Storage Sutton Privacy Policy for Customers
This Privacy Policy explains how Storage Sutton collects, uses, stores, and protects personal data relating to our customers in the Storage Sutton service area. We are committed to processing your personal information in accordance with the UK General Data Protection Regulation and all applicable data protection laws.
By using our storage services or otherwise providing your personal information to us, you acknowledge that you have read and understood this Privacy Policy.
Scope and Data Controller
This Privacy Policy applies to all Storage Sutton customers and prospective customers in our service area who use, enquire about, or are otherwise associated with our storage services. It covers personal data collected via our facilities, website, written correspondence, and any other communication channels we may use.
Storage Sutton is the data controller in respect of the personal data we collect and process about you. This means that we decide how and why your personal data is processed and we are responsible for ensuring that such processing is carried out in accordance with data protection laws.
Personal Data We Collect
We only collect personal data that is necessary for the purposes described in this Privacy Policy. Depending on how you interact with us, we may collect and process the following categories of information:
Identification and contact details: Your full name, postal address, billing address, contact address, and other contact details such as your preferred communication channels.
Account and contract details: Customer account numbers or identifiers, contract start and end dates, storage unit references, payment history, outstanding balances, and related contractual information.
Payment and billing information: Billing details, such as payment method and transaction records. We do not store full card details, though our payment processors may do so in accordance with their own security and regulatory obligations.
Verification and security information: Copies or details from identification documents where required for verification, along with vehicle registration numbers, access codes, and entry and exit records for our storage facilities.
Communication records: Records of communications with you, including enquiries, complaints, feedback, and any correspondence regarding your contract or use of our services.
Technical and usage data: Information generated through your use of our website or online systems, such as IP address, device information, and basic usage statistics. This is used to manage and improve our online services.
Lawful Basis for Processing
We rely on one or more of the following lawful bases under the UK General Data Protection Regulation when processing your personal data:
Contract: We process personal data where it is necessary to enter into or perform a contract with you, including setting up and managing your storage unit, handling payments, and providing customer service.
Legal obligation: We process personal data where we are required to comply with legal and regulatory obligations, such as tax, accounting, fraud prevention, and health and safety requirements.
Legitimate interests: We process personal data where it is necessary for our legitimate business interests and where your interests and fundamental rights do not override those interests. This includes managing and improving our services, maintaining security at our facilities, recovering debts, and responding to enquiries.
Consent: In limited cases, we may rely on your consent, for example for optional marketing communications. Where we rely on consent, you may withdraw it at any time by contacting us or using any unsubscribe options provided.
Purposes for Which We Use Personal Data
We use your personal data for the following purposes:
To set up and manage your storage contract, including processing applications, allocating storage units, and verifying identity or eligibility where necessary.
To process payments, issue invoices, manage billing queries, and maintain records for accounting and audit purposes.
To maintain the safety and security of our facilities, which may include recording access logs and using security systems where appropriate.
To provide customer support, respond to your questions or complaints, and communicate with you about your contract, storage unit, or any changes to our terms or policies.
To manage our business operations, including monitoring the use of our services, planning capacity, and improving our service delivery.
To comply with legal obligations and to establish, exercise, or defend legal claims, including debt recovery and responding to requests from regulatory or law enforcement authorities.
To send you relevant information about our services, promotions, or updates, where permitted by law and in accordance with your communication preferences.
Data Retention
We will keep your personal data only for as long as it is necessary for the purposes described in this Privacy Policy, or for as long as required by applicable law and regulation.
In general, we retain customer account and contract information for the duration of your relationship with us and for a period afterwards to respond to queries, resolve disputes, comply with legal obligations, and maintain records for tax and accounting purposes. The exact retention period may vary depending on the type of data and the context of its collection.
When personal data is no longer required, we will securely delete it, anonymise it, or otherwise remove it from our systems.
Sharing Personal Data and Processors
We may share your personal data with trusted third parties where necessary for the purposes described in this Privacy Policy. These third parties may act as data processors, processing personal data on our behalf under our instructions, or as separate controllers in certain circumstances.
Categories of recipients may include:
Payment and billing providers who process payments, manage direct debits, and assist with fraud prevention and detection.
IT and system service providers who support our website, customer management systems, storage facility access systems, and data hosting.
Professional advisers such as accountants, auditors, or legal advisers, where necessary for advice, compliance, or dispute resolution.
Debt collection agencies and credit control services where needed to recover outstanding amounts owed by customers.
Regulatory authorities, law enforcement agencies, or other public bodies where required by law or where necessary to protect our rights, customers, facilities, or the public.
Where we use data processors, we ensure they are bound by written contracts requiring them to process personal data only on our instructions, to implement appropriate security measures, and to comply with data protection law.
International Transfers
Where it is necessary to transfer personal data outside the United Kingdom or European Economic Area, we will ensure that appropriate safeguards are in place to protect your information in accordance with data protection law. Such safeguards may include using standard contractual clauses approved by relevant authorities or ensuring that the receiving country has an adequate level of protection.
Security of Your Personal Data
We take the security of your personal data seriously and implement technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include access controls, secure storage systems, and appropriate staff training.
While we strive to protect your personal data, no system is completely secure. If we become aware of a personal data breach that may pose a risk to your rights and freedoms, we will take steps to mitigate the impact and notify you and any applicable supervisory authority where required by law.
Your Data Protection Rights
You have various rights under data protection law in relation to the personal data we hold about you. These rights may be subject to legal conditions and exemptions, and we may need to verify your identity before responding to certain requests.
Right of access: You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data, along with information about how it is used.
Right to rectification: You have the right to request that inaccurate or incomplete personal data is corrected or updated.
Right to erasure: In certain circumstances, you have the right to request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for processing.
Right to restriction of processing: You have the right to request that we restrict the processing of your personal data in certain situations, such as where you contest the accuracy of the data or object to our legitimate interests.
Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and to transmit it to another controller.
Right to object: You have the right to object to the processing of your personal data where we rely on legitimate interests as our lawful basis. You also have the right to object at any time to the use of your personal data for direct marketing.
Right to withdraw consent: Where we rely on your consent to process your personal data, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or other factors. Any changes will take effect when the updated version is made available. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.
