Storage Catford Privacy Policy
This Privacy Policy explains how Storage Catford collects, uses, and protects personal data relating to our customers in the Catford area. It also sets out your rights under the United Kingdom General Data Protection Regulation, the Data Protection Act 2018, and related privacy laws. This Privacy Policy applies to all Storage Catford customers and prospective customers who use or enquire about our storage services in the area.
Data Controller
Storage Catford is the data controller for the personal data described in this Privacy Policy. As data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring that such processing complies with applicable data protection law.
Personal Data We Collect
We collect and process personal data that you provide to us directly and data that arises from your use of our services. The categories of data we may collect include:
Identification and contact details such as full name, postal address, billing address, proof of identity details, and contact preferences. Account and contract information such as storage unit details, contract start and end dates, payment terms, correspondence related to your account, and records of communications. Payment and transaction details such as payment method, payment history, invoices, and records of charges and refunds. Usage and security information such as access records to our premises, CCTV footage for security and safety purposes where installed, and records of incidents or enquiries. Technical and enquiry data such as information provided through enquiry forms, online quote requests, or written correspondence, including details of your storage requirements and any feedback you provide.
How We Collect Your Data
We may collect your personal data when you contact us to enquire about our services, request a quote, or make a booking. We also collect data when you enter into a storage agreement with us, access our premises, make payments, or otherwise interact with our staff. In some cases, we may receive data from third parties where this is necessary to administer your contract or comply with legal obligations, for example from payment providers or regulatory bodies.
Purposes and Lawful Bases for Processing
We process your personal data only where we have a valid legal basis under the UK GDPR. The main purposes and corresponding lawful bases are as follows:
To provide storage services and manage your contract. This includes setting up and administering your account, providing access to storage units, handling payments, and communicating with you about your booking. The lawful basis is performance of a contract or taking steps at your request prior to entering into a contract.
To comply with legal and regulatory obligations. This includes verifying identity where required, maintaining accounting records, cooperating with law enforcement, and complying with tax, safety, and security regulations. The lawful basis is compliance with legal obligations.
To maintain security and prevent fraud. We may use access records, CCTV footage where installed, and account information to protect our premises, staff, customers, and property, and to detect and prevent crime or misuse of our services. The lawful basis is our legitimate interests in operating a secure business environment and protecting our assets and customers.
To manage business operations and improve services. We may use aggregated or pseudonymised data from customer accounts, enquiries, and feedback to monitor service performance, train staff, and improve our processes. The lawful basis is our legitimate interests in running and developing our business, provided that your rights and freedoms are not overridden.
To send service communications. We may contact you about important information relating to your account, such as changes to terms, payment reminders, or essential operational updates. The lawful basis is performance of a contract and our legitimate interests in ensuring that services operate effectively.
Where we rely on legitimate interests, we always balance those interests against your rights and expectations and only process personal data that is necessary for the stated purposes.
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.
Customer account and contract data is typically retained for the duration of your storage agreement and for a reasonable period afterwards, for example to respond to queries, handle potential disputes, and meet record-keeping obligations. Financial and transaction records are generally retained in line with statutory retention periods required for tax and accounting purposes. Security and access records, including CCTV footage where used, are retained for a limited period appropriate to security needs, unless a longer retention period is required in connection with an investigation or legal claim.
When data is no longer needed, we will securely delete or anonymise it so that it can no longer be linked to you.
Data Processors and Third Parties
We may engage carefully selected third parties to process personal data on our behalf. These service providers act as data processors and are only permitted to process your personal data in accordance with our instructions and data protection law. They are required to implement appropriate security measures and must not use your personal data for their own purposes.
Examples of third parties that may process data on our behalf include payment processing providers that handle card or electronic payments and maintain secure payment records, information technology and system support providers that host or maintain our customer management, access control, or security systems, document storage or shredding services used for secure handling and disposal of records, and external professional advisers such as accountants or legal advisers where necessary for business administration and legal compliance.
Where required, we may also share personal data with independent third parties who are separate data controllers, such as law enforcement or regulatory authorities, where we are legally obliged or have a strong legitimate interest to do so.
We do not sell your personal data and we do not share your information with third parties for their independent marketing purposes.
International Transfers
Where any of our service providers are located outside the United Kingdom or the European Economic Area, or where data is accessed from such locations, we will ensure that appropriate safeguards are in place to protect your personal data. These safeguards may include the use of standard contractual clauses approved by relevant authorities or other lawful transfer mechanisms. You can request further information about these safeguards using the contact details provided in our customer documentation or on our premises.
Data Security
We take the security of your personal data seriously and use a combination of organisational and technical measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures may include restricted access controls, staff training on data protection responsibilities, secure storage systems, and appropriate procedures for handling and disposing of records. While no system can be guaranteed as completely secure, we continually review and enhance our controls to maintain a level of security appropriate to the risks.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to the personal data we hold about you. These rights are subject to certain conditions and exemptions:
Right of access. You have the right to request confirmation of whether we process your personal data and to receive a copy of that data, along with information about how it is used.
Right to rectification. You have the right to ask us to correct or complete any inaccurate or incomplete personal data we hold about you.
Right to erasure. In certain circumstances, you may have the right to request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected or where you withdraw consent, if consent was the basis for processing.
Right to restriction. You may have the right to request that we restrict the processing of your personal data in certain situations, such as while we are assessing a request for rectification or objection.
Right to object. You have the right to object to processing based on our legitimate interests, on grounds relating to your particular situation. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is required for legal claims.
Right to data portability. In certain cases, you may have the right to receive personal data that you have provided to us in a structured, commonly used, and machine-readable format and to request that we transmit that data to another controller, where technically feasible.
To exercise any of these rights, you can contact us using the details made available in your contract documents or at our premises. We may need to verify your identity before responding to your request. There is normally no charge for exercising your rights, and we will respond within the timeframes set by law.
Complaints and Supervisory Authority
If you have concerns about how we handle your personal data, we encourage you to contact us in the first instance so that we can try to resolve the issue. You also have the right to lodge a complaint with the UK data protection supervisory authority. Details of how to do so are available from the Information Commissioner Office.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data protection practices. Any updated version will apply from the date it is published. We recommend that you review this Privacy Policy periodically to stay informed about how we process your personal data.
