Storage West Heath Privacy Policy
This Privacy Policy explains how Storage West Heath collects, uses, stores and protects personal data for all Storage West Heath customers in the area. It also explains your rights under applicable data protection laws, including the UK General Data Protection Regulation and the Data Protection Act 2018. By using our services, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all personal data processed by Storage West Heath in connection with our self-storage and related services. It covers personal data of individual customers, representatives of business customers, prospective customers, previous customers, and any other persons who interact with us in relation to our services within the Storage West Heath service area.
Types of Personal Data We Collect
We may collect and process the following categories of personal data about you:
Identification and contact details, such as full name, residential or business address, billing address, and other address details relevant to your storage agreement.
Account and contract information, such as customer number, storage unit number, contract dates, service preferences, payment terms, and correspondence related to your contract.
Payment and billing information, such as limited payment details necessary to process your payments and records of invoices, charges and payment status. We do not store full card details where payments are processed through third party payment providers.
Security and access data, such as CCTV images on our premises, records of access to and from the site, and information relating to keys, codes or fobs issued to you for security and operational reasons.
Communication data, such as records of your requests, enquiries, complaints, feedback and any other communications with us, whether in person, by post, or through other communication channels.
Usage information, such as how you use our facilities and services, including dates of visits, duration of storage and services purchased.
How We Collect Your Personal Data
We collect personal data in the following ways:
Directly from you when you contact us, request a quotation, visit our site, sign a storage agreement, make a payment, or otherwise communicate with us.
Indirectly from third parties, such as payment service providers, where this is necessary to complete a transaction or verify information you have provided.
Automatically when you visit our premises, for example through CCTV systems and access control systems that are in place for safety and security.
Lawful Bases for Processing
We process your personal data only when we have a lawful basis under the UK GDPR. Depending on the context, we rely on the following lawful bases:
Contract: We process personal data when it is necessary to enter into or perform a contract with you, for example to provide a storage unit, manage your account, take payments or respond to pre-contract enquiries.
Legal obligation: We process certain personal data to comply with legal and regulatory requirements, such as tax, accounting, and record-keeping obligations, and to cooperate with lawful requests from authorities.
Legitimate interests: We process personal data where it is necessary for our legitimate business interests and where these interests are not overridden by your rights and interests. This includes ensuring site security, preventing fraud, maintaining and improving our services, managing business operations, recovering debts and handling customer enquiries.
Consent: On limited occasions, we may rely on your consent, for example where we wish to send certain types of marketing communications or retain your details for future offers beyond what is reasonably expected. Where we rely on consent, you may withdraw it at any time.
How We Use Your Personal Data
We use your personal data for the following purposes:
To provide and manage storage services, including setting up customer accounts, administering contracts, allocating and controlling access to units, processing renewals and changes to your services.
To process payments and manage billing, including issuing invoices, processing transactions, managing arrears and handling queries related to payments.
To maintain site safety and security, including the use of CCTV and access control systems to protect customers, staff, property and assets, and to investigate security incidents.
To communicate with you, including confirming bookings, notifying you of important information about your contract or our services, responding to your enquiries and complaints, and sending service-related updates.
To manage our business operations, including keeping appropriate records, performing audits, managing risk, and improving our services and customer experience.
To comply with legal and regulatory requirements, including responding to lawful requests and orders from public authorities and enforcing our legal rights.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet any legal, accounting or reporting requirements.
In general, we keep customer contract records and related communications for the duration of your relationship with us and for a period thereafter as required or permitted by law, typically up to six years from the end of the contract to comply with statutory limitation periods and financial record-keeping rules.
CCTV and access control records are retained for a shorter period, which is limited to what is necessary for security and investigative purposes, unless a longer retention period is required due to a specific incident, dispute or legal requirement.
Where personal data is no longer required, we take reasonable steps to securely delete or anonymise it so that it can no longer be associated with an identifiable individual.
Data Processors and Third Parties
We may share your personal data with carefully selected third party service providers who act as data processors on our behalf. These processors may provide services such as payment processing, secure data storage, IT support, accounting support, and security system maintenance.
When we use processors, we ensure that appropriate contractual and technical safeguards are in place so that your personal data is processed only in accordance with our instructions, kept secure and not used for the processor's own purposes.
We may also share personal data with other third parties where we are required to do so by law or where it is necessary to protect our rights, our customers, or others. This may include law enforcement agencies, regulatory bodies, or professional advisers such as lawyers or auditors.
We do not sell your personal data and we do not allow third parties to use your personal data for their own marketing purposes without your explicit consent where required.
International Transfers
Where personal data is transferred outside the United Kingdom, for example where our processors store data in another country, we take steps to ensure an adequate level of protection is in place. This may include using countries that have been formally recognised as providing an adequate level of protection or using approved contractual safeguards.
How We Protect Your Data
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include access controls, physical security at our premises, secure storage of records, staff training and regular review of our security procedures.
Your Data Protection Rights
You have a number of rights in relation to your personal data under the UK GDPR. These rights apply to all Storage West Heath customers in the area, subject to certain limitations and exemptions in the law.
Right of access: You can request confirmation of whether we process your personal data and obtain a copy of that data, together with related information.
Right to rectification: You can request that we correct or complete any inaccurate or incomplete personal data we hold about you.
Right to erasure: In certain circumstances, you can request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected or where you withdraw consent and there is no other lawful basis for processing.
Right to restriction of processing: You can request that we restrict the processing of your personal data in certain situations, such as while we verify the accuracy of the data or assess an objection you have raised.
Right to object: You can object to our processing of your personal data where we rely on legitimate interests as the legal basis, and we will stop processing unless we have compelling legitimate grounds or the processing is required for legal claims.
Right to data portability: In some cases, you can request that we provide your personal data in a structured, commonly used and machine-readable format, or transmit it to another controller where technically feasible.
Right to withdraw consent: Where we rely on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing before it was withdrawn.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you are unhappy with how we handle your personal data. We encourage you to contact us first so we can seek to resolve any concerns directly.
Updates to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or for other operational reasons. The latest version will apply to all personal data we hold about you. You should review this Privacy Policy periodically to stay informed about how we protect your personal data.
