you provide to us in the course of registering for an account or creating or updating a user profile. This information may include, for example, name, postal address, telephone number, e-mail address, and related demographic information about you. We may indicate that some personal information is required for you to register for the account or to create the profile, while some is optional.
  • Interactive Features. Our Services may contain interactive functionality that allows you to engage with other users on the Services, post comments to forums, to upload user information and other content (the "User Materials") to your account, participate in surveys, and otherwise to interact with the Services and with other users. If you use any interactive functionality on our Services that request or permit you to provide us with personal information (including, for example, any services that allow you to post User Materials on any of our Services), we collect the Personal Information that you provide to us in the course of using these interactive features.
  • Correspondence. If you contact us by e-mail, using a contact form on the Services, or by mail, fax, or other means, we collect the Personal Information contained within, and associated with, your correspondence.
  • Contests and Sweepstakes. We or our advertisers and other business partners may conduct or sponsor special contests, sweepstakes, and other promotions that users may enter or otherwise participate in on our Services. Certain of these promotions may be co-branded with one of our advertisers or other business partners. In these instances, the collection of your Personal Information may occur directly by the third-party partner on its website or other online service and may be shared with us. The promotion will state the privacy policy or policies governing the collection of such personal information.

Passively-Collected Information

When you visit our Services, some information is collected automatically. For example, when you access our Services, we automatically collect your browser’s Internet Protocol (IP) address, your browser type, the nature of the device from which you are visiting the Services (e.g., a personal computer or a mobile device), the identifier for any handheld or mobile device that you may be using, the website that you visited immediately prior to accessing any Web-based Services, the actions you take on our Services, and the content, features, and activities that you access and participate in on our Services. We also may collect information regarding your interaction with e-mail messages, such as whether you opened, clicked on, or forwarded a message.

We may collect this information passively using technologies such as standard server logs, cookies, and clear GIFs (also known as "Web beacons"). We use passively-collected information to administer, operate, and improve the Website and our other services and systems, to improve the effectiveness of advertising on our Services, and to provide advertisements and other content that is tailored to you. We may also use cookies on the Website in order to deliver our online advertising through third-party vendors, including Google, on a variety of sites on the internet. If we link or associate any information gathered through passive means with Personal Information, or if applicable laws require us to treat any information gathered through passive means as Personal Information, we treat the combined information as Personal Information under this Policy. Otherwise, we use and disclose information collected by passive means in aggregate form or otherwise in a non-personally identifiable form.

You may opt out of receiving cookie-based advertising from Google by visiting the Google advertising opt-out page and/or from other third party vendors by visiting the Advertising Initiative opt out page. You may also modify your cookie settings in your browser through your browser settings. Please note that if you set your browser to disable cookies you may not be able to fully access and use the Services.

Also, please be aware that third parties, such as companies displaying advertisements on the Services or sites or services provided by third parties ("Third-Party Sites") that may be linked to from the Services, may set cookies on your hard drive or use other means of passively collecting information about your use of their services, Third-Party Sites or content. We do not have access to, or control over, these third-party means of passive data collection.

Information from Other Sources

We may receive information about you, including Personal Information, from third parties, and may combine this information with other Personal Information we maintain about you. If we do so, this Policy governs any combined information that we maintain in personally-identifiable format.

Use of Personal Information

We use Personal Information to provide services and information that you request; to enhance, improve, operate, and maintain our Services, our programs, services, websites, and other systems; to prevent fraudulent use of our Services and other systems; to prevent or take action against activities that are, or may be, in violation of our Terms of Use or applicable law; to tailor advertisements, content, and other aspects of your experience on and in connection with the Services; to maintain a record of our dealings with you; for other administrative purposes; and for any other purposes that we may disclose to you at the point at which we request your Personal Information, and pursuant to your consent.

We may also use Personal Information you provide at any time during your visit to the Website to contact you regarding products, services, and offers, both from ourselves and from third parties, that we believe you may find of interest. We allow you to opt-out from receiving marketing communications from us as described in the "Choice" section below.

Disclosure of Personal Information

Except as described in this Policy, we will not disclose your Personal Information that we collect on the Services to third parties without your consent. We may disclose information to third parties if you consent to us doing so, as well as in the following circumstances:

Service Providers

We may disclose Personal Information to third-party service providers (e.g., payment processing and data storage and processing facilities) that assist us in our work. We limit the Personal Information provided to these service providers to that which is reasonably necessary for them to perform their functions, and we require them to agree to maintain the confidentiality of such Personal Information.

