1. Summary

Extra Space Asia will collect, use or disclose personal data for reasonable business purposes only if there is consent or deemed consent from the individual and information on such purposes have been notified. We may also collect, use or disclose personal data if it is required or authorised under applicable laws.

2. Collection of Personal Data

Extra Space Asia collect personal data from customers, business contacts, partners, personnel, contractors and other individuals with their consent pursuant to Article 15(1)(1) of the PIPA. Such personal data may be provided to us in forms filled out by individuals, face to face meetings, email messages, telephone conversations, through our websites or provided by third parties. If any individuals contact us, we may keep a record of that contact.

We collect these personal data when it is necessary for business purposes or to meet the purposes for which the individuals have submitted the information.

We will only collect, hold, process, use, communicate and/or disclose such personal data, in accordance with this policy. If any party is acting as an intermediary or otherwise on behalf of a third party individual or supplying us with information regarding a third party individual (such as a friend, a colleague, an employee etc.), such intermediary party undertakes that you are an authorised representative or agent of such third party individual and that you have obtained all necessary consents from such third party individual to the collection, processing, use and disclosure by us of their personal data. Because we are collecting the third party individual’s data from you, you undertake to make the third party individual aware of all matters listed in this policy preferably by distributing a copy of this policy to them or by referring them to our website.

You are under no obligation to provide personal data to us. However, if you choose to withhold the requested personal data, you may not be able to use certain aspects of our Services. You must ensure that all personal data submitted to us is complete, accurate, true and correct. Failure on your part to do so may result in our inability to provide you with Services you have requested or to process any requests and applications you may have made to us.

Depending on the nature of your interaction with us, some examples of personal data which we may collect from you include your name and identification information such as your contact information such as your address, email address or telephone number, nationality, gender, date of birth, marital status, photographs and other audio-visual information, employment information and financial information such as credit card numbers, debit card numbers or bank account information. Additionally, we may collect biometric information (such as face data extracted from a photograph or image supplied by you) and information about your use of and interaction with our Services such as your device Internet Protocol (IP) address, device name, operating system version, the time and date of access, and other usage statistics.

3. Use of Personal Data

Extra Space Asia is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this website, then you can be assured that it will only be used in accordance with this policy.

We use personal data for the following purposes:

• performing obligations in the course of or in connection with our provision of the services and/or goods requested by customers;
• to keep customers and other contacts informed of the products and services we offer that may be of interest to them;
• for general management and reporting purposes, such as invoicing and account management;
• for resolving any problems or disputes in relation to our products and services;
• complying with any applicable laws, regulations, codes of practice, guidelines, or rules, or to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority;
• for recruitment purposes;
• for purposes related to the employment of our personnel and providing internal services to our personnel;
• all other incidental business purposes related to or in connection with the above;
• to verify your identity and to prevent and detect fraud;
• responding to, handling, and processing queries, requests, applications, complaints, and feedback from you;
• managing your relationship with us;
• processing payment or credit transactions;
• to analyse traffic, improve user experience and deliver advertisements relating to our services on third-party platforms such as Google, Meta and LinkedIn, and engage in remarketing and customer list-based advertising (e.g. Google Customer Match or Meta Custom Audiences);
• in the use of data analytics and automated tools, including artificial intelligence-assisted systems, to analyse enquiry data, service usage and operational trends. Such tools are used to support internal decision-making and service improvement and do not produce legal or similarly significant effects on individuals;
• when we use AI and data analytics to assess customer engagement, prioritise leads and improve retention (supports internal decision-making; no legal or similarly significant effects on individuals);
• for ensuring safety and security of our Services, properties, and systems;
• our facilities are monitored by CCTV systems and access control measures for security, safety, loss prevention and operational management. These systems may collect images, access timestamps and related data of individuals entering or present at our premises. Records are accessed on a need-to-know basis and retained only as long as necessary;
• telephone calls, video calls, online meetings and any other modes of communication with us may be recorded for purposes such as quality assurance, training, compliance and dispute resolution. We may communicate with customers and business contacts via messaging platforms such as WhatsApp Business;
• transmitting to any unaffiliated third parties including our third party service providers and agents, and relevant governmental and/or regulatory authorities, whether in Korea or abroad, for the aforementioned purposes;
• for paid advertising on social media platforms such as LinkedIn, Facebook, and Instagram. These platforms may collect information independently in accordance with their own privacy policies. We do not receive personal data unless you voluntarily engage with such advertisements;
• we and our advertising and analytics partners may collect and use mobile advertising identifiers provided by your device operating system (such as Apple’s Identifier for Advertisers (IDFA) or Android Advertising ID (AAID)). These identifiers are unique, user-resettable identifiers that enable us to deliver relevant advertisements, measure the effectiveness of marketing campaigns, and analyse user interactions with our application;
• our application integrates third-party software development kits (SDKs) and services, including analytics, advertising, messaging, and crash reporting tools. These SDKs may collect information such as device identifiers, IP address, app usage data, and diagnostic information;
• our application may request access to your device camera to enable features such as capturing images, or uploading photos. We will only access your camera with your explicit permission and only while the feature is in use. You may withdraw camera access at any time through your device settings.

