Last updated: 23 April 2026
Privacy Policy
Storage Pal SAS
Effective Date: February 8, 2026
Last Updated: February 8, 2026
Introduction
Storage Pal SAS (“StoragePal,” “we,” “us,” or “our”) is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website, mobile applications, and storage services.
Our Commitment
- Transparency in how we handle your data
- Respect for your privacy rights under GDPR and French law
- Security measures to protect your information
- Your control over your personal data
Who We Are
Storage Pal SAS
SIREN: 839 540 671
SIRET: 839 540 671 00014
RCS: Paris
Address: 24 rue Miollis, 75015 Paris, France
Email: [email protected]
Phone: 01 76 34 00 47
Data Protection Officer
Email: [email protected]
Address: Data Protection Officer, Storage Pal SAS, 24 rue Miollis, 75015 Paris, France
Table of Contents
- Scope and Definitions
- Personal Data We Collect
- How We Collect Your Data
- Legal Basis for Processing
- How We Use Your Personal Data
- How We Share Your Personal Data
- International Data Transfers
- Data Retention
- Your Privacy Rights
- Cookies and Tracking Technologies
- Security Measures
- Children’s Privacy
- Third-Party Links
- Changes to This Policy
- Contact and Complaints
1. Scope and Definitions
1.1 Scope
This Privacy Policy applies to all personal data processed by StoragePal through:
- Our website: www.storagepal.fr
- Our mobile applications (iOS and Android)
- Our customer service channels (phone, email, chat)
- Our storage and transport services
- Marketing communications
1.2 Key Definitions
- Personal Data: Any information relating to an identified or identifiable natural person (e.g., name, email address, phone number, payment information).
- Processing: Any operation performed on personal data, including collection, storage, use, sharing, or deletion.
- Data Controller: StoragePal, as the entity determining the purposes and means of processing your personal data.
- Data Subject: You, the individual whose personal data we process.
- GDPR: General Data Protection Regulation (EU) 2016/679.
- CNIL: Commission Nationale de l’Informatique et des Libertés, the French data protection authority.
2. Personal Data We Collect
2.1 Account and Identity Data
When you create an account or use our services, we collect:
- Full name (first and last names)
- Email address
- Phone number (mobile and/or landline)
- Password (stored in encrypted form)
- Date of birth (for age verification and consumer rights)
- Account preferences (language, communication preferences)
2.2 Service and Order Data
To provide our storage and transport services:
- Collection address (street, building, floor, access codes)
- Delivery/return address
- Article descriptions (type, quantity, dimensions, weight)
- Photos of articles (when uploaded by customer)
- Storage location details
- Service history (collections, deliveries, visits, modifications)
- Reservation dates and times
2.3 Financial Data
For payment processing:
- Credit/debit card information (card number, expiry date, CVV — processed by our payment provider)
- Billing address
- Transaction history
- Invoice data
- Payment method preferences
Note: We do not store complete credit card numbers. Payment processing is handled by our PCI-DSS compliant payment service providers.
2.4 Communication Data
When you contact us:
- Email correspondence
- Phone call recordings (with prior notice and consent)
- Chat messages
- Customer service tickets
- Feedback and survey responses
- Claim and complaint details
2.5 Surveillance and Security Data
Warehouse Video Surveillance:
- CCTV footage from warehouse facilities where your articles are stored
- Purpose: Security, theft prevention, operational monitoring, dispute resolution
- Recording: Continuous recording during warehouse operating hours
- Retention: Footage retained for up to 30 days, longer if related to an incident or claim
- Legal basis: Legitimate interests (security and protection of property)
Telephone Call Recording:
- Voice recordings of calls with Storage Pal customer service
- Purpose: Quality assurance, training, dispute resolution, legal compliance
- Notice: You will be informed at the start of each call that it may be recorded
- Retention: Recordings retained for 6 months
- Legal basis: Consent (by continuing the call) and legitimate interests
By using Storage Pal services, you acknowledge and consent to video surveillance in warehouse facilities and recording of telephone communications with customer service.
