Our Commitment to Your Privacy

TREATMENT OF PERSONAL DATA
At OhMyBox! we are concerned about the personal data we process and about the exact compliance with the current regulations on personal data protection, among others, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, as well as Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights.

In accordance with this, we hereby inform you of the following questions regarding the processing of personal data carried out by OhMyBox!:

Who is the controller of the processing of your personal data?
Identity: OMB SELF STORAGE, S.L.U. (hereinafter, OhMyBox!)
FISCAL IDENTIFICATION NUMBER (NIF): B65983462
Postal address::  Carrer de la Marina, no. 153
                        ZIP 08013, Barcelona
Data protection delegate:: dpo2@ohmybox.es

Principles relating to the processing
The principles required by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as RGPD) are respected in the processing of personal data carried out therein:
  • Principle of lawfulness, fairness and transparency: the data we collect are processed lawfully, fairly and transparently, with the prior consent of the data subjects where necessary or, where appropriate, for the performance of a contract to which the data subject is a party or for the implementation at the request of the data subject of pre-contractual measures, or, if the processing is necessary for compliance with an applicable legal obligation or the fulfilment of legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
 
  • Purpose limitation principle: the personal data we process are used for the purposes indicated in the section “For what purposes do we use your personal data?”
  • Principle of data minimization: in accordance with this principle, the only personal data we collect from users are those strictly necessary for contractual relations, to manage and deal with requests for quotations, the participation of interested parties in the selection processes we carry out and to be able to deal with queries or requests made to us by users.
  • Principle of accuracy: the personal data we collect will be kept accurate and, if necessary, updated. To this end, in the event of any change in personal data, the user must inform us so that we can carry out the appropriate update.
  • Principle of limitation of the retention period: the personal data that we process will be kept for the periods indicated in the section “How long will we keep your personal data?”
  • Principle of integrity and confidentiality: to respect this principle, personal data will be processed in a way that ensures adequate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by applying appropriate technical and organisational measures.
What categories of personal data do we process?
The categories of data that we process through this website are:
  • Data collected through the contact form: name; e-mail address; telephone number and message sent by the user.
  • Data collected through the quotation request form: name and surname; e-mail address; postcode; telephone; type of storage room for which you are requesting a quotation; duration.
All the personal data requested in the forms are obligatory so that, in the event that the user does not provide any of them, we will not be able to manage and attend to the budget requests, the participation of the interested parties in the personnel selection processes that we carry out, or the consultations or requests made by the users.
Cookies collect information on the use made by users of the website, pages visited, origin, geographical location, and IP addresses, although this information will be collected in aggregate form, i.e., without identifying users. You can consult the information on the cookies used in the “Cookies policy”.

How did we obtain your personal data?
All personal data processed by OhMyBox! is provided to us by the data subjects themselves or their legal representatives.
The personal data that we collect through this website has been collected through the different existing forms, the contact email address or by telephone.

For what purpose do we use your personal data ( whether users of the website or not)?
Customer data: we use your personal data for the proper maintenance, development, fulfilment and control of the contractual relationship with our customers and the services they require.
We also use their identification and contact details to send them commercial information about our products, services, news, articles, updates, offers and promotions.
Supplier data: we use your personal data for the proper maintenance, development, fulfilment and control of the contractual relationship with our suppliers and the services they provide us.
Personnel data: we use your personal data for the proper maintenance, development, fulfilment and control of the contractual relationship with our employees, as well as compliance with current legislation on labour, Social Security and Occupational Risk Prevention that may be applicable.
Data collected through the "Work with us" section: we use your personal data to manage the participation of interested parties in the personnel selection processes that we carry out.
Data collected through the contact form: the personal data provided by users are used to manage and respond to the queries or requests they make.
Data collected through the quotation request form: the personal data provided by users are used to manage and respond to the quotation requests they make.
Likewise, in the event that they have given their consent by ticking the box provided for this purpose next to the form, we will use their personal data to send communications based on the service.
Data of users of our profiles on social networks: to interact with our users, mainly by responding to comments they make to the publications we make on the profiles we have on different social networks.

