Privacy Policy

WADAYA SELF STORAGE W.L.L, CR No. 197353 - 1, is a self storage business operating in the Kingdom of Bahrain. For the personal data covered by this policy, we act as the data controller within the meaning of Bahrain's Personal Data Protection Law (PDPL).

We are responsible for deciding how and why that personal data is handled. If you have a question about anything in this policy, contact us using the details at the end of it.

This policy applies whenever you deal with us: when you visit our website or use any of our online services, when you enquire about, reserve, or rent a unit, when you visit or use our facilities, when you contact us by any channel, and in any other dealings you have with us, online or offline.

It applies whether you are a prospective customer, a current customer, a former customer, someone acting for a customer, or a visitor to our facilities or our website. Where a separate notice is given to you at the point information is collected, that notice applies in addition to this policy.

This policy applies to personal data, meaning information that identifies you or can reasonably be linked to you. It does not apply to information that is publicly available, or that has been anonymised, de-identified, or aggregated so that it no longer identifies you.

We may use and disclose that information for any lawful business purpose, without restriction and without further notice to you or your consent, including to understand demand, to plan and improve our services, and to report on our business.

What we collect depends on how you deal with us:

• Contact details, such as your name, phone number, email address, and postal address.
• Identity and agreement details, such as identification details, date of birth, signature, and the agreements you enter into with us.
• Billing records, such as rentals, invoices, payments, balances, and amounts owed.
• Payment details, collected and held by our payment providers when you pay or save a payment method.
• Usage data, such as pages visited, referring sources, and device, browser, and network information, collected through cookies and similar technologies.
• Communications, meaning messages and correspondence you exchange with us through any channel.
• Facility records, such as access records and security camera footage.
• Preferences, such as your marketing choices, language, and the settings you select.
• Any other information you choose to provide, or that we describe to you when we collect it.

We collect personal data:

• from you directly, when you contact us, request a quote, reserve or rent a unit, create or use an account, or visit one of our facilities;
• from your use of our website and online services, automatically, through cookies and similar technologies;
• from our facilities, through access systems and security cameras;
• from people acting for you, such as an alternative contact, a representative, or a colleague at your organisation;
• from third parties, such as our service providers, payment providers, advertising and analytics partners, and publicly available sources.

Some categories of information are treated as sensitive under the PDPL, including information about health, religious or political beliefs, ethnic origin, and criminal records. We do not normally ask for sensitive personal data and you should not send it to us unless we ask for it.

If we do need it for a specific reason, we will explain why and, unless another lawful ground applies, we will ask for your explicit consent. You may withdraw that consent at any time.

If you give us the details of another person, for example as an alternative or emergency contact, as someone authorised to access a unit or act for you, or as a referee, you confirm that they have agreed you may do so and that you have told them about this policy.

We may contact that person about your account and deal with them in relation to it as if they were you, including where we are unable to reach you. You may ask us at any time to remove them, and they may contact us about their own information.

Where our customer is a company or other organisation, we process personal data about the people who act for it, such as its authorised signatories, contacts, and the individuals it permits to access a unit. This policy applies to that information in the same way.

If you give us personal data about your colleagues, you confirm that you are entitled to do so and that they have been told about this policy.

We use personal data:

• to provide our services, including enquiries, quotes, reservations, agreements, rentals, and account access;
• to manage billing, including invoicing, charging saved payment methods, receipts, reminders, and collecting amounts owed;
• to verify identity and to prevent, detect, and investigate fraud, misuse, and security incidents;
• to protect our premises and property, and the people and goods in them;
• to send service communications about your enquiry, rental, account, or payments;
• to send marketing communications where permitted, always with a way to opt out;
• to measure and improve our advertising, our website, and our services, and to understand how they are used;
• to manage complaints, claims, and disputes, and to keep records of our dealings with you;
• to comply with legal obligations and to establish, exercise, or defend legal claims;
• for any purpose we describe to you at the time we collect the information;
• for any other purpose with your consent, or as otherwise permitted by law.

We rely on a different lawful ground depending on the situation.

Contract. Where we need the information to enter into an agreement with you, to take steps you request before an agreement, or to perform an agreement, including providing the unit, managing your account, and being paid.

Legal obligation. Where we are required to collect, hold, or disclose information, including for tax and accounting, identity verification, and responding to a lawful request from an authority.

Consent. Where you have given consent, for example to some marketing or to non-essential cookies. You may withdraw consent at any time, and doing so does not affect what was done before you withdrew it.

Legitimate business purposes. Where processing is otherwise permitted under the PDPL, including securing our premises and services, preventing fraud, understanding and improving how our services are used, marketing responsibly, recovering amounts owed, and protecting our legal position.

Where permitted, we may contact you about our services, offers, and news, by email, SMS, or similar channels, and we may use information about your interests and how you use our website to make what we send more relevant.

You can opt out at any time by using the unsubscribe link in any marketing message, by changing your preferences where we offer them, or by contacting us. Opting out of marketing does not stop service communications about your enquiry, rental, account, or payments, which are part of the service and cannot be opted out of while you hold an agreement with us.

Where you apply for or hold an account with us, we may carry out identity, fraud, and credit-related checks, and we may take those checks into account in deciding whether to enter into or continue an agreement and on what terms.

