If we combine or connect non-personal information with Personal Information so that it directly or indirectly identifies an individual or so that we may draw inferences about an individual, we treat the combined information as Personal Information and, when applicable, Sensitive Personal Information.

Employees or job applicants may provide additional information through job applications, benefits enrollment, payroll or direct deposit enrollment, or other parts of the employment process. We maintain a separate privacy notice for employees and job applicants.

Legal Basis for Processing

Under the General Data Protection Regulation (“GDPR”), we are only allowed to process your Personal Information, where we have a legal basis to do so. For those of the processing activities described above, which are subject to the GDPR, we rely in particular on the following legal bases:

• Consent: For some processing activities we require your consent before we engage into the processing of your Personal Information for a specific purpose (Art. 6 sec. 1 lit. a GDPR);
• Performance of a contract: We process your Personal Information, where the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into the contract (Art. 6 sec. 1 lit. b GDPR);
• Compliance with a legal obligation: We process your Personal Information, where the processing is necessary for complying with a legal obligation (Art. 6 sec. 1 lit. c GDPR);
• Legitimate interest: We process your Personal Information, where the processing is necessary for the legitimate interest we pursue, except where such interests are overridden by your fundamental rights and freedoms (Art. 6 sec. 1 lit. f GDPR). The legitimate interests we pursue are further specified in the tables above, namely in the column “Business Purpose for Collecting the Personal Information”.

Data Retention

Except as otherwise permitted or required by applicable law or regulation, we will only retain your Personal Information for as long as necessary to fulfill the purposes for which we collected it, as required to satisfy any legal, accounting, or reporting obligations, to exercise or legal rights and defend claims, or as necessary to resolve disputes. To determine the appropriate retention period for Personal Information, we consider applicable legal requirements, the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information, and whether we can achieve those purposes through other means.

Selling or Sharing Your Personal Information

Storable does not sell your information, including Personal Information and Sensitive Personal Information.

Consistent with your consent, Storable shares unique personal identifiers that are Personal Information with third-party data analytics providers for behavioral tracking, also referred to as cross-context behavioral advertising or targeted advertising, through technology within web-browsers like cookies, beacons, and pixel tags.  For information regarding the rights you may have to opt-out of information sharing for the purposes of cross-context behavioral advertising, see the “Exercising Your Rights” section below.

How We Collect Information About You

We collect information, including Personal Information, from you through the categories of sources listed above.  We use different methods to collect information from and about you. Those methods include the following:

Personal Information you voluntarily provide to us when you register for a service or product, express an interest in obtaining information about us, our products and services, or our third-party partners, or when you contact us or a third-party partner about our products or services.

We also collect certain information automatically when you visit, use, or navigate our Website or products and services. When you visit our Website, we or third parties we work with automatically collect certain information using technologies such as cookies and other data collection tools. For more information, please see “Cookies and Similar Tracking Technologies” section below.

We may also obtain information from third parties that we partner, collaborate, or work with.

You also may provide information for us to publish or display on public platforms or transmit to other users of our products and services or third parties (collectively, “User Contributions”). For example, we maintain official pages on third-party social media websites such as Facebook, Instagram, LinkedIn, Twitter, and YouTube. When you interact with us on social media websites, we collect analytics regarding your likes, interests, and feedback regarding our products and services. When you interact with platforms like Facebook, Instagram, LinkedIn, Twitter, and YouTube, you are subject to their terms of use and privacy policies. We may collect certain information about you that you have posted and made public on these third-party social media websites. We strongly advise that you avoid posting/sharing confidential, financial, or other sensitive information like your Social Security number, bank account number, phone number, mailing address, or email address when posting to a social media site. Any posts that you make on our official social media pages (including posts that contain pictures, comments, suggestions, opinions, complaints, or personal information) are publicly available to others who use those pages, as well as the companies operating the websites on which they appear. In order to better understand your rights and obligations with regard to such posts, please refer to the privacy policies posted on those social media sites you are visiting.

You may submit other forms of User Contributions for posting and transmission to others at your own risk. Although we limit access to certain pages and/or you may set certain privacy settings for User Contributions by logging into your account profile, please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of any Website users with whom you choose to share your User Contributions. Therefore, we do not guarantee that your User Contributions will only be viewed by authorized persons.

We may obtain information about you from other sources, such as data analytics providers, marketing or advertising service providers, fraud prevention service providers, vendors that provide services on our behalf, or publicly available sources.

