Storage Foots Cray Privacy Policy
This Privacy Policy explains how Storage Foots Cray collects, uses, shares and protects personal data relating to customers and prospective customers. It applies to all Storage Foots Cray customers, and those making enquiries, within our service area. We are committed to handling your personal data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation and applicable data protection laws.
Data Controller
Storage Foots Cray is the controller of the personal data described in this Privacy Policy. This means we are responsible for deciding how and why your personal data is used, and for ensuring that it is processed in compliance with data protection legislation.
You can contact us in writing at our trading address for any questions about this Privacy Policy or how we handle your personal data.
Personal Data We Collect
We collect and process different types of personal data depending on your relationship with us and how you use our services. This may include:
Identification and contact details: name, postal address, billing address, previous address where needed for identity checks, and general contact details such as your preferred communication method.
Account and contract information: customer account numbers, contract start and end dates, storage unit details, access permissions for authorised persons, records of services you have booked or used, and information needed to manage payments and renewals.
Payment information: limited payment details such as payment method, payment history, and billing information. Card details may be processed by our payment service providers and are not retained by us beyond what is necessary for processing payments and preventing fraud.
Communication data: information you provide during telephone calls, in person, or in written correspondence, including enquiries, complaints and feedback, as well as records of communications relating to your account.
Security and access information: access logs, entry and exit times for our site, access codes or fob identifiers, and in some cases vehicle registration numbers where these are captured as part of site security.
CCTV images: images and recordings captured by CCTV systems in and around our premises, used for security, crime prevention and safety purposes.
Technical and usage data: limited technical information relating to your interactions with our website or online account services, such as pages visited and basic device information, collected through essential functional tools and similar technologies.
How We Use Your Personal Data and Lawful Basis
We only process your personal data where we have a valid lawful basis under data protection law. The main purposes and lawful bases are:
To provide our storage and related services: we use your identification, contact, account, contract and payment information to set up and manage your account, provide storage units, arrange access, take payment, issue invoices, and administer your contract. Lawful basis: performance of a contract and steps taken at your request before entering into a contract.
To manage customer relationships: we use your contact and communication data to respond to enquiries, provide customer support, handle complaints, send important service updates (such as changes to access arrangements, terms, or policies) and manage renewals and move-outs. Lawful basis: performance of a contract and our legitimate interests in managing our business and customer relationships.
For security, safety and fraud prevention: we use access information, vehicle registration data where applicable, and CCTV images to protect our premises, customers, staff and property, to monitor for unauthorised access, and to help prevent and investigate crime or fraud. Lawful basis: our legitimate interests in ensuring site security and safety, and compliance with legal obligations where relevant.
For billing and financial management: we use payment and account information to issue invoices, administer payments, manage arrears or debt recovery, and maintain appropriate accounting records. Lawful basis: performance of a contract, our legitimate interests in running our business, and compliance with legal obligations in relation to tax and accounting.
To comply with legal and regulatory obligations: we may use any relevant personal data to comply with legal requirements, court orders, law enforcement requests, and regulatory obligations. Lawful basis: compliance with a legal obligation and, where appropriate, our legitimate interests in protecting our rights and responding to claims.
For marketing where permitted: we may send you information about similar services that we provide, when you have an existing customer relationship with us or have given your consent. You can opt out of marketing at any time. Lawful basis: our legitimate interests in promoting our services, or your consent where required.
Data Retention
We keep your personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, including satisfying any legal, accounting or reporting requirements.
In general, customer account and contract records are kept for a period after the end of your contract in order to deal with any queries, disputes or legal claims, and to meet our legal obligations. Financial and transaction records are usually kept for longer periods as required by tax and accounting laws.
CCTV footage is typically retained for a limited period necessary for security and investigation purposes, unless a specific recording is needed for a longer period in connection with an incident, claim or legal proceedings.
When personal data is no longer required, we will securely delete or anonymise it in accordance with our data retention policies.
Data Sharing and Processors
We do not sell your personal data. We may share it with carefully selected third parties where necessary for the purposes outlined in this Privacy Policy and where appropriate safeguards are in place.
Service providers and processors: we use external providers to help us operate our business, including payment processing services, IT and system support, customer management systems, document storage providers, security and CCTV system providers, and professional advisers such as accountants or legal advisers. These organisations act as processors or independent controllers depending on the service they provide and must handle your data securely and in line with data protection laws.
Authorities and law enforcement: we may disclose personal data where required to do so by law or regulation, or where we reasonably believe it is necessary to comply with legal obligations, protect our rights, assist in the prevention or detection of crime, or support the safety and security of individuals and property.
Business transfers: in the event that our business or part of it is sold, restructured or transferred, personal data relevant to the business may be transferred to the new owner or operator, who will be required to handle it in accordance with data protection law and this Privacy Policy or a replacement policy notified to you.
Where our service providers process personal data outside the United Kingdom, we will ensure that appropriate safeguards are in place, such as standard contractual clauses or other mechanisms approved under data protection law.
Your Data Protection Rights
As an individual, you have a number of rights in relation to the personal data we hold about you. These rights may be subject to certain conditions and exemptions. You have the right to:
Access: request confirmation that we are processing your personal data and receive a copy of the data we hold about you.
Rectification: request that inaccurate or incomplete personal data is corrected or updated.
Erasure: request that we delete your personal data where there is no good reason for us to continue processing it, for example where it is no longer needed for the original purpose and there are no overriding legitimate grounds for retention.
Restriction: request that we temporarily restrict the processing of your personal data in certain circumstances, such as while we verify its accuracy or our reasons for processing it.
Objection: object to our processing of your personal data where we rely on legitimate interests as the legal basis, including for direct marketing. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims.
Data portability: request that we provide you, or a third party you select, with a copy of certain personal data in a structured, commonly used and machine readable format, where the processing is based on consent or contract and carried out by automated means.
Withdraw consent: where we rely on your consent for specific processing, you have the right to withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before withdrawal.
To exercise any of these rights, please write to us at our trading address marked for the attention of the data protection contact. We may need to verify your identity before responding to your request. We aim to respond without undue delay and within the time period required by law.
Complaints
If you have concerns about how we handle your personal data, we encourage you to contact us first so that we can try to resolve the issue. You also have the right to lodge a complaint with the UK data protection supervisory authority.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, our services or legal requirements. Any updated version will apply from the date it is published. We recommend that you review this Privacy Policy periodically to stay informed about how we handle your personal data.
