Storage Stamford Hill Privacy Policy
This Privacy Policy explains how Storage Stamford Hill collects, uses, stores and protects personal data relating to customers and prospective customers in the Stamford Hill area. It is intended to provide clear information in accordance with the UK General Data Protection Regulation and related data protection laws.
By using our services, visiting our premises, or communicating with us, you acknowledge that you have read and understood this Privacy Policy.
Scope and Data Controller
This Privacy Policy applies to all Storage Stamford Hill customers, former customers, prospective customers, and any individuals who make enquiries or otherwise interact with us in the Stamford Hill area. Storage Stamford Hill is the data controller for the personal data described in this Policy. This means that we determine the purposes and means of processing your personal data.
Types of Personal Data We Collect
We collect and process different types of personal data about you depending on your interactions with us. The categories of data we may collect include:
Identification and contact details, such as your name, postal address, billing address, and any other contact details you choose to provide.
Account and contract information, such as customer reference numbers, storage unit numbers, contract start and end dates, payment history, and related records.
Payment and billing information, such as basic payment details needed to process your payments, transaction records, and invoices. Card data is handled in line with applicable security standards and, where processed by payment providers, is subject to their policies as independent or joint controllers or processors.
Communication data, such as records of enquiries, complaints, feedback, and any correspondence you have with us in person or by other means.
Security and access data, such as CCTV images at our premises, access logs, and details related to security incidents. CCTV may operate in and around our facilities for safety and security purposes.
Technical and usage information, such as limited device or system information used for security, service administration and performance monitoring when you interact with any of our digital services.
Lawful Bases for Processing
We only process your personal data where we have a lawful basis to do so. Depending on the circumstances, we may rely on the following bases:
Contract: We process data that is necessary to enter into and perform our contract with you, including setting up and managing your storage account, administering payments, and providing customer support.
Legal obligation: We process data where this is necessary for compliance with legal and regulatory obligations, such as tax, accounting, security, and law enforcement requirements.
Legitimate interests: We process data where it is necessary for our legitimate interests or those of a third party and where your interests and fundamental rights do not override those interests. This includes securing our premises, preventing fraud, managing our business, improving our services, and handling enquiries and complaints.
Consent: In limited circumstances, we may rely on your explicit consent, for example for certain types of marketing communications where required by law. Where we rely on consent, you can withdraw it at any time.
How We Use Your Personal Data
We use your personal data for the following purposes:
To set up, administer and manage your storage contract, including verifying your identity where necessary, arranging access to your unit, and handling renewals or terminations.
To process payments, manage billing, handle deposits and refunds, and maintain accurate financial records.
To communicate with you about your account, including sending important information about your contract, access times, safety notices, changes to terms, and service updates.
To provide customer service and support, respond to your enquiries and complaints, and resolve any disputes.
To secure our premises, prevent and detect crime, and protect people, property and assets, including through the use of CCTV and access control systems.
To comply with legal and regulatory obligations, including record-keeping, responding to lawful requests from authorities, and establishing or defending legal claims.
To improve and develop our services and operations, including monitoring usage patterns, service performance, and conducting internal reporting and analysis.
Data Sharing and Processors
We may share your personal data with third parties where this is necessary for the purposes described in this Privacy Policy and where we have a lawful basis to do so.
Service providers acting as data processors: We may engage trusted third parties to provide services that involve handling personal data on our behalf, such as payment processing, IT and cloud services, data storage, security providers, maintenance contractors, and professional advisers. These processors are required to process your data only on our instructions and to implement appropriate security measures.
Professional and legal advisers: We may share data with accountants, auditors, legal advisers or other professional advisers where necessary for our legitimate interests or to comply with legal obligations.
Authorities and law enforcement: We may disclose personal data where required by law, regulation, or court order, or where necessary to prevent or detect crime, fraud or other unlawful activity.
Business transfers: If we undergo a reorganisation, change of ownership, or similar corporate event relating to Storage Stamford Hill, personal data may be transferred as part of that process in accordance with data protection law.
We do not sell your personal data to third parties.
International Data Transfers
Where any of our processors or service providers transfer personal data outside the United Kingdom, we will ensure that appropriate safeguards are in place in accordance with data protection law. These may include the use of standard contractual clauses, reliance on adequacy regulations, or other lawful transfer mechanisms.
Data Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected and to meet legal, accounting, or reporting requirements.
Customer and contract records are generally retained for a period after the end of your contract to enable us to respond to queries, handle disputes, and comply with legal obligations. Payment and financial records may be retained for longer periods as required by tax and accounting laws.
CCTV footage is retained for a limited period, which is typically short, unless a longer retention period is required for the investigation of an incident, to support legal proceedings, or to comply with a legal obligation.
When personal data is no longer required, we will securely delete or anonymise it in accordance with our data retention procedures.
Security of Your Personal Data
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or damage. These measures may include access controls, physical security at our premises, encryption and secure storage, and staff training on data protection responsibilities.
While we strive to protect your information, no system can be completely secure. We therefore cannot guarantee absolute security, but we regularly review and improve our safeguards.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data, subject to certain limitations and exemptions. These rights include:
Right of access: You have the right to request confirmation that we process your personal data and to receive a copy of that data, together with certain information about how we process it.
Right to rectification: You have the right to request that inaccurate or incomplete personal data is corrected or updated.
Right to erasure: In certain circumstances, you may request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected or where you withdraw consent.
Right to restriction of processing: You may ask us to restrict the processing of your personal data in certain circumstances, for example while we verify its accuracy or consider an objection you have raised.
Right to object: You have the right to object to processing that is based on our legitimate interests, including profiling based on those interests. We will stop processing your data unless we have compelling legitimate grounds to continue or the processing is required for legal reasons.
Right to data portability: Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format and, where technically feasible, to transmit it to another controller.
Right to withdraw consent: Where we rely on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing before consent was withdrawn.
To exercise any of these rights, you can contact us using the details provided in our customer documentation or at our premises. We may need to verify your identity before responding to your request. There is normally no fee for exercising your rights, but we may charge a reasonable fee or refuse a request where it is manifestly unfounded or excessive.
Complaints
If you have concerns about how we handle your personal data, we encourage you to contact us first so that we can try to resolve the issue. You also have the right to lodge a complaint with the relevant data protection supervisory authority in the United Kingdom.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or other factors. Any significant changes will be made available to customers, and the updated version will apply from the date it is published. We encourage you to review this Policy periodically to stay informed about how we process your personal data.