Cookies and Similar Tracking Technologies

We and our third-party partners use cookies on our Website. A cookie is a small file placed on the hard drive of your computer or device. You may configure cookie settings through the prompts displayed when visiting our Website. You may also have the opportunity to further configure cookie settings through your internet browser. However, if you select to refuse certain cookies or reject certain cookie settings, you may be unable to access certain parts of our Website. Upon confirmation of your preferences, our system will issue cookies when you direct your browser to our Website, or limit their application as appropriate.

Web Beacons and Pixels

Our Website pages and emails may contain web beacons (small transparent embedded images or objects, also known as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count Website page visitors or email readers, or to compile other similar statistics such as recording Website content popularity or verifying system and server integrity.

We use cookies or other automatic information collection technologies consistent with your consent to help us maintain the security of our Website and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions. These allow us to distinguish you from other Website users to deliver a better and more personalized service when you browse our Website. It also allows us to improve our Website by enabling us to:

• Estimate our audience size and usage patterns.
• Store your preferences so we may customize our Website according to your individual interests.
• Speed up your searches.
• Recognize you when you return to our Website.

As also described above, we also may use these technologies to, consistent with your consent, collect information about your online activities over time and across third-party websites or other online services (behavioral tracking). Some content or applications, including advertisements, on the Website or Storable platforms are served by third parties, including advertisers, ad networks and servers, content providers, and application providers. We may permit third parties to use tracking technologies on our Website for analytics and advertising, including to help manage and display advertisements and to tailor advertisements to your interests. These include but may not be limited to Google Analytics and Meta Pixels. The third parties use their technology to provide advertising about products and services tailored to your interests which may appear either on our Website or on other websites. We do not control how these third-party tracking technologies operate or how they may use the collected information.

Do Not Track Signals

Our website is not designed to respond to “do not track” signals received from browsers.

For information on how you can provide consent or opt out of behavioral tracking on our Website, and learn about how we respond to web browser signals and other mechanisms that enable you to opt into or opt out of behavioral tracking, click here https://privacyrequest.storable.com/. Some features of our Website or platforms may not be available to you as a result of your choice to opt-out. Please email [email protected] if you have questions about this.

The Purposes for Collecting and Using Your Personal Information

We may collect and use Personal Information for the various purposes listed in the charts above. We may also use your information for any other purpose with your consent.

We will not use your information for any materially different, unrelated, or incompatible purposes without providing you notice.

Disclosure of Your Personal Information

In addition to the specific situations discussed elsewhere in this Privacy Policy, we may disclose your information, including Personal Information:

• With any member of our corporate group, which means our subsidiaries, our ultimate holding company and its subsidiaries, and our affiliates.
• With your consent.
• For any other purposes that we disclose when you provide the information.

We may also disclose your Personal Information in order to do any of the following:

• Fulfill the purpose for which you provide it.
• Comply with any court order, law, subpoena, or other legal process, including to respond to any government or regulatory request.
• Enforce or apply any agreements between Storable and you, if applicable.
• Protect and defend our rights and property, our Website, the users of our Website, and/or our affiliated parties.
• Protect the safety of Storable, users of our Website, our customers, or others.
• Complete a sale, transfer, or merger of some or all of our assets or equity, or reorganization, dissolution, or similar event involving our business (including in contemplation of such transactions). Your information may be among the shared or transferred business assets. If such transfer is subject to any mandatory restrictions under applicable laws, we will comply with those restrictions.
• Satisfy any other purpose disclosed by us when you provide the information.

We may also provide aggregated information (consisting of combined information of a number of individuals but that does not identify those individuals) to third parties, who may use such information to analyze patterns or statistics regarding use of our products and services.

How We Protect Your Personal Information

Personal Information is maintained on our servers or those of our service providers, and access is restricted to individuals with a specific need to access the information to provide products and services to you, or otherwise for the purposes described in this Privacy Policy.

We realize individuals trust us to protect their Personal Information. We educate our employees about the importance of confidentiality and privacy.  We require all third parties with a business need to access Personal Information we have collected to adhere to stringent privacy policies and agree to maintain the information in confidence and safeguard if against unauthorized access or disclosure.

We maintain commercially reasonable safeguards to help protect Personal Information we have collected against accidental loss or unauthorized use, disclosure, alteration, or destruction.  We periodically review our data security practices and consider appropriate new technology methods to ensure compliance with federal and state data privacy and information security regulations.  We subject our systems to simulated intrusion tests, however, no security system or method of transmitting or storing electronic data is ever completely secure or impenetrable. In the event that your Personal Information is accessed or disclosed in an unauthorized manner we will notify you as required by applicable law.

