Storage Harefield Privacy Policy
This Privacy Policy explains how Storage Harefield collects, uses, stores, and protects personal data relating to all Storage Harefield customers in the area. It also describes your rights under the UK General Data Protection Regulation and other applicable data protection laws. By using our storage services, visiting our premises, or communicating with us, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all personal data processed by Storage Harefield in connection with the provision of storage and related services to customers in the local area. It covers data collected when you make enquiries, sign a storage agreement, access our facilities, use our website or online tools, or otherwise interact with us as an actual or prospective customer.
Data Controller
Storage Harefield is the data controller for the personal data described in this Privacy Policy. As data controller, Storage Harefield determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection laws.
Personal Data We Collect
We collect and process different categories of personal data depending on how you interact with us. This may include:
Identification and contact details, such as your full name, residential or correspondence address, and other basic contact details you choose to provide to us.
Customer account and contract information, such as storage unit number, contract start and end dates, payment status, deposit details, and communications relating to your account or storage agreement.
Payment and billing information, such as payment history, partial card details processed through our payment provider, and billing-related records necessary for accounting and tax purposes. We do not store full card details on our own systems when payment is taken through a secure payment processor.
Usage and access information, such as facility entry and exit records, unit access logs where applicable, and records of interactions at reception or via customer service channels.
Security and monitoring data, such as CCTV footage and incident logs from our premises, where used for the security and safety of customers, staff, and property.
Online and technical information, such as basic information provided through contact forms, enquiry forms, or other online tools, and technical logs necessary to operate our website and maintain its security.
How We Collect Personal Data
We collect personal data directly from you when you make an enquiry, request a quote, enter into a storage agreement, make or attempt a payment, contact our customer service team, or visit our premises. We may also collect personal data from third parties where permitted by law, such as payment providers or reference services, and from the use of security systems such as CCTV at our site.
Purposes and Lawful Basis for Processing
We process your personal data only where we have a lawful basis for doing so. Depending on the context, we may rely on the following lawful bases:
Contract. We process personal data to enter into and perform a contract with you, including managing reservations and bookings, providing storage services, managing payments, responding to your requests, and handling account administration.
Legal obligation. We process personal data where necessary to comply with legal and regulatory obligations, including tax and accounting rules, fraud prevention requirements, and obligations to law enforcement or regulatory authorities when we are required to do so.
Legitimate interests. We process personal data based on our legitimate interests, provided that such interests are not overridden by your rights and freedoms. These interests include securing and managing our premises, preventing and investigating potential misuse or criminal activity, maintaining and improving our services, managing customer relationships, handling queries and complaints, and protecting our legal rights.
Consent. In limited circumstances, we may rely on your consent, for example for certain types of optional communications or uses of data that are not strictly necessary for providing the services. Where we rely on consent, you can withdraw it at any time, without affecting the lawfulness of processing that took place before withdrawal.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet any legal, accounting, or reporting requirements. The retention period depends on the nature of the data and the purposes of processing, and will be determined in line with legal obligations and industry standards.
Customer contract and billing records are generally retained for a period necessary to comply with tax, accounting, and contractual limitation requirements. Security and CCTV footage is retained for a shorter period, only for as long as is necessary for security, safety, and incident investigation purposes, unless a longer retention period is required due to an ongoing investigation or legal claim.
When personal data is no longer needed, we will securely delete it or anonymise it so that it can no longer be associated with you.
Data Sharing and Processors
We do not sell your personal data. We may share personal data with trusted third parties who act as data processors on our behalf. These service providers are only permitted to process personal data in accordance with our instructions and only for the purposes specified in our agreement with them. They are required to implement appropriate technical and organisational measures to protect your data.
Typical processors may include payment processing providers, cloud and data hosting services, IT support providers, customer relationship management tools, security and CCTV system providers, and professional advisers such as accountants or legal advisers acting under confidentiality obligations.
We may also disclose your personal data to other third parties where required by law, for example to law enforcement agencies, regulatory bodies, government authorities, or in connection with legal proceedings. In the event of a business sale, reorganisation, or similar transaction, personal data may be shared with relevant third parties as part of that process, in accordance with data protection laws.
International Transfers
Where we use processors or service providers located outside the United Kingdom or the European Economic Area, or where data is otherwise transferred internationally, we take steps to ensure that your personal data is afforded an equivalent level of protection. This may include relying on adequacy regulations, and implementing appropriate safeguards such as standard contractual clauses or other mechanisms recognised under data protection law.
Data Security
We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include access controls, secure storage, encryption, staff training, and procedures for handling suspected data security incidents. While we strive to protect your data, no system can be completely secure, and you should take care to protect your own information, such as by safeguarding access credentials and devices.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data, subject to certain conditions and exemptions.
Right of access. You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data, together with information about how it is processed.
Right to rectification. You have the right to request correction of inaccurate personal data and completion of incomplete data.
Right to erasure. In certain circumstances, you have the right to request that we delete your personal data, for example where the data is no longer needed for the purposes for which it was collected, or where you withdraw consent and there is no other lawful basis for processing.
Right to restriction. You have the right to request that we restrict the processing of your personal data in specific situations, such as while we are verifying its accuracy or assessing an objection.
Right to object. You have the right to object to processing based on our legitimate interests, on grounds relating to your particular situation. We will stop such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is required for legal claims.
Right to data portability. In some cases, you have the right to receive personal data that you provided to us in a structured, commonly used, and machine-readable format, and to request that we transmit that data to another controller where technically feasible.
Where we rely on consent as a lawful basis, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
Exercising Your Rights and Complaints
If you wish to exercise any of your data protection rights or have questions about how we handle your personal data, you can contact Storage Harefield using the contact details available on our main customer information materials or at our premises. We may need to verify your identity before responding to your request to ensure that personal data is not disclosed to anyone who does not have the right to receive it.
You also have the right to lodge a complaint with the relevant data protection authority if you believe that your rights have been infringed or that your personal data has been processed in a way that does not comply with applicable law. We encourage you to contact us first so that we can address your concerns directly where possible.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our processing activities, legal requirements, or business practices. Any changes will be made available through our usual customer communication channels or at our premises. Your continued use of our services after any update indicates that you have read and understood the revised Privacy Policy.
