Privacy Policy for storabble

Version: December 29, 2025
This Privacy Policy informs you about how, to what extent, and for what purpose we collect and process personal data on our website storabble.com and in the context of our services.
1. Name and Contact Details of the Controller
The controller responsible for data processing on this website is:
storabble Group AG
Lerchenfeldstrasse 3
CH-9014 St. Gallen
Switzerland
E-mail address: info@storabble.com
1.1. Data Protection Representative in the European Union (pursuant to Art. 27 GDPR)
For our users and data subjects based in the European Union (EU), we have appointed a data protection representative as an additional point of contact pursuant to Art. 27 GDPR:
Attn: zurb Holding UG (haftungsbeschränkt)
Vitalisstraße 67
50827 Cologne
Germany
gdpr-eu-datenschutzvertreter@storabble.com
2. Your Rights as a Data Subject (Data Subject Rights)
You have the right to obtain information about your personal data processed by us at any time. In particular, you have the following rights:
• Right of access: You can request information about your data processed by us.
• Right to rectification: You can request the correction of inaccurate data.
• Right to erasure: You can request the erasure of your data, provided that no legal retention obligations prevent this.
• Right to restriction of processing: You can request the restriction of the processing of your data.
• Right to data portability: You can request to receive your data in a structured, commonly used, and machine-readable format.
• Right to object: You can object to the processing of your data, especially for advertising purposes.
• Right to withdraw consent: If processing is based on your consent, you can withdraw this consent at any time with effect for the future.
• Right to lodge a complaint: You have the right to lodge a complaint with the competent supervisory authority (in Switzerland, the Federal Data Protection and Information Commissioner, FDPIC). If you are based in the EU, you also have the right to lodge a complaint with a supervisory authority in the Member State of your habitual residence, place of work, or the place of the alleged infringement if you believe that the processing of your personal data violates the GDPR. In Austria, the competent supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, DSB), Barichgasse 40-42, 1030 Vienna, telephone +43 1 52 152-0, www.dsb.gv.at.
To exercise your rights, please contact us using the contact details provided above.
3. Collection and Processing of Personal Data and Purposes of Processing
3.1. When Visiting Our Website (Server Log Files)
Each time our website is accessed, our system automatically collects data from the computer system of the accessing computer. The following data is collected: IP address, date and time of access, browser type and version, operating system used, HTTP headers involved in the request.
• Purpose: To ensure the security, stability, and functionality of our website.
• Legal Basis: Our legitimate interest (Art. 6(1)(f) GDPR).
3.2. Registration and Use of a User Account
You have the option to create a user account. In doing so, we collect data such as e-mail address, password, and first and last name.
• Purpose: Provision of the platform's services and personalized functions.
• Legal Basis: Performance of the user contract (Art. 6(1)(b) GDPR).
3.3. Contact (General)
When you contact us, whether via our contact form, by e-mail, or by telephone, we process the personal data necessary to handle your request.
When using the contact form, this typically includes: First name, last name, e-mail address, telephone number, company name, if applicable, your Value Added Tax Identification Number (VAT ID), and the content of your message.
In the case of telephone contact, we process in particular your telephone number and the information provided during the conversation.
In the case of e-mail contact, we process your e-mail address and the information contained in the e-mail.
• Purpose: To process your request.
• Legal Basis: Performance of a pre-contractual measure or a contract (Art. 6(1)(b) GDPR).
3.4. Core Functions of Our Platform
a) Forwarding of Contact Requests to Storage Providers
Users can submit a request directly to the respective storage provider via a contact form on a listing. In doing so, we collect the following data: First name, last name, e-mail, telephone number, and the content of your message.
• Purpose: We store this data and forward it to the storage provider you have selected in order to initiate the rental of a storage unit.
• Legal Basis: Initiation and performance of a contract at your request (Art. 6(1)(b) GDPR). The privacy policy of the respective storage provider applies to the further processing of the data by the provider.
Additional Service: Alternative Offers by Storabble
In addition to forwarding your original request, we use the contact details you provide (e-mail, telephone number) to draw your attention to other storage units that are suitable and relevant to your specific search. This may occur via e-mail or telephone.
Purpose: This service aims to provide you, as a comparison platform, with the best possible support in your search for the ideal storage unit.
Legal Basis: The legal basis for this is our legitimate interest (Art. 6(1)(f) GDPR) in providing and improving our service in a user-oriented manner.
