Storage Sands End Privacy Policy
This Privacy Policy explains how Storage Sands End collects, uses, stores, and protects personal data relating to our self-storage services. It applies to all Storage Sands End customers and prospective customers in our service area, as well as individuals who contact us, visit our premises, or otherwise interact with us in the context of our services.
We are committed to complying with applicable data protection laws, including the United Kingdom General Data Protection Regulation and the Data Protection Act 2018, and to handling your personal data lawfully, fairly, and transparently.
1. Data Controller
Storage Sands End is the controller of the personal data described in this Privacy Policy. As controller, we determine the purposes and means of processing your personal data in connection with the provision of storage and related services.
2. Personal Data We Collect
The personal data we collect will depend on how you interact with us and the services you use. We may collect and process the following categories of personal data:
Identification and contact details: name, postal address, billing address, date of birth, and contact information such as email address and any communication preferences you provide.
Contract and account data: storage unit number, contract start and end dates, services selected, payment status, account history, and correspondence relating to your contract or enquiries.
Payment and transaction data: payment method, partial payment card details as processed by our payment providers, bank transfer information where applicable, and records of payments made and amounts due. We do not store full card details.
Verification and security data: copies or details of identification documents where required for security or fraud prevention purposes, and information collected via access control systems such as entry logs.
Technical and usage data: information about how you interact with our website or online services, such as IP address, browser type, device identifiers, and pages visited, to the extent this is collected through cookies or similar technologies.
Visual and security data: CCTV images captured on our premises for safety and security, including images of customers, visitors, and vehicles entering or using our facilities.
Communication data: records of your communications with us, including enquiries, complaints, and feedback submitted in person, by post, or through online or other channels.
3. Lawful Basis for Processing
We rely on one or more of the following lawful bases under the UK GDPR to process your personal data:
Performance of a contract: We process personal data where it is necessary to enter into and perform a contract with you, including to set up your storage unit, manage your account, process payments, and provide customer service.
Compliance with legal obligations: We process personal data where necessary to comply with legal and regulatory requirements, such as tax, accounting, record-keeping, and obligations relating to safety and security.
Legitimate interests: We process personal data where necessary for our legitimate business interests, provided these are not overridden by your rights and interests. This includes ensuring the security of our premises, preventing fraud, managing and improving our services, and communicating with you about service updates related to your contract.
Consent: In limited cases, we may rely on your consent, for example for certain marketing activities or optional cookies where required by law. Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
4. How We Use Personal Data
We use personal data for the following purposes:
To provide and manage storage services: including processing bookings, allocating storage units, managing access, and responding to your requests.
To administer customer accounts: including invoicing, processing payments, managing deposits or fees, handling renewals or termination, and maintaining accurate records.
To ensure safety and security: including monitoring access to our premises, operating CCTV systems, preventing and detecting crime or misuse of our facilities, and enforcing our terms and conditions.
To communicate with you: including sending service messages about your contract, responding to enquiries, and providing updates that are necessary for the use of our services.
To manage our business: including internal reporting, auditing, quality assurance, staff training, and service improvement activities.
To meet legal and regulatory requirements: including cooperating with law enforcement or regulatory bodies where required by law.
5. Data Sharing and Processors
We do not sell your personal data. We may share your personal data with the following categories of recipients where necessary and lawful:
Service providers and processors: third parties who process personal data on our behalf and in accordance with our instructions, such as payment processors, IT and hosting providers, security and CCTV maintenance providers, and professional advisers such as accountants or auditors. We ensure that data processing agreements are in place and that processors implement appropriate technical and organisational measures to protect personal data.
Public authorities and law enforcement: where required by law, regulation, or court order, or where it is necessary to protect our rights, property, or the safety of customers and staff.
Business partners in limited circumstances: for example, where we work with third parties to provide complementary services you have requested in connection with your storage service. In such cases, we share only the data necessary for the provision of those services.
In the event of a business reorganisation: if we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards and limitations.
6. International Transfers
Where we use service providers or systems located outside the United Kingdom, your personal data may be transferred to countries that do not provide the same level of data protection as the UK. In such cases, we will ensure that appropriate safeguards are in place, such as standard contractual clauses approved under data protection law or other lawful transfer mechanisms, and we will take steps to protect your rights and interests.
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including meeting legal, accounting, or reporting requirements.
In general, we apply the following retention principles:
Customer and contract records: kept for the duration of the contract and for a period thereafter to respond to queries, manage disputes, and comply with legal obligations. This period will typically not exceed six years from the end of the contractual relationship, unless a longer period is required by law.
Payment and financial records: retained in accordance with tax and accounting regulations, generally for a period required by law after the transaction.
CCTV footage: retained for a limited period necessary for security and investigation purposes and then automatically overwritten or securely deleted, unless required for a specific ongoing investigation or legal claim.
Marketing and communication preferences: retained until you withdraw your consent or object to processing, or until the data is no longer necessary for the purposes for which it was collected.
When personal data is no longer required, we will take appropriate steps to securely delete or anonymise it.
8. Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data. These rights are subject to certain conditions and exemptions. They include:
Right of access: you can request confirmation of whether we process your personal data and obtain a copy of that data, along with information about how it is used.
Right to rectification: you can ask us to correct or complete any inaccurate or incomplete personal data we hold about you.
Right to erasure: in certain circumstances, you can request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected or where you withdraw consent and there is no other legal basis for processing.
Right to restriction of processing: you can ask us to restrict the processing of your personal data in certain situations, such as where you contest the accuracy of the data or object to processing.
Right to data portability: in certain circumstances, you can request that we provide your personal data in a structured, commonly used, and machine-readable format and transmit it to another controller where technically feasible.
Right to object: you can object to processing based on our legitimate interests, including profiling, and we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or where processing is required for legal claims.
Right to withdraw consent: where we rely on your consent for processing, you can withdraw that consent at any time. This will not affect the lawfulness of processing before withdrawal but may affect our ability to provide certain services.
You also have the right to lodge a complaint with the relevant supervisory authority if you believe your data protection rights have been infringed.
9. Security of Personal Data
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. These measures include access controls, secure storage, staff training, and regular review of our security practices. While we strive to protect your data, no system can be completely secure, and we cannot guarantee absolute security.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. Any updated version will apply from the date of publication.