2.6 Technical and Usage Data
When you use our website and applications:
- IP address
- Device information (device type, operating system, browser type)
- Log data (access times, pages viewed, actions taken)
- Cookie identifiers (see Section 10)
- Geolocation data (with your consent, for service delivery)
- Referral source (how you found our website)
- Session information
2.7 Marketing and Preferences Data
- Marketing consent preferences
- Newsletter subscription status
- Communication preferences (email, SMS, phone)
- Promotional code usage
- Referral program participation
2.8 Special Categories of Data
We do not intentionally collect sensitive personal data (racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, genetic data, sex life, or sexual orientation).
If you inadvertently provide such information (e.g., in customer service communications), we will delete it or process it only with your explicit consent and only when necessary.
3. How We Collect Your Data
3.1 Data You Provide Directly
- Account registration: Name, email, password, phone number
- Service bookings: Addresses, article details, dates
- Payments: Billing information, payment methods
- Customer service: Communications, complaints, feedback
- Marketing: Newsletter signups, survey responses
3.2 Data We Collect Automatically
- Website/app usage: Through cookies, log files, and analytics tools
- Device data: IP address, browser type, operating system
- Location data: From mobile devices (with consent)
3.3 Data from Third Parties
- Payment processors: Transaction confirmation, fraud prevention signals
- Transport partners: Delivery confirmations, issue reports
- Warehouse operators: Article reception confirmations, inventory updates
- Social media platforms: If you connect your account (name, email, profile picture)
- Fraud prevention services: Risk assessment data
- Public sources: Business registry data (for B2B customers)
4. Legal Basis for Processing
We process your personal data based on the following legal grounds:
4.1 Contract Performance (GDPR Article 6(1)(b))
Processing necessary to provide our services to you:
- Creating and managing your account
- Processing orders and payments
- Coordinating collection and delivery
- Providing customer support
- Managing your stored articles
4.2 Legal Obligation (GDPR Article 6(1)(c))
Processing required by law:
- Tax and accounting obligations
- Invoicing requirements (French Commercial Code)
- Identity verification (anti-money laundering)
- Responding to legal requests
- Regulatory reporting
4.3 Legitimate Interests (GDPR Article 6(1)(f))
Processing for our legitimate business interests:
- Warehouse video surveillance: security, theft prevention, protection of customer property, operational monitoring, dispute resolution
- Fraud prevention and security
- Network and information security
- Business analytics and improvement
- Debt collection
- Internal administration
- Legal claims defense
Balancing test: We ensure our interests do not override your rights and freedoms.
4.4 Consent (GDPR Article 6(1)(a))
Processing based on your explicit consent:
- Marketing communications (newsletters, promotional offers)
- Optional cookies (analytics, advertising)
- Location services
- Phone call recordings
- Referral program participation
You can withdraw consent at any time through your account settings or by contacting us.
5. How We Use Your Personal Data
5.1 Service Delivery
- Order processing: Managing collection, storage, and return of your articles
- Transport coordination: Scheduling and routing with transport partners
- Warehouse management: Article tracking, inventory management
- Customer account: Profile management, service history, preferences
- Payment processing: Charging fees, issuing invoices, handling refunds
5.2 Customer Service and Support
- Query resolution: Answering questions, resolving issues
- Complaint handling: Processing and resolving complaints
- Technical support: Troubleshooting account or service issues
- Service improvements: Using feedback to enhance our services
5.3 Marketing and Communications
With your consent:
- Promotional emails: Special offers, discounts, new services
- Newsletter: Tips, news, updates
- SMS marketing: Time-sensitive offers (with explicit SMS consent)
- Referral rewards: Managing referral program participation
You can opt out at any time via unsubscribe links or account settings.