Your Privacy Rights

Consistent with applicable law, you may exercise the rights described in this section. Please note that some of the rights may vary depending on the jurisdiction in which you reside.

Under certain consumer data privacy laws of some U.S. states, such as the California Consumer Privacy Act (“CCPA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”) and the Connecticut Data Privacy Act (“CTDPA”) (collectively “U.S. State Privacy Law”), California, Colorado, Connecticut and Virginia residents have specific rights regarding their Personal Information, also referred to as personal data. Likewise, under the General Data Protection Regulation (EU) 2016/679 (“EU-GDPR”) or the UK General Data Protection Regulation (“UK-GDPR”; collectively, “GDPR”), data subjects who either (i) are in the EU or the UK or (ii) are affected by processing activities in the context of an establishment of Storable in the EU or the UK have specific rights regarding their Personal Information, which the GDPR also calls personal data.

If applicable, this section describes your U.S. State Privacy Law -rights as well as your GDPR-rights and explains how to exercise those rights. The section will not apply, however, if Storable does not collect any Personal Information about you or if all of the information we collect does not fall within the protection of applicable law. This Section only includes information Storable has collected as a business. It does not address information Storable may handle as a service provider or processor for other businesses.

Exercising Your Rights

To exercise any of the rights described in this Section, please submit a request by either:

• Emailing us at [email protected].
• Submitting this data request form: https://privacyrequest.storable.com/

Only you, or sometimes someone legally authorized to act on your behalf, may submit a request to exercise your Personal Information rights. Your request must:

• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
• Provide sufficient information, which will likely need to match information we previously collected from you, that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative (“Authorized Agent”). In some instances, we may ask you to provide a signed declaration under penalty of perjury that you are the consumer whose Personal Information is the subject of the request. For requests seeking particularly sensitive information, we may require additional proof of identification.

If you would like, you may designate an Authorized Agent to make a request on your behalf. We will deny requests from agents that do not submit proof of authorization from you.  If you designate an Authorized Agent to make a request on your behalf, to verify that an authorized agent has authority to act for you, we may require:

• A copy of a power of attorney or require that you provide the authorized agent with written permission.
• You to verify your own identity with us directly.

We will only use Personal Information provided in the request to verify the requestor’s identity or authority to make it, except for record-keeping purposes. We will delete this information as soon as practicable after complying with the request.

If you submit a request to Storable and Storable is the service provider or processor of your Personal Information, we will do our best to route the request to the proper party so long as we have sufficient information to do so on your behalf.

Right to Know and Data Portability/Right of Access

You may have the right to request that we disclose certain information to you about our collection and use of your Personal Information (the “Right to Know”). You may also have the right to confirm whether Storable is processing your Personal Information and to access this Personal Information (the “Right to Access” and “Right to Data Portability”). Once we receive your request and confirm your identity, we will disclose to you:

• The categories of Personal Information we collected about you.
• The categories of sources for the Personal Information we collected about you.
• Our business or commercial purpose for collecting, selling, or sharing that Personal Information.
• The categories of recipients to whom we disclose Personal Information. The specific pieces of Personal Information we collected about you in a portable and readily usable format when Storable processes the information through automated or searchable means (also called a “data portability” request).
• In relation to data subjects protected by the GDPR, any further personal data that we are obliged to provide under Art. 15 GDPR.

Right to Delete

You may have the right to request that we delete any of your Personal Information that you have provided or that we have collected from you and retained, subject to certain exceptions (the “Right to Delete”). Once we receive your request and confirm your identity, we will review your request to see if an exception requiring us to retain the information applies. We may deny a deletion request if retaining the information is necessary for us or our service provider(s) to:

1. Complete the transaction for which we collected the Personal Information, provide a good or service that you requested or otherwise take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform a contract with you.
2. Help to ensure security and integrity to the extent the use of the consumer’s Personal Information is reasonably necessary and proportionate for those purposes.
3. Debug to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another consumer to exercise the consumer’s free speech rights, or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that conforms or adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the ability to complete such research, if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us and compatible with the context in which the consumer provided the information.
8. Comply with a legal obligation.

Right to Correct Inaccurate Information

If we maintain inaccurate information about you, you may have the right to request correction of that inaccurate Personal Information, taking into account the nature of the Personal Information and the purposes of the Personal Information processing. We will use commercially reasonable efforts to correct this information.

Right to Limit

Storable’s use of Sensitive Personal Information falls into one of limited business purposes.  We do not share Sensitive Personal Information for any other purpose. 

