Storage East Dulwich Privacy Policy
This Privacy Policy explains how Storage East Dulwich collects, uses, stores and shares personal data of customers and prospective customers located in the Storage East Dulwich service area. It also describes your rights under the UK General Data Protection Regulation and related data protection laws.
By using our storage facilities or related services, you acknowledge that you have read and understood this Privacy Policy. We may update this policy from time to time. Any changes will apply from the date they are published.
Who this Privacy Policy applies to
This Privacy Policy applies to all individual customers and prospective customers of Storage East Dulwich in our operating area, including people who:
Use or enquire about our storage units or related services, visit our premises, visit our website, contact us by post or other communication channels, act on behalf of a business customer, supplier or partner.
Where you provide us with personal data relating to another individual, you are responsible for ensuring that the individual understands how their data will be used and that you have authority to share it with us.
What personal data we collect
The personal data we collect will depend on how you interact with us and which services you use. We may collect and process the following categories of personal data:
Identification and contact details, such as full name, residential or business address, billing address, proof of identity details as required for security and legal compliance, and other contact information you choose to provide.
Account and contract information, such as customer account details, unit number or storage space details, start and end dates of agreements, payment history, communication history with us, and records of enquiries or complaints.
Payment and billing information, such as payment method details and billing records. We do not store full payment card details where a secure payment provider is used; instead, we may hold limited information necessary for transaction records, refunds and fraud prevention.
Security and access data, such as access codes, logs of entries to and exits from our premises where an access control system is used, and closed-circuit television images in and around our facilities. CCTV is used for security, safety and fraud prevention.
Technical and usage data, such as details of how you use our website and online services, including device information, approximate location data based on IP address, pages viewed and time spent on our website. This may be collected using cookies or similar technologies where permitted by law and subject to your choices.
Marketing and communication preferences, such as records of your consent to receive marketing communications, your preferences about how you wish to be contacted, and any opt-out or unsubscribe requests.
Lawful bases for processing your data
We only process your personal data where we have a lawful basis under data protection law. Depending on the context, we rely on the following lawful bases:
Contract: to take steps at your request before entering into a storage agreement, to enter into and perform our contract with you, and to manage your account and any related services.
Legal obligation: to comply with legal and regulatory requirements, such as tax, accounting, anti-money laundering, crime prevention, and obligations relating to safety and security of our premises.
Legitimate interests: to pursue our legitimate business interests, provided your rights and freedoms do not override those interests. This includes managing and improving our services and premises, protecting our property and customers, maintaining security and preventing fraud, sending limited service-related communications, handling enquiries and complaints, and developing our business operations.
Consent: where required by law, we will obtain your consent before sending certain direct marketing communications or before using non-essential cookies or similar technologies. You can withdraw your consent at any time, although this will not affect the lawfulness of processing before withdrawal.
How we use your personal data
We use your personal data for the following purposes:
To provide storage and related services, including creating and managing your customer account, processing bookings and contracts, arranging access to units, issuing invoices and processing payments.
To communicate with you, including responding to your enquiries, confirming bookings, notifying you about important changes to your contract or our terms, and dealing with any issues or complaints.
To manage our facilities, including maintaining security systems and access controls, monitoring access to units and communal areas, and operating CCTV for security, safety and crime prevention.
To comply with our legal and regulatory obligations, including record-keeping for accounting and tax purposes, and cooperating with law enforcement or regulatory authorities where required.
To improve our services and operations, including analysing how our facilities and website are used, planning future capacity and services, and training our staff.
To send you marketing communications about our services where we are permitted to do so by law or where you have given your consent. You can opt out of marketing at any time.
Data sharing and processors
We may share your personal data with carefully selected third parties where necessary and lawful. These third parties act either as independent controllers or as processors acting on our instructions.
We may use data processors to support the operation of our business, including providers of data storage and hosting services, payment processing services, customer relationship management systems, security and access control systems, and professional advisers such as accountants or legal advisers.
Where we engage processors, we ensure that a written contract is in place requiring them to process personal data only on our documented instructions, to maintain appropriate security measures, to keep data confidential, and to assist us in meeting our data protection obligations.
We may also share personal data with law enforcement agencies, regulators, courts or other public authorities if required by law or where it is necessary to protect our rights, property or safety or that of our customers or others.
We do not sell your personal data.
Retention of your personal data
We keep your personal data only for as long as is necessary for the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements.
In determining appropriate retention periods, we consider the nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and any applicable legal requirements or guidance.
As a general guideline, customer and contract information is typically retained for a period after the end of your contract, to address any queries, disputes or legal claims. CCTV recordings are usually retained for a short period unless they are required for investigation of an incident. Payment records and related financial information may be kept for a longer period to comply with accounting and tax obligations.
When personal data is no longer required, we will securely delete or anonymise it.
International transfers
Where we use service providers or systems located outside the United Kingdom or the European Economic Area, your personal data may be transferred to countries that do not provide the same level of data protection. In such cases, we will ensure that appropriate safeguards are in place, such as standard contractual clauses or other lawful transfer mechanisms, to protect your personal data.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data. These rights may be subject to certain conditions and exemptions.
Right of access: you can request a copy of the personal data we hold about you and information about how we process it.
Right to rectification: you can ask us to correct inaccurate or incomplete personal data.
Right to erasure: in certain circumstances, you can ask us to delete your personal data.
Right to restriction: you can ask us to restrict the processing of your personal data in specific situations.
Right to data portability: in some cases, you can request that we provide your personal data in a structured, commonly used and machine-readable format, or that we transmit it to another controller.
Right to object: you can object to our processing of your personal data where we rely on legitimate interests, and you can always object to direct marketing.
Rights in relation to automated decision-making: you have rights relating to decisions based solely on automated processing where they produce legal or similarly significant effects on you.
To exercise any of your rights, you can contact us using our usual contact channels. We may need to verify your identity before responding to your request. We aim to respond within the time limits set by law.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you are unhappy with how we have handled your personal data.
Security of your personal data
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, alteration or destruction. These measures include access controls, physical security measures at our premises, secure storage systems, and staff training. While we take reasonable steps to safeguard your data, no system can be completely secure and we cannot guarantee absolute security.