5.4 Business Operations
- Analytics: Understanding service usage, improving user experience
- Quality control: Monitoring service quality, training staff
- Financial management: Accounting, invoicing, tax compliance
- Legal compliance: Meeting regulatory obligations
- Risk management: Fraud prevention, credit risk assessment
5.5 Security and Fraud Prevention
- Account security: Detecting unauthorized access
- Fraud detection: Identifying suspicious transactions or behavior
- Payment verification: Preventing payment fraud
- System security: Protecting against cyber threats
6. How We Share Your Personal Data
We do not sell your personal data. We share data only as described below:
6.1 Service Providers (Data Processors)
We share data with third parties who help us provide services:
Transport Partners
- Data shared: Name, phone number, collection/delivery addresses, article descriptions, special access instructions
- Purpose: Collection and delivery services
- Legal basis: Contract performance
Warehouse Operators
- Data shared: Name, article descriptions, photos, storage duration, access requests
- Purpose: Article storage and retrieval
- Legal basis: Contract performance
Payment Processors
- Data shared: Name, email, billing address, payment method, transaction amount and details
- Purpose: Processing payments securely
- Legal basis: Contract performance
- Security: PCI-DSS compliant processors
Technology Providers
- Email service providers (for transactional and marketing emails)
- Cloud hosting providers (for data storage)
- Customer support platforms (for ticket management)
- Analytics services (for usage insights)
- Purpose: Platform operation and improvement
- Legal basis: Legitimate interests
All service providers are contractually obligated to protect your data, can only use it for specified purposes, and must comply with GDPR and our security standards.
6.2 Legal and Regulatory Authorities
We may disclose data when required by law:
- Courts and tribunals: In response to court orders
- Law enforcement: When legally obligated
- Tax authorities: For tax compliance
- Regulatory bodies: For regulatory compliance
- CNIL: In response to data protection inquiries
Legal basis: Legal obligation (GDPR Article 6(1)(c))
6.3 Business Transfers
If StoragePal is involved in a merger, acquisition, or asset sale:
- Your data may be transferred to the new owner
- We will notify you via email and website notice
- The new owner must honor this Privacy Policy
- You have the right to object
Legal basis: Legitimate interests (GDPR Article 6(1)(f))
6.4 With Your Consent
We may share data with third parties when you explicitly consent:
- Referral programs: Sharing referrer name with referee (if consented)
- Social media: If you connect accounts or share content
- Third-party integrations: If you authorize connections
6.5 Anonymized and Aggregated Data
We may share anonymized or aggregated data that cannot identify you:
- Industry statistics and trends
- Service usage analytics
- Business intelligence
This does not constitute “personal data” under GDPR.
7. International Data Transfers
7.1 Data Storage Location
Your personal data is primarily stored and processed within the European Economic Area (EEA), specifically in France.
7.2 Transfers Outside the EEA
Some service providers may process data outside the EEA. When we transfer data internationally, we ensure appropriate safeguards:
Transfer Mechanisms:
- EU Standard Contractual Clauses (SCCs): Approved by the European Commission
- Adequacy Decisions: Countries recognized by the EU as providing adequate protection
- Your explicit consent: For specific transfers when appropriate
Current Non-EEA Processors:
- Payment processing services (may involve processors with SCCs)
- Cloud infrastructure providers (with EU data residency and SCCs)
- Customer support tools (with EU data centers where possible)
Your Rights: You can request information about international transfers and obtain copies of safeguards by contacting our DPO.
8. Data Retention
We retain your personal data only as long as necessary for the purposes described in this policy and as required by law.
8.1 Retention Periods
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Account data (active customers) | Duration of relationship + 3 years | Contract performance, legal obligation |
| Account data (inactive, no orders) | 3 years of inactivity, then deletion | Legitimate interests |
| Transaction and invoice data | 10 years from transaction | French tax law (CGI Article L102 B) |
| Payment data (card details) | Processed and deleted by payment provider | PCI-DSS requirements |
| Service history (orders, deliveries) | Duration of relationship + 5 years | Legal obligation (warranty, claims) |
| Marketing data (with consent) | Until consent withdrawn + 3 years | Consent, legitimate interests |
| Customer service records | 5 years from last contact | Legitimate interests, legal claims |
| Phone call recordings | 6 months | Legal obligation (dispute resolution) |
| CCTV footage (warehouse surveillance) | 30 days (longer if incident/claim) | Security, legitimate interests, legal obligation |
| Website logs and analytics | 13 months | CNIL recommendation |
| Complaint and claim data | 5 years from resolution | Legal obligation (statute of limitations) |
8.2 Deletion Procedures
After retention periods expire:
- Automated deletion: Systems automatically delete data
- Manual review: Some data requires manual verification before deletion
- Backup systems: Data in backups is overwritten within 90 days
8.3 Legal Hold
We may retain data beyond standard periods when:
- Required by court order or legal investigation
- Necessary for ongoing legal proceedings
- Disputed claims are unresolved
9. Your Privacy Rights
Under GDPR and French law, you have the following rights:
9.1 Right of Access (GDPR Article 15)
You can request:
- Confirmation of whether we process your data
- A copy of your personal data
- Information about processing purposes, categories, recipients
- Data retention periods
- Information about your other rights
How to exercise: Email [email protected] or submit request via your account.