Where amounts are owed to us, we may use and share personal data to recover them, including with debt recovery and credit management providers and our legal advisers, and we may record how an account has been conducted.

To protect our customers and their goods, our staff, and our premises, security cameras operate at our facilities and record activity in and around them around the clock. Entry to and movement within our facilities may also be recorded. Signage at our facilities makes clear that recording takes place.

Only authorised personnel have access to the cameras and the recordings. Recordings are treated as confidential and are not shared with others, except where disclosure is required or permitted by law or requested by a competent authority, or where it is necessary to perform or enforce an agreement, investigate an incident, deal with a damage or insurance claim, or establish, exercise, or defend a legal claim.

We do not sell personal data. We may disclose information that does not identify any individual, including aggregated information, without restriction. We share personal data only with:

• service providers who process data for us, such as hosting and cloud infrastructure, billing and payment systems, messaging services, and analytics and advertising services, under appropriate safeguards;
• professional advisers, such as lawyers, accountants, auditors, and insurers, where needed;
• debt recovery and credit management providers, where amounts are owed to us;
• a person you have named as an alternative contact or as authorised to act for you;
• authorities, courts, and regulators, where the law requires or permits it, or where necessary to protect the rights, property, or safety of any person;
• a buyer or successor, if our business or assets are transferred, as part of that transaction;
• any other recipient we describe to you at the time, or with your consent.

We and our service providers may store or process personal data outside the Kingdom of Bahrain, including in countries whose data protection laws differ from Bahrain's. Where that happens, we require safeguards intended to keep the data protected consistently with this policy and applicable law.

We keep personal data for as long as it is needed for the purposes described in this policy, including the life of your agreement, amounts owed, disputes, and any record-keeping period required or advisable under applicable law, and then delete or anonymise it. How long that is depends on the type of information and why we hold it.

We may keep personal data for longer where we are required or entitled to preserve it, including in connection with an actual or anticipated claim, investigation, or regulatory request, and we may decline a deletion request on that basis.

We apply physical, electronic, and administrative measures appropriate to the personal data we hold, and we limit access to those who need it for a legitimate business purpose. People who handle personal data for us are required to keep it confidential and to use it only for the purposes we permit.

Where you are given, or choose, credentials for access to any part of our services, you are responsible for keeping them confidential and for activity carried out using them. No system can be guaranteed fully secure, and transmission over the internet is at your own risk to the extent permitted by law. We are not responsible for the circumvention of any security or privacy measure.

We rely on the information you give us being accurate and current. Please tell us promptly if your contact details, billing details, or any other information change, or if anything we hold about you is wrong or incomplete, and we will correct it. Where we can, we will also tell anyone we have shared the incorrect information with.

Cookies are small files placed on your device when you visit a website. We use cookies and similar technologies to make our website work, to remember your preferences, to understand how visitors use it, and to support our advertising. Some are set by us and some by the services we use.

Broadly, they fall into four groups: those that are necessary for the website to function; those that remember your preferences; those that help us measure and analyse how the website is used; and those used for advertising and to measure how our advertising performs.

We use analytics and measurement services to understand how visitors reach and use our website, and third-party advertising services to measure the performance of our advertising and to show our advertising to people who have visited it. For these purposes we may share limited data with those services, including information about your visit and identifiers derived from your contact details.

You can control cookies through your browser settings, and through any cookie controls we offer on our website. Blocking cookies may affect parts of the website. We do not control how third-party services collect or use information through their own technologies, and we do not respond to browser “do not track” signals.

Subject to the PDPL, you have the following rights in relation to your personal data:

• to be told what personal data we hold about you and to request a copy of it;
• to have inaccurate or incomplete information corrected;
• to ask us to delete personal data in certain circumstances;
• to object to processing in certain circumstances, including processing for direct marketing;
• to ask us to restrict how we process your personal data in certain circumstances;
• to withdraw consent where processing is based on consent;
• to ask us to transfer certain personal data to you or to another party where that right applies;
• to complain to the Personal Data Protection Authority in Bahrain.

To exercise a right, contact us using the details at the end of this policy, telling us what you want and, if it helps, which account or agreement your request relates to. We may need to verify your identity first, and we may ask for more information so that we can find what you are looking for.

We will respond within the period required by law. We may decline or limit a request where the law allows or requires us to do so, and where we do we will tell you why. You do not have to pay a fee in the ordinary course.

We do not make decisions about you by automated means alone that produce legal effects concerning you or similarly significantly affect you.

Our services are intended for adults with legal capacity to contract, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it, subject to any legal requirement to retain it.

Our website may link to websites and services we do not control. This policy does not apply to them, and we are not responsible for their content or for how they handle your data. We recommend you read their policies before providing them with personal data.

We may update this policy at any time to reflect changes in our practices or in the law. The current version is always published on this page with its date. Where a change is material, we will take reasonable steps to bring it to your attention.

Questions or requests about this policy or your personal data can be sent to hello@wadayaselfstorage.com. If you are concerned about how your personal data has been handled, or you believe it may have been lost or disclosed without authorisation, please tell us straight away at the same address so that we can look into it.

You may also lodge a complaint with the Personal Data Protection Authority in Bahrain at any time.