Storage South Croydon Privacy Policy
This Privacy Policy explains how Storage South Croydon collects, uses, stores and protects personal data relating to our customers and prospective customers in the South Croydon area. We are committed to complying with the UK General Data Protection Regulation and the Data Protection Act 2018 and to handling your personal data lawfully, fairly and transparently.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage South Croydon customers, as well as individuals who enquire about or use our storage services, including those located in and around the South Croydon area. It covers personal data collected through our premises, our website, written correspondence and any other communication channels we use to provide our services.
Data Controller
Storage South Croydon is the data controller in respect of the personal data we process about you. This means we determine the purposes and means of processing your personal data and are responsible for ensuring that it is handled in accordance with applicable data protection laws.
Personal Data We Collect
We collect and process different types of personal data depending on your relationship with us and how you use our services. This may include:
Identification and contact details such as name, postal address, billing address, identification numbers on official documents, and communication preferences.
Account and contract information such as customer account numbers, storage unit details, contract start and end dates, rental rates, payment history and correspondence related to your storage agreement.
Payment and billing data such as billing records and details necessary to process payments. Detailed payment card data is not stored by us where it is processed directly by a payment service provider.
Communication data such as information contained in emails, letters, forms, call notes and any other communications you send to us or that we send to you.
Site and security data such as CCTV footage in and around our facilities, access logs, visit times and information gathered as part of security and access control procedures.
Technical data such as IP addresses, device identifiers, and basic usage data where you interact with any online services we operate, to the extent necessary to operate and secure those services.
How We Collect Your Data
We collect personal data directly from you when you enquire about our services, request a quote, sign a storage contract, make a payment, communicate with us or visit our premises. We may also receive personal data from third parties where this is necessary to provide our services or to comply with legal obligations, for example from payment service providers or identity verification services.
Purposes of Processing and Lawful Bases
We process your personal data only where we have a valid lawful basis under the UK GDPR. The main purposes and corresponding lawful bases are as follows:
To provide and manage storage services: We use your identification, contact, account and payment data to set up and administer your storage agreement, manage your unit, process payments and provide customer support. The lawful basis is performance of a contract or taking steps at your request before entering into a contract.
To maintain security and access control: We use CCTV footage, access logs and related data to protect our premises, your property, our staff and other customers, and to prevent and investigate unauthorised access or criminal activity. The lawful bases are our legitimate interests in ensuring security and, where applicable, legal obligations relating to health and safety and crime prevention.
To communicate with you: We use your contact and communication data to respond to your enquiries, send service-related notices, contract updates, payment reminders and other essential information concerning your storage. The lawful basis is performance of a contract and our legitimate interests in administering our relationship with you.
To manage billing and debt recovery: We use payment and account data to issue invoices, manage billing queries and, where necessary, pursue outstanding debts. The lawful bases are performance of a contract and our legitimate interests in protecting our business.
To comply with legal and regulatory obligations: We may process any relevant personal data where necessary to comply with tax, accounting, anti-money laundering, law enforcement and other legal requirements. The lawful basis is compliance with a legal obligation.
To improve and manage our business: We may use aggregated or limited personal data to analyse service performance, monitor usage trends and plan capacity. The lawful basis is our legitimate interests in maintaining and improving our services.
Where we rely on legitimate interests, we always assess and balance our interests against your rights and expectations, and we will not process personal data where our interests are overridden by your fundamental rights and freedoms.
Data Retention
We retain your personal data only for as long as necessary for the purposes for which it was collected, and to meet legal, accounting or reporting requirements.
Customer and contract records are generally kept for the duration of your storage agreement and for a reasonable period afterwards, typically up to seven years, to comply with tax and accounting regulations and to enable us to respond to any queries or disputes.
CCTV footage and access logs are retained for a shorter period, usually only for as long as needed to maintain security, investigate incidents and comply with any legal or insurance requirements relating to particular events.
Where data is no longer needed, it is securely deleted, anonymised or otherwise removed from our systems in line with our data retention policies.
Data Processors and Third Parties
We may share your personal data with carefully selected third parties that act as data processors on our behalf. These service providers process personal data only on our instructions and are subject to strict contractual obligations to protect your data.
Such processors may include providers of data storage and cloud hosting services, IT support and maintenance services, payment processing and billing platforms, customer relationship management tools, security and CCTV system providers and professional advisers to the extent they provide services to us.
Where we share data with other third parties acting as independent controllers, such as law enforcement agencies, regulators, insurers or debt recovery agencies, we do so only where necessary and in accordance with a valid lawful basis and applicable law.
We do not sell your personal data. We do not transfer your personal data outside the United Kingdom or European Economic Area unless appropriate safeguards are in place to ensure an equivalent level of protection.
Your Data Protection Rights
Under the UK GDPR, you have a number of rights in relation to your personal data, subject to certain conditions and exemptions. These include:
The right of access: You can request confirmation of whether we process your personal data and obtain a copy of that data, together with information about how it is used.
The right to rectification: You can ask us to correct or complete any personal data that is inaccurate or incomplete.
The right to erasure: In certain circumstances, you can request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected and we have no legal reason to keep it.
The right to restriction of processing: You can ask us to restrict the processing of your personal data in specific situations, such as while we are reviewing the accuracy of data or considering an objection you have raised.
The right to data portability: Where we process your personal data by automated means based on your consent or a contract, you may have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.
The right to object: You can object to processing based on our legitimate interests, on grounds relating to your particular situation. We will stop such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where processing is required for legal claims.
The right to withdraw consent: Where we rely on your consent to process personal data, you can withdraw that consent at any time. Any withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe your data protection rights have been infringed.
Security of Your Personal Data
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These measures include controlled access to systems, physical security at our sites, appropriate data back-up and staff training in data protection and confidentiality.
Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or data protection best practices. Any updated version will apply to all Storage South Croydon customers in the South Croydon area from the date it is published. We encourage you to review this policy periodically so that you remain informed about how we handle your personal data.
