Storage South Norwood Privacy Policy
This Privacy Policy explains how Storage South Norwood collects, uses, stores and protects personal data relating to customers and prospective customers in the Storage South Norwood service area. It also explains your rights under the UK General Data Protection Regulation and related data protection laws, and how you can exercise those rights.
Scope of this privacy policy
This Privacy Policy applies to all Storage South Norwood customers, former customers and prospective customers in the Storage South Norwood area, as well as users of our services and visitors to our premises who provide personal data to us. By using our storage services or otherwise providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy.
Personal data we collect
We collect and process different types of personal data depending on how you interact with us. This may include:
Identification data such as full name, title, date of birth and identification document details when required for security or legal purposes.
Contact details such as home address, billing address, service address, and any contact preferences you tell us about.
Account and contract information such as storage unit number, contract start and end dates, services taken, payment status and correspondence relating to your account.
Payment-related information such as payment history and methods used. We do not store full card details when payments are processed through secure third-party payment providers.
Usage and communication data such as enquiries, complaints, feedback, and records of conversations or communications with us.
Security and access information such as CCTV images on and around our sites, access control records, and incident reports used for safety and security purposes.
Technical information such as basic device and browser details, and general usage information relating to our online services where applicable.
How we collect personal data
We collect personal data directly from you when you request a quote, make a booking, sign a storage contract, make a payment, visit our sites, contact us with an enquiry, or otherwise interact with our services.
We may also receive information about you from third parties such as payment providers, credit reference agencies, or service partners where this is necessary to provide our services, comply with legal obligations or protect our legitimate interests.
Lawful bases for processing
We process your personal data only when we have a lawful basis to do so under data protection law. Depending on the activity, one or more of the following bases will apply:
Contract: We process personal data where it is necessary to enter into or perform a contract with you. This includes setting up your storage account, providing storage services, communicating with you about your contract and handling payments.
Legal obligation: We process data where we are required to comply with legal obligations, such as tax and accounting rules, anti-fraud measures, security requirements, and law enforcement requests where we are legally required to respond.
Legitimate interests: We process data where it is necessary for our legitimate business interests and where your interests and fundamental rights do not override those interests. This can include maintaining site security, monitoring usage of our facilities, improving our services, managing debt recovery and responding to customer enquiries.
Consent: In limited situations we may rely on your consent, for example where you have clearly agreed to receive certain types of optional communications. Where we rely on consent, you may withdraw it at any time.
How we use personal data
We use the personal data we collect for the following purposes:
To provide, manage and administer storage services, including setting up your account, allocating storage units, managing access and maintaining records.
To process payments, manage billing, handle refunds and pursue outstanding balances where necessary.
To communicate with you about your contract, service updates, notices relating to your storage unit, and any issues that may affect your use of our services.
To maintain the safety and security of our premises, staff and customers, including the use of CCTV and access control systems.
To manage customer relationships, handle enquiries, resolve complaints, and improve our services based on feedback and usage patterns.
To comply with our legal and regulatory obligations and to cooperate with regulators and law enforcement where lawfully required.
To protect our business, for example in relation to fraud prevention, dispute resolution and establishing or defending legal claims.
Data sharing and processors
We do not sell your personal data. We only share your personal data where necessary and permitted by law. This may include:
Service providers acting as data processors who perform services on our behalf, such as payment processing, secure data storage, IT support, security and CCTV management, and account administration. These providers are only allowed to use your data in accordance with our instructions and must protect it appropriately.
Professional advisers such as auditors, legal advisers, and accountants where this is necessary for our legitimate business purposes and to meet legal obligations.
Authorities and regulators where we are legally required to do so or where disclosure is necessary to protect our rights, customers, staff, or property.
Debt collection agencies and similar partners where this is necessary to recover unpaid fees or enforce our contractual rights.
Data retention
We keep your personal data only for as long as it is needed for the purposes described in this Privacy Policy, or as required by law.
In general, we keep account and contract information for a period after your contract ends to respond to any queries, manage disputes, meet tax and accounting requirements, and demonstrate compliance with our legal obligations.
CCTV and access records are kept for a shorter period, unless they are required for the investigation of an incident, security matter or legal claim, in which case they may be retained for a longer period until the matter is fully resolved.
When personal data is no longer required, we will delete it securely or anonymise it so that it can no longer be associated with you.
International transfers
Where we use service providers who are based outside the United Kingdom or who store data in other countries, we take steps to ensure that your personal data is protected to a standard that is equivalent to UK data protection law. This may include using standard contractual clauses or relying on adequacy regulations approved by the relevant authorities.
Security of your data
We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or damage. These measures include physical security at our sites, controlled access to systems, staff training and the use of secure technologies and protocols where appropriate.
While we take reasonable steps to protect your personal data, no system can be completely secure. You also play a part in keeping your information safe by keeping your access codes, passwords and any security details confidential.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data. These include the right to:
Access your personal data and receive a copy of the information we hold about you.
Request correction of any inaccurate or incomplete personal data we hold about you.
Request erasure of your personal data in certain circumstances, for example where it is no longer necessary for the purposes for which it was collected and we have no legal reason to keep it.
Request restriction of processing of your personal data in certain situations, such as where you contest the accuracy of the data or object to our use of it.
Object to the processing of your personal data where we are relying on legitimate interests and your particular situation gives rise to an objection, or where data is processed for direct marketing.
Request the transfer of your personal data to you or another service provider in a structured, commonly used and machine-readable format, where technically feasible and where processing is based on consent or contract.
Withdraw consent where we rely on your consent to process your personal data. Withdrawal of consent does not affect the lawfulness of processing carried out before you withdrew it.
You also have the right to lodge a complaint with the relevant supervisory authority if you are concerned about how we handle your personal data.
Changes to this privacy policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations or how we process personal data. Any significant changes will be made available through our usual communication channels. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
