Storage Sanderstead Privacy Policy
This Privacy Policy explains how Storage Sanderstead collects, uses, stores and protects personal data relating to current and prospective customers. It applies to all Storage Sanderstead customers and users of our storage services in the Sanderstead area, including individuals and business customers.
We are committed to complying with the UK General Data Protection Regulation GDPR and the Data Protection Act 2018. This Privacy Policy is intended to give you clear information about our data practices and your rights.
Personal Data We Collect
We only collect personal data that is necessary for the provision, administration and security of our storage services. The types of data we may collect include:
Identification data such as full name, title, date of birth and proof of identity details shown on official documents such as passport or driving licence when required for verification and security.
Contact details such as home or business address, billing address, and any alternative contact address you provide, as well as general correspondence details you share with us in writing.
Account and contract information such as your storage unit number, contract start and end dates, payment history, service preferences, and records of communications with us relating to your account.
Payment and billing information such as billing name and address, the type of payment method you choose and transaction records. Card details are processed via secure payment processors and are not stored in full by us.
Usage and operational data such as access logs to the storage facility, including dates and times of entry, and information about services you use or request, for security and service monitoring.
Technical information if you interact with our online services, such as IP address and device type, to help ensure security and proper operation of those services. We do not intentionally collect more technical data than is required for those purposes.
How We Collect Your Data
We collect personal data directly from you in most cases, including when you request a quote, make a booking, sign a storage agreement, make a payment, contact us with a query, or update your details.
We may also receive some information from third party payment processors in relation to completed transactions, and from any third party you authorise to act on your behalf, for example where a business or agent arranges storage services for you.
Lawful Bases for Processing
Under GDPR, we must have a lawful basis to process your personal data. Depending on the specific activity, we rely on the following lawful bases:
Contract. We process personal data when it is necessary to enter into and perform our contract with you. This includes setting up your account, providing storage services, managing your booking, handling payments, and communicating with you about your storage arrangement.
Legal obligation. We may process personal data where it is necessary to comply with legal obligations, for example tax, accounting, fraud prevention, crime prevention and assisting law enforcement or regulatory authorities when we are legally required to do so.
Legitimate interests. We may process data where it is in our legitimate interests, provided that your interests and fundamental rights do not override those interests. This may include securing and managing our facility, maintaining accurate records, improving our services, and handling routine business operations such as internal reporting.
Consent. In limited circumstances we may ask for your consent, for instance where you choose to receive certain forms of marketing communications. Where we rely on consent, you can withdraw it at any time.
How We Use Your Personal Data
We use your personal data to:
Provide and manage our storage services and fulfil our contractual obligations to you.
Verify your identity and maintain the security and integrity of our storage facility.
Administer your account, including billing, payments, arrears management and responding to your queries or instructions.
Monitor access and usage for safety, security and appropriate use of the premises.
Maintain business records and comply with legal and regulatory requirements.
Communicate with you about changes to our services, terms and policies where necessary.
Develop and improve our services, including understanding how customers use storage services in the Sanderstead area, using aggregated or anonymised data wherever possible.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for any legal, accounting or reporting requirements.
Customer account and contract records are generally retained for a period required by applicable laws after the end of your storage contract. This is to resolve disputes, respond to queries, demonstrate proper record keeping and meet tax and regulatory obligations.
Access and security records are retained for a shorter period, only as long as necessary to support security, incident investigation and risk management.
Where we no longer need your personal data, we will either securely delete it or irreversibly anonymise it so that you are no longer identifiable.
Data Processors and Third Parties
In order to operate effectively, we may use carefully selected third party service providers who process personal data on our behalf. These providers are data processors and are only permitted to use your personal data in accordance with our documented instructions. They must implement appropriate technical and organisational measures to protect your data.
Examples of such processors include payment processing providers, secure data storage and hosting companies, accounting or invoicing platforms, and providers of access control or security systems.
Where we share data with external professional advisers, such as accountants or legal advisers, they will generally act as independent data controllers and handle your data in accordance with their own legal obligations.
We do not sell your personal data. We only disclose personal data to third parties when this is necessary for our services, required by law, or where you have given clear consent.
International Transfers
Where any of our processors or systems are located outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place to protect your personal data. These may include adequacy regulations, standard contractual clauses or equivalent lawful mechanisms as recognised under data protection law.
How We Protect Your Data
We take reasonable and proportionate steps to protect your personal data from loss, misuse, unauthorised access, disclosure, alteration or destruction. These measures include physical security measures at our storage facility, access controls, secure storage of records, and careful selection and oversight of our service providers.
While no method of transmission or storage is completely secure, we review our practices regularly and take steps to address emerging risks where appropriate.
Your Data Protection Rights
Under GDPR, you have a number of rights in relation to your personal data. These rights apply to all Storage Sanderstead customers in the Sanderstead area, subject to certain legal conditions and exemptions.
Right of access. You have the right to request confirmation that we process your personal data and to request a copy of the data we hold about you.
Right to rectification. You have the right to ask us to correct inaccurate or incomplete personal data. It is important that you keep your contact and account details up to date.
Right to erasure. In certain circumstances, you may have the right to request that we delete your personal data. This right is not absolute and may not apply where we need to retain the data for legal or contractual reasons.
Right to restriction of processing. You may request that we restrict our processing of your data in certain cases, for example while a dispute or accuracy check is being resolved.
Right to data portability. Where processing is based on consent or contract and carried out by automated means, you may have the right to receive your personal data in a commonly used, machine readable format and to request that it be transmitted to another controller where technically feasible.
Right to object. You may have the right to object to processing based on our legitimate interests in certain situations. We will then stop processing unless we can demonstrate compelling legitimate grounds or the processing is required for legal claims.
Rights in relation to consent. Where we rely on your consent, you are free to withdraw it at any time. This will not affect the lawfulness of processing before consent was withdrawn.
Exercising Your Rights
If you wish to exercise any of your data protection rights, or if you have any questions about this Privacy Policy or how we handle your personal data, you can contact us using the usual communication methods you use for your account or storage enquiries.
We may need to verify your identity before responding to a rights request. We aim to respond without undue delay and within the timescales required by data protection law.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations or data protection best practice. The updated version will apply from the date it is made available. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.
By using Storage Sanderstead services in the Sanderstead area, you acknowledge that you have read and understood this Privacy Policy and that your personal data will be processed in accordance with it and with applicable data protection law.
