Storage Southborough Privacy Policy
This Privacy Policy explains how Storage Southborough collects, uses, stores and protects personal data relating to its customers and prospective customers in the area. It also describes your rights under the UK General Data Protection Regulation and related data protection laws, and how you can exercise those rights.
By using our services, renting or enquiring about storage units, visiting our premises, or otherwise interacting with Storage Southborough, you acknowledge that your personal data will be processed in accordance with this Privacy Policy.
Scope and who this policy applies to
This Privacy Policy applies to all Storage Southborough customers and prospective customers in the surrounding area, as well as individuals who contact us with general enquiries, suppliers who are sole traders, and any visitors to our premises whose personal data we process in the course of operating our storage business.
This policy does not cover the processing of personal data by third parties who may independently provide services to you. Those third parties will have their own privacy policies and responsibilities for compliance.
Data controller
Storage Southborough is the data controller in respect of the personal data processed about you for the purposes described in this Privacy Policy. As data controller, we are responsible for deciding how we hold and use personal information about you and for ensuring that such processing is carried out in compliance with applicable data protection legislation.
Personal data we collect
The type and amount of personal data we collect about you depends on your relationship with us and the services you use. We may collect and process the following categories of personal data:
Identification and contact information, including your full name, postal address, billing address, contact address, date of birth, and any identification numbers or document details that you provide to us such as a driving licence or passport number where required for verification.
Contact details, including your email address, mobile number and landline number, together with details of any alternative contact person or emergency contact you provide.
Account and contract information, including your storage unit number, rental start and end dates, access authorisations, payment history, records of communications with you, and copies of signed contracts or agreements.
Payment information, including payment method and transaction records. We may receive limited card details or bank details as required to process payments or refunds, though payment card information is normally processed by third party payment processors on our behalf.
Security and access data, including access logs to the premises or storage units, entry and exit times, records of key fob or code usage, and any relevant CCTV footage captured at our premises.
Correspondence and enquiry information, including details provided when you make enquiries about our services in person or by other means, and any complaints, feedback or requests you submit to us.
How we collect your personal data
We collect personal data directly from you when you contact us, request a quote, complete forms, sign contracts, make payments, or otherwise use our services. We may also collect personal data when you visit our premises through access control systems and CCTV.
In some cases we may receive personal data about you from third parties, for example references or contact details provided by another customer, credit and identity verification providers where applicable, or law enforcement and regulatory bodies where we are legally required to do so.
Lawful bases for processing your data
We will only process your personal data where we have a lawful basis under data protection law. Depending on the context, we may rely on the following lawful bases:
Contract: Processing that is necessary to enter into or perform a contract with you, for example to set up and manage your storage unit rental, maintain your account, process payments, and provide customer support.
Legal obligation: Processing that is necessary to comply with our legal and regulatory obligations, such as verifying identity where required, maintaining financial and tax records, responding to lawful requests from public authorities, and maintaining appropriate safety and security measures.
Legitimate interests: Processing that is necessary for our legitimate business interests, provided that your interests and fundamental rights do not override those interests. This includes securing our premises and assets, preventing and detecting fraud or misuse of our facilities, improving and managing our services, and communicating with you about similar services you already use, where this is permitted by law.
Consent: Where required, we may rely on your explicit consent, for example for certain types of direct electronic marketing that go beyond what is allowed under legitimate interests, or for retaining your information for a longer period once your contract ends, where not otherwise required by law. You may withdraw your consent at any time as described below.
How we use your personal data
We may use your personal data for the following purposes:
To create, manage and administer your storage account, including setting up units, arranging access, contacting you about your booking, and handling renewals or changes.
To process payments, issue invoices and receipts, collect outstanding sums, and manage any payment disputes or refunds.
To maintain security and safety at our premises, including monitoring access, operating CCTV systems, investigating incidents and preventing unauthorised entry or misuse of storage units.
To provide customer service and support, respond to your enquiries and complaints, and communicate important information about your contract, unit access, or changes to our services and policies.