4. Marketing Communications and Consent Compliance

We may contact you using various communication channels, including email, telephone, SMS, fax, push notifications, and messaging platforms (including but not limited to WhatsApp and KakaoTalk or similar applications), for the purposes set out below.

Service Communications

We may send communications that are necessary for the administration, fulfilment, or performance of services, including confirmations, updates, operational notices, and other service-related matters (“Service Communications”).

Such Service Communications shall not contain promotional or marketing content.

Messaging Platforms (e.g. WhatsApp, KakaoTalk, SMS)

Marketing Communications transmitted via messaging platforms shall: (a) be sent only where you have provided explicit and informed consent where required; and (b) include a clear opt-out mechanism in each message (e.g., unsubscribe instructions or reply keywords).

Push Notifications

Where you enable or accept push notifications through a mobile application or device: (a) you consent to receive push notifications, which may include Service Communications and Marketing Communications; and (b) you may disable push notifications at any time through the application or device settings, provided that doing so may affect certain functionalities of the services.

5. Disclosure of Personal Data to Third Parties

Extra Space Asia respects the confidentiality of the personal data you have provided to us.

We do not disclose personal data to third parties except when permitted by law, or in cases where we have engaged third parties such as data intermediaries or sub-contractors specifically to assist with our business activities. Any such third parties whom we engage will be bound contractually to keep all information confidential.

We will only share your personal data in the following circumstances:

• With third party identity verification services in order to verify your identity and to prevent and detect fraud. For instance, if you have signed up to use the Extra Space Express application, we use Jumio Corporation (“Jumio”), a third party identity verification service provider, to verify your identity. Jumio will verify your identity using biometric data that is obtained from photographs and identification documents supplied by you. Jumio will permanently destroy such biometric data in its possession and control within 3 years after you first provided those photographs and identification documents. For more information on how Jumio collects, processes, stores, retains and deletes your personal data, please refer to its privacy policy at https://www.jumio.com/privacy-center/privacy-notices/online-services-notice/.
• With our affiliates and third party service providers who assist us in our business activities and/or providing the Services.
• With parties involved in a transaction involving the purchase, sale, lease, merger or amalgamation or any other acquisition, disposal or financing of our business.
• With our professional advisors such as our auditors and lawyers.
• With law enforcement, officials, or other third parties when we are compelled to do so by a subpoena, court order, or similar legal procedure, or when we believe in good faith that the disclosure of personal data is necessary to prevent physical harm or financial loss, to report suspected illegal activity, or to investigate violations of our user agreements or any other applicable policies.
• Any other party to whom you authorise us to disclose your personal data including those identified in the list of uses in this policy.
• When your personal data is shared with third parties, we will take the required contractual, technological and organisational measures to safeguard your personal data and ensure that it is processed by such third parties only to the extent necessary.

