Storage Blackheath Privacy Policy
This Privacy Policy explains how Storage Blackheath collects, uses, stores, and protects personal data relating to our storage services. It applies to all Storage Blackheath customers and prospective customers in our service area, as well as individuals who contact us with enquiries about our services.
We are committed to complying with the UK General Data Protection Regulation and the Data Protection Act 2018. We process personal data lawfully, fairly, and transparently, and only for specified, explicit, and legitimate purposes.
Personal Data We Collect
We collect and process personal data that is necessary to provide our storage services, administer customer accounts, and meet our legal obligations. The personal data we may collect includes:
Identification and contact details such as name, postal address, billing address, contact address, and any alternative contact details you provide.
Communication details such as email content, written correspondence, and notes of telephone conversations or in-person discussions that relate to your use of our services.
Contract and account information such as storage unit number, contract start and end dates, payment history, services requested, access permissions, and records of any instructions or preferences you provide.
Payment-related information such as payment method, payment confirmations, and transaction records. We do not store full payment card details when payments are processed through secure payment providers.
Security and access information such as records of access to the premises, access control logs, and CCTV footage captured on and around our site, where installed and clearly signposted.
Technical and usage data such as basic information needed to operate and secure our website or online tools, including logs of visits, dates and times of access, and data necessary for security and performance monitoring.
Lawful Bases for Processing Your Data
We rely on one or more of the following lawful bases to process your personal data:
Contractual necessity: We process your data when it is necessary to enter into a contract with you or to perform a contract for storage services. This includes setting up your account, managing your booking, taking payment, and communicating with you about your storage arrangements.
Legal obligation: We process your data when it is necessary to comply with legal or regulatory requirements, such as tax, accounting, or safety regulations, and for the prevention and detection of crime.
Legitimate interests: We process your data where it is necessary for our legitimate business interests, provided that these interests are not overridden by your rights and freedoms. This may include ensuring the security of our premises, improving our services, managing queries and complaints, and maintaining accurate business records.
Consent: In limited circumstances, we may rely on your consent, for example for certain types of direct marketing where this is required by law. Where we rely on consent, you can withdraw it at any time by contacting us using the details given in your contract or correspondence.
How We Use Your Personal Data
We use your personal data for the following purposes:
To provide and manage storage services, including setting up and administering your account, allocating units, processing payments, and managing access and security.
To communicate with you about bookings, renewals, changes to your contract, payment reminders, and any issues related to your use of the storage facility.
To maintain the safety and security of our premises, customers, and staff, including through access logs and, where applicable, CCTV monitoring in public and communal areas.
To handle enquiries, requests, and complaints, and to provide customer service and support.
To comply with legal obligations, cooperate with law enforcement or regulatory authorities where required, and maintain accurate financial and tax records.
To manage our business operations, including internal administration, service improvement, and reporting.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.
In general, we keep customer account and contract information for a period after your relationship with us ends, to address any questions, disputes, or legal obligations. The specific retention period may depend on the type of record and applicable law.
CCTV footage, where used, is normally retained for a limited period sufficient to support security and investigative purposes, unless a longer retention period is required for an ongoing investigation, legal claim, or compliance requirement.
When personal data is no longer required, we take steps to delete, anonymise, or securely destroy it in line with our data retention and deletion procedures.
Data Processors and Third Parties
We may use carefully selected third party service providers, acting as data processors, to help us operate our business and deliver our services. These may include:
Payment processing providers that handle card or electronic payments securely on our behalf.
IT and cloud service providers that host systems, provide data storage, or support our electronic communications and records.
Security and maintenance service providers that support access control systems, CCTV, and the physical security of our site.
Professional advisers such as accountants, auditors, or legal advisers where reasonably necessary for the management of our business and to comply with our legal obligations.
Where we engage data processors, they are only permitted to process your personal data on our instructions, for specified purposes, and must provide appropriate security measures. They are not allowed to use your data for their own purposes.
We may also share personal data with law enforcement agencies, courts, regulators, or other authorities where we are legally required to do so, or where we consider it necessary to protect our rights, property, or the safety of customers and staff.
International Data Transfers
Where possible, we aim to keep your personal data within the United Kingdom or the European Economic Area. If it becomes necessary to transfer personal data to a country outside these areas, we will ensure that an adequate level of protection is in place. This may include using standard contractual clauses or other safeguards recognised by data protection law.
Your Data Protection Rights
Under data protection law, you have several rights in relation to your personal data, subject to certain conditions and exemptions:
Right of access: You can request confirmation of whether we process your personal data and obtain a copy of that data, along with information about how it is used.
Right to rectification: You can ask us to correct or update inaccurate or incomplete personal data we hold about you.
Right to erasure: In certain circumstances, you can request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected and we have no legal obligation to retain it.
Right to restriction of processing: You can request that we restrict the processing of your personal data in certain situations, such as while we verify its accuracy or consider an objection you have raised.
Right to object: You can object to processing based on our legitimate interests, including any direct marketing activities, on grounds relating to your particular situation. We will stop processing unless we have compelling legitimate grounds or the processing is required for legal claims.
Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request a copy of the personal data you have provided to us in a commonly used, machine-readable format and ask us to transmit it to another controller where technically feasible.
Right to withdraw consent: Where we rely on your consent for specific processing, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing that took place before consent was withdrawn.
You can exercise your rights by contacting us using the contact details provided in your contract or our written communications. We may need to verify your identity before responding to your request.
Complaints and Contact
If you have concerns about how we handle your personal data, you should contact us in the first instance so we can try to resolve the issue. You also have the right to lodge a complaint with the relevant data protection supervisory authority in the United Kingdom.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. Any significant changes will be communicated where appropriate, and the updated policy will apply from the date it is made available.