Response time: Within 1 month (may extend to 3 months for complex requests).
Cost: Free for first request; reasonable fee for additional copies.
9.2 Right to Rectification (GDPR Article 16)
You can request correction of inaccurate personal data or completion of incomplete personal data.
How to exercise: Update in your account settings or contact us.
Response time: Within 1 month.
9.3 Right to Erasure / “Right to be Forgotten” (GDPR Article 17)
You can request deletion when:
- Data is no longer necessary for its original purpose
- You withdraw consent (where processing is based on consent)
- You object to processing (see 9.5)
- Data was unlawfully processed
- Legal obligation requires deletion
Exceptions (we may refuse if):
- Legal obligation requires retention (e.g., tax records)
- Legal claims must be defended or established
- Public interest requires processing
How to exercise: Email [email protected].
Response time: Within 1 month.
9.4 Right to Restriction of Processing (GDPR Article 18)
You can request restriction when:
- You contest the accuracy of data (during verification)
- Processing is unlawful, but you prefer restriction over deletion
- We no longer need data, but you need it for legal claims
- You’ve objected to processing (pending verification of legitimate grounds)
How to exercise: Email [email protected].
Response time: Within 1 month.
9.5 Right to Object (GDPR Article 21)
You can object to processing based on:
- Legitimate interests: Object at any time; we must stop unless compelling legitimate grounds
- Direct marketing: Absolute right to object; we must stop immediately
- Profiling for marketing: Absolute right to object
How to exercise:
- Marketing: Click “unsubscribe” in emails or update account preferences
- Other processing: Email [email protected]
Response time: Immediate for marketing; within 1 month for other objections.
9.6 Right to Data Portability (GDPR Article 20)
You can request your personal data in a structured, commonly used, machine-readable format, or transfer of your data directly to another controller (where technically feasible).
Applies to:
- Data you provided to us
- Processing based on consent or contract
- Processing carried out by automated means
How to exercise: Email [email protected].
Response time: Within 1 month.
Format: JSON or CSV.
9.7 Right to Withdraw Consent (GDPR Article 7(3))
When processing is based on consent:
- You can withdraw consent at any time
- Withdrawal does not affect the lawfulness of past processing
- We will stop processing unless another legal basis applies
How to exercise:
- Account settings (for marketing, optional cookies)
- Email [email protected]
- Click “unsubscribe” (for marketing emails)
9.8 Right to Lodge a Complaint
You can file a complaint with:
CNIL (French Data Protection Authority)
Commission Nationale de l’Informatique et des Libertés
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07, France
Website: www.cnil.fr
Phone: +33 1 53 73 22 22
Or your local EU data protection authority if you reside outside France.
9.9 Exercising Your Rights
How to submit requests:
- Email: [email protected]
- Account portal: [Your Account] > [Privacy Settings] > [Data Rights Request]
- Mail: Data Protection Officer, Storage Pal SAS, 24 rue Miollis, 75015 Paris, France
Verification: We may request identification to verify your identity before processing requests.
Response time: Within 1 month (may extend to 3 months for complex requests; we will inform you of extensions).
No fee: Generally free; reasonable fees may apply for manifestly unfounded or excessive requests.
10. Cookies and Tracking Technologies
10.1 What Are Cookies?
Cookies are small text files stored on your device when you visit our website. They help us provide and improve our services.
10.2 Types of Cookies We Use
10.2.1 Strictly Necessary Cookies
Purpose: Essential for website functionality.
