Storage Surrey Privacy Policy
This Privacy Policy explains how Storage Surrey collects, uses, stores, and protects personal data relating to customers and prospective customers in our service area. It also explains your rights under the UK General Data Protection Regulation and related data protection laws. By using our services, visiting our facilities, or contacting us, you acknowledge that you have read and understood this Privacy Policy.
Scope and Data Controller
This Privacy Policy applies to all Storage Surrey customers, prospective customers, and users of our services in the Surrey area. Storage Surrey is the data controller for the personal data described in this Privacy Policy. This means that we decide how and why your personal data is processed.
Personal Data We Collect
We collect and process different categories of personal data depending on how you interact with us. This may include the following information.
Identity and contact information such as your name, postal address, billing address, contact address, and any other identifying details you provide when you make an enquiry, request a quote, or enter into a storage agreement with us.
Account and contract information such as unit number, contract start and end dates, payment terms, pricing, deposit details, and records of communications regarding your account.
Payment and billing details such as payment method, bank or card details processed securely by our payment processors, payment history, invoices, and records of transactions.
Usage and service information such as dates and times of accessing your storage unit when recorded, records of services requested, and any additional services you purchase from us.
Security and access information such as CCTV images on and around our premises, access control logs, and records relating to incidents or accidents on our sites where applicable.
Communication data such as emails and letters you send to us, notes of telephone conversations, and information you provide when you give feedback, make a complaint, or respond to surveys.
Technical information such as basic device and browser details, and general usage data when you visit our website, to the extent that this is collected through essential website functionality and security measures.
Lawful Bases for Processing
We only process your personal data where we have a lawful basis to do so under data protection law. Depending on the specific processing activity, we rely on one or more of the following lawful bases.
Contract. We process your personal data where it is necessary to enter into or perform a contract with you, such as when you take out a storage unit, make payments, or ask us to provide a quote.
Legal obligation. We process certain personal data to comply with legal and regulatory obligations, such as tax, accounting, reporting, health and safety, and to respond to lawful requests from public authorities.
Legitimate interests. We process personal data where it is necessary for our legitimate business interests, provided that your interests and fundamental rights do not override those interests. This includes maintaining site security with CCTV, managing and improving our services, preventing fraud and misuse, and handling customer queries and complaints.
Consent. In limited cases, we may rely on your consent, for example where required by law for certain forms of direct marketing. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.
How We Use Your Personal Data
We use the personal data we collect for the following purposes.
To provide storage services and manage your account, including setting up your contract, processing payments, managing access to your unit, communicating with you about your account, and handling renewals or terminations.
To respond to enquiries and requests for information, including providing quotes, discussing our services, and following up on any questions you raise.
To maintain the security and safety of our premises, customers, staff, and property, including the use of CCTV and access control systems, and managing incidents or disputes.
To manage our business operations, including record keeping, financial management, auditing, service improvements, and staff training.
To comply with legal and regulatory obligations, including record retention, responding to lawful requests from authorities, and cooperating with law enforcement where necessary.
To send you information about our services where this is permitted by law and, where required, with your consent. You can opt out of marketing communications at any time.
Data Retention
We keep your personal data only for as long as is necessary for the purposes for which it was collected, or to satisfy legal, accounting, or reporting requirements.
In general, we retain customer account and contract records for a period that allows us to respond to queries, handle disputes, and meet our statutory obligations. This typically means keeping key records for several years after your contract or relationship with us ends, in line with local limitation and tax rules.
CCTV footage and access logs are kept for shorter periods, unless they are required for the investigation of an incident, dispute, or legal claim, in which case they may be retained for longer as necessary for that purpose.
When personal data is no longer required, we take steps to delete it securely or to anonymise it so that it can no longer be associated with an identifiable individual.
Data Processors and Sharing
We may share your personal data with carefully selected third parties who act as data processors on our behalf. These service providers are only permitted to process your personal data following our instructions and are required to keep it secure and confidential.
Typical categories of processors include payment service providers who process your payments securely, cloud and data storage providers that host our systems and backups, providers of customer management and invoicing systems, and professional advisers such as accountants and auditors who support our business operations.
In some circumstances, we may also need to share your personal data with other third parties acting as independent data controllers, such as public authorities, law enforcement agencies, regulators, insurers, or legal advisers, where this is necessary to comply with legal obligations or to protect our rights, property, or the safety of our customers and staff.
We do not sell your personal data. We do not routinely transfer your personal data outside the United Kingdom or European Economic Area. If we ever need to do so, we will ensure that appropriate safeguards are in place to protect your data in accordance with data protection law.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data. These rights may be subject to certain conditions and exemptions.
Right of access. You have the right to request a copy of the personal data we hold about you, together with information about how we use it.
Right to rectification. You have the right to ask us to correct or complete inaccurate or incomplete personal data.
Right to erasure. In certain circumstances, you have the right to ask us to delete your personal data, for example where it is no longer needed for the purposes for which it was collected or where you have withdrawn consent.
Right to restriction. You can request that we restrict the processing of your personal data in certain situations, such as while we are verifying its accuracy or assessing an objection you have raised.
Right to object. You have the right to object to processing based on our legitimate interests, including profiling, on grounds relating to your particular situation. You also have an absolute right to object to direct marketing at any time.
Right to data portability. Where processing is based on consent or contract and carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, machine readable format and to request that we transmit it to another controller where technically feasible.
Right to withdraw consent. Where we rely on your consent, you can withdraw that consent at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.
Exercising Your Rights and Complaints
If you wish to exercise any of your rights or have questions about how we handle your personal data, you can contact us using the contact details provided on our website or at our premises. We may need to confirm your identity before responding to certain requests.
You also have the right to lodge a complaint with the relevant data protection authority if you believe that your data protection rights have been infringed. We would, however, appreciate the opportunity to address your concerns first, so we encourage you to contact us in the first instance.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal or regulatory developments, or our internal practices. Any changes will be posted as an updated version with a revised date. We encourage you to review this Privacy Policy periodically to stay informed about how we process your personal data.