What is the legal basis for the processing of your personal data?
Customer data: the legal basis that legitimises the processing of your personal data is its necessity for the execution of the contract to which the customers are a party.
As regards the sending of commercial information, the legal basis that legitimates such processing is its necessity for the satisfaction of legitimate interests pursued by OhMyBox! as provided for in Article 6.1. f) of the General Data Protection Regulation. This is without prejudice to the possibility that you have to oppose sending this commercial information, which you can do at any time and in each communication we send, where we will provide you with a simple and free system to unsubscribe and stop receiving it.
Supplier data: the legal basis that legitimises the processing of their personal data is their need for the execution of the contract to which they are a party.
Personnel data: the legal basis for the processing of your personal data is the need for the execution of the contract to which the employees are a party.
Data collected through the "Work with us" section: the legal basis legitimising the processing of the personal data of data subjects is their need for the implementation of pre-contractual measures at their request.
Data collected through the contact form: the legal basis that legitimises the processing of the personal data provided by the interested parties is their need for the execution of the legal relationship that arises from filling in this form and, therefore, to manage the queries or requests they make to us.
Data collected through the quote request form: the legal basis that legitimises the processing of users' personal data is their need for the application of pre-contractual measures at their request.
With regard to the sending of service-based communications, the legal basis for the processing of your data is the consent you give us by ticking the box provided for this purpose next to the form. In any case, you may withdraw your consent at any time and in each communication we send, where we will provide you with a simple and free system to unsubscribe and stop receiving them.
Data of users of our profiles on social networks: the legal basis that legitimises the processing of the personal data of our followers and users of our social networks is the consent they give when they follow us on them, although they may stop doing so at any time.
To which recipients will your personal data be disclosed?
The personal data of customers, suppliers and employees will be communicated, where appropriate, to the tax authorities for compliance with legal and tax obligations, as well as to the financial institution(s) through which OhMyBox! manages collections (in the case of customers) and payments (in the case of suppliers and employees).
In other cases, we do not disclose personal data to third parties unless it is necessary to comply with legal obligations.
However, for some matters, we use the services of third parties, who act as data processors, with whom we have signed the corresponding data processing contract in accordance with the provisions of article 28.3 of the RGPD.
Data transfers to third countries
For the management and storage of information and e-mail, we use the services of Microsoft Corporation, a company that acts as a data processor and which, despite being outside the European Union and the European Economic Area, the international transfer of data involved in its use also has the appropriate guarantees provided for in Article 46.2 c) of the General Data Protection Regulation (standard contractual clauses adopted by the European Commission).
  • Microsoft Privacy Policy.
  • Microsoft Data Protection Addendum.
Similarly, our systems and this website are operated by our parent company, Safestore Limited, based at Brittanic House, Stirling Way, Borehamwood, Hertfordshire, WD6 2BT (UK), which also involves an international transfer of data, which is also secured by the existence of an adequacy decision of the European Commission, namely Commission Implementing Decision (EU) 2021/1772 of 28 June 2021 under Regulation (EU) 2016/679 of the European Parliament and the Council on the adequate protection of personal data by the United Kingdom.
In addition, as we use Google Analytics analytics cookies, their use also implies the existence of international data transfers, and information on this can be found in our Cookie Policy.
How long will we retain your personal data?
Customer data: personal data will be retained for the duration of the contractual relationship and, once this has ended, for the periods necessary to comply with legal obligations.
In relation to the sending of commercial information, personal identification and contact data will be retained until the interested parties express their refusal to continue receiving it, which they can do in each commercial communication we send them, where we will provide them with a simple and free system to unsubscribe and stop receiving it.
Supplier and personnel data: the personal data of employees will be retained for the duration of the contractual relationship and, once this has ended, for the periods necessary to comply with legal obligations.
Data collected through the "Work with us" section: the personal data of candidates and their curriculum vitae will be retained for a maximum period of twelve months from their submission, even if they are not initially hired so that we can use them for other selection processes. Once this twelve-month period has elapsed, we will proceed to delete them.
Data collected through the contact form: the personal data provided by users when filling in the form will be retained only during the management of the queries or requests they make to us and, subsequently, for the periods necessary to comply with legal obligations.
Data collected through the quotation request form: the personal data provided by users when filling in the form will be retained for the periods necessary to process the quotation requests and, subsequently, for the periods necessary to comply with legal obligations.
With regard to the sending of service-based communications, we will retain your personal data until the interested parties revoke any consent they may have given, which they may do at any time and, in any case, in each commercial communication we send them, where we will provide them with a simple and free system to unsubscribe and stop receiving it.
Data of users of our profiles on social networks: we will retain personal data on the respective social network until the followers stop following us.
What are your rights when you provide us with your personal data?
  • Right to request access to your personal data: to know and verify the lawfulness of the processing, you may ask us at any time to confirm whether OhMyBox! is processing your personal data and, if so, we will inform you, among other things, about what data we are processing, its purpose, the origin of the data, the expected period of retention of the data and, where appropriate, the recipients or categories of recipients.
  • Right to request rectification: you may ask us to rectify personal data that is inaccurate or to supplement incomplete personal data, including using an additional statement. In this case, you must indicate in your request which data you are requesting and the correction to be made and, if necessary, provide us with documentary evidence of the inaccuracy or incompleteness of the data undergoing processing.
  • Right to request deletion ("right to erasure"): you may request that your personal data be deleted and no longer processed if they are no longer necessary for the purposes for which they were collected or otherwise processed, you withdraw your consent, they have been unlawfully processed or they must be deleted to comply with a legal obligation.
  • Right to request the restriction of the processing of your personal data: in this case OhMyBox! will only retain your personal data to formulate, exercise or defend claims, for the protection of the rights of another natural or legal person or reasons of substantial public interest.
  • Right to portability of your personal data: you can ask us to provide your personal data, to you or to another controller you specify, in a structured, commonly used and machine-readable format.
  • Right to object to processing: OhMyBox! will stop processing your personal data in the manner you have indicated unless we need to continue processing it for compelling legitimate reasons or the formulation, exercise or defence of any claims.
How to exercise your data protection rights: to exercise your rights you must send us a written request addressed to OMB SELF STORAGE, S.L.U., at Carrer de la Marina, no. 153, ZIP 08013, Barcelona, or by sending an e-mail to dpo2@ohmybox.es. In any case, we may ask you for a copy of your ID card if it is necessary to prove your identity.
OhMyBox! will respond to all requests within the terms and conditions required by current legislation on personal data protection.
How to file a complaint with the Spanish Data Protection Agency: if you consider that we have not properly handled your personal data or that we have not properly attended to the exercise of your data protection rights, you can file a complaint with the Spanish Data Protection Agency, either through its electronic headquarters or at its address, calle Jorge Juan, no. 6, ZIP 28001 in Madrid.
More information on data protection rights and complaints to the supervisory authority can be found at www.aepd.es.