Examples: Session authentication, security features, load balancing, shopping cart functionality.
- Legal basis: Legitimate interests (GDPR Article 6(1)(f))
- Consent required: No (exempt under ePrivacy Directive)
- Can be disabled: No, but you can stop using our site
10.2.2 Functional Cookies
Purpose: Enhanced functionality and personalization.
Examples: Language preferences, display preferences, user interface customization, “Remember me” functionality.
- Legal basis: Consent (GDPR Article 6(1)(a))
- Consent required: Yes
- Duration: Up to 12 months
10.2.3 Analytics and Performance Cookies
Purpose: Understanding how visitors use our site.
Examples: Google Analytics (anonymized), page view tracking, session duration, bounce rate analysis.
- Legal basis: Consent (GDPR Article 6(1)(a))
- Consent required: Yes
- Duration: Up to 13 months (CNIL recommendation)
- Anonymization: IP addresses are anonymized
10.2.4 Marketing and Advertising Cookies
Purpose: Delivering relevant advertisements.
Examples: Google Ads, Facebook Pixel, retargeting tags, conversion tracking.
- Legal basis: Consent (GDPR Article 6(1)(a))
- Consent required: Yes
- Duration: Up to 13 months
10.3 Cookie Consent Management
- First visit: Cookie banner appears requesting consent
- Granular choices: Accept all, reject all, or customize by category
- Withdraw consent: Change preferences anytime via the cookie settings link
Cookie Settings Access:
- Footer of every page: “Cookie Preferences”
- Account settings: [Privacy] > [Cookie Preferences]
- Email: [email protected]
10.4 Third-Party Cookies
Some cookies are set by third-party services:
| Service | Purpose | Privacy Policy |
|---|---|---|
| Google Analytics | Website analytics | https://policies.google.com/privacy |
| Google Ads | Advertising | https://policies.google.com/technologies/ads |
| Facebook Pixel | Advertising | https://www.facebook.com/privacy/explanation |
10.5 Do Not Track (DNT)
We do not currently respond to DNT browser signals, as there is no industry standard for compliance. You can control tracking through cookie preferences.
10.6 Cookie List
You can view our complete cookie list in your browser settings or by visiting our Cookie Policy page. We will update our cookie list when we add or remove cookies.
11. Security Measures
11.1 Technical Security Measures
We implement industry-standard security measures:
Encryption:
- In transit: TLS 1.2+ encryption for all data transmission
- At rest: AES-256 encryption for stored sensitive data
- Passwords: Bcrypt hashing with salt
Access Controls:
- Role-based access control (RBAC)
- Multi-factor authentication (MFA) for staff
- Principle of least privilege
- Regular access reviews
Network Security:
- Firewalls and intrusion detection systems
- DDoS protection
- Regular vulnerability scanning
- Penetration testing (annual)
Application Security:
- Input validation and sanitization
- SQL injection prevention
- Cross-site scripting (XSS) protection
- CSRF token protection
11.2 Organizational Security Measures
Staff Training:
- Annual GDPR and data protection training
- Security awareness programs
- Phishing simulation exercises
Policies and Procedures:
- Data protection policies
- Incident response plan
- Business continuity plan
- Vendor management procedures
Physical Security:
- Secure data centers with access controls
- 24/7 monitoring and surveillance
- Environmental controls (fire, flood, temperature)
11.3 Data Breach Procedures
In the event of a personal data breach:
Within 72 hours:
- Notify CNIL (if risk to rights and freedoms)
- Assess nature and impact of the breach
- Implement containment measures
Without undue delay:
- Notify affected individuals (if high risk)
- Provide information about the breach and mitigation steps
- Document the breach in internal register
Notification will include: nature of the breach, categories and volume of data affected, likely consequences, measures taken or proposed, and contact point for further information.
Report breaches to: [email protected]
11.4 Your Security Responsibilities
You should:
- Use a strong, unique password
- Enable two-factor authentication (if available)
- Keep login credentials confidential
- Log out after using shared devices
- Report suspicious activity immediately
We will never:
- Ask for your password via email or phone
- Request credit card details via email
- Send unsolicited links requesting login
12. Children’s Privacy
12.1 Age Requirement
Our services are not intended for children under 18 years of age. We do not knowingly collect personal data from children.
