m² SELF STORAGE

Privacy Policy

This Privacy Policy explains what personal data M2 SELF STORAGE SINGLE-MEMBER P.C. (the “Company” or “m² Self Storage”) collects, why and on what legal basis we process it, who we share it with, how long we keep it and what rights you have.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Greek Law 4624/2019 and, for cookies and electronic communications, Greek Law 3471/2006.

1

Data controller

The controller of your personal data is:

  • Company name: M2 SELF STORAGE ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε. (single-member private company), trading as m² Self Storage
  • Registered office: 17 Krystalli & 1 Damokleous Street, 121 31 Peristeri, Athens, Greece
  • VAT No.: EL802444407 · General Commercial Registry (G.E.MI.) No.: 176468603000
  • Phone: +30 211 218 0577 · Email: info@m2selfstorage.gr

For any question or request about your personal data, contact us at info@m2selfstorage.gr. The Company has not appointed a Data Protection Officer (DPO), as it is not required to under Article 37 GDPR.

2

What data we collect

We collect only the data needed for each purpose. Most of it you give us directly; some is collected automatically when you browse the Website or visit our facilities.

1

Contact and quote requests

Your first and last name, email address, phone number, the service you are interested in, the unit size and rental period you want, and anything you write in your message.

2

Storage size calculator

The items and quantities you select, the suggested unit size and rental period, and your contact details if you ask for a quote.

3

Newsletter

Your email address, if you subscribe.

4

Customers

For a storage unit or registered business address contract: your full name, Tax Identification Number (ΑΦΜ) and identity card details, together with your contact details. For a registered business address, these details are also used for the electronic lease filed with the Greek tax authority (AADE), and we also process details of the mail we receive on your behalf.

5

Visitors to our facilities

Images from security cameras (CCTV) at the entrances and common areas, and an access log (personal code, date and time of entry). Signs are posted wherever CCTV is in operation.

6

Browsing the Website

IP address, device and browser type, pages visited, date and time, and cookie data according to your choices. See our Cookie Policy for details.

3

Purposes and legal basis

We process your data only where there is a legal basis under Article 6 GDPR:

  • Answering requests and sending quotes — steps taken at your request before entering into a contract (Art. 6(1)(b)).
  • Entering into and performing the contract, customer service and receiving mail — performance of a contract (Art. 6(1)(b)).
  • Invoicing, bookkeeping and filing the electronic lease with AADE — compliance with a legal obligation (Art. 6(1)(c)).
  • Sending our newsletter and offers — your consent (Art. 6(1)(a)), which you can withdraw at any time.
  • Security of people and property at our facilities (CCTV, access control) — our legitimate interest (Art. 6(1)(f)).
  • Protecting the Website from spam and abuse (Google reCAPTCHA) and keeping it running — legitimate interest (Art. 6(1)(f)).
  • Visitor statistics and ad measurement (Google Analytics, Google Ads, Meta Pixel, Nimbata) — your consent through the cookie banner (Art. 6(1)(a) GDPR and Art. 4(5) of Law 3471/2006).
  • Establishing, exercising or defending legal claims — legitimate interest (Art. 6(1)(f)).

We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you.

4

Who receives your data

Your data is accessible only to authorised Company staff and, where necessary, to the following recipients:

  • providers of Website hosting, maintenance, technical support and email delivery;
  • Google (Google Analytics, Google Ads, Google Tag Manager, reCAPTCHA, Google Maps);
  • Meta Platforms (Meta Pixel);
  • Mailchimp, to send our newsletter;
  • Nimbata, to measure phone calls that come from the Website (call tracking);
  • Trustindex, to display Google reviews;
  • CookieYes, to manage cookie consent;
  • our accounting firm;
  • public authorities (such as AADE), courts and legal advisers, where required by law or to protect our rights.

Anyone processing data on our behalf is bound by a contract under Article 28 GDPR. We do not sell or rent your personal data.

5

Transfers outside the European Union

Some of the providers above (such as Google, Meta, Mailchimp and Nimbata) may process data in the United States or other countries outside the EU. These transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, for certified companies, or on the European Commission’s Standard Contractual Clauses.

6

How long we keep your data

  • Requests that did not lead to a contract: up to 12 months from our last contact.
  • Customer data: for the term of the contract and afterwards for as long as tax and accounting law requires, or until any related claims become time-barred.
  • Newsletter: until you unsubscribe.
  • CCTV footage: up to 15 days, unless needed to investigate a specific incident.
  • Access log: up to 30 days, unless needed to investigate a specific incident.
  • Cookies: as set out in our Cookie Policy.

When these periods end, the data is deleted or anonymised.

7

Your rights

Under the GDPR you have the right to:

  • be informed and access your data;
  • have inaccurate or incomplete data corrected;
  • have your data erased (the “right to be forgotten”), where it applies;
  • restrict processing;
  • data portability for the data you have given us;
  • object to processing based on legitimate interest and, in every case, to direct marketing;
  • withdraw your consent at any time, without affecting the lawfulness of processing carried out before you withdrew it.

To exercise your rights, email us at info@m2selfstorage.gr. We will reply without undue delay and within one month at the latest; this can be extended by two further months where necessary. Exercising your rights is free of charge; we may ask for information to confirm your identity.

8

Do you have to give us your data?

Fields marked as required on our forms are needed so that we can answer your request. The details we ask for when you sign a contract are needed for the contract and for our legal obligations; without them we cannot provide the service. Subscribing to the newsletter and accepting non-essential cookies are optional.

9

Data security

We take appropriate technical and organisational measures to protect your data against loss, misuse, unauthorised access, alteration or disclosure, such as an encrypted connection (HTTPS), access limited to authorised persons, and secure storage.

10

Cookies

The Website uses cookies. Non-essential cookies, such as those for statistics and advertising, are set only with your consent, which you can give, refuse or change at any time in the Website’s cookie settings. Details are in our Cookie Policy.

11

Right to lodge a complaint

If you believe that the processing of your data breaches the law, you have the right to lodge a complaint with the competent supervisory authority:

Hellenic Data Protection Authority (HDPA)
1-3 Kifisias Avenue, 115 23 Athens, Greece
Phone: +30 210 6475 600
Email: contact@dpa.gr
Website: www.dpa.gr

12

Changes to this Policy

We may update this Policy when our services or the law change. The current version is always published on this page.

Last updated: 30 October 2026

13

Governing law

This Policy is governed by Greek law. The courts of Athens have jurisdiction over any dispute, without prejudice to mandatory consumer-protection rules.