Business Transfers

Information about our users, including Personal Information, may be disclosed and otherwise transferred to an acquirer, or successor or assignee as part of any merger, acquisition, debt financing, sale of company assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which Personal Information is transferred to one or more third parties as one of our business assets.

To Protect our Interests

We also disclose Personal Information if we believe that doing so is in our interest to protect our property or other legal rights (including, but not limited to, enforcement of our agreements), or the rights or property of others, or otherwise to help protect the safety or security of our Services and other users of the Services.

Compliance with Law

We may disclose Personal Information required by law, such as to comply with a subpoena or other legal process, or to respond to a government request.

Your Rights

Choice

If you receive promotional e-mail from us, you may unsubscribe at any time by following the instructions contained within the e-mail. You may also opt-out from receiving promotional e-mail from us, and any other promotional communications that we may send to you from time to time (e.g., by postal mail) by sending your request to us by e-mail at privacy@extraspace.com or by writing to us at the address given at the end of this policy. Additionally, if we offer user account functionality on the Services, we may allow you to view and modify settings relating to the nature and frequency of promotional communications that you receive from us.

Please be aware that if you opt-out of receiving promotional e-mail from us, it may take up to ten business days for us to process your opt-out request, and you may receive promotional e-mail from us during that period. Additionally, even after you opt-out from receiving promotional messages from us, you will continue to receive administrative messages from us regarding our Services.

Access

If we offer the ability to create user accounts or profiles on our Services, you may have the ability to access and update many categories of Personal Information that you provide to us by logging in to your account and accessing your account settings. If you wish to access or amend any other Personal Information we hold about you, you may contact us at privacy@extraspace.com . We may request proof of your identity before sharing or updating such Personal Information.

If you request that we delete your Personal Information on any of our Services (via a user settings page, by e-mail, or otherwise), we will do so within a reasonable period of time, but we may need to retain some of your Personal Information in order to satisfy our legal obligations, or where we reasonably believe that we have a legitimate reason to do so.

Additionally, if you are in the European Union, you may reach out to us to request a copy of your personal information, to request a transfer of your Personal Information to a third party in certain circumstances, to withdraw any consents that you have provided for processing your Personal Information, or to request that we cease processing your Personal Information. However, please note that it may not be possible for us to cease processing all of the Personal Information we hold if we have another legal basis or requirement for maintaining such information. You also have the right to make a complaint at any time to the relevant data protection authority in your country.

California Privacy Rights

California provides its residents with certain rights. For more information about these rights, please see "Your California Privacy Rights and Disclosures" below.

Links

The Services may contain links to other websites, products, or services that we do not own or operate. For example, the Services may contain links to third-party merchants from which users may purchase sound recordings that are streamed through the Services. The Services also may contain links to Third-Party Sites such as social networking services. If you choose to visit or use any Third-Party Sites or products or services available on or through such Third-Party Sites, please be aware that this Policy will not apply to your activities or any information you disclose while using those Third-Party Sites or any products or services available on or through such Third-Party Sites. We are not responsible for the privacy practices of these Third-Party Sites or any products or services on or through them. Additionally, please be aware that the Services may contain links to websites and services that we operate but that are governed by different privacy policies. We encourage you to carefully review the privacy policies applicable to any website or service you visit other than the Services before providing any Personal Information on them.

International Visitors

Our servers and data centers are located in the United States. If you choose to use the Services from outside the U.S., then you should know that you are transferring your Personal Information outside of your region and into the U.S. for storage and processing. Also, we may transfer your data from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. You should know that each region can have its own privacy and data security laws, some of which may be less stringent as compared to those of your own region.

Security and Retention

We use reasonable security measures that are designed to protect personal information from accidental loss, disclosure, misuse, and destruction. Please be aware, however, that no data security measures can be guaranteed to be completely effective. Consequently, we cannot ensure or warrant the security of any information that you provide to us. You transmit information to us at your own risk.

We will retain your Personal Information for as long as needed to fulfill your requests, provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements.

How We Respond to Do Not Track Signals

Your web browser may let you choose your preference as to whether you want to allow the collection of information about your online activities over time and across different websites or online services. At this time, the Services do not respond to the preferences you may have set in your web browser regarding such collection of your information, and the Services may continue to collect information in the manner described in this Privacy Policy.

Children Under the Age of 18

The Services are not directed to, and we do not knowingly collect or solicit personal information from, children under the age of 18. If we learn we have collected or received personal information from a child under the age of 18, we will delete that information. If you believe we might have any information from or about a child under the age of 18, please contact us using the contact information below.

