Storage Crofton Park Privacy Policy
This Privacy Policy explains how Storage Crofton Park collects, uses, stores, and protects personal data relating to customers and prospective customers in the local area. It is intended to meet the requirements of the UK General Data Protection Regulation and related data protection laws. By using our storage services or communicating with us, you acknowledge that you have read and understood this Privacy Policy.
Scope and Data Controller
This Privacy Policy applies to all Storage Crofton Park customers and prospective customers within our service area, including individuals and businesses who make enquiries, enter into storage agreements, or otherwise interact with us. Storage Crofton Park is the data controller in respect of the personal data we process for the purposes set out in this policy.
Personal Data We Collect
We collect and process different categories of personal data, depending on how you interact with us and the services you use. This may include:
Identification data such as full name, title, date of birth, and proof of identity details shown on official documents.
Contact details such as home or business address, billing address, and other address information you provide to us.
Account and contract information such as storage unit number, rental term, start and end dates, services selected, and payment history.
Financial information such as payment method details, partial card information where required for payment processing, and records of invoices and receipts.
Communication data such as written correspondence, enquiries, complaints, feedback, and records of telephone or in-person conversations where documented.
Security and access information such as details relating to site access systems, access logs, incident reports, and, where in place, closed circuit television recordings captured in and around our premises.
Technical data such as IP address, device information, and basic usage data collected when you visit our website or use any online tools we provide, to the extent necessary to operate and secure our services.
How We Collect Your Data
We obtain personal data directly from you when you contact us, request a quote, visit our premises, sign a storage agreement, make a payment, or communicate with us by any channel. We may also receive information from third parties where this is necessary to confirm identity or carry out fraud prevention, or where a business customer provides contact details of staff who will access a storage unit.
Purposes and Lawful Bases for Processing
We only process your personal data where we have a lawful basis. The main purposes and corresponding lawful bases are:
To provide storage services to you, including setting up and administering your account, managing bookings, processing payments, and communicating with you about your contract. The lawful basis is the performance of a contract or taking steps at your request before entering into a contract.
To comply with legal and regulatory obligations, including tax, accounting, record keeping, crime prevention, and responding to lawful requests from public authorities. The lawful basis is compliance with a legal obligation.
To maintain the safety and security of our premises, customers, and staff, including monitoring access and, where in operation, CCTV surveillance and incident management. The lawful basis is our legitimate interests in ensuring security and preventing crime.
To manage our business operations, including internal administration, service improvement, training, and quality control. The lawful basis is our legitimate interests in operating and improving our storage services.
To send you relevant service information, such as changes to terms, operational notices, or important updates relating to your storage unit. The lawful basis is performance of a contract and our legitimate interests in keeping customers informed.
With your consent, to send you non-essential marketing communications about our services, offers, or updates that may be of interest to you. You can withdraw consent to marketing at any time.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. In general:
Basic account and contract records are kept for the duration of your contract and for a reasonable period afterwards to handle queries, disputes, or legal claims, and to meet statutory retention requirements.
Financial and transaction records are retained for the period required by tax and accounting laws.
Security and access records, including CCTV where used, are kept for a limited period that allows us to investigate incidents or respond to lawful requests, unless a longer retention is necessary in connection with an ongoing investigation or legal matter.
Marketing preferences and contact details associated with them are retained until you opt out or withdraw consent, or until we determine that the data is no longer needed for the original purpose.
When personal data is no longer required, we will securely delete or anonymise it so that it can no longer be associated with you.
Use of Data Processors
We may engage carefully selected third party service providers to process personal data on our behalf. These processors help us with services such as payment processing, secure data storage, information technology support, security systems, and professional advisory services. Where we use data processors, they are only permitted to process personal data in accordance with our documented instructions and for the purposes we specify.
We require all processors to implement appropriate technical and organisational measures to protect the confidentiality and security of your data and to comply with applicable data protection law. We remain responsible for the acts and omissions of our processors in relation to personal data they handle on our behalf.
Data Sharing and International Transfers
We do not sell your personal data. We may share your data with third parties where this is necessary for the purposes described in this Privacy Policy, including professional advisers, payment service providers, insurers, regulators, and law enforcement bodies where required. If personal data is transferred outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses, to protect your rights.
Data Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These measures include access controls, secure storage, staff training, and regular review of our security practices. While no system can be guaranteed to be completely secure, we work to ensure that the level of protection is appropriate to the risks associated with the types of data we process.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data, subject to certain conditions and legal exemptions. These rights include:
The right of access, which allows you to request confirmation of whether we process your personal data and to obtain a copy of that data, along with certain information about how it is used.
The right to rectification, which allows you to request that inaccurate or incomplete personal data we hold about you is corrected.
The right to erasure, sometimes called the right to be forgotten, which allows you to request deletion of your personal data in certain circumstances, for example where it is no longer needed for the original purpose and there is no legal reason for us to keep it.
The right to restrict processing, which allows you to request that we limit the way we use your data in certain situations, for example while we are considering a request to rectify or erase it.
The right to data portability, which allows you to receive certain personal data you have provided to us in a structured, commonly used, machine readable format and, where technically feasible, to ask us to transfer it to another controller.
The right to object to processing based on our legitimate interests, including profiling based on those interests, and the right to object at any time to the use of your personal data for direct marketing.
Where we rely on consent as a lawful basis, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Exercising Your Rights and Complaints
If you wish to exercise any of your data protection rights or have questions about how we handle your personal data, you can contact us using the contact details available on our website or at our premises. We may need to verify your identity before responding to a request. We aim to respond within the time limits set by law and will explain if we need more time or are unable to fully comply with your request due to legal obligations or exemptions.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you are not satisfied with how we handle your personal data or respond to your requests. We would, however, appreciate the opportunity to try to resolve your concerns directly before you approach a supervisory authority.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal or regulatory developments, or improvements in the way we communicate information about our privacy practices. Any updated version will be made available through our usual communication channels and will apply from the date it is published. We encourage you to review this policy periodically to stay informed about how we protect your personal data.
