Storage Stockwell Privacy Policy
This Privacy Policy explains how Storage Stockwell collects, uses, stores and protects personal data about its customers and prospective customers in its service area. It also explains the lawful bases we rely on under the UK General Data Protection Regulation and the Data Protection Act 2018, how long we keep your data, when we use external processors, and the rights you have in relation to your personal data.
This Privacy Policy applies to all Storage Stockwell customers and prospective customers in our operating area who use, enquire about or interact with our storage services, whether in person, by telephone or through other communication channels.
Data Controller
Storage Stockwell is the data controller for the personal data described in this Privacy Policy. As data controller, we decide how and why your personal data is processed and we are responsible for ensuring that such processing is carried out in compliance with applicable data protection laws.
Personal Data We Collect
We collect and process personal data that is necessary to provide our storage services, manage our relationship with you and comply with legal obligations. The categories of personal data we may collect include:
Identification and contact details such as name, postal address, billing address, contact address, and any other address you provide; nationality; and identification details necessary to verify your identity where required.
Account and contract information such as storage unit number, contract start and end dates, services selected, rental fees, payment status, and records of correspondence relating to your account.
Payment and billing data such as payment method details, billing history, invoices, transaction records, and information required to process refunds or address payment queries. We do not store full card details where payment is taken through a secure payment service provider.
Communication records such as enquiries, complaints, feedback and any communications you send to us or that we send to you, including notes of telephone conversations where relevant to our services.
Security and access information such as records of access to the premises or units where sign-in systems, key codes or access control technology are used, and any incident reports relating to security or safety within our facilities.
Technical and usage data where applicable, such as basic information about your interactions with any digital tools we may use, for example dates and times of access or updates to your account.
How We Collect Personal Data
We collect personal data directly from you when you contact us, obtain a quote, sign a storage agreement, make a payment, request information, or otherwise communicate with us. We may also receive personal data from third parties where this is necessary for our services, for example from payment service providers in relation to a transaction, or from authorised persons acting on your behalf.
Lawful Basis for Processing
We process your personal data only where we have a lawful basis under the UK GDPR. Depending on the context, we may rely on one or more of the following lawful bases:
Contractual necessity: We process personal data to take steps at your request before entering into a contract, to enter into a contract with you, and to perform our obligations under that contract. This includes processing necessary for handling enquiries, preparing storage agreements, setting up and managing your account, providing access to your unit, arranging payments and responding to service-related queries.
Legal obligation: We process personal data when necessary to comply with legal and regulatory requirements. This may include record-keeping for tax and accounting purposes, compliance with anti-money laundering or fraud-prevention laws where applicable, and responding to lawful requests from public authorities.
Legitimate interests: We process personal data where this is necessary for our legitimate interests or those of a third party, provided that your interests or fundamental rights and freedoms do not override those interests. Our legitimate interests include managing and improving our business and services, ensuring security and safety at our premises, recovering debts, handling customer service issues, and defending legal claims.
Consent: In limited circumstances, we may rely on your consent, for example where you choose to receive certain optional communications that are not strictly necessary for the service. When we rely on consent, you can withdraw it at any time, although this will not affect the lawfulness of processing carried out before withdrawal.
How We Use Your Personal Data
We use the personal data we collect for the following purposes:
To provide storage services, including managing reservations, agreements and access to storage units, and processing payments.
To communicate with you regarding your enquiries, bookings, contracts, payments, renewals, changes to services and any issues or incidents affecting your use of our facilities.
To manage our business operations, including internal administration, financial management, auditing, quality control and staff training.
To maintain security and safety at our facilities, investigate potential breaches of our terms or site rules, and manage incidents or disputes.
To comply with legal and regulatory obligations, including record-keeping, tax rules and responding to lawful requests from authorities.
To protect our legal rights, for example in relation to debt recovery, enforcement of contractual terms or the handling and defence of legal claims.
Data Retention
We keep personal data only for as long as necessary for the purposes for which it was collected, and to comply with legal, accounting and reporting obligations. The specific retention period will depend on the type of data and the context in which it was collected.
In general, we retain customer account and contract information for a period following the end of the storage agreement, to enable us to respond to queries, manage any disputes or claims and meet legal requirements. Payment and financial records are kept for the period required by tax and accounting rules. Security and incident records are retained for periods that reflect the need to investigate events and protect our legal interests.
When personal data is no longer required, we will securely delete or anonymise it so that it can no longer be linked to an identifiable individual.
Use of Data Processors
We may engage carefully selected third parties as data processors to process personal data on our behalf. These processors may provide services such as payment processing, secure data storage, accounting support, or IT and system administration services.
When we use a processor, we remain responsible for your personal data and we ensure that appropriate contractual and technical safeguards are in place. Processors are only allowed to process personal data in accordance with our written instructions, must keep it secure, and are not permitted to use it for their own purposes.
Where processors are located outside the United Kingdom or where data may be accessed from another country, we will ensure that appropriate safeguards are used to protect the data in line with data protection law, such as recognised transfer mechanisms or contractual protections where required.
Sharing of Personal Data
We may share your personal data with:
Service providers acting as processors who assist us with the provision of our services, including payment service providers, IT and system support providers, professional advisers and auditors.
Public authorities and law enforcement where we are required by law to do so, or where disclosure is necessary to protect our rights, property, safety or the safety of others.
Professional advisers such as legal or accounting advisers, where necessary to obtain advice or protect our legal interests.
Any third party to whom we may transfer or merge parts of our business or assets, in which case the new owner may use your personal data in the same way as set out in this Privacy Policy.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data. Subject to certain conditions and exemptions, these include:
Right of access: You have the right to obtain confirmation as to whether we process personal data about you, and to request a copy of that personal data together with information about how we use it.
Right to rectification: You have the right to request correction of inaccurate personal data and completion of incomplete data that we hold about you.
Right to erasure: You may request that we delete your personal data where there is no good reason for us to continue processing it, for example where it is no longer necessary for the purposes for which it was collected, or where you have successfully objected to processing. This right does not apply where we are required to retain the data to comply with legal obligations or to establish, exercise or defend legal claims.
Right to restriction of processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of the data or consider an objection you have raised.
Right to object: You have the right to object to processing that is based on our legitimate interests, on grounds relating to your particular situation. We will no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for legal claims.
Right to data portability: Where processing is based on consent or on a contract and is carried out by automated means, you may have the right to receive the personal data you provided in a structured, commonly used and machine-readable format, and to request that it is transmitted to another controller where technically feasible.
Right to withdraw consent: Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, our data processing activities or legal requirements. Any updated version will apply from the date it is made available. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.