SMS Terms & Conditions

  1. When you opt-in to the service, we may, depending on your method of opting in, send you an SMS message to confirm your signup.
  2. You can cancel the SMS service at any time. Just text "STOP" to the short code. After you send the SMS message "STOP" to us, we will send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us. If you want to join again, just sign up as you did the first time or text "START" to 297772 and we will start sending SMS messages to you again.
  3. If at any time you forget what keywords are supported, just text "HELP" to the short code. After you send the SMS message "HELP" to us, we will respond with instructions on how to use our service as well as how to unsubscribe.
  4. We are able to deliver messages to the following mobile phone carriers: Major carriers: AT&T, Verizon Wireless, Sprint, T-Mobile, MetroPCS, U.S. Cellular, Alltel, Boost Mobile, Nextel, and Virgin Mobile. Minor carriers: Alaska Communications Systems (ACS), Appalachian Wireless (EKN), Bluegrass Cellular, Cellular One of East Central IL (ECIT), Cellular One of Northeast Pennsylvania, Cincinnati Bell Wireless, Cricket, Coral Wireless (Mobi PCS), COX, Cross, Element Mobile (Flat Wireless), Epic Touch (Elkhart Telephone), GCI, Golden State, Hawkeye (Chat Mobility), Hawkeye (NW Missouri), Illinois Valley Cellular, Inland Cellular, iWireless (Iowa Wireless), Keystone Wireless (Immix Wireless/PC Man), Mosaic (Consolidated or CTC Telecom), Nex-Tech Wireless, NTelos, Panhandle Communications, Pioneer, Plateau (Texas RSA 3 Ltd), Revol, RINA, Simmetry (TMP Corporation), Thumb Cellular, Union Wireless, United Wireless, Viaero Wireless, and West Central (WCC or 5 Star Wireless). ***Carriers are not liable for delayed or undelivered messages***
  5. As always, message and data rates may apply for any messages sent to you from us and to us from you. You may receive up to two (2) promotional messages per month. Informational text message, such as billing reminders, emergency notifications, etc, may vary in frequency. If you have any questions about your text plan or data plan, it is best to contact your wireless provider. For all questions about the services provided by this short code, you can send an email to commssupport@extraspace.com.

Updates to this Policy

We may occasionally update this Policy. When we do, we will also revise the "last updated" date at the beginning of the Policy. If we change this Policy in a manner that is materially less restrictive of our use or disclosure of your Personal Information, we will use reasonable efforts to notify you of the change and to obtain your consent prior to applying the change to any Personal Information that we collected from you prior to the date the change becomes effective. We encourage you to periodically review this Policy to stay informed about how we collect, use, and disclose personal information.

Contacting Us

If you have any questions or comments about this Policy, please contact us using the following contact information:

Extra Space Storage Inc.
2795 East Cottonwood Parkway, Suite 300
Salt Lake City, UT 84121
privacy@extraspace.com

CALIFORNIA PRIVACY RIGHTS AND DISCLOSURES

This summary of California privacy rights and disclosures (this "California Notice") applies solely to residents of the State of California about whom we collect personal information ("consumers" or "you"), including, for example, visitors to our websites and our customers. We adopt this California Notice to comply with the California Consumer Privacy Act of 2018 (as amended, and together with the California attorney general’s implementing regulations, the "CCPA") and any terms defined in the CCPA have the same meaning when used in this California Notice.

Information We Collect

We may collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household ("personal information"). "Personal information" does not include:

  • Publicly available information from government records.
  • Deidentified or aggregated consumer information.
  • Information excluded from the CCPA’s scope, such as health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) and personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA), California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

Specifically, we have collected the following categories of personal information from our consumers within the last 12 months for the business or commercial purposes described below:

Description Examples Source Business or Commercial Purposes for Collection
Identifiers. A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers. Directly from the consumer Creating accounts and providing our services

Sending marketing communications

Conducting contests and sweepstakes
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories. Directly from the consumer, if any
Protected classification characteristics under California or federal law. Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, and pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, or genetic information (including familial genetic information). Directly from the consumer, if any
Commercial information. Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Directly from the consumer, if any
Biometric information. Genetic, physiological, biological, or behavioral characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints, faceprints, voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, or sleep, health, or exercise data. Directly from the consumer, if any
Internet or other similar network activity. Browsing history, search history, or information on a consumer’s interaction with a website, application, or advertisement. Directly from the consumer, if any

Indirectly from the consumer (e.g., through cookies)

Third-party service providers (e.g., data analytics)

In addition to the business or commercial purposes for collection described above, we have in the preceding 12 months collected all categories of personal information described above for the following purposes:

  • To process your requests, purchases, payments, and transactions and to prevent transactional fraud.
  • To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
  • To create, maintain, customize, and secure your account with us.
  • improve this Site and our products and services.
  • To provide, support, personalize, and develop this Site and our products and services.
  • To help maintain the safety, security, and integrity of this Site and our products, services, databases, other technology assets, and business.
  • To deliver content and product- and service-offerings relevant to your interests, including targeted offers and ads through this Site, third-party sites, and via email or text message (with your consent, where required by law).