Security
In accordance with the provisions of Article 32 of the RGPD, OhMyBox! has adopted the appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
To assess the adequacy of the level of security, a particular account has been taken of the risks presented by the processing of data, in particular as a result of the accidental or unlawful destruction, loss or alteration of personal data transmitted, retained or otherwise processed, or the unauthorised disclosure of or access to such data.
Duty of secrecy
OhMyBox! has taken measures to ensure that any person acting under their respective authority who has access to the personal data provided to us by users may only process such data on the instructions of the company, and must also maintain the corresponding professional secrecy over such data, which shall be of indefinite duration.
To this end, our employees have signed a document of confidentiality and duty of secrecy regarding the information and personal data that they process as part of their working relationship with the company.

Use of the website by minors
We kindly ask users to read the policies on the use of the website by minors that we have published in the “Legal notice” on our website.

Social Networking
Profiles on social networks: OhMyBox! has profiles on some of the main social networks that exist today, so the personal data of our followers, people who appear in the publications we make (for example, photographs) and people who send us private messages may be processed.

Data processing and purpose: the data processing that OhMyBox! will carry out is limited and conditioned to the policies and functionalities of each social network.
When a user becomes a follower of ours on a social network, they authorise us to use their personal data only within the scope of the corresponding social network for the management of our page or profile and the communications that we maintain in a bidirectional manner with our followers through chat, messages or other means of communication that the Social Network currently and in the future allows. This implies that we will have access to the information of your profile that appears in the comment, for example, and without limitation, your user name, image (in the event that the user has put a picture on your profile), and comments made.
We would also like to inform you that, when a user becomes a follower of ours, the news we publish may also appear on their wall and that, if they make comments on our wall, both their comment and the name of their profile and, where appropriate, the photograph they have on their profile, will be accessible to other followers. In any case, the user is responsible for the use they make of the Social Network.
We will not use the personal data of users for purposes other than those indicated in previous paragraphs or to send them information through an environment other than the social network.
Unless the interested party gives their consent or requests us to do so to deal with a request they make to us, we will not extract their personal data from the social network environment.

Data protection rights: with regard to the rights of access, rectification or deletion, restriction of processing, opposition and portability of your personal data, we can only act in accordance with the possibilities that each social network allows for this purpose. OhMyBox! will provide all possible assistance to the interested party so that they can exercise the aforementioned rights.
In any case, any of our followers may unsubscribe from our page or profile at any time so that we would no longer have access to their personal data, although the social network may retain the comments previously made on our wall.
In any case, it is the responsibility of the user to use the Social Network, so OhMyBox! does not assume any responsibility in this regard.
You can consult the privacy policy of each of the social networks where OhMyBox! has a page or profile below: Cookies
Cookies are small text files that are stored on the hard disk or in the memory of the computer that accesses or visits the pages of certain websites so that the user's preferences can be known when they log on again. Cookies stored on the user's hard drive cannot read the data contained therein, access personal information or read cookies created by other providers.
See information on the cookies used on this website in the “ Cookies policy” section.
Text dated: 26 April 2023
Complete your quote

You’re almost done!

Complete your quote at