Storage Thornton Heath Privacy Policy
This Privacy Policy explains how Storage Thornton Heath collects, uses, discloses and protects personal data relating to customers and prospective customers in the Thornton Heath area. It is designed to comply with the UK General Data Protection Regulation and the Data Protection Act 2018. By using our storage services or making an enquiry, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage Thornton Heath customers, past, present and prospective, whose personal data we process in connection with our storage and related services in the Thornton Heath area. It also applies to individuals who contact us with enquiries, visit our premises, or act as emergency or alternative contacts for our customers.
Personal data we collect
We collect and process different categories of personal data depending on how you interact with us. This may include:
Identification and contact details such as full name, home address, billing address, contact address, date of birth, and identification document details where required for verification.
Communication details such as email address, postal address and any other contact details you provide to us for correspondence about your storage unit or enquiries.
Contract and account information such as customer reference number, storage unit number, contract start and end dates, services selected, payment terms, renewal and termination information, and correspondence relating to your contract.
Payment and billing information such as partial payment card details handled via our payment processor, bank transfer references and payment history. We do not store full card details when processed through secure payment providers.
Security and access information such as CCTV footage captured on or around our premises, access logs relating to entry systems or key codes, and records of incidents for security and safety purposes.
Emergency and alternative contact details where you provide details for another person to be contacted in specific circumstances related to your storage unit.
Technical and usage information where you interact with our digital channels, such as basic device, browser and interaction data, to help us administer and improve our services.
How we collect personal data
We collect personal data directly from you when you request a quote, make a booking, sign a storage agreement, visit our site, contact us by phone or in writing, or otherwise communicate with us. We may also obtain information from third parties where this is necessary for credit checks, anti fraud measures, or debt recovery, and where such processing is lawful.
Lawful bases for processing
We only process your personal data where we have a valid lawful basis under data protection law. Depending on the circumstances, we rely on the following lawful bases:
Contract. We process personal data where it is necessary to enter into, perform or manage a contract with you for storage and related services. This includes processing required to set up your account, manage payments, provide access to storage, communicate with you about your unit and handle renewals or termination.
Legal obligation. We process personal data where we need to comply with legal or regulatory requirements. This may include identity verification, record keeping, tax and accounting obligations, responding to requests from law enforcement or regulatory authorities, and complying with court orders.
Legitimate interests. We process personal data where it is necessary for our legitimate business interests or those of a third party, and where your interests and fundamental rights do not override those interests. These interests include the management and security of our premises, preventing and detecting crime or fraud, maintaining accurate business records, improving our services, pursuing and defending legal claims, and managing customer relationships.
Consent. In limited cases, we may rely on your consent, for example for certain types of optional marketing communications. Where we rely on consent, you have the right to withdraw it at any time.
How we use personal data
We use the personal data we collect for the following purposes:
To provide and manage storage services, including setting up your account, preparing and managing contracts, processing payments, allocating and managing storage units, and providing customer service.
To communicate with you about your account, including sending service messages, payment reminders, notices relating to access or maintenance, and updates to our terms and policies.
To protect our premises and property, including the use of CCTV, access systems and incident records to maintain safety and security and to prevent and detect crime.
To manage our business operations, including internal administration, accounting, auditing, reporting and service improvement.
To comply with legal and regulatory obligations, including responding to lawful requests from public authorities and retaining certain records as required by law.
To enforce our agreements and pursue legal claims, including debt recovery and resolving disputes.
To send you marketing communications about our services where permitted by law or where you have given consent, and to give you the opportunity to opt out at any time.
Data sharing and processors
We may share your personal data with carefully selected third parties where this is necessary and lawful. These third parties may act as data processors on our behalf or as separate controllers. Categories of recipients may include:
Payment service providers and banks that process your payments and manage transactions.
IT and system support providers that host, maintain or support our business systems, including storage management software and security systems.
Professional advisers such as accountants, auditors, legal advisers and consultants who assist with the running of our business.
Security and CCTV service providers involved in maintaining our security systems.
Debt collection agencies and tracing agents where required to recover unpaid charges or locate customers in connection with contractual obligations.
Law enforcement agencies, regulators, courts and other public authorities where required by law, or where disclosure is necessary to protect our rights, your safety or the safety of others.
We require our data processors to act only on our instructions, to keep your data secure, and to comply with applicable data protection laws.
Data retention
We keep personal data only for as long as is necessary for the purposes for which it was collected, and to meet legal, accounting or reporting requirements. Retention periods may vary depending on the nature of the data and our obligations.
Customer account and contract information is generally retained for a number of years after your contract ends, to enable us to respond to queries, handle disputes, meet tax and accounting requirements, and demonstrate compliance with our legal obligations.
CCTV footage and security related information is retained for a shorter period, unless we need to keep it longer in connection with an incident, investigation or legal claim.
Marketing and enquiry data is kept for a period appropriate to manage our relationship with you. You can ask us to stop processing your data for marketing at any time.
When personal data is no longer required, we will securely delete or anonymise it.
Data security
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include access controls, secure storage, staff training and regular review of our security practices. While we take reasonable steps to protect your data, no system can be completely secure and you should take care to keep your access details safe.
International transfers
If we transfer personal data outside the United Kingdom, we will ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws. This may include using standard contractual clauses or ensuring that the destination country has been recognised as providing an adequate level of data protection.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data, which apply in most circumstances. These include:
The right of access. You can request confirmation of whether we process your personal data and obtain a copy of that data, along with certain information about how we use it.
The right to rectification. You can ask us to correct or complete personal data that is inaccurate or incomplete.
The right to erasure. You can ask us to delete your personal data in certain situations, for example where it is no longer needed for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for processing.
The right to restriction of processing. You can ask us to restrict the processing of your data in certain circumstances, for example while we verify its accuracy or consider an objection you have raised.
The right to object. You can object to our processing of your personal data where we rely on legitimate interests, including profiling based on those interests. You also have the absolute right to object to direct marketing.
The right to data portability. You can request that we provide certain personal data to you or to another controller in a structured, commonly used and machine readable format, where the processing is based on consent or contract and is carried out by automated means.
The right to withdraw consent. Where we rely on your consent to process personal data, you can withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, you can contact us using the details provided in your contract or on our usual communication channels. We may need to verify your identity before responding to your request. We aim to respond within the time limits set by data protection law.
Complaints
If you are concerned about how we handle your personal data, you can contact us so that we can try to resolve the issue. You also have the right to lodge a complaint with the UK data protection supervisory authority.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or other factors. When we make changes, we will revise the date of the latest version and make the updated policy available. We encourage you to review this Privacy Policy regularly to stay informed about how we handle your personal data.
