Storage Norbury Privacy Policy
This Privacy Policy explains how Storage Norbury collects, uses, stores, and protects personal data relating to our customers and prospective customers in our service area. It also explains the legal bases we rely on under the UK General Data Protection Regulation and other applicable data protection laws, how long we keep your data, when we use data processors, and the rights you have in relation to your personal information.
This Privacy Policy applies to all individuals who use Storage Norbury services, enquire about our services, or otherwise interact with us as customers or potential customers within our local service area. By using our services, you acknowledge that you have read and understood this Privacy Policy.
Data Controller
Storage Norbury is the data controller for the personal data we process in connection with the provision of storage and related services. This means that we decide how and why your personal data is used, in line with applicable data protection laws.
Personal Data We Collect
We collect and process different categories of personal data, depending on how you interact with us and the services you use. The main types of personal data we may collect include:
Identification and contact details, such as your full name, postal address, billing address, country of residence, and any other contact information you choose to provide when you enquire about or use our services.
Account and contract information, such as storage unit numbers, contract start and end dates, payment terms, records of communications, service preferences, and any additional information required to set up and manage your storage agreement.
Payment and billing information, such as records of payments made, amounts due, invoices, and related accounting information. We do not store full payment card details where payments are processed through third-party payment service providers.
Usage and operational data, such as access logs to our premises, times and dates of entry to storage facilities where access control systems are used, and records relating to the security and maintenance of units.
Communication data, such as enquiries, complaints, feedback, and correspondence relating to your account, including information you provide to us over the phone, in writing, or when you contact us through online channels.
Security and CCTV data, where applicable, such as video footage captured on our premises for safety and security purposes. CCTV is used only in line with applicable laws and is retained for limited periods.
How We Collect Your Data
We collect personal data directly from you when you contact us, request a quote, sign a contract, make a payment, or otherwise use our services. We may also collect data automatically through our access control systems and security measures at our storage facilities. In some cases, we may receive limited personal data from third parties, such as payment service providers or other service providers, where this is required to complete a transaction or meet our legal obligations.
Lawful Basis for Processing
We only process your personal data when we have a valid lawful basis under the UK GDPR and related data protection legislation. The main lawful bases we rely on are:
Contract: We process your personal data when it is necessary to enter into or perform a contract with you, including setting up, managing, and enforcing storage agreements, handling payments, and providing customer support.
Legal obligation: We process your personal data when it is necessary to comply with legal and regulatory obligations, such as tax, accounting, financial reporting, and requirements from law enforcement or regulatory authorities.
Legitimate interests: We process personal data where it is necessary for our legitimate business interests, provided your interests and fundamental rights do not override those interests. This includes ensuring the security of our premises, improving our services, preventing fraud, and maintaining accurate records.
Consent: In limited cases, we may rely on your consent to process your data, for example, for certain optional communications or marketing where required by law. When we rely on consent, you can withdraw it at any time.
How We Use Your Personal Data
We use your personal data for the following purposes:
To provide and manage storage services, including creating and maintaining customer accounts, administering contracts, managing access to storage units, handling bookings, and responding to enquiries.
To process payments and manage billing, including issuing invoices, receiving payments, managing arrears, and maintaining accounting records.
To maintain the safety and security of our premises, including managing access control systems and operating CCTV for crime prevention and security monitoring.
To provide customer service and support, including responding to questions or complaints, arranging changes to your services, and communicating important information about your storage unit or contract.
To comply with legal and regulatory obligations, including record keeping, responding to lawful requests from authorities, and meeting tax and accounting requirements.
To improve and manage our business, including monitoring usage patterns, planning capacity, developing our services, training staff, and protecting our legitimate interests.
Data Retention
We keep personal data only for as long as necessary to fulfil the purposes for which it was collected and to meet legal, accounting, or reporting obligations. The specific retention periods can vary depending on the type of data and legal requirements, but generally:
Contract and account data are kept for the duration of your storage agreement and for a reasonable period afterwards to handle queries, disputes, or legal claims and to comply with tax and accounting laws.
Payment and billing records are retained for the period required by applicable financial and tax legislation.
CCTV footage and access logs are normally retained for a limited period necessary for security and investigation purposes, after which they are securely deleted unless required as evidence in an ongoing matter.
Where we no longer need your personal data, it will be securely deleted or anonymised so that it can no longer be linked back to you.
Use of Data Processors
We may use carefully selected third-party service providers, known as data processors, to process personal data on our behalf. These processors may provide services such as payment processing, secure data hosting, accounting support, IT maintenance, or security and access control systems.
When we use processors, we ensure that appropriate data processing agreements are in place and that they are required to handle your personal data securely, confidentially, and only in accordance with our instructions and applicable data protection laws. Processors are not allowed to use your personal data for their own purposes.
Sharing Your Personal Data
We may share your personal data with third parties in the following limited circumstances:
With our professional advisers, such as accountants or legal advisers, where necessary for business management, compliance, or the handling of disputes.
With law enforcement, regulatory bodies, courts, or other authorities, where required by law or necessary to protect our rights, property, or the safety of our customers and staff.
In connection with a reorganisation, transfer, or sale of all or part of our business, where personal data may be transferred as part of that transaction, subject to appropriate safeguards.
We do not sell your personal data to third parties.
Your Data Protection Rights
Under the UK GDPR and other applicable data protection laws, you have several rights in relation to your personal data. These include:
The right of access: You have the right to request confirmation that we process your personal data and to receive a copy of the personal data we hold about you.
The right to rectification: You have the right to ask us to correct inaccurate or incomplete personal data.
The right to erasure: In certain circumstances, you have the right to request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected and we have no other lawful basis for retaining it.
The right to restrict processing: You may request that we restrict the processing of your personal data in certain situations, such as while we are considering a request to rectify or erase your data.
The right to data portability: Where processing is based on consent or contract and carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller where technically feasible.
The right to object: You may object to processing based on our legitimate interests, including any direct marketing activities, in which case we will stop such processing unless we can demonstrate compelling legitimate grounds.
The right to withdraw consent: Where we rely on consent to process your data, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
International Transfers
Where personal data is transferred outside the UK or European Economic Area, we will ensure that appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses, so that your personal data continues to receive a level of protection essentially equivalent to that in the UK.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. Any significant changes will be communicated where appropriate, and the updated version will apply from the date it is published.
