Storage Gunnersbury Privacy Policy
This Privacy Policy explains how Storage Gunnersbury collects, uses, stores and protects personal data relating to customers and prospective customers in the Storage Gunnersbury service area. It also explains your rights under the UK General Data Protection Regulation and the Data Protection Act, and how you can exercise those rights.
By using our storage services, contacting us, or otherwise providing your personal data, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage Gunnersbury customers and prospective customers in our service area, as well as visitors who contact us or make enquiries about our services. It covers personal data we collect in person at our facility, by post, and via any digital channels we operate, such as our website or online forms where applicable.
Personal Data We Collect
We only collect personal data that is necessary for the provision and administration of our storage services, for security, and for legal compliance. The types of personal data we may collect include:
Identification and contact details, such as your name, postal address, billing address, contact address, and any other address relating to your account, as well as your preferred communication method.
Account and contract details, such as storage unit numbers, contract start and end dates, payment amounts, rental terms, and any correspondence relating to your contract or enquiries.
Payment and transaction information, such as payment records, invoices, refunds and credits. We do not store full payment card details when payments are processed by secure payment providers.
Security and access information, such as access logs, key or fob numbers, entry and exit times, and, where installed, closed circuit television footage of common or protected areas for security and safety purposes.
Communication data, including records of telephone conversations, written correspondence, and messages you send to us, such as enquiries, feedback and complaints.
How We Collect Personal Data
We collect personal data in several ways, including:
Directly from you when you contact us, request a quote, make a booking, sign a contract, make a payment, or communicate with us in any other way.
Automatically when you access our premises, including via access control systems and, where in place, closed circuit television monitoring of relevant areas.
From third parties where this is necessary and lawful, for example payment service providers confirming that a payment has been made, or where we are required to check details for fraud prevention or legal compliance.
Purposes and Lawful Basis for Processing
We process your personal data only where we have a lawful basis under data protection law. The purposes and corresponding lawful bases include:
To provide and manage storage services, including setting up and administering your account, securing and managing access to your storage unit, and handling enquiries and contract changes. The lawful basis is performance of a contract or taking steps at your request prior to entering into a contract.
To process payments and manage billing, including issuing invoices, collecting payments, and dealing with payment queries. The lawful basis is performance of a contract and our legitimate interests in managing our business and preventing fraud.
To maintain the safety and security of our customers, staff and property, including using access control systems and closed circuit television where installed. The lawful basis is our legitimate interests in maintaining security and preventing crime, and, where necessary, compliance with legal obligations.
To comply with legal and regulatory requirements, including tax, accounting, and record keeping obligations, as well as responding to lawful requests from authorities. The lawful basis is compliance with legal obligations.
To communicate with you about your contract, service updates and any issues relating to your use of our facilities. The lawful basis is performance of a contract and our legitimate interests in keeping you informed and ensuring quality of service.
Where required by law, we will ask for your consent before using your personal data for specific purposes. Where consent is used as the lawful basis, you may withdraw your consent at any time.
Data Retention
We keep personal data only for as long as necessary for the purposes for which it was collected, or as required by law. The precise retention period varies depending on the type of data and our legal obligations.
Customer account and contract data is generally retained for a period after your contract ends, to enable us to manage any queries, disputes or legal claims and to comply with tax and accounting requirements.
Payment records are retained for the period required by applicable tax and financial reporting laws.
Security and access data, such as access logs and closed circuit television images, are retained for a shorter period, unless an incident or investigation requires us to keep particular recordings or logs for longer.
When personal data is no longer required, it will be securely deleted, anonymised or destroyed in a manner that protects your privacy.
Data Sharing and Processors
We do not sell your personal data. We may share your personal data with trusted third parties who act as data processors on our behalf. These processors only process your data under our instructions and are required to keep it secure and confidential.
These processors may include payment service providers, accountancy and bookkeeping services, information technology service providers who support our systems and data storage, and security service providers where applicable.
We may also share data with professional advisers, such as lawyers or auditors, where necessary, and with law enforcement or regulatory bodies where required by law or to protect our rights, property or safety or that of others.
Where we use processors located outside the United Kingdom or European Economic Area, we will ensure that appropriate safeguards are in place to protect your personal data, consistent with data protection law.
Security of Your Personal Data
We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include access controls, secure storage systems, and staff training on data protection responsibilities.
While no system can be completely secure, we regularly review our procedures and security measures to reduce risks to an appropriate level, taking into account the nature of the data and the activities involved.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data. These rights apply in most circumstances and may be subject to limitations and conditions. Your rights include:
The right of access, which allows you to request a copy of the personal data we hold about you and certain information about how it is used.
The right to rectification, which allows you to request that inaccurate or incomplete personal data is corrected or updated.
The right to erasure, sometimes known as the right to be forgotten, which allows you to request the deletion of your personal data where there is no longer a lawful basis for us to keep it.
The right to restrict processing, which allows you to request that we limit the use of your data in certain circumstances.
The right to data portability, which allows you to request that we provide you or a third party with certain personal data in a structured, commonly used and machine readable format.
The right to object to processing based on our legitimate interests, including profiling, and the right to object at any time to direct marketing where used.
The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects for you, where applicable.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe your data protection rights have been infringed.
Children and Vulnerable Individuals
Our services are not directed at children. We do not knowingly enter into storage contracts directly with individuals under the age required to enter into a binding contract. If we discover that we hold personal data of a child without appropriate authority, we will delete it where appropriate.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, applicable laws or regulatory guidance. When we make significant changes, we will take reasonable steps to bring the updated policy to your attention. The latest version will always apply to how we use your personal data.