Right to object: You can object to this additional contact by us at any time and without giving reasons. A simple note in a reply e-mail or a verbal notification by telephone is sufficient.
b) Direct Rental of Storage Units from storabble Group AG
If you rent a storage unit directly from us, the contract is concluded outside the website (e.g., via e-mail). For this purpose, we process master contract data (name, address, contact details) and the signed rental agreement.
• Purpose: Conclusion and execution of the rental agreement. For the clear identification of our contractual partners and for the prevention of fraud, we also collect and store a copy of an official identification document.
• Legal Basis: Performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in fraud prevention. We treat this sensitive data with enhanced security measures. The copy of the identification document will be deleted as soon as the purpose of identification is fulfilled and no legal retention obligations prevent this.
c) Active Support in Searching for Storage via WhatsApp (on a voluntary basis)
In addition to the processes described in sections a) and b), we offer users the voluntary option of receiving extended and proactive support from us in their search for storage via WhatsApp.
Purpose: This service includes the proactive sending of suitable, alternative storage unit offers, answering queries, and providing general assistance via the WhatsApp communication channel.
Type of data: For this purpose, we process your mobile phone number as well as the data you have stored in your WhatsApp profile (e.g., profile picture, name) and the metadata generated during communication.
Legal Basis: This contact and the associated data processing are based exclusively on your explicit, voluntary, and separate consent (Art. 6(1)(a) GDPR), which you grant us, for example, by activating a corresponding checkbox.
Data transfer to Meta/USA: We point out that WhatsApp is a service of Meta Platforms, Inc. (USA). When using WhatsApp, your data is inevitably transmitted to Meta's servers, including in the USA.
Right to withdraw consent: You can withdraw your consent to be contacted via WhatsApp at any time and without giving reasons with effect for the future. An informal message to us in the WhatsApp chat (e.g., "STOP") or an e-mail is sufficient for this purpose.
3.5. Cookies, Analysis of User Behavior, and Advertising
We use cookies and similar technologies on our website. Cookies are small text files that are stored on your device. The legal bases for the use of these technologies differ depending on your location.
• For users in the European Union (EU) and the European Economic Area (EEA):
For technically non-essential cookies (e.g., for analysis, marketing), we use all technologies described below only after your explicit consent (Art. 6(1)(a) GDPR). You grant this consent via our cookie banner and can revoke or adjust it there at any time with effect for the future. Without your consent, these cookies will not be set.
• For users in Switzerland:
For technically non-essential cookies (e.g., for analysis, marketing), we rely on our legitimate interest in improving and marketing our services. By continuing to use our website, we assume your consent to the use of these technologies. You have the option at any time to prevent the storage of cookies through corresponding settings in your browser or to delete stored cookies.
a) Anonymized Website Analysis and Security Check
To understand the use of our platform and to continuously improve our offer, we collect statistical data about your interactions with our website. We do this in a two-stage, data-protection-friendly process:
1. Collection of anonymous usage data:
We record purely factual events to understand how our platform is used. This includes:
• Submitting contact requests or feedback,
• Performing a search for a location (including the exact search term),
• Opening a listing,
• The display of a listing in the search results,
• Clicks on specific buttons within a listing.
This interaction data is stored completely anonymously. We do not store IP addresses, browser information, or other data that would allow a conclusion to be drawn about your person together with these events.
2. Temporary security check:
Independently of the anonymous analysis, your IP address and browser agent are processed briefly during interactions for the security of our systems. This process serves exclusively for the technical check to fend off automated access by bots. The legal basis for this is our legitimate interest in the integrity and security of our website (Art. 6(1)(f) GDPR). The IP address and browser agent are discarded after this check and are not stored together with the usage data.
b) Use of Third-Party Services for Analysis and Advertising
In addition to our own anonymized analysis, we use specialized services from third-party providers to measure the reach of our website and to display personalized advertising. This also occurs exclusively on the basis of your consent.
Analysis: Google Analytics 4.
Advertising and Remarketing: Google Ad Manager, Google Ads (Conversion tracking, remarketing, customer matching, smart bidding, etc. We use various functions of Google Ads to measure the effectiveness of our advertising (conversion tracking), to re-engage users who have already visited our site (remarketing), and to optimize our target groups. For this purpose, cookies set by Google process your usage data (e.g., pages visited, listings clicked) and transmit it to Google. As part of "Customer Match," we can also transmit pseudonymized lists of contact data (e.g., hashed e-mail addresses) to Google in order to reach existing customers on Google platforms in a targeted manner. For audience selection (e.g., for "Audience Expansion" or "Optimized Targeting"), we use the demographic characteristics and interest categories provided by Google. We do not transmit this sensitive data to Google, but merely select it as criteria for our advertising campaigns. We do not have access to the assignment of these characteristics to individual, identifiable persons.), Meta Pixel (Conversion tracking for Meta ads).
c) Google Preferred Sources
On our website you can set storabble as a preferred source in your Google account. Google takes preferred sources into account when presenting search results, among others in "Top Stories", in AI Overviews and in AI Mode. This too happens exclusively on the basis of your consent: only then do we load the script required for it from Google and thereby establish a connection to Google servers, in the course of which your IP address is transmitted and cookies set by Google (e.g. NID) may be stored. Without your consent neither the script is loaded nor the button displayed. You make the setting itself in a window provided by Google, it is stored in your Google account, and we do not learn whether or how you have set it.
