Storage Grahame Park Privacy Policy
This Privacy Policy explains how Storage Grahame Park collects, uses and protects personal data for all Storage Grahame Park customers in the area. It sets out the types of information we process, the purposes and lawful bases for that processing under the UK General Data Protection Regulation and the Data Protection Act, how long we keep your information, who we share it with, and the rights you have over your personal data.
By using our storage services or otherwise providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy. We may update this Policy from time to time and will apply the latest version to all new and existing customers once published.
Data Controller
Storage Grahame Park is the data controller for the personal data described in this Privacy Policy. This means we decide why and how your personal data is processed when you use our storage services or interact with us as a customer or prospective customer in the area.
Personal Data We Collect
We collect and process different categories of personal data about you, depending on how you interact with us and the services you use. This may include:
Identification details such as your full name, date of birth and identification document details where required to verify your identity.
Contact details such as your home address, billing address, and any other correspondence address you provide to us.
Account and contract information such as storage unit numbers, access codes or keys issued to you, contract start and end dates, payment status, and service preferences.
Payment and transaction information such as payment method details you provide to us, payment history for your storage unit, and records of invoices and receipts.
Security and access information such as CCTV images captured on our premises, access logs for entry systems where applicable, and incident reports related to safety or security.
Communication records such as notes from telephone conversations, and summaries of in-person discussions relating to your storage agreement or enquiries.
Technical information collected through use of our online services, where applicable, such as your IP address, device information and basic usage data required to operate and secure our online portals.
How We Collect Your Data
We collect personal data directly from you when you contact us, ask for a quote, sign a storage agreement, access our facilities, make a payment, or communicate with us in any other way. We may also collect personal data automatically when you enter our premises through CCTV systems used for safety and security, and when you use any online tools or portals we make available for managing your account.
In some limited cases, we may receive information about you from third parties, for example where another person is paying on your behalf or where we receive information from law enforcement agencies in connection with security or fraud prevention.
Lawful Bases for Processing
We only process your personal data when we have a lawful basis under the GDPR. Depending on the specific processing activity, we rely on the following lawful bases:
Contractual necessity: We process personal data that is necessary to enter into and perform our storage contracts with you. This includes processing required to provide you with a storage unit, manage your account, take payments, communicate with you about your contract, and provide support.
Legal obligation: We process personal data where we are required to do so by law, including for tax, accounting, record-keeping and responding to lawful requests from public authorities or law enforcement.
Legitimate interests: We process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. These interests include operating and improving our storage services, ensuring the safety and security of our premises and customers, preventing and detecting fraud or criminal activity, and managing business planning and reporting.
Consent: In a limited number of situations, we may rely on your explicit consent to process personal data for a specific purpose. Where we rely on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing based on consent before it was withdrawn.
How We Use Your Personal Data
We use your personal data for the following purposes:
To provide and manage storage services, including setting up your customer account, allocating and managing storage units, and providing access to our facilities.
To administer contracts and payments, including issuing invoices and receipts, processing payments and refunds, and managing any changes, renewals or cancellations of your agreement.
To maintain security and safety, including operation and monitoring of CCTV systems, managing access control to the site, investigating incidents, preventing unauthorised access, and protecting our property and the property you store with us.
To communicate with you about your account, including sending important information relating to your contract, service notifications, and responding to enquiries or complaints.
To comply with legal and regulatory requirements, including maintaining appropriate financial and accounting records and responding to lawful requests from public authorities.
To manage and improve our business, including internal reporting, quality control, staff training and planning of facility improvements.
Data Retention
We keep your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy and to comply with legal, accounting and reporting requirements.
Customer account and contract data is typically retained for a period after the end of your agreement to allow us to respond to queries, handle disputes, and comply with our legal obligations. Payment and financial records are kept for the period required by applicable tax and accounting laws.
CCTV footage and access logs are retained for a limited period that is appropriate for security and incident investigation purposes, unless a longer retention period is required due to an ongoing investigation or legal proceedings.
When personal data is no longer required, we will securely delete or anonymise it, ensuring that it can no longer be associated with you.
Data Processors and Sharing
We may share your personal data with trusted third parties who act as data processors on our behalf. These processors may provide services such as payment processing, IT hosting or support, security systems support, document storage, and account administration. We only use processors who can demonstrate that they will protect your information in line with data protection laws and our own policies.
We may also share your personal data with professional advisers such as accountants or legal advisers where this is necessary for the services they provide to us, and with public authorities, regulators or law enforcement where we are legally required or permitted to do so.
We do not sell your personal data to third parties. Any sharing of your data is limited to what is necessary for the relevant purpose and takes place under appropriate contractual and security safeguards.
International Transfers
If we transfer your personal data outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws. This may include using approved standard contractual clauses or ensuring that the recipient country benefits from an adequacy decision.
Your Data Protection Rights
Under the GDPR, you have a number of rights in relation to your personal data. These rights apply to all Storage Grahame Park customers in the area, subject to certain legal limitations and conditions.
Right of access: You have the right to request confirmation of whether we process your personal data and to receive a copy of that data, together with information about how we use it.
Right to rectification: You have the right to ask us to correct inaccurate personal data we hold about you and to complete incomplete data.
Right to erasure: In certain circumstances, you have the right to request that we delete your personal data, for example where it is no longer needed for the purpose it was collected, or you withdraw consent where consent is the sole legal basis.
Right to restriction of processing: You may ask us to restrict the processing of your personal data in certain situations, such as while we verify the accuracy of data you believe is incorrect or where you object to processing.
Right to data portability: Where processing is based on consent or contract and carried out by automated means, you have the right to request that we provide you with your personal data in a structured, commonly used and machine-readable format, or that we transmit it directly to another controller where technically feasible.
Right to object: You have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis, including for security or business operations, if you believe your rights and interests override our reasons for processing.
Right to withdraw consent: Where we rely on your consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing before consent was withdrawn.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe your data protection rights have been infringed.
Security of Your Data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include physical security at our premises, controlled access to systems and storage areas, and administrative controls to ensure that staff and processors handle your data appropriately and in accordance with this Privacy Policy.
While we take reasonable steps to protect your personal data, no system can be completely secure. We continually review and update our security measures to respond to emerging risks.
