Storage Spitalfields Privacy Policy
This Privacy Policy explains how Storage Spitalfields collects, uses, stores and protects personal data relating to our customers in the Storage Spitalfields service area. It also explains the lawful bases on which we process personal data, how long we retain it, with whom it may be shared, and the rights you have under data protection law, including the UK General Data Protection Regulation and the EU General Data Protection Regulation where applicable.
By using Storage Spitalfields services, including enquiring about storage, entering into a storage agreement, or communicating with us in any way, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all individual customers and prospective customers of Storage Spitalfields in our operating area. It also applies to individuals acting on behalf of business customers, such as directors, partners, employees and authorised representatives, where we process their personal data in connection with the provision of our storage services.
This Privacy Policy does not apply to websites, services or platforms that are operated by third parties outside the control of Storage Spitalfields, even if they are referenced or accessed in connection with our services.
Data Controller
Storage Spitalfields is the data controller in respect of the personal data we collect and use about you for the purposes described in this Privacy Policy. As data controller, Storage Spitalfields decides how and why your personal data is processed and is responsible for ensuring that such processing complies with applicable data protection laws.
Personal Data We Collect
We collect and process different categories of personal data depending on your interaction with us. This may include:
Identification and contact details, such as your name, postal address, billing address, contact address, date of birth, and documentation used to verify your identity in accordance with our security and fraud prevention measures.
Contact details, such as your email address and any phone or mobile number you choose to provide so that we can communicate with you regarding enquiries, bookings, payments or access to storage units.
Contract and account information, such as the storage unit or service you have booked, the duration of your contract, payment terms, invoices, account history, communications with us, and records of your interactions with our staff.
Payment information, such as partial payment card details or transaction references processed through our chosen payment processors, and billing records necessary to administer your account. We do not store full payment card details where this is handled directly by a secure third party payment processor.
Usage and access information, which may include records of your visits to our storage facilities, CCTV footage at our premises for security and safety purposes, access logs where access control systems are in place, and records of any incidents, accidents or complaints.
Technical information, where you interact with us online, such as IP address, device data, browser type, and basic analytics information that helps us understand how our websites or online systems are used, where such information constitutes personal data.
Any other information you choose to provide to us in the course of using our services, such as feedback, survey responses, or information provided when you contact our customer service team.
Purposes and Lawful Bases for Processing
We process your personal data only where we have a lawful basis to do so. Depending on the context, this will be one or more of the following:
Performance of a contract. We use your personal data to take steps at your request before entering into a storage agreement and to perform our contractual obligations once a contract is in place. This includes setting up your account, managing bookings, processing payments, providing access to storage facilities, and communicating with you about your contract and services.
Compliance with legal obligations. We may process personal data to comply with legal and regulatory obligations, including those relating to tax, accounting, fraud prevention, health and safety, and law enforcement requests, and to maintain required business records.
Legitimate interests. We may process personal data where it is necessary for our legitimate interests or those of a third party, provided that such interests are not overridden by your rights and interests. Our legitimate interests include operating and improving our storage business, ensuring the security and safety of our premises, preventing and detecting crime and fraud, managing customer relationships, handling queries and complaints, and protecting our legal rights.
Consent. In limited circumstances, we may rely on your consent to process your personal data, for example for certain forms of optional marketing or promotional communications. Where we rely on consent, you are free to withdraw it at any time, and we will explain how you can do this at the point of collection.
How We Share Your Personal Data
We may share your personal data with carefully selected third parties where this is necessary for the purposes described in this Privacy Policy and where we have a lawful basis to do so. These recipients may include:
Service providers and data processors who provide services to us, such as payment processing, secure data hosting, IT maintenance, security and CCTV monitoring, customer relationship management systems, communication tools, and professional advisors. These processors are contractually required to protect your personal data and may only use it in accordance with our instructions.
Insurers and professional advisors, including legal, accounting or risk management professionals, where necessary to manage claims, obtain advice, or protect our business.
Public authorities, law enforcement agencies, regulators or courts, where we are legally obliged to disclose information or where disclosure is necessary to establish, exercise or defend legal claims or to protect the safety of individuals or property.
Other third parties in connection with a business transaction, such as a merger, acquisition or restructuring, subject to appropriate confidentiality safeguards and only where permitted by data protection law.
We do not sell your personal data to third parties for their own independent marketing purposes.
International Transfers
Where we engage processors or service providers located outside the United Kingdom or the European Economic Area, or where personal data is otherwise transferred internationally, we will ensure that appropriate safeguards are in place to protect your personal data. These safeguards may include the use of standard contractual clauses approved by relevant data protection authorities or other mechanisms recognised under data protection law. Further information about international transfers and the safeguards used can be provided on request.
Data Retention
We keep your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including meeting any legal, accounting or reporting requirements. The specific retention period will depend on the nature of the data and our legal obligations.
In general, we retain customer account and contract information for a period necessary to manage our relationship with you, to respond to queries or complaints, and to comply with legal retention requirements. CCTV footage and access logs are kept for shorter periods, unless they are required in connection with an investigation, dispute or legal claim, in which case they may be retained for longer as necessary.
When personal data is no longer required for the purposes for which it was collected, we will securely delete, anonymise or irreversibly destroy it in accordance with our data retention procedures.
Security of Your Personal Data
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include access controls, staff training, secure storage systems, encryption where appropriate, and procedures to test and evaluate the effectiveness of our security measures.
While we take reasonable steps to protect your personal data, no system can be completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that poses a high risk to your rights and freedoms, we will inform you and notify the relevant supervisory authority where required by law.
Your Data Protection Rights
Under data protection law, you have several important rights in relation to your personal data. Subject to certain conditions and exemptions, these may include:
The right of access. You may request confirmation of whether we process your personal data and obtain a copy of that data, along with information about how we use it.
The right to rectification. You can request that inaccurate or incomplete personal data held about you is corrected or updated.
The right to erasure. In certain circumstances, you can ask us to delete your personal data, for example where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other lawful basis for processing.
The right to restriction of processing. You can request that we temporarily restrict the processing of your personal data in certain situations, such as while we are verifying the accuracy of the data or considering an objection.
The right to object. You may object to our processing of your personal data where we rely on legitimate interests as our lawful basis and you believe your rights override those interests. You also have the right to object to direct marketing at any time.
The right to data portability. Where processing is based on your consent or on a contract and carried out by automated means, you may request that we provide your personal data in a structured, commonly used and machine readable format, or that we transmit it to another controller where technically feasible.
The right to withdraw consent. Where we rely on your consent for specific processing activities, you can withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before it was withdrawn.
You also have the right to lodge a complaint with a competent data protection authority if you believe that your personal data has been processed in a way that does not comply with data protection laws.
Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal or regulatory developments, or improvements in how we communicate information about our data protection practices. Any changes will be effective from the date on which the updated Privacy Policy is published or otherwise made available to you.
We encourage you to review this Privacy Policy periodically so that you remain informed about how Storage Spitalfields collects and uses personal data and about your rights in relation to that data.