4. Data Transfer to Third Parties and Processors
We only transfer your data to third parties if this is necessary for the provision of our service (see section 3.4.a), if you have consented, or if a legal obligation exists.
Furthermore, we use technical service providers (processors) for the operation of our website and the provision of our services, who process your data on our behalf. We have concluded data processing agreements (DPA) with them.
This includes the following categories and services:
• Hosting and Infrastructure: Google Cloud
• Outgoing E-mails (DNS and SES): Amazon Web Services (AWS)
• Incoming E-mails and File System: Gmail and Google Drive
• Interaction and Communication:
WhatsApp Business Chat Widget: We offer you the opportunity on our website to contact us directly via WhatsApp using a chat widget. The operator of this service is Meta Platforms, Inc., USA. If you use this service, your telephone number, your name stored on WhatsApp, your profile picture, and the messages you send, as well as associated metadata, are transmitted directly to Meta's servers, including in the USA. The legal basis for the use of this service is your consent, which you give by actively using the widget, as well as our legitimate interest in efficient customer communication.
• Tag Management: Google Tag Manager
• Transfer to Property Owners and Appointed Management Companies: If you rent a storage unit directly from us (pursuant to section 3.4 b)), we manage this tenancy on behalf of the respective property owner. To fulfill contractual and administrative obligations, we provide the property owner and/or the management company appointed by them with a quarterly report. This report contains personal data of the tenants, namely first and last name, address, the rented storage unit, and the start and end of the rental period.
The purpose of this data transfer is the contract processing, the owner's accounting, and the administration of the property. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR), as this administration is an integral part of providing the rental service.
• Transfer to Insurance Companies: If you take out insurance for your storage unit through us as part of your rental agreement, a transfer of data to the respective insurance company is necessary. We clearly distinguish between two different purposes and legal bases here:
o Data transfer for the performance of the contract: In order to conclude and manage the insurance contract you have requested, we pass on the personal data absolutely necessary for this (in particular name, address, rental details) to the insurance company.
Purpose: This data transfer takes place exclusively for the establishment and administration of the insurance relationship you have commissioned. Legal Basis: The processing is necessary for the performance of the contract (Art. 6(1)(b) GDPR).
o Data transfer for advertising purposes (only with consent): Any further transfer of data to the insurance company for the purpose of promotional contact (e.g., for other insurance products) only takes place if you have given us your explicit, voluntary, and separate consent (e.g., by activating a corresponding optional checkbox during the booking process).
Purpose: To enable product information and advertising by the insurance company.
Legal Basis: This data transfer is based exclusively on your consent (Art. 6(1)(a) GDPR). This consent is not linked to the conclusion of the insurance contract and can be revoked at any time.
Responsibility of the insurance company: The respective insurance company itself is responsible for all further data processing after the transfer. The data protection provisions of the respective insurer apply.
5. Data Transfer to Third Countries (outside the EU/Switzerland)
Some of the service providers we use (e.g., Google, Amazon Web Services, Meta) are based in the USA. A transfer of your data to the USA and other countries without an adequate level of data protection may therefore occur.
We ensure the protection of your data by resorting to recognized guarantees, in particular by concluding Standard Contractual Clauses (SCC), which are recognized by the European Commission and the FDPIC. In certain cases, a transfer may also be based on your explicit consent.
6. Data Security
We take appropriate technical and organizational security measures to protect your data against manipulation, loss, or unauthorized access by third parties. This includes in particular the use of SSL/TLS encryption for all data transmission on our website. All access to servers is via strong public key crypto. Data transmissions are made via encrypted tunnels. A WAF is used.
7. Storage Duration
We store your personal data only for as long as is necessary to achieve the respective purposes or as provided for by the statutory retention periods (e.g., 10 years for business documents under the Swiss Code of Obligations).
8. Updates and Amendments to this Privacy Policy
This privacy policy can be adapted at any time to changed legal or factual circumstances. The version published on our website shall apply.