We will continue to collect the categories of personal information described above for the business or commercial purposes described above. We may also use or disclose the personal information we collect for one or more of the following purposes:

  • To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
  • As described to you when collecting your personal information or as otherwise set forth in the CCPA.
  • To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about the users of this Site is among the assets transferred.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Disclosures of Personal Information for a Business Purpose

In the preceding 12 months, we have disclosed the following categories of personal information for a business purpose:

  • (A) Identifiers.
  • (B) California customer records.
  • (C) Protected classification characteristics.
  • (D) Commercial information.
  • (E) Biometric information.
  • (F) Internet activity.

We disclose your personal information for a business purpose to the following categories

  • Service providers.
  • When we disclose your personal information to a service provider, we enter into a contract with the service provider that describes the business purpose for which your personal information is disclosed and restricts the service provider from using your personal information for any purpose other than providing the services under the contract.

    Sales of Personal Information

    In the preceding 12 months, we have not sold personal information.

    Your Rights and Choices

    The CCPA provides you, as a California resident, with specific rights regarding your personal information. This section describes your CCPA rights and explains how to exercise those rights.

    Access to Specific Information and Data Portability Rights

    You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request (see Exercising Access, Data Portability, and Deletion Rights), we will disclose to you:

    • The categories of personal information we collected about you.
    • The categories of sources for the personal information we collected about you.
    • Our business or commercial purpose for collecting that personal information.
    • The categories of third parties with whom we share that personal information.
    • The specific pieces of personal information we collected about you (also called a data portability request).
    • If we disclosed for a business purpose or sold your personal information, two separate lists disclosing:
      • Disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
      • Sales, identifying the personal information categories that each category of recipient purchased.

    Deletion Rights

    You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Access, Data Portability, and Deletion Rights), we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

    We may deny your deletion request if retaining the information is necessary for us or our service providers to:

    • Complete the transaction for which we collected the personal information, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
    • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
    • Debug products to identify and repair errors that impair existing intended functionality.
    • Exercise free speech, ensure the right of another consumer to exercise that consumer’s free speech rights, or exercise another right provided for by law.
    • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
    • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s
    • Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
    • Comply with a legal obligation.
    • Make other internal and lawful uses of the information that are compatible with the context in which you provided it.

    Exercising Access, Data Portability, and Deletion Rights

    To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by either:

    Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

    You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

    • Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
    • Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

    We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

    Making a verifiable consumer request does not require you to create an account with us, but we may require authentication of the consumer that is reasonable in light of the nature of the personal information requested.

    We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

    For instructions on exercising sale opt-out rights, see Personal Information Sales Opt-Out and Opt-In Rights.

    Response Timing and Format

    We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (for a maximum total of 90 days), we will inform you of the reason and extension period in writing.

    If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

    Any disclosures we provide will only cover the 12-month period preceding the receipt of a verifiable consumer request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

    We do not charge a fee to process or respond to your verifiable consumer request unless the request is excessive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. Alternatively, we may decline to respond to the request and notify you of our reason for doing so.

    Non-Discrimination

    We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

    • Deny you goods or services.
    • Charge you different prices or rates for goods or services, including through granting discounts or other benefits or imposing penalties.
    • Provide you a different level or quality of goods or services, including denial of goods or services.
    • Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

    Other California Privacy Rights

    California’s "Shine the Light" law (Civil Code Section § 1798.83) permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us through the information set forth below.

    Changes to this California Notice

    We reserve the right to update or change this California Notice at any time. When we make changes to this California Notice, we will post the updated notice on this Site and update the date on which this California Notice was last updated. The date this California Notice was last updated is at the top of this page. You are responsible for periodically reviewing this Site and this California Notice to check for any updates or changes. Your continued use of this Site following the posting of changes constitutes your acceptance of such changes.

    Contact Us

    If you have any questions or comments about this California Notice or our privacy practices, your choices and rights regarding use of your personal information, or wish to exercise your rights under California law, please contact us at:

    Phone: (800) 331-0876
    Site: www.extraspace.com/help/privacy
    Email: privacy@extraspace.com
    Postal Address:
    Extra Space Storage Inc.
    2795 East Cottonwood Parkway, Suite 300
    Salt Lake City, UT 84121