Privacy Policy - Stroudgreen Storage

This Privacy Policy explains how Stroudgreen Storage collects, uses, stores, and protects personal data relating to its customers. It applies to all Stroudgreen Storage customers in the area, including current, former, and prospective customers who enquire about, reserve, or use storage services. We are committed to handling personal information in a lawful, fair, and transparent way in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who this policy applies to

This policy applies to individuals who interact with Stroudgreen Storage in connection with storage services. It covers data collected when you:

request a quote or make an enquiry;
sign up for storage services;
use our facilities or manage an account;
contact us for support, billing, or service-related matters;
provide information as a visitor, authorised person, or business contact.

Where we process personal data on behalf of a business customer, we will still protect that data in line with applicable data protection law.

2. Personal data we collect

We collect only the information needed to provide storage services, manage our relationship with customers, meet legal obligations, and improve our operations. The types of personal data we may collect include:

Identity data such as your name, date of birth, and identification details where required for verification;
Contact data such as address, email address, telephone number, and correspondence details;
Account and contract data such as customer reference numbers, service selection, start and end dates, payment status, and billing records;
Transaction data such as payment information, invoices, refunds, and records of charges;
Security and access data such as entry logs, CCTV recordings, access records, and incident reports;
Communications data such as emails, letters, complaint records, and notes from conversations;
Technical data where relevant, such as device or usage data from our systems and digital platforms.

We do not intentionally collect special category data unless it is provided to us for a specific reason and only where permitted by law. If such information is received, it will be handled with additional care and only for the purpose for which it was supplied.

3. How we use your data

We use personal data for the following purposes:

to provide storage services and manage your account;
to verify identity and prevent unauthorised access;
to process payments, issue invoices, and manage refunds;
to communicate about bookings, renewals, service changes, and support requests;
to maintain safety and security at our facilities;
to detect and prevent fraud, misuse, or criminal activity;
to meet legal, regulatory, accounting, and tax obligations;
to handle disputes, complaints, and legal claims;
to improve our services, systems, and customer experience.

We only process personal data where it is necessary and proportionate for the relevant purpose.

4. Lawful basis for processing

Under data protection law, we must have a lawful basis to use your personal data. Depending on the activity, we rely on one or more of the following lawful bases:

Contract

Processing is necessary for the performance of a contract or to take steps at your request before entering into a contract. This includes setting up your storage service, managing your account, taking payments, and providing access to your unit or stored items.

Legal obligation

We process data where necessary to comply with legal obligations, including tax, accounting, fraud prevention, regulatory, and record-keeping requirements.

Legitimate interests

We may process personal data for our legitimate interests where those interests are not overridden by your rights and freedoms. These interests include maintaining security, preventing loss or damage, managing business operations, improving services, and protecting against unlawful use of our facilities.

Consent

In limited cases, we may rely on your consent, for example for optional marketing communications or other activities where consent is appