Privacy Policy - Footscray Storage

This Privacy Policy explains how Footscray Storage collects, uses, stores, shares, and protects personal information. It applies to all Footscray Storage customers in the area, including prospective customers, current customers, former customers, visitors, and any person who interacts with our storage services, facilities, staff, systems, or communications. We are committed to handling personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

1. Who We Are

Footscray Storage provides storage-related services to individuals and businesses. In the course of operating our services, we may process personal data about customers, account holders, authorised users, visitors, and people who contact us in relation to storage services. For the purposes of data protection law, we act as a data controller when we determine the purposes and means of processing personal data.

2. Personal Data We Collect

We may collect and process the following categories of information:

Identity data: name, date of birth, and identification details needed for account setup or verification.
Contact data: postal address, email address, and telephone number.
Account data: customer reference numbers, rental details, access permissions, payment status, and service preferences.
Financial data: billing information, transaction records, payment confirmations, and limited payment card information where necessary for processing.
Security and access data: entry logs, access codes, key records, CCTV images, and related security records.
Communications data: emails, messages, call notes, complaints, and service requests.
Technical data: IP address, device information, browser details, and usage data if you interact with our digital systems.
Verification data: documents or information required to confirm identity, authority, or eligibility to use our services.

We generally collect personal information directly from you. In some cases, we may also receive information from third parties such as payment providers, identity verification services, insurers, contractors, or legal and regulatory authorities where lawful and appropriate.

3. How We Use Personal Data

We use personal data for the following purposes:

to provide and manage storage services;
to create, maintain, and administer customer accounts;
to verify identity and prevent fraud;
to process payments, refunds, and account adjustments;
to manage access to storage units and facilities;
to maintain security, monitor premises, and investigate incidents;
to respond to enquiries, complaints, and support requests;
to send service-related notices and important account information;
to comply with legal obligations, tax requirements, and regulatory duties;
to protect our rights, property, customers, staff, and visitors;
to improve our services, systems, and customer experience;
to establish, exercise, or defend legal claims.

4. Lawful Basis for Processing

We process personal data only where we have a valid lawful basis under GDPR. Depending on the context, we rely on one or more of the following:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes opening an account, providing storage space, managing access, billing, and delivering customer support.

Legal Obligation

We may process information where required to comply with applicable laws, including accounting, tax, consumer, safety, security, fraud-prevention, and record-keeping obligations.

Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. This may include protecting our premises, preventing misuse, improving services, handling disputes, and ensuring operational security.

Consent

Where required by law, we will rely on your consent. For example, certain optional marketing communications or non-essential uses of data may be based on consent. You may withdraw consent at any time where processing is based on consent.

5. Sharing and Processors

We may share personal data with trusted third parties where necessary and lawful. These parties may act as processors on our behalf or as independent controllers in their own right.

Examples of processors and service providers may include:

payment processing providers;
accounting and bookkeeping services;
IT hosting, cloud storage, and software providers;
security and CCTV system providers;
customer support and communications platforms;
identity verification and fraud-prevention services;
maintenance, cleaning, and facilities management contractors;
professional advisers such as lawyers, auditors, and insurers.

Where a third party processes data on our behalf, we require them to handle it securely, only for authorised purposes, and in accordance with data protection requirements. We do not sell personal data.

We may also disclose personal data to law enforcement, regulators, courts, or other authorities where required by law or where reasonably necessary to protect our legal rights or investigate unlawful activity.

6. International Transfers

If personal data is transferred outside the United Kingdom or European Economic Area, we will take appropriate steps to ensure that it remains protected. This may include using approved contractual safeguards or relying on other lawful transfer mechanisms permitted under data protection law.

7. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including satisfying legal, accounting, and reporting obligations. Retention periods depend on the type of information and the reason for processing.

Customer account data: retained for the duration of the contract and for a reasonable period afterwards to handle queries, disputes, and legal claims.
Financial and transaction records: retained for the period required by tax and accounting laws.
Security logs and access records: retained for a limited period unless longer retention is required for incident investigation or legal reasons.
Communications: retained as long as necessary to respond to requests, manage the relationship, or defend legal claims.
Verification and compliance data: retained where necessary to meet legal or regulatory obligations.

When personal data is no longer needed, we will delete it or anonymise it securely.

8. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. These measures may include access controls, secure storage, staff training, password protection, monitoring systems, and restricted access to sensitive records. While no system can be guaranteed completely secure, we take reasonable steps to reduce risk and protect the information we hold.

9. Your Rights Under GDPR

You have a number of rights in relation to your personal data. These rights may be subject to legal limitations and exemptions.

Right of access: you may request a copy of the personal data we hold about you.
Right to rectification: you may ask us to correct inaccurate or incomplete information.
Right to erasure: you may request deletion of data in certain circumstances.
Right to restriction: you may ask us to restrict processing in certain cases.
Right to data portability: you may request transfer of certain data to you or another organisation.
Right to object: you may object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
Right to lodge a complaint: you may complain to the relevant data protection supervisory authority if you believe your rights have been infringed.

If you wish to exercise any of these rights, we may need to verify your identity before responding. We aim to respond within the time limits required by law.

10. Children

Our storage services are not intended for children. We do not knowingly collect personal data from children except where required in limited circumstances relating to lawful account administration or legal obligations.

11. Automated Decision-Making

We do not rely on fully automated decision-making that produces legal or similarly significant effects without human involvement, unless we are permitted to do so by law and provide appropriate safeguards.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulatory guidance, or our services. The updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically.

13. Summary of Key Principles

In simple terms: we collect only the information needed to run our storage services, we use it for clear and lawful purposes, we keep it only as long as necessary, we share it only with trusted processors or where the law requires it, and we respect your GDPR rights.

By using Footscray Storage services, you acknowledge that personal data may be processed as described in this Privacy Policy, subject always to applicable data protection law.