Storage Upper Norwood Privacy Policy
This Privacy Policy explains how Storage Upper Norwood collects, uses, stores, and protects personal data relating to our customers and prospective customers within the Storage Upper Norwood service area. It also describes your rights under applicable data protection laws, including the UK General Data Protection Regulation and the Data Protection Act 2018.
By using our storage facilities and related services, you acknowledge that you have read and understood this Privacy Policy. This policy applies to all customers and users of Storage Upper Norwood services in our operating area, whether you contact us online, by post, or in person at our premises.
Who We Are
Storage Upper Norwood is the controller of the personal data we collect about you in connection with the provision of storage and related services. As controller, we determine the purposes and means of processing your personal data and are responsible for ensuring that such processing complies with applicable data protection laws.
Types of Personal Data We Collect
We may collect and process the following categories of personal data about you, depending on how you interact with us and which services you use:
Identification data such as full name, title, date of birth, and proof of identity documents where required for security or legal reasons.
Contact details such as correspondence address, billing address, and other contact information that you choose to provide so that we can manage your account and communicate with you.
Contract and account details such as unit or space number, rental term, payment status, and communication history relating to your contract with us.
Payment and billing information such as payment method details and transaction history, captured and processed through secure payment processors. We do not store full card details when this is handled by third-party payment providers.
Usage and communication data such as enquiries you submit, feedback you provide, and records of communications between you and Storage Upper Norwood staff.
Security and access information such as access codes, sign in and sign out times, and where installed at our premises, CCTV images captured for security and safety purposes.
Technical information such as basic device and browser information provided automatically when you visit our website, to the extent necessary for security, performance, and basic analytics.
How We Collect Your Data
We collect personal data from you directly when you request a quotation, make a booking, sign a storage agreement, make a payment, or otherwise communicate with us. We may also collect data when you visit our premises and interact with our staff or security systems.
In some cases, we may receive personal data about you from third parties such as comparison or referral services that you have used to find storage providers, payment and billing providers involved in processing your transactions, or public authorities where required for legal compliance.
Lawful Bases for Processing
We only process your personal data where we have a lawful basis for doing so. Depending on the context, these lawful bases may include one or more of the following:
Contract: We process your data when it is necessary to enter into or perform a contract with you, for example to provide storage space, manage your account, handle enquiries, and process payments.
Legal obligation: We process your data when it is necessary to comply with legal or regulatory obligations, such as record keeping, tax, accounting, fraud prevention, and law enforcement requests where we are required to respond.
Legitimate interests: We process your data where it is necessary for our legitimate business interests or the legitimate interests of a third party, and where these interests are not overridden by your rights and freedoms. This may include ensuring the security of our premises, improving our services, handling customer queries, and protecting our business from misuse or illegal activity.
Consent: In limited circumstances, we may rely on your explicit consent, for example for certain types of marketing communications where consent is required. You can withdraw your consent at any time, although this will not affect the lawfulness of processing carried out before consent was withdrawn.
Purposes for Which We Use Personal Data
We may use your personal data for the following purposes:
To provide storage and related services to you, including setting up and managing your storage agreement, processing bookings, and arranging move in and move out procedures.
To manage billing and payments, including issuing invoices, collecting payments, and handling queries about charges and account status.
To maintain the safety and security of our premises, staff, and customers, including the use of access controls and CCTV where installed, and to prevent and investigate theft, damage, or misuse of our facilities.
To communicate with you about your contract, service updates, changes to our terms, or other information necessary for the performance of our agreement with you.
To respond to your enquiries, complaints, or feedback, and to improve the quality and efficiency of our services based on your interactions with us.
To comply with legal, regulatory, or law enforcement requirements and to establish, exercise, or defend legal claims.
To perform internal reporting, auditing, and business planning, using aggregated or pseudonymised data wherever possible to minimise the impact on your privacy.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, accounting, or reporting requirements. The length of time we keep your data will depend on the type of data and the reason we collected it.
