Storage Bexley Privacy Policy
This Privacy Policy explains how Storage Bexley collects, uses, stores, and protects personal data of all Storage Bexley customers in the area. It also explains your rights under the United Kingdom General Data Protection Regulation and the Data Protection Act 2018. By using our services you acknowledge that you have read and understood this Privacy Policy.
Who this Privacy Policy applies to
This Privacy Policy applies to all Storage Bexley customers in the area, including individuals, sole traders, partnerships, and representatives of corporate clients who use or enquire about our storage or related services. It also applies to visitors to our premises and to individuals who contact us with questions or requests about our services.
Types of personal data we collect
We may collect and process the following categories of personal data, depending on your relationship with us and the services you use:
Identification data such as full name, title, date of birth, identification document details and signatures.
Contact data such as correspondence address, billing address, and other contact information that you choose to provide to us.
Account and contract data such as customer reference numbers, storage unit numbers, contract details, move in and move out dates, payment history, and communication records related to your account.
Payment and billing data such as transaction details, invoicing records, payment status and methods used for payment. We do not store full payment card details where payments are processed through a secure payment processor.
Security and access data such as CCTV footage from our sites, access control logs, entry and exit times, and incident reports where relevant for security and safety.
Usage and communication data such as enquiries, complaints, feedback, and any correspondence you have with us by post or other channels.
How we collect your personal data
We collect personal data from you directly when you contact us, request a quote, make a booking, sign a storage agreement, make a payment, or otherwise communicate with us. We may also collect data from you when you visit our premises, including via CCTV systems and access control systems used for safety and security.
We may receive limited personal data from third parties where this is necessary and lawful, for example from payment service providers, debt recovery agencies, or professional advisers acting on your behalf. In all cases we only collect personal data that is relevant and necessary for the purposes described in this Privacy Policy.
Lawful bases for processing your personal data
We process personal data only when we have a lawful basis under data protection law. Depending on the specific activity, we rely on one or more of the following lawful bases:
Performance of a contract. We process personal data to enter into and fulfil storage agreements or related contracts with you, including setting up your account, managing your storage unit, handling payments, and providing customer service.
Compliance with legal obligations. We process certain personal data because we are required to do so by law, such as keeping financial records for tax and accounting purposes, maintaining health and safety records, and cooperating with law enforcement or regulatory authorities when legally required.
Legitimate interests. We process personal data where it is necessary for our legitimate business interests and where your interests and fundamental rights do not override those interests. These legitimate interests may include ensuring the security of our premises and customers, preventing and investigating fraud or misuse of our services, managing and improving our services and premises, and handling complaints or disputes.
Consent. In limited circumstances we may rely on your consent, for example where required by law before sending certain types of direct marketing. Where we rely on consent you can withdraw it at any time, and this will not affect the lawfulness of processing carried out before withdrawal.
Purposes for which we use personal data
We use your personal data for the following purposes:
To provide storage and related services to you, including setting up your account, administering your contract, managing access to storage units, and handling enquiries.
To process payments, issue invoices, manage billing queries, and recover any outstanding amounts lawfully owed to us.
To maintain the safety and security of our premises, customers, staff, and property, including through CCTV monitoring, access control systems, and incident reporting.
To communicate with you about your contract, your account, our services, and any changes to our terms, policies, or opening hours.
To comply with legal and regulatory requirements, respond to legal claims, and cooperate with public authorities where we are legally required to do so.
To manage our business operations, including record keeping, financial management, staff training, and service improvement.
Data retention periods
We keep personal data only for as long as is necessary for the purposes for which it was collected and to meet any legal, accounting, or reporting requirements. The specific retention period will depend on the category of information and the applicable laws or regulations.
Customer account and contract data are generally retained for a period after the end of the storage agreement to enable us to respond to queries, address disputes, and meet legal obligations relating to financial and tax records.
CCTV footage and access logs are retained for a limited period, which is determined by our security needs and any incident investigations, unless a longer retention period is required by law or is necessary for the establishment, exercise, or defence of legal claims.
When personal data is no longer required, it is securely deleted, anonymised, or otherwise disposed of in a safe manner.
Data processors and third parties
We may engage carefully selected third party service providers to process personal data on our behalf. These service providers act as data processors and are only permitted to process personal data in accordance with our instructions and for the purposes described in this Privacy Policy.
Examples of the types of processors we may use include payment processing providers, accounting and bookkeeping providers, IT and cloud storage providers, security system providers such as CCTV and access control support, and professional advisers such as auditors or legal advisers where they act as processors.
We require all data processors we use to implement appropriate technical and organisational measures to protect personal data and to maintain confidentiality. We do not allow them to use personal data for their own purposes.
We may also share personal data with third parties acting as independent controllers where necessary, for example with law enforcement or regulatory authorities where required by law, with courts and legal representatives in connection with legal proceedings, or with debt recovery agencies where necessary to recover sums owed to us.
International data transfers
Where we make use of service providers located outside the United Kingdom or the European Economic Area, or where personal data may be stored or accessed from outside these territories, we take steps to ensure that appropriate safeguards are in place to protect your data. These safeguards may include the use of data protection clauses approved by relevant authorities or other measures permitted by data protection law.
Security of your personal data
We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These measures include access controls, secure storage, staff training, and policies designed to protect the confidentiality and integrity of personal data.
Your data protection rights
Under data protection law, you have a number of rights in relation to the personal data we hold about you. These rights apply in most circumstances and may be subject to certain conditions and exemptions.
Right of access. You have the right to request confirmation that we process your personal data and to receive a copy of that data, together with information about how we use it.
Right to rectification. You have the right to request that inaccurate personal data is corrected and that incomplete data is completed.
Right to erasure. In certain circumstances, you have the right to request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected and we have no other lawful basis to retain it.
Right to restriction of processing. You may request that we restrict the processing of your personal data in certain situations, such as while we consider a request to rectify inaccurate data.
Right to data portability. Where our processing is based on your consent or on a contract and is carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, machine readable format and to request that it is transmitted to another controller where technically feasible.
Right to object. You have the right to object to certain types of processing based on our legitimate interests, on grounds relating to your particular situation. We will stop such processing unless we can demonstrate compelling legitimate grounds or the processing is required for legal claims.
Right to withdraw consent. Where we rely on your consent, you have the right to withdraw that consent at any time.
You also have the right to lodge a complaint with a supervisory authority if you believe that your data protection rights have been infringed.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. Any significant changes will be communicated by appropriate means, and the updated version will apply from the date it is made available.
