Privacy Policy

01 — Who We Are

About this policy

StorageMania (referred to as "StorageMania", "we", "us", or "our") operates a self-storage facility located at 23 Lower Ottery Road, Philippi Industria, Cape Town, South Africa. This Privacy Policy explains how we collect, use, share, and protect personal information when you use our website, request a quote, apply for a unit online, sign a rental agreement, or visit our facility.

We are committed to processing your personal information lawfully, fairly, and transparently in accordance with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPIA").

02 — Information We Collect

What we collect from you

We only collect personal information that we reasonably need in order to provide you with our storage services and respond to your enquiries.

Information you provide directly

• Identity information — full name, identity number, passport number or company registration number (required for rental agreements), date of birth
• Contact information — email address, phone number, physical address
• Storage details — unit size requirements, items to be stored, intended duration
• Payment information — records of your EFT and card payments (we do not store full card numbers)
• Communication records — emails, WhatsApp messages, call notes, and quote requests submitted through our website
• Online rental applications — if you apply for a unit online, also your emergency contact's details, your preferred move-in date and payment method, and your signature (see "Applying for a unit online" below)

Information collected automatically

• Website usage data — pages visited, time spent on site, referring website, device type, and browser information collected via Google Analytics, the Meta Pixel, and PostHog (including session recordings, described under "Cookies and analytics" below)
• Security-check data — on the online application page only, technical information about your browser and device, including your IP address, which Cloudflare Turnstile checks to keep automated spam out of the form (see "Applying for a unit online" below)
• CCTV footage — captured at our facility for security purposes
• Vehicle registration numbers — recorded at our access gate

03 — How We Use It

Why we process your information

We process your personal information for the following purposes:

• To respond to quote requests and provide pricing information
• To enter into and administer a rental agreement
• To collect rental payments and manage your account
• To communicate with you about your unit, payments, notices, or facility updates
• To maintain the security of our facility, tenants, and stored property
• To comply with legal, regulatory, and tax obligations
• To improve our website, services, and marketing — including remarketing on Meta (Facebook/Instagram) and Google
• To prevent and detect fraud, theft, or misuse of our facility or website

04 — Sharing

Who we share information with

We do not sell your personal information. We may share it with the following parties only where necessary:

• Payment processors and banks — for processing EFTs and card payments
• Service providers — including our website host, database provider (Supabase), transactional email provider (Resend), the mailbox provider where we receive website enquiries and applications (Microsoft Outlook), product analytics provider (PostHog), the security check on our online application page (Cloudflare Turnstile), and accounting software
• Marketing platforms — Google Ads and Meta (Facebook/Instagram) for measurement and remarketing in pseudonymised or hashed form
• Security and law enforcement — where required to investigate suspected criminal activity, comply with a court order, or respond to a lawful request
• Professional advisors — including lawyers, auditors, and insurers where required to protect our legitimate interests

Where your information is stored. Several of our service providers process information outside South Africa. Our database provider, Supabase, stores quote enquiries, online rental applications, and feedback on servers in the European Union (Ireland). Our transactional email provider, Resend, is based in the United States and delivers the notification emails those enquiries and applications generate. We receive those emails, including the rental agreement PDFs attached to online applications, in a mailbox provided by Microsoft (Outlook), which may store them in the United States or other countries where Microsoft operates. Our product analytics provider, PostHog, processes website usage data on servers in the United States. Cloudflare, which runs the security check on our online application page (Cloudflare Turnstile), is based in the United States. Google (Google Analytics and Google Ads) and Meta (the Meta Pixel), whose tools are described under "Cookies and analytics" below, are also based in the United States. We make these transfers under section 72 of POPIA on the basis that the recipients are subject to data-protection rules that provide a comparable level of protection and, where a provider delivers the service or responds to the enquiry you asked us for, that the transfer is necessary to do so. Where any other party operates outside of South Africa, we take reasonable steps to ensure your information receives an adequate level of protection.

05 — Retention & Security

How long we keep it and how it's protected

We retain personal information only for as long as is necessary for the purposes for which it was collected, or as required by South African law (for example, financial records are kept for at least 5 years in line with SARS requirements).

Quote enquiries that do not result in a rental are retained for up to 24 months for follow-up and marketing measurement, unless you ask us to delete them sooner. Online rental applications are deleted from our database automatically after 2 days. If an application doesn't lead to a lease, the emailed copy is deleted within about 7 days; see "Applying for a unit online" below. CCTV footage is typically retained for 30 days unless it forms part of an active investigation.

We protect your information using reasonable technical and organisational measures, including access controls, encrypted database storage, secure backups, and staff confidentiality obligations. No system is perfectly secure, but we take our duty seriously.

