Storage Shirley Customer Privacy Policy
This Privacy Policy explains how Storage Shirley collects, uses, stores and protects personal data relating to customers and prospective customers in the area. It also sets out your rights under the UK General Data Protection Regulation and related data protection laws, and how you can exercise those rights.
Storage Shirley is committed to handling personal data lawfully, fairly and transparently. We only collect and process the personal data that we need to provide our services, manage our relationship with you and meet our legal and regulatory obligations.
Scope of this Privacy Policy
This Privacy Policy applies to all customers, prospective customers and authorised users of Storage Shirley in the area, including individuals who enquire about our services, sign a storage agreement, access our premises or communicate with us in connection with our services.
By using our services or otherwise providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy.
Data Controller
Storage Shirley is the data controller in respect of the personal data we collect and process about you. As data controller, we determine the purposes and means of the processing of your personal data and are responsible for ensuring that such processing complies with applicable data protection laws.
Personal Data We Collect
We may collect and process the following categories of personal data about you as a customer or prospective customer of Storage Shirley:
Identification and contact details, such as your name, postal address, billing address, and similar identifying information you provide to us when you make an enquiry, request a quote or enter into a storage agreement.
Account and contract information, such as customer reference numbers, details of your storage unit, contract start and end dates, payment terms, and records of your communications with us relating to your contract.
Payment and transaction data, such as the method of payment you use, payment status and transaction history relating to your storage services. We do not store full payment card details; where card payments are used, these are handled by secure payment processors.
Access and security data, such as access codes, key numbers, records of entry and exit times, and closed circuit television images captured on or around our premises, to the extent that such images identify you.
Communication data, such as information you provide when you contact us in person, by post or through other communication channels, including records of queries, feedback, complaints or requests you raise with us.
Marketing preferences, such as your choices about receiving service updates, promotions or other marketing communications from us.
Purposes and Lawful Bases for Processing
We process your personal data only where we have a legal basis to do so. Depending on the context, we rely on the following lawful bases under the UK General Data Protection Regulation.
To enter into and perform a contract. We process personal data to take steps at your request before entering into a storage agreement and to perform our contract with you. This includes providing storage services, setting up and managing your account, taking and processing payments, communicating with you about your contract and dealing with any issues or requests you raise.
To comply with legal obligations. We process personal data where necessary to comply with our legal and regulatory obligations, including accounting and tax requirements, health and safety laws, and obligations to respond to lawful requests from law enforcement or other public authorities.
For our legitimate interests. We process personal data where this is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms. These interests include managing and improving our services, ensuring the security of our premises and systems, preventing and detecting fraud and misuse of our facilities, and maintaining accurate business records.
With your consent. In some cases we rely on your consent, for example where required for certain forms of direct marketing. Where we rely on consent, you can withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Data Retention
We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal and regulatory obligations.
In general, we keep customer contract and billing records for a period necessary to administer your contract and for a subsequent period required for taxation, accounting and record keeping purposes. Security and access records, including closed circuit television images and access logs, are kept for a shorter period, unless a longer retention is needed in connection with an investigation, dispute or legal claim.
When personal data is no longer required for the purposes set out in this Privacy Policy, we will securely delete or anonymise it, in line with applicable data protection laws and our internal policies.
Data Processors and Sharing of Personal Data
We may share your personal data with carefully selected third parties who act as data processors on our behalf. These processors may include providers of payment processing services, customer management systems, information technology support, security and closed circuit television services, and document storage or destruction services.
Where we engage third party processors, we ensure that they only process personal data in accordance with our documented instructions, that they implement appropriate technical and organisational security measures, and that they are bound by contractual obligations consistent with data protection law.
We may also share your personal data with third parties acting as independent data controllers where this is necessary to comply with legal obligations, to protect our rights or property, or in connection with the sale or reorganisation of our business or assets, to the extent permitted by law.
We do not sell or rent your personal data to third parties.
International Transfers
Our primary data processing activities take place within the United Kingdom or other locations where equivalent data protection standards apply. If we transfer personal data outside the United Kingdom to a country that does not provide an adequate level of data protection, we will ensure that appropriate safeguards are in place, such as standard data protection clauses or equivalent measures recognised under data protection law.
Security of Personal Data
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include access controls, secure storage arrangements, staff training and policies designed to protect the confidentiality and integrity of personal data.
Your Data Protection Rights
As a customer of Storage Shirley in the area, you have a number of rights in relation to your personal data under the UK General Data Protection Regulation, subject to certain conditions and exemptions.
Right of access. You have the right to obtain confirmation as to whether we process personal data about you and, if so, to receive a copy of that data and certain related information.
Right to rectification. You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
Right to erasure. In certain circumstances, you have the right to request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected or where you withdraw consent and there is no other legal basis for processing.
Right to restriction of processing. You have the right to request that we restrict the processing of your personal data in certain situations, for example while we verify the accuracy of the data or consider an objection you have raised.
Right to object. You have the right to object to the processing of your personal data where we rely on legitimate interests as our lawful basis, including profiling based on those interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where processing is required for the establishment, exercise or defence of legal claims.
Right to data portability. Where our processing is based on your consent or on a contract with you and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine readable format and to request that we transmit it directly to another controller where this is technically feasible.
Right to withdraw consent. Where we rely on your consent to process personal data, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before the withdrawal.
You can exercise your rights by contacting Storage Shirley using the contact methods you normally use in relation to your contract or enquiries. We may need to verify your identity before responding to your request.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations or how we process personal data. When we make significant changes, we will take reasonable steps to inform you, for example by displaying a notice at our premises or updating the information made available to customers.
You should review this Privacy Policy periodically to stay informed about how Storage Shirley protects your personal data and your rights in relation to it.
