Storage Elm Park Privacy Policy
This Privacy Policy explains how Storage Elm Park collects, uses, stores and protects personal data relating to our customers and prospective customers in the surrounding area. It also explains your rights under the UK General Data Protection Regulation and related data protection laws. This Privacy Policy applies to all Storage Elm Park customers in the area, as well as individuals who contact us, visit our premises, or use our services.
Who We Are and Scope of This Policy
Storage Elm Park is a self-storage service provider. In the course of providing storage units and related services, we act as a data controller in relation to the personal data we collect and use about you. This Privacy Policy applies to all interactions you have with us as a customer or potential customer, including when you visit our site, make an enquiry, sign a storage agreement, make a payment, or communicate with us in any way.
Personal Data We Collect
We may collect and process the following categories of personal data:
Identification and contact details, such as your full name, postal address, billing address, and any other contact information you choose to provide during enquiries or when entering into a storage agreement.
Account and contract information, such as unit number, contract start and end dates, services taken, and records of communications relating to your account.
Payment and transaction data, such as details of payments made, payment method used, and any related billing information. We do not store full payment card details when third-party payment processors are used, but we may keep partial information to identify transactions.
Verification and security data, such as copies of identity documents where legally required or necessary to prevent fraud, access codes or unit keys allocation records, and records of entry to and exit from the site where access control systems are used.
CCTV images, where CCTV operates on site for security and safety purposes, which may capture images of you, your vehicle, and persons accompanying you.
Communication records, such as notes of conversations, messages sent to us, and any other information you voluntarily provide when contacting us.
Lawful Basis for Processing
We only process your personal data where we have a lawful basis under the UK GDPR. Depending on the circumstances, we may rely on one or more of the following lawful bases:
Contractual necessity: We process personal data to take steps at your request before entering into a contract, and to perform our storage agreements with you. This includes managing bookings, administering your unit, processing payments, and communicating with you about your account.
Legal obligation: We may process personal data to comply with legal and regulatory obligations, including accounting, tax requirements, fraud prevention measures, and responding to lawful requests from authorities.
Legitimate interests: We may process data where it is necessary for our legitimate interests, provided that your interests and fundamental rights do not override those interests. Our legitimate interests include ensuring the security of our site and units, maintaining business records, managing and improving our services, and protecting and enforcing our legal rights.
Consent: Where required by law, we may seek your consent for specific uses of your data, such as certain forms of direct marketing communications. When we rely on consent, you can withdraw it at any time.
How We Use Your Personal Data
We use your personal data for the following purposes:
To provide and manage storage services, including setting up and administering your account, allocating and managing your storage unit, and dealing with enquiries and requests.
To take payment and manage billing, including issuing invoices, processing payments, and managing any outstanding balances.
To maintain site security and safety, including operating access control systems and CCTV, investigating incidents, and ensuring the safety of customers, staff and property.
To communicate with you about your account and our services, such as sending important service messages, updates to terms, and information about bookings or renewals.
To comply with legal and regulatory requirements, including record-keeping, responding to lawful requests, and cooperating with law enforcement where necessary.
To manage our business operations, including reporting, auditing, handling complaints and disputes, and improving our services and customer experience.
Data Sharing and Processors
We may share your personal data with trusted third parties where this is necessary for the purposes described in this Privacy Policy, and where appropriate safeguards are in place. These third parties act as data processors on our behalf or as separate controllers, depending on the circumstances.
Data processors may include payment processing providers that handle card or electronic payments, IT and cloud service providers that host or support our systems, and security service providers that support CCTV or access control systems.
Where third parties act as our processors, they are only permitted to process your personal data in accordance with our instructions, for the purposes we specify, and subject to confidentiality and security obligations. We do not sell your personal data to third parties.
In limited cases, we may share personal data with professional advisers, insurers, or law enforcement and regulatory bodies where necessary to protect our legitimate interests, comply with legal obligations, or establish, exercise or defend legal claims.
Data Retention
We retain personal data only for as long as it is necessary for the purposes for which it was collected, and in line with legal and regulatory requirements.
Contract and account information is generally retained for the duration of your agreement with us and for a reasonable period afterward to handle queries, resolve disputes, keep appropriate business records, and meet legal obligations such as tax and accounting requirements.
Payment and transaction records are kept for the period required by relevant financial and tax legislation.
CCTV footage, where used, is retained for a limited period which is typically short, unless we need to retain specific footage for longer in connection with an incident, investigation or legal claim.
When personal data is no longer needed for the purposes for which it was collected, and there is no legal requirement or legitimate business reason to retain it, we securely delete or anonymise it.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to the personal data we hold about you. These rights may be subject to certain conditions and legal exemptions. Your rights include:
Right of access: You can request confirmation that we process your personal data and ask for a copy of the data we hold about you.
Right to rectification: You can ask us to correct inaccurate or incomplete personal data.
Right to erasure: In certain circumstances, you can request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected and we have no other lawful basis for retaining it.
Right to restriction of processing: You can ask us to restrict the processing of your personal data in certain situations, such as while we verify the accuracy of the data or assess an objection you have raised.
Right to object: You may object to processing that is based on our legitimate interests, including any direct marketing. We will stop processing your data for these purposes unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is required for legal claims.
Right to data portability: Where the processing is based on consent or on a contract and is carried out by automated means, you can request that we provide your personal data in a structured, commonly used and machine-readable format, or that we transfer it to another controller where technically feasible.
Right to withdraw consent: Where we rely on your consent to process personal data, you can withdraw that consent at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.
You also have the right to lodge a complaint with a supervisory authority if you believe that your data protection rights have been infringed.
Security of Your Data
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, unlawful processing, accidental loss, destruction or damage. These measures are designed to provide a level of security appropriate to the risks associated with the processing of your data. Access to personal data is limited to staff and processors who need it for the purposes described in this Privacy Policy and who are subject to confidentiality obligations.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or how we process personal data. Any updated version will be made available to customers, and the revised policy will apply from the date it is issued. We encourage you to review this Privacy Policy periodically so that you remain informed about how we handle your personal data.