06 — Online Applications

Applying for a unit online

You can apply for a storage unit on our website before you visit, so that your rental agreement is ready to sign when you arrive. This section explains what the online application collects and what happens to it. Applying online is optional — you can also complete your rental agreement in person at our facility.

What we collect

• Your details — your full name; your South African ID number, passport number, or company registration number; your physical address (which we also use as your postal address); your cell number, plus home and work numbers if you give them; and your email address
• Your emergency contact's details — their name, their relationship to you, their physical address and phone number, and their email address and ID number if you choose to give them
• Your rental details — the unit size you want, your preferred move-in date, a description of what you plan to store, and how you would prefer to pay (EFT or card at our facility)
• Your signature — drawn on screen to confirm your application. We receive only an image of the finished signature, which is printed, with the date and time you signed, in the application section of your rental agreement. It does not sign the agreement itself: you sign the printed agreement in ink when you collect your unit
• Your confirmations — that you accept the rental agreement terms, that you agree to us processing these details to prepare your lease, and that your emergency contact has agreed to you sharing their details with us

We never ask for bank account or card details online.

Why we collect it

We use these details to prepare your rental agreement, to get your unit ready, and to contact you about your application and your move-in. This processing is necessary to conclude the rental agreement you have asked to enter into, which section 11(1)(b) of POPIA allows.

Your emergency contact has not dealt with us directly, so we ask you to confirm that they have agreed to you sharing their details with us. We rely on that agreement and on our legitimate interest in having someone to reach in an emergency if we cannot get hold of you (sections 11(1)(a) and 11(1)(f)). We use their details only to record them on your rental agreement and to contact them if we need to, never for marketing. If you have been named as someone's emergency contact and object to us holding your details, please contact us using the details at the bottom of this page.

Where it goes and how long we keep it

• Our database — your application is stored with our database provider, Supabase, for 2 days and is then deleted automatically. Access is restricted to StorageMania; it cannot be read through the public website
• Email — we send a summary of your application to StorageMania through our email provider, Resend, with your completed rental agreement, including your signed application, attached as a PDF. We receive it in a mailbox provided by Microsoft (Outlook)
• At our facility — our staff print the agreement so that it is ready for you to check, initial, and sign when you arrive
• Afterwards — if you go ahead, the emailed agreement and the paper copy you sign are kept with our signed lease records for as long as the lease runs and as long afterwards as the law requires. If your application doesn't lead to a lease, we delete the email and its PDF within about 7 days, and you can ask us to delete your application sooner

Supabase stores the application on servers in the European Union (Ireland). Resend, which delivers the email, and Cloudflare, which runs the security check described below, are based in the United States, and Microsoft may store the email in the United States or other countries where it operates. These are the same cross-border transfers described under "Who we share information with" above, made on the same basis under section 72 of POPIA.

Analytics on the application page

The application page never makes session recordings, and it does not load the Meta Pixel or the Google tag (Google Analytics and Google Ads). PostHog records only basic usage events there — such as page views, which step of the form you reached, the unit size, and how you chose to pay — and never what you type into the form. Apart from PostHog, the only outside service the page loads is Cloudflare Turnstile, the security check described below. If you arrive from our quote form, the details you already gave us there are carried over in your browser's temporary session storage so that you don't have to type them again; they stay on your device and are cleared when your application is sent or when you close the tab.

Security check on the application page

To keep automated spam out of the application form, the application page uses Cloudflare Turnstile, a security check run by Cloudflare, which is based in the United States. Its script loads when you open the page, and the check runs when you reach the final step: Turnstile looks at technical information about your browser and device, including your IP address, to tell people apart from automated programs. Most people never see it; if Cloudflare can't confirm this automatically, you'll be asked to tick a box. When you send your application, our server asks Cloudflare to confirm that the check was passed, and that request includes your IP address. We don't send Cloudflare the details you type into the form. We rely on our legitimate interest in protecting the form from spam and abuse (section 11(1)(f) of POPIA). If the security check can't run in your browser, you can call or WhatsApp us to finish your application instead.

07 — POPIA

How we apply the POPI Act

The Protection of Personal Information Act, 2013 (Act No. 4 of 2013) sets out eight conditions that every South African business must meet when it processes personal information. This section explains, condition by condition, how those obligations apply to StorageMania and what we do about each one. We treat this as an ongoing responsibility rather than a once-off exercise, and review these practices as our systems change.

1. Accountability

StorageMania is the responsible party for the personal information described in this policy — we decide why and how it is processed. As required by section 55 of the Act, we have designated an Information Officer who is accountable for our compliance and for handling privacy requests. Their contact details are at the bottom of this page.