Delegation of Processing of Personal Information

6. International Transfers

To facilitate our operations, the personal data which you provide to us may be transferred, stored and/or processed in a country other than Korea. These countries may have data protection laws which are different from the laws of your country. However, regardless of where the personal data is located, we will take measures to ensure that all transfers comply with applicable data protection laws and your personal data will be protected to the standard required. The legal basis for international transfer of the personal data is Article 28-8(1)3 of PIPA.

You may refuse overseas transfer by cancelling your membership with us. In such case, we will not be able to provide our services to you. You can request to cancel your membership with us via the DPO contact below.

7. Rights and Obligation of Data Subjects

You and your legal representative may, at any time, request to access, transmit, correct, delete, suspend processing of, refuse or request an explanation for automated decision-making or withdraw consent for the collection and use of your registered personal information. To do so, you may contact our DPO, and a required identity verification process will be conducted upon exercising these rights to ensure secure data protection.

For children under the age of 14, their legal representative must exercise these rights directly. If you are a minor aged 14 or older, you may exercise your rights regarding your personal information either directly or through your legal representative. However, your right to request access to or suspension of processing of personal information may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.

Access to and Correction of Personal Data

Upon request, Extra Space Asia will provide the individual with access to their personal data or other appropriate information on their personal data in accordance with the requirements of the PIPA and other applicable laws.

When personally identifiable information is retained, we assume responsibility for keeping an accurate record of the information once a visitor has submitted and verified the data. We do not assume responsibility for verifying the ongoing accuracy of the content of personal information. Upon request, we will correct an error or omission in the individual’s personal data that is in our possession or control in accordance with the requirements of the PIPA and other applicable laws.

If you have an account with us for the Services, you may access, review, change or delete personal data associated with your account by logging in and editing such information. Alternatively, you may submit an access request to our Data Protection Officer. We may charge for such requests in accordance with applicable law.

Withdrawal of Consent

Extra Space Asia is committed to ensuring that personal data is stored securely. You have the right at any time to request us to limit the processing and use of your personal data (for example, requesting us to stop sending you any marketing and promotional materials or contacting you for marketing purposes).

Upon reasonable notice being given by you of your withdrawal of any consent given or deemed to have been given in respect of our collection, use or disclosure of his personal data, Extra Space Asia will inform you of the likely consequences of withdrawing your consent. We will cease (and cause any of our data intermediaries and agents to cease) collecting, using or disclosing the personal data unless it is required or authorised under applicable laws.

Marketing Communications shall only be sent where you have provided valid consent where required under applicable law.

Each Marketing Communication shall include a clear and accessible mechanism allowing you to opt out of receiving such communications and where any communication contains both service-related and promotional elements, such communication shall be treated as a Marketing Communication.

You may opt out of receiving Marketing Communications at any time by:

1. using the unsubscribe facility provided in the relevant communication; or
2. contacting us through the prescribed contact details.

For the avoidance of doubt, an opt-out from Marketing Communications shall not affect:

1. continued receipt of Service Communications; or
2. constitute a withdrawal of consent for the collection, use, or disclosure of personal data for non-marketing purposes, unless expressly notified by you.

Your request should be addressed to the contact information below.

Name: Lim Jin Yin
Position: Data Protection Officer
Phone Number: +65 6771 3179
E-mail: dpo@extraspaceasia.com

8. Security and Protection of Personal Data

Extra Space Asia has implemented generally accepted standards of technology and operational security to protect the personal data in our possession or under our control and to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. All Extra Space personnel follow a network-wide security policy. Only authorised Extra Space personnel are provided access to personally identifiable information and these personnel have agreed to ensure confidentiality of this information. This policy is also required for any fulfilment agents of Extra Space.

Technical, administrative, and physical protective measures we apply include the following:

1. Administrative measures: Establishment and implementation of internal management plans, operation of a dedicated department, and regular employee training.
2. Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, and installation and update of security programs.
3. Physical measures: Access control to computer rooms, data storage rooms, etc.

