Storage St Margarets Privacy Policy
This Privacy Policy explains how Storage St Margarets collects, uses, stores and protects personal data relating to our customers within the Storage St Margarets service area. It also explains your rights under applicable data protection laws, including the UK General Data Protection Regulation and the Data Protection Act 2018.
By using our storage services, visiting our premises, or interacting with us in any way, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage St Margarets customers and prospective customers in our service area, as well as visitors to our premises and individuals who contact us by any means. It covers personal data that we collect directly from you and data that we receive from third parties acting on your behalf or in connection with the services we provide.
Personal Data We Collect
We may collect and process the following categories of personal data about you:
Identification data such as name, title, date of birth and proof of identity details shown on documents such as passports or driving licences.
Contact details such as home address, correspondence address, billing address, and details you provide for correspondence.
Contract and account data such as storage unit numbers, move-in and move-out dates, rental terms, payment status, and records of your interactions with us in relation to your contract.
Payment and billing information such as payment method, billing history, and records relating to invoices and payments. We do not store full payment card numbers if you pay by card, but our payment processors may securely process and store such data on our behalf.
Security and access data such as CCTV footage at our premises, access logs, gate or door entry records, unit access records, and incident reports.
Communication data such as emails, letters, messages, notes of telephone conversations and any feedback or complaints you provide.
Technical data where applicable, which may include IP addresses, device information and basic usage data when you visit our website or use any online services we provide.
How We Collect Your Personal Data
We collect personal data in various ways, including:
When you enquire about our services or request a quote.
When you sign a storage agreement or other contractual documentation with us.
When you make a payment or request a refund.
When you visit our premises and your image is captured on CCTV or your access is recorded.
When you contact us by telephone, in writing or through any other communication method.
From third parties such as payment processors or business partners, where they are permitted to share your data with us.
Lawful Bases for Processing
We process your personal data only where we have a lawful basis under data protection legislation. Depending on the circumstances, we may rely on the following lawful bases:
Contract: We process personal data that is necessary to enter into or perform our contract with you, including setting up your account, managing your storage unit, taking payment, and communicating with you about your agreement.
Legal obligation: We may process personal data to comply with our legal and regulatory obligations, for example maintaining financial records for tax and accounting purposes and assisting law enforcement or regulatory authorities where we are legally required to do so.
Legitimate interests: We may process personal data where it is necessary for our legitimate business interests, provided that your interests and fundamental rights do not override those interests. These interests include managing and improving our services, ensuring the security of our premises and systems, preventing fraud, recovering debts, and protecting our property and the property stored with us.
Consent: In limited cases we may rely on your consent, for example for certain forms of optional marketing. Where we rely on consent, you may withdraw it at any time by contacting us.
How We Use Your Personal Data
We use your personal data for the following purposes:
To provide, administer and manage storage services and related services that you have requested or contracted for.
To verify your identity, set up your customer account and assess eligibility for our services.
To process payments, issue invoices and manage billing, arrears and debt recovery.
To monitor and maintain the security and safety of our premises, staff, customers and stored goods, including through CCTV monitoring and access control systems.
To communicate with you about your account, service updates, changes to terms and conditions, and other operational matters.
To respond to your enquiries, feedback, complaints or claims.
To comply with applicable laws, regulations, court orders and requests from public authorities.
To improve our services, premises and customer experience, including through internal analysis and reporting.
Data Retention
We keep your personal data only for as long as is necessary to fulfil the purposes for which it was collected, and to comply with legal, accounting or reporting obligations.
In general, we may retain your core account and contract data for a period after your contract ends to deal with any queries, disputes or claims and to meet our legal obligations. Financial and transaction records may be kept for a longer period in line with statutory retention requirements.
CCTV footage and access records are retained for a limited period, which is determined by security and operational needs, unless a longer retention period is required in connection with an investigation, dispute or legal claim.
When personal data is no longer required, we will securely delete or anonymise it in accordance with our data retention policies.
Sharing Your Personal Data and Use of Processors
We may share your personal data with third parties where this is necessary for the purposes described in this Privacy Policy and where we have a lawful basis to do so.
We may share data with the following categories of recipients:
Service providers and processors who provide services to us such as payment processing, IT hosting and support, customer relationship management systems, document storage, security and CCTV maintenance, and debt collection. These third parties act on our instructions and are required to protect your data and use it only for the services they provide to us.
Professional advisers including lawyers, accountants, auditors and insurers, where necessary for the establishment, exercise or defence of legal claims or for compliance and governance purposes.
Public authorities, regulators, law enforcement and courts where we are required or permitted by law to share personal data, or where disclosure is necessary to protect our rights, the rights of our customers or the safety of our premises.
Potential purchasers or investors and their advisers in the context of a business sale, merger, restructuring or similar transaction. In such cases data will be shared only where necessary and subject to appropriate confidentiality safeguards.
Where we use processors, we enter into written agreements requiring them to implement appropriate technical and organisational measures to protect personal data and to process it only in accordance with our documented instructions.
International Transfers
Where personal data is transferred outside the United Kingdom or the European Economic Area by our service providers, we take steps to ensure that appropriate safeguards are in place. This may include relying on adequacy regulations, standard contractual clauses or other lawful transfer mechanisms under data protection law.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data. Subject to certain conditions and exemptions, these include:
Right of access: You have the right to obtain confirmation as to whether we process your personal data and, if so, to request a copy of that data.
Right to rectification: You have the right to request correction of inaccurate or incomplete personal data that we hold about you.
Right to erasure: You may request that we delete your personal data where there is no lawful basis for us to continue processing it, for example where it is no longer needed for the purpose for which it was collected and we are not required to retain it.
Right to restriction of processing: You may ask us to restrict the processing of your personal data in certain situations, such as where you contest its accuracy or object to our processing.
Right to data portability: In some cases, you may be entitled to receive personal data you have provided to us in a structured, commonly used and machine-readable format and to request that we transfer it to another controller where technically feasible.
Right to object: You have the right to object to processing based on our legitimate interests, including profiling, on grounds relating to your particular situation. We will stop processing unless we have compelling legitimate grounds or the processing is for the establishment, exercise or defence of legal claims.
Right to withdraw consent: Where we rely on your consent, you can withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before consent was withdrawn.
Protecting Your Personal Data
We adopt appropriate technical and organisational measures designed to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. Measures may include physical security at our premises, access controls, secure storage, encryption and staff training on data protection obligations.
Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or operational needs. Any updates will take effect when the revised Privacy Policy is made available. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.