Right to Restriction of Processing

Data subjects protected by the GDPR under certain circumstances have the right to obtain restriction of processing; e.g. where (i) the accuracy of the personal data is contested, for as long as the accuracy is verified; (ii) the processing is unlawful and you oppose the erasure of the personal data; (iii) we no longer need the personal, but they are required by you for the establishment, exercise or defense of a legal claim; or (iv) you have objected to the processing pending the assessment of your objection.

Right to Withdraw your Consent

Where we process your personal data on the basis of your consent, you can withdraw your consent at any time. This will not affect the lawfulness of our processing activities based on your consent that happened before your withdrawal.

Right to Opt-In or Opt-Out of Sale / Right to Object

U.S. State Privacy Law gives consumers the right to request to opt out of the processing of Personal Information for purposes of (i) targeted advertising, (ii) the sale or sharing of Personal Information, and/or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Likewise, under the GDPR, data subjects have the right to object (i) on grounds relating to his or her particular situation, certain processing activities, or (ii) processing activities for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing.

If you are age 16 or older, you have the right to direct us to not sell your Personal Information at any time (the “right to opt-out”). We do not sell the Personal Information of consumers we actually know are less than 16 years old, unless we receive affirmative authorization (the “right to opt-in”) from either the consumer who is between 13 and 15 years old, or the parent or guardian of a consumer less than 13 years old. Consumers who opt-in to Personal Information sales may opt-out of future sales at any time.

Once you make an opt-out request, we will wait at least 12 months before asking you to reauthorize Personal Information sales. However, you may change your mind and opt back in to Personal Information sales at any time by submitting a request online through this link.

You do not need to create an account with us to exercise your opt-out rights. We will only use Personal Information provided in an opt-out request to review and comply with the request.

Non-Discrimination

We will not discriminate against you for exercising any of your rights. Unless permitted by U.S. State Privacy Law, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by U.S. State Privacy Law that can result in different prices, rates, or quality levels, such as offering coupons, discounts, promotions, other price reductions, or promotional offers for products and services in exchange for providing your Personal Information. Any permitted financial incentive we offer will reasonably relate to your Personal Information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time. Do not provide your Personal Information if you do not want to opt in to these offers. After you receive a promotional offer, you may opt-out by contacting us.

Response Timing and Format

We will confirm receipt of your request within 10 business days. If you do not receive confirmation within the 10-day timeframe, please contact [email protected].

We endeavor to substantively respond to a verifiable consumer request within 30 days of its receipt. If we require more time (up to another 30 days), we will inform you of the reason and extension period in writing. In relation to a request under the GDPR, we will inform you on the action taken without undue delay and in any event within one month of receipt of your request.

We will deliver our written response by mail or electronically, at your option.

If we cannot comply with your rights request, our response will explain the reasons we cannot comply, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Appeal Process

Residents of Colorado, Connecticut and Virginia, may submit an appeal of a decision to deny a rights request within a reasonable time of receiving the denial.  If you are a resident of one of these states and would like to submit an appeal, please email [email protected].

Data subjects protected under the GDPR also have the right to lodge a complaint with the supervisory authority.

Children’s Online Privacy

We do not direct our Website to minors and we do not knowingly collect Personal Information from children under 16 or as defined by local legal requirements. If we learn we have mistakenly or unintentionally collected or received Personal Information from a child without appropriate consent, we will delete it. If you believe we mistakenly or unintentionally collected any information from or about a child, please contact us at [email protected].

Consent to Personal Information Transfer

We are based in the United States. We may process, store, and transfer the Personal Information we collect in and to a country outside your own with different privacy laws that may or may not be as comprehensive as your own.

If you are located outside United States and choose to provide information to us, please note that we transfer information, including Personal Information, to the United States. By submitting your Personal Information or engaging with our Website, you consent to this transfer, storing, or processing. Where our processing of Personal Information in the US involves a transfer from either the EU or the UK, we ensure appropriate safeguards; e.g. by concluding agreements incorporating the EU Commission’s standard contractual clauses for international transfers and / or as the case maybe the UK equivalent, where necessary with additional measures in order to ensure a level of data protection essentially equivalent to that in the EU / UK.

We will take all steps reasonably necessary to ensure that your information is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Information will take place to an organization or a country unless there are adequate controls in place including the security of your Personal Information.

For More Information

To ask questions about this policy, you can contact Storable at:

• [email protected]

Changes To This Policy

We may revise this Privacy Policy from time to time and will post the date it was last updated at the top of this Privacy Policy. We will provide additional notice to you if we make any changes that materially affect your privacy rights.