Information relevant to your contract, payments, and use of our services is typically retained for a minimum period required by law for tax and accounting purposes, and for a reasonable period thereafter to address any disputes or queries arising from your contract.
Security and access data, such as CCTV footage where used, will be retained for a limited period appropriate to security needs and then securely erased or overwritten, unless it is required for the investigation of a specific incident.
When personal data is no longer required for the purposes for which it was collected and there is no legal requirement to retain it, we will delete it or anonymise it so that it can no longer be linked to an identifiable individual.
Data Processors and Third Parties
We may share your personal data with trusted third parties who act as data processors on our behalf. These processors are engaged to provide services such as payment processing, secure data storage, customer management systems, accounting and invoicing support, and security or maintenance services for our premises and IT systems.
All processors are required to process your personal data only on our instructions, to keep it secure, and to comply with data protection law. We take steps to ensure that appropriate contractual safeguards are in place, including data processing agreements that define the scope and purpose of processing, confidentiality obligations, and security standards.
We may also share your data with other third parties where required by law, for example with law enforcement agencies, courts, tax authorities, or regulatory bodies, or where it is necessary to establish, exercise, or defend legal claims.
We do not sell your personal data to third parties. If we are involved in a business reorganisation, sale, or transfer of all or part of our operations, your personal data may be transferred as part of that transaction, subject to protections required by data protection law.
International Transfers
If we transfer personal data outside the United Kingdom, we will ensure that an adequate level of protection is in place, for example by relying on an adequacy regulation, entering into standard contractual clauses, or implementing other appropriate safeguards recognised under data protection law.
Security of Your Personal Data
We take appropriate technical and organisational measures to protect your personal data from loss, misuse, unauthorised access, disclosure, alteration, or destruction. These measures may include physical access controls at our premises, restricted access to personal data within our organisation, secure storage systems, and regular review of our security arrangements.
While we work to protect your personal data, no system can be guaranteed as completely secure. You also have a role in keeping your data safe, for example by keeping access codes confidential and notifying us promptly if you believe your account or storage unit security has been compromised.
Your Data Protection Rights
Under data protection law, you have certain rights in relation to your personal data. These rights may be subject to conditions and legal exemptions but generally include:
Right of access: You can request confirmation of whether we process personal data about you and obtain a copy of that data together with information about how it is used.
Right to rectification: You can ask us to correct any inaccurate or incomplete personal data we hold about you.
Right to erasure: In certain circumstances, you can request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected or where you withdraw consent and there is no other lawful basis for processing.
Right to restriction of processing: You can ask us to restrict the processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to its processing.
Right to data portability: For data you have provided to us and that we process by automated means on the basis of consent or contract, you may request to receive that data in a structured, commonly used, machine readable format, and have it transmitted to another controller where technically feasible.
Right to object: You can object at any time to processing of your personal data that is based on our legitimate interests, including any direct marketing activities. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or where processing is required for legal claims.
Right not to be subject to automated decision making: Storage Upper Norwood does not routinely carry out automated decision making that produces legal or similarly significant effects on you. If this changes, we will update this policy and explain the logic and potential consequences.
Exercising Your Rights
If you wish to exercise any of your data protection rights in relation to Storage Upper Norwood, or if you have any questions or concerns about how we process your personal data, you can contact us using the contact details provided on our official communications and website. We may need to verify your identity before responding to your request, particularly where we handle sensitive or security related information.
We aim to respond to all valid requests within one month. If your request is complex or you have made multiple requests, this period may be extended, in which case we will inform you.
You also have the right to lodge a complaint with the relevant data protection authority if you are unhappy with how we handle your personal data. However, we encourage you to contact us first so that we have the opportunity to address your concerns directly.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, how we process personal data, or changes in legal or regulatory requirements. Any updated version will apply to all Storage Upper Norwood customers in our service area from the date it is published. We recommend that you review this policy periodically to stay informed about how we protect your personal data.