2. Processing limitation

We collect only the information we actually need to answer your enquiry, quote you, or manage your rental — typically your name, phone number, email address, and what you intend to store. We process it on one of the lawful grounds in section 11: your consent (for example, when you submit the quote form), the performance of a contract with you (your rental agreement), compliance with a legal obligation, or our legitimate business interests. Where we rely on consent, you may withdraw it at any time, and where we rely on legitimate interest, you may object.

3. Purpose specification

We collect personal information for the specific, lawful purposes set out in "Why we process your information" above — responding to enquiries, providing quotes, administering rentals and payments, keeping the site secure, and measuring our advertising. We do not collect information speculatively for purposes we have not identified.

4. Further processing limitation

If we ever want to use your information for a purpose that is not compatible with the one it was collected for, we will ask for your consent first, unless the law specifically permits or requires the further processing. We do not sell your personal information, and we do not share it with third parties for their own marketing.

5. Information quality

We take reasonable steps to keep the information we hold accurate, complete, and up to date, given the purpose it is used for. Because most of it comes directly from you, the quickest way to correct anything is to contact us — we will update our records and, where relevant, confirm the change back to you.

6. Openness

This policy is our notification to you under section 18: it records what we collect, why, who we share it with, where it is stored, and how long we keep it. We update it when our practices change, and the "Last updated" date at the top of this page shows when that last happened. You are entitled to ask us what personal information we hold about you at any time.

7. Security safeguards

We protect personal information with reasonable technical and organisational measures, described under "How long we keep it and how it's protected" above. Our website is served over HTTPS, database access is restricted so that enquiry and application data cannot be read publicly, and staff who handle customer information are bound by confidentiality obligations. Where an operator processes information on our behalf, they are required to secure it and to process it only on our instructions. If a security compromise affects your personal information, section 22 requires us to notify the Information Regulator and you as soon as reasonably possible, and we will do so.

8. Data subject participation

You may ask what personal information we hold about you, request a copy of it, ask us to correct or delete it, and object to processing — the full list is in "Your rights under POPIA" below. We respond to these requests within 30 days. We do not charge for a request to correct or delete information; a prescribed fee may apply to a formal request for a copy of your records.

Direct marketing

Section 69 restricts unsolicited electronic marketing. We send marketing messages only where you have consented, or where you are an existing customer and the message relates to a similar service. Every marketing message includes a way to opt out, and you can also tell us to stop at any time by replying, emailing, or calling us. Quotes, invoices, and other messages about a rental you have asked for are service communications, not marketing.

Special personal information and children

We do not seek out special personal information as defined in section 26 — such as health, biometric, religious, or political information — and you should not send it to us in an enquiry. We also do not knowingly collect information from children under 18, as set out under "Children's information" below.

If you think we have got something wrong

Please raise it with our Information Officer first — most issues are quickest to resolve directly. If you are not satisfied with how we have handled it, you have the right to complain to the Information Regulator of South Africa, whose contact details are at the bottom of this page.

08 — Your Rights

Your rights under POPIA

You have the right to:

• Be informed about how your personal information is processed
• Request a copy of the personal information we hold about you
• Ask us to correct or update inaccurate or outdated information
• Object to processing where we rely on legitimate interest
• Withdraw your consent to direct marketing at any time
• Request that we delete or destroy your personal information, subject to legal retention requirements
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, please contact us using the details at the bottom of this page. We will respond within 30 days.

09 — Cookies & Tracking

Cookies and analytics

Our website uses cookies and similar technologies to make the site work, to understand how visitors use it, and to measure the effectiveness of our advertising. The main tools we use are:

• Google Analytics & Google Ads — to understand site traffic, conversions, and to serve remarketing ads
• Meta Pixel — to measure Facebook and Instagram ad performance and serve relevant ads
• PostHog — product analytics that shows us how visitors move through the site and which pages lead to enquiries. It records page views and interactions such as clicks, and when you submit the quote form it records the unit size and storage type you selected — not your name, phone number, or email address. PostHog may also make session recordings: a replay of how a visit went (the pages seen, scrolling, mouse movements, and clicks), which helps us find and fix the parts of the site that confuse people. Recordings are not linked to your name, and anything typed into a form field is masked so that it is never captured. The online application page is never recorded (see "Applying for a unit online" above)
• Cloudflare Turnstile — used only on the online application page: a security check that tells people apart from automated spam by looking at technical information about your browser and device (see "Applying for a unit online" above)
• Essential cookies — required for the site to function (for example, remembering form input)

You can block or delete cookies through your browser settings. Doing so may affect the functionality of the site.

10 — Children

Children's information

Our services are intended for individuals 18 years or older. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently collected such information, please contact us so we can remove it.

11 — Updates

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The "Last updated" date at the top of this page indicates when the latest changes were made. We encourage you to review this page periodically.