Storage St Giles Privacy Policy for Customers
This Privacy Policy explains how Storage St Giles collects, uses, stores and shares personal data relating to customers and prospective customers in our service area. It is intended to meet the requirements of the UK General Data Protection Regulation and the Data Protection Act 2018.
By becoming a customer of Storage St Giles or by making an enquiry about our services, you acknowledge that you have read and understood this Privacy Policy.
Scope and data controller
This Privacy Policy applies to all Storage St Giles customers and prospective customers in our operating area, including individuals, sole traders and representatives of corporate clients. It also applies to visitors to our storage facilities where personal data is collected, such as through CCTV or visitor records.
Storage St Giles is the data controller for the personal data described in this policy. This means we decide how and why your personal data is processed and are responsible for ensuring it is handled in a lawful, fair and transparent way.
Personal data we collect
We collect only the personal data that is necessary for the purposes set out in this Privacy Policy. This may include:
Identification and contact details: name, postal address, billing address, date of birth, and basic identification information.
Communication details: email address, communication preferences and records of communications with you, including enquiries, quotes and support requests.
Contract and account information: storage unit numbers, contract dates, payment status, access permissions, and related account notes that are necessary to manage your storage agreement.
Payment information: limited payment details such as partial card information or payment transaction references processed through secure payment providers. We do not store full card details when not necessary.
Usage and security data: access logs for our premises, CCTV footage covering communal and security areas, and records of incidents or security events as required to keep our facilities safe.
Website and enquiry data: information you choose to submit when requesting information or a quote, such as your name, preferred unit size, and any message you provide. We may also collect technical data about how you use our website, such as logs and diagnostic information, in line with applicable law.
Lawful bases for processing
We process your personal data only where we have a lawful basis under data protection law. Depending on the circumstances, we rely on one or more of the following lawful bases:
Contract: to take steps at your request before entering into a contract, and to perform our contract with you. This includes processing necessary to provide storage services, manage your account, handle payments, and respond to your service requests.
Legal obligation: to comply with legal and regulatory obligations, such as tax and accounting requirements, record keeping rules, and obligations to assist law enforcement or regulatory bodies where we are legally required to do so.
Legitimate interests: to pursue our legitimate business interests in a way that does not override your fundamental rights and freedoms. This includes securing our premises and assets, preventing fraud, managing customer relationships, improving our services, and handling business administration.
Consent: where required by law, we may rely on your consent, for example for certain types of optional marketing communications. When we rely on consent, you can withdraw it at any time.
How we use your personal data
We use your personal data for the following purposes:
To provide storage services and manage customer accounts, including processing bookings, allocating units, handling access arrangements, and dealing with queries or complaints.
To administer contracts, including billing, payment collection, credit control, and resolving disputes.
To maintain the safety and security of our premises, staff, customers and stored property, including through access controls, CCTV monitoring and incident investigations.
To comply with legal and regulatory obligations, including maintaining accurate financial records, responding to lawful requests from public authorities, and meeting insurance and health and safety requirements.
To manage and improve our business, including monitoring service performance, conducting internal reporting, and developing new services.
To communicate with you about your contract, changes to our terms or policies, operational notices that may affect your use of the facility, and, where permitted, information about related services you may be interested in.
Data retention
We keep personal data only for as long as it is needed for the purposes set out in this Privacy Policy, or for as long as we are required to keep it by law.
In general, we apply the following retention principles:
Customer account and contract information is retained for the duration of your contract and for a period afterwards to deal with any queries, disputes or legal claims. This period is usually up to six years after the end of the contract, in line with limitation periods for legal claims and accounting requirements.
CCTV footage is kept for a limited period that is appropriate for security and investigation purposes, unless a specific recording needs to be retained for longer in connection with an incident, dispute or legal process.
Enquiry records for potential customers are retained for a reasonable period to manage follow-ups and business analysis, and then securely deleted or anonymised.
Where we rely on your consent to process personal data, we will retain the data for as long as your consent remains valid and will delete or anonymise the data when consent is withdrawn, unless another lawful basis applies.
Data processors and third parties
We may engage carefully selected third party service providers to process personal data on our behalf. These service providers act as data processors and may only process your personal data in accordance with our instructions and for the purposes set out in this Privacy Policy. We put in place appropriate contracts to ensure your data is protected.
Examples of such processors include:
Providers of secure payment processing and billing services.
IT and cloud service providers who host or support our systems, customer databases or communication tools.
Security service providers that support access control and CCTV systems.
Professional advisers, such as accountants or legal advisors, where they require access to limited personal data in order to provide their services.
We may also share personal data with third parties who act as independent data controllers where this is necessary to comply with legal obligations, to protect our rights or the rights of others, or where you have requested or authorised such sharing. Such recipients may include law enforcement agencies, courts, regulatory bodies, insurers and other professional advisers.
International transfers
Where we use service providers located outside the United Kingdom or where data is otherwise transferred internationally, we take steps to ensure that your personal data is afforded an equivalent level of protection. This may include using countries that have been recognised as providing an adequate level of data protection or using approved standard contractual clauses and additional safeguards where necessary.
Your data protection rights
Under data protection law, you have a number of rights in relation to the personal data that we hold about you. Subject to certain conditions and exemptions, these rights may include:
The right of access: you can request confirmation that we are processing your personal data and obtain a copy of that data.
The right to rectification: you can ask us to correct inaccurate or incomplete personal data.
The right to erasure: in certain circumstances, you can ask us to delete or remove your personal data, for example where it is no longer needed for the original purpose or where you withdraw consent.
The right to restrict processing: you can request that we restrict the processing of your personal data in certain situations, such as where you contest its accuracy.
The right to data portability: you can, in some cases, receive your personal data in a structured, commonly used and machine readable format and have it transferred to another controller.
The right to object: you can object to our processing of your personal data where we rely on legitimate interests or where we process it for direct marketing.
Where we rely on consent, you have the right to withdraw your consent at any time. Withdrawing consent will not affect the lawfulness of processing carried out before the withdrawal.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe that your personal data has been handled in a way that does not comply with data protection law.
Security of your personal data
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include physical security at our premises, access controls, staff training and organisational policies.
While we take reasonable steps to protect your personal data, no system can be completely secure. You are responsible for keeping any account details or access credentials safe and notifying us promptly if you suspect any unauthorised use.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or data protection best practice. When we make significant changes, we will take reasonable steps to bring them to your attention. The most recent version of the Privacy Policy will apply to the personal data we hold about you.