While no electronic transmission over the internet is entirely secure, the security of our Services also depends on you. You agree to: take steps to secure your computer and other devices; make full use of the tools we provide to secure our Services and your account; and use secure passwords and maintain their confidentiality.

9. Retention of Personal Data

Extra Space Asia will cease to retain personal data, as soon as it is reasonable to assume that the purpose for collection of such personal data is no longer being served by such retention, and such retention is no longer necessary for legal or business purposes. While retention periods will vary depending on the type of information, our typical retention periods are described below:

• Account data such as your name, contact information, biometric information, are retained until you choose to close your account.
• Contact data that we collect for marketing purposes are retained until you unsubscribe from our marketing lists.
• Data collected via technical means such as cookie and other analytical tools are kept for a period of 1 year from expiry of the cookie.
• Personal data that we collect to comply with our legal obligations (such as tax, financial or anti-money laundering laws) may be retained after closure of your account for as long as required under such laws.

Personal data may be retained in accordance with relevant laws and regulations in the following cases:

1. Records regarding transactions, such as labelling, advertising, contract details, and performance, pursuant to Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc.
   • Records of contract or withdrawal of subscription, payment settlement, and supply of goods, etc.: 5 years
   • Records of consumer complaints or dispute resolution: 3 years
2. Retention of communication confirmation data pursuant to Article 15-2 of the Protection of Communications Secrets Act
   • Computer communication, internet log records, and access location tracking data: 3 months
   • Records of consumer complaints or dispute resolution: 3 years

10. Procedures and Methods for Destruction of Personal Information

We destroy personal information without delay when the personal information becomes unnecessary owing to the expiry of the retention period, attainment of the purpose of processing the personal information, etc.

If personal information must be retained pursuant to other statutes despite the expiry of the retention period, attainment of the purpose of processing the personal information, etc., the relevant personal information will be transferred to a separate database (DB) or stored in a different location.

The procedures and methods for the destruction of personal information are as follows:

1. Destruction Procedure. We select the personal information for which a reason for destruction has arisen and destroy such personal information after obtaining approval from our Chief Privacy Officer.
2. Destruction Method. We destroy personal information recorded and stored in the form of electronic files in a manner that prevents such personal information from being reproduced, and destroy personal information recorded and stored in paper documents by shredding or incinerating them.

11. Notification of Breach

In the event of a data breach, Extra Space Asia will take steps to assess if it is notifiable. If the data breach occurs, Extra Space Asia will notify you and the Personal Information Protection Commission (PIPC) and/or Korea Internet & Security Agency (KISA) without delay and within the timeframes required under PIPA.

12. Cookies and Related Technologies

This Policy also applies to any personal data we collect via our website. Cookies may be used on some pages of our websites. A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Because we want visitors’ website experience to be as informative and resourceful as possible, we may provide a number of links to third party websites. We assume no responsibility for the information practices of these third party websites that visitors are able to access through ours. When a visitor to our website links to these third party websites, our privacy practices no longer apply. We encourage visitors to review each website’s privacy policy before disclosing any data.

13. Contact Us

If a customer, employee or individual has concerns or further queries about how Extra Space Asia are handling his/her personal data, or any problem or complaint about such matters, please contact:

Name: Lim Jin Yin
Position: Data Protection Officer
Phone Number: +65 6771 3179
E-mail: dpo@extraspaceasia.com

14. Amendments and Updates

As part of our efforts to ensure that we properly manage, protect and process your personal data, we will be reviewing our policies, procedures and processes from time to time. We reserve the right to amend the terms of this Privacy Policy at our absolute discretion. Any amended Privacy Policy will be posted on our website. You are encouraged to visit our websites from time to time to ensure that you are well informed of our latest policies in relation to personal data protection.

This Privacy Policy is effective as of 20 October 2026.

You can view previous versions of the Privacy Policy below:

• Effective from 9 November 2010 to 19 October 2026 (view)