Storage Cambridge Heath Privacy Policy
This Privacy Policy explains how Storage Cambridge Heath collects, uses, stores and protects personal data relating to customers in the Cambridge Heath area. It also explains your rights under the UK General Data Protection Regulation and related data protection laws. This Privacy Policy applies to all Storage Cambridge Heath customers, including prospective customers, current customers and former customers whose data we continue to retain in accordance with legal and contractual obligations.
Who we are and scope of this policy
Storage Cambridge Heath is a self-storage service provider operating in the Cambridge Heath area. In relation to the personal data we collect about you as a customer or potential customer, we act as a data controller. This means we determine the purposes and means of processing your personal data and are responsible for ensuring that such processing complies with applicable data protection laws.
This Privacy Policy applies to any personal data processed by Storage Cambridge Heath in connection with your enquiries, reservations, contracts, access to and use of storage units, payments and related services, as well as to communications sent to or received from you.
Personal data we collect
We may collect and process the following categories of personal data about you:
Identification and contact details, such as your full name, postal address, proof of address details, date of birth, and other information required to verify your identity.
Contact information, such as email address, correspondence address and other contact details you provide to us, excluding phone numbers and WhatsApp numbers.
Contract and account information, such as unit number, contract start and end dates, billing history, payment status, deposit details, and correspondence regarding your contract.
Payment and billing information, such as payment method details and transaction records processed through our payment processors. We do not store full bank card details where this is handled by our payment processors.
Access and security information, such as records of access to the premises where such systems operate, including times of entry and exit and any unique access identifiers or codes associated with your account.
Communications and enquiries, including messages, complaints, feedback or query details, as well as any information you provide when communicating with us in writing or in person.
How we collect your personal data
We collect personal data directly from you when you make an enquiry, request a quote, create an account, sign a contract, access our premises or communicate with us. We may also receive personal data about you from third parties where required for verification, fraud prevention or where you have authorised another person to act on your behalf.
Lawful bases for processing your data
We rely on one or more of the following lawful bases under the UK General Data Protection Regulation to process your personal data:
Contract: We process personal data when it is necessary to enter into, perform or manage a contract with you, including to provide storage services, manage your account, take payment, and communicate about your contract.
Legal obligation: We process personal data where we are required to do so to comply with legal and regulatory obligations, including tax, accounting, record-keeping, anti-money laundering, fraud prevention and health and safety requirements.
Legitimate interests: We process personal data where it is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms. These interests include managing and improving our services, ensuring site security, preventing and detecting fraud or misuse, pursuing and defending legal claims, and maintaining business records.
Consent: In some cases, we may rely on your consent, for example for certain marketing communications where required by law. Where we rely on consent, you may withdraw your consent at any time.
How we use your personal data
We may use your personal data for the following purposes:
To respond to enquiries, provide quotes and assist you in selecting storage services.
To set up, manage and administer your account and contract, including invoicing and processing payments.
To provide access to and secure operation of storage units and the premises.
To communicate with you regarding your contract, payments, operational updates and any issues relating to your storage unit or our services.
To manage customer service, handle complaints, resolve disputes and maintain accurate records.
To comply with legal and regulatory requirements, including responding to lawful requests from public authorities.
To protect the security of our premises, systems and customers, including the prevention, detection and investigation of crime or fraud.
To analyse and improve our services and operations, in a way that respects your privacy and, where possible, uses anonymised or aggregated information.
Data retention
We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. The length of time we keep your data depends on the nature of the information and the purposes for which it is processed.
In general, we retain account and contract information for a period after the end of your contract in order to respond to inquiries, handle disputes, maintain accurate financial and tax records, and comply with legal obligations. Access records and security data are retained for as long as reasonably necessary to ensure site safety and investigate incidents, and then securely deleted or anonymised.
When personal data is no longer required for the purposes for which it was collected and no legal obligation requires retention, we will securely delete, anonymise or otherwise dispose of it.
Data processors and third parties
We may share your personal data with trusted third parties that act as data processors on our behalf. These processors are engaged to provide services such as payment processing, secure data storage, customer management systems, accounting support, maintenance of our information technology systems, and physical security and access control systems.
Where we use processors, we enter into appropriate data processing agreements that require them to process your personal data only on our instructions, to implement suitable technical and organisational measures to protect your data, and to comply with applicable data protection laws.
We may also share personal data with other third parties acting as independent controllers where required by law or where strictly necessary, such as public authorities, law enforcement bodies, tax authorities, insurance providers or professional advisers. Any such sharing is limited to what is necessary and proportionate in the circumstances.
We do not sell your personal data to third parties.
International transfers
Where it is necessary to transfer personal data outside the United Kingdom or the European Economic Area, we ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws. These safeguards may include adequacy regulations, standard contractual clauses or other legally recognised mechanisms.
Security of your personal data
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include access controls, secure storage, data minimisation and regular review of our data handling practices.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data. These rights apply to all Storage Cambridge Heath customers in the Cambridge Heath area and, in certain cases, to prospective and former customers.
Right of access: You have the right to request confirmation as to whether we process your personal data and, if so, to receive a copy of that data together with certain information about how we process it.
Right to rectification: You have the right to request that we correct or complete any inaccurate or incomplete personal data we hold about you.
Right to erasure: In certain circumstances, you may have the right to request the deletion of your personal data. This right is not absolute and may be subject to our need to retain data for legal or contractual reasons.
Right to restriction of processing: You may request that we restrict the processing of your personal data in certain situations, for example while we verify its accuracy or consider an objection you have raised.
Right to data portability: In certain circumstances, you have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format, and to have that data transmitted to another controller where technically feasible.
Right to object: You have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis. We will stop processing unless we can demonstrate compelling legitimate grounds or where processing is required for legal claims.
Rights in relation to consent: Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.
Exercising your rights and complaints
You can contact us to exercise any of your data protection rights. When you make a request, we may need to ask you for additional information to confirm your identity and ensure your rights are protected. We aim to respond to all valid requests within the time limits set by law.
If you believe that your data protection rights have been infringed, you also have the right to lodge a complaint with the data protection supervisory authority. You can do this in the country where you live or work, or where you consider that a breach of data protection law has occurred.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal obligations. Any significant changes will be communicated in an appropriate manner, and the updated policy will apply from the date it is made available.