12.2 Parental Consent
If you are under 18:
- You may not create an account without parental consent
- Your parent or guardian must create the account
- We may request verification of parental consent
12.3 Discovery of Child Data
If we discover we have collected data from a child under 18 without proper consent:
- We will delete the data as soon as possible
- We will deactivate the account
- We will notify the individual (or parent/guardian) if contact information is available
To report child data: Email [email protected] immediately.
13. Third-Party Links
13.1 External Websites
Our website and communications may contain links to third-party websites:
- Social media platforms (Facebook, Instagram)
- Partner services
- Industry resources
We are not responsible for privacy practices of third-party sites, content on external websites, or data collection by third parties.
13.2 Before Visiting Third-Party Sites
We recommend:
- Reading their privacy policies
- Understanding their data practices
- Reviewing their cookie policies
This Privacy Policy applies only to StoragePal services.
14. Changes to This Policy
14.1 Updates
We may update this Privacy Policy to reflect:
- Changes in our data practices
- New legal requirements
- Service enhancements
- Feedback from regulators or users
14.2 Notification of Changes
Material changes:
- Email notification to registered users (30 days advance notice)
- Prominent website banner
- In-app notification
- Updated “Last Updated” date at top of policy
Non-material changes:
- Updated “Last Updated” date
- Website notification
14.3 Your Options
After notification of material changes:
- Accept: Continue using services (constitutes acceptance)
- Reject: Stop using services and request account deletion
- Object: Contact us to discuss specific concerns
14.4 Version History
Previous versions of this Privacy Policy are available upon request to [email protected].
15. Contact and Complaints
15.1 Data Protection Officer
For privacy questions, concerns, or to exercise your rights:
Email: [email protected]
Mail: Data Protection Officer, Storage Pal SAS, 24 rue Miollis, 75015 Paris, France
Phone: 01 76 34 00 47
Response time: We aim to respond within 48 hours for initial acknowledgment and within 1 month for full resolution.
15.2 General Inquiries
Customer Service
Email: [email protected]
Phone: 01 76 34 00 47
Hours: Monday–Friday 9:00 AM – 6:00 PM CET, Saturday 10:00 AM – 2:00 PM CET
15.3 Complaints and Disputes
Internal complaint process:
- Contact our DPO: [email protected]
- We will investigate and respond within 1 month
- If unresolved, we will escalate to senior management
External complaint: If you are not satisfied with our response, you have the right to lodge a complaint with:
CNIL (Commission Nationale de l’Informatique et des Libertés)
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07, France
Website: www.cnil.fr
Phone: +33 1 53 73 22 22
Online complaint: https://www.cnil.fr/fr/plaintes
Appendix: Legal Framework
This Privacy Policy is designed to comply with:
EU and French Law:
- GDPR (General Data Protection Regulation) – EU 2016/679
- French Data Protection Act (Loi Informatique et Libertés) – Law No. 78-17 of 6 January 1978 (as amended)
- ePrivacy Directive – Directive 2002/58/EC (as amended)
- French Commercial Code – Invoicing and record-keeping requirements
- CNIL Guidelines – French data protection authority recommendations
Industry Standards:
- PCI-DSS – Payment Card Industry Data Security Standard
- ISO 27001 – Information Security Management
- ISO 27701 – Privacy Information Management
This Privacy Policy was last updated on February 8, 2026 and is effective as of February 8, 2026.
For the most current version, please visit: https://storagepal.fr/privacy-policy/
Quick Reference Guide
Your Key Rights:
- Access your data
- Correct inaccuracies
- Delete your data (with exceptions)
- Object to processing
- Restrict processing
- Export your data (portability)
- Withdraw consent anytime
- Complain to CNIL
Contact for Rights Requests: [email protected]
We Do NOT:
- Sell your personal data
- Process data from children under 18
- Share data without legal basis
- Transfer data outside EEA without safeguards
We DO:
- Protect your data with encryption
- Honor your privacy rights
- Keep data only as long as necessary
- Give you control over your information