Storage Carshalton Privacy Policy
This Privacy Policy explains how Storage Carshalton collects, uses, stores and shares personal data relating to its customers and prospective customers in the Carshalton area. It is designed to comply with the UK General Data Protection Regulation and the Data Protection Act 2018. By using our storage services or contacting us, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage Carshalton customers and individuals who enquire about or use our storage services within the Carshalton area, including individuals acting on behalf of businesses. It covers personal data obtained through our premises, our website, written correspondence and any other direct interactions with us.
Who is the Data Controller
Storage Carshalton is the data controller in respect of the personal data it collects and processes about you for the purposes described in this Privacy Policy. As data controller, we determine the purposes and means of processing your personal information and are responsible for ensuring that such processing complies with applicable data protection law.
Personal Data We Collect
We may collect and process the following categories of personal data about you:
Identification and contact details, such as your full name, postal address, billing address, and any additional contact address you provide, together with details of any identification documents you present for verification. Contact information, such as your email address, contact preferences, and any additional contact person you nominate. Contract and account information, including storage unit details, contract dates, payment history, invoices, correspondence relating to your contract, and records of your enquiries or complaints. Payment and billing information, such as partial payment card details used for transaction processing, account name, and transaction records. We do not store full card numbers or security codes. Security and access information, such as CCTV images captured on our premises, access logs to storage units where applicable, and records relating to security incidents. Technical information, such as basic information about your device and interactions when you visit our website, including IP address, browser type and basic usage data, where this is necessary to operate and secure our online services.
How We Collect Your Data
We collect personal data directly from you when you contact us for a quotation, visit our premises, sign a storage contract, make a payment, or communicate with us by post or online. We may also collect information from third parties where lawful to do so, for example from credit reference agencies if we carry out limited checks in connection with a contract, or from individuals who have been authorised by you to act on your behalf.
Purposes and Lawful Basis for Processing
We process your personal data only where we have a lawful basis under data protection law. The main lawful bases we rely on are contract, legal obligation and legitimate interests. In some cases, we may rely on your consent.
We use your personal data for the following purposes and legal bases. To provide storage services and manage your contract, including setting up your account, allocating storage units, administering access, processing payments and communicating with you about your contract. Our lawful basis is performance of a contract or taking steps at your request prior to entering into a contract. To comply with legal and regulatory obligations, including obligations relating to taxation, accounting, prevention and detection of crime, and responding to lawful requests from authorities. Our lawful basis is compliance with a legal obligation. To protect our premises, property and the safety of staff and customers, including the use of CCTV systems and access logs to prevent and investigate security incidents. Our lawful basis is our legitimate interests in ensuring site security and protecting property, balanced against your rights and freedoms. To manage our business operations, such as handling customer service queries, monitoring service quality, training staff and improving our services. Our lawful basis is our legitimate interests in running and improving our business in a responsible manner. To send you service messages, important updates about your storage unit or changes to this Privacy Policy or our terms and conditions. Our lawful basis is performance of a contract and our legitimate interests in keeping you properly informed. To send you marketing communications about our services and offers, where you have given consent or where we are otherwise permitted by law to do so. You can opt out of marketing communications at any time.
Data Retention
We will retain your personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements.
In general, we retain customer contract and billing records for a period required by applicable tax and accounting rules following the end of your contract. CCTV footage is retained for a shorter period sufficient to investigate incidents and maintain security, unless a specific recording needs to be kept longer in connection with an ongoing investigation or legal claim. Information used solely for marketing purposes will be retained until you withdraw your consent or object to such processing, or we determine that it is no longer accurate or relevant.
Processors and Sharing of Personal Data
We may share your personal data with carefully selected third party service providers who act as data processors on our behalf. These processors provide services such as payment processing, secure data storage, IT support, accounting support, and CCTV system maintenance. We require all processors to act only on our documented instructions, to keep your data secure and confidential, and to comply with data protection laws.
We may also share your data with professional advisers such as lawyers or accountants where necessary, with law enforcement or regulatory bodies where we are legally required or permitted to do so, or with another organisation in the context of a business reorganisation, merger or transfer of services, where lawful and with appropriate safeguards.
We do not sell your personal data. Where any transfer of data outside the United Kingdom or European Economic Area occurs, we will ensure that appropriate safeguards are in place, such as adequacy regulations or standard contractual clauses, to protect your information.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data, subject to certain conditions and exemptions. These rights include the right of access, which allows you to request confirmation that we process your personal data and to obtain a copy of that data. The right to rectification, which allows you to request correction of inaccurate or incomplete personal data. The right to erasure, also known as the right to be forgotten, which in certain circumstances allows you to request that we delete your personal data. The right to restrict processing, which allows you in some cases to request that we limit how we use your data. The right to data portability, which in certain situations allows you to obtain your personal data in a structured, commonly used and machine readable format and to have it transmitted to another controller. The right to object, which allows you to object at any time to processing based on our legitimate interests and to object to direct marketing. Where we rely on consent as our lawful basis, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Exercising Your Rights and Complaints
If you wish to exercise any of your data protection rights, or if you have any concerns about how we handle your personal data, you can contact us using the details provided on our main customer information materials or at our premises. We will respond to your request in accordance with applicable law and usually within one month.
You also have the right to lodge a complaint with the relevant supervisory authority if you believe that your data protection rights have been infringed. We would, however, welcome the opportunity to address your concerns directly in the first instance.
Security of Your Data
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or damage. These measures include physical security at our sites, controlled access to customer records, secure payment processing arrangements and regular review of our security practices. While we strive to protect your personal information, no system can be completely secure and we cannot guarantee absolute security of your data.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or data protection practices. When we make significant changes, we will take appropriate steps to bring them to your attention, for example by updating notices at our premises or revising the information provided during the contracting process. The most recent version of this Privacy Policy will always apply to the personal data we hold about you.