To meet our legal and regulatory obligations, including record keeping, accounting, and cooperation with law enforcement or regulatory investigations where lawfully required.
To manage our business operations, including internal reporting, quality control, staff training, and planning and expanding our services in the area.
To send you information about services that are the same as or similar to those you already receive from us, where this is permitted by law and you have not opted out of such communications.
Data retention
We keep personal data only for as long as is necessary for the purposes for which it was collected, and to meet any legal, accounting or reporting requirements. The specific retention period will depend on the type of data and the reasons for which it is processed.
Generally, we retain contract and account records for a period after your relationship with us ends, in order to deal with any queries, complaints or legal claims that may arise. Security and access data, including CCTV footage and access logs, is kept for shorter periods unless it is required for the investigation of an incident or for legal reasons.
When personal data is no longer required, we will securely delete, anonymise or destroy it in accordance with our data retention procedures.
Data processors and third party recipients
We may engage carefully selected third party service providers to process personal data on our behalf as data processors. These may include providers of payment processing services, IT hosting and maintenance, customer relationship management systems, security services, and professional advisers such as accountants or legal advisers. Such processors are only permitted to process personal data in accordance with our documented instructions and are required to implement appropriate security measures.
We may also share personal data with third parties who act as independent controllers, for example with banks, insurers, law enforcement agencies, courts, regulatory authorities, or debt collection agencies where necessary and lawful.
We do not sell your personal data. Any sharing is limited to what is necessary and proportionate for the relevant purpose and is always carried out in compliance with data protection law.
International transfers
Where any of our service providers access or store personal data outside the United Kingdom, we will ensure that appropriate safeguards are in place to protect your information, such as using countries that have been recognised as providing an adequate level of data protection, or entering into contracts incorporating standard data protection clauses approved for use under the UK GDPR.
How we protect your data
We take reasonable technical and organisational measures to protect the personal data we hold against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include access controls, physical security at our premises, secure storage of physical records, and appropriate procedures for handling data breaches.
While we do our best to protect your personal data, no system can be guaranteed to be completely secure. You are also responsible for keeping any access codes or credentials we provide confidential and for notifying us promptly if you believe they have been compromised.
Your data protection rights
You have a number of rights in relation to the personal data we hold about you, subject to certain conditions and exemptions under data protection law. These rights include:
The right to be informed: You have the right to clear and transparent information about how we use your personal data, which we provide through this Privacy Policy and related notices.
The right of access: You have the right to request a copy of the personal data we hold about you and to obtain information about how it is processed.
The right to rectification: You have the right to ask us to correct or complete any inaccurate or incomplete personal data about you.
The right to erasure: In certain circumstances, you have the right to request that we delete your personal data, for example where it is no longer needed for the purpose for which it was collected, or where you withdraw consent and there is no other legal basis for processing.
The right to restrict processing: You may ask us to temporarily suspend processing of your data, for example while we verify its accuracy or assess an objection you have raised.
The right to data portability: In certain circumstances, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine readable format, and to have that data transmitted to another controller where technically feasible.
The right to object: You have the right to object to the processing of your personal data based on our legitimate interests, including any direct marketing, in which case we will stop processing unless we can demonstrate compelling legitimate grounds.
Rights relating to automated decision making: We do not carry out automated decision making that produces legal or similarly significant effects on you solely on the basis of automated processing.
Exercising your rights and complaints
You may exercise your rights or raise questions about how we process your personal data by contacting us using the usual contact routes associated with your account or by writing directly to our main business address. In order to protect your privacy, we may ask you to verify your identity before responding to certain requests.
If you are not satisfied with our response or believe that we are not processing your personal data in accordance with data protection law, you have the right to lodge a complaint with the relevant supervisory authority in the United Kingdom.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or the services we offer. Any changes will take effect from the date the updated version is published. You should review this Privacy Policy periodically to stay informed about how we handle your personal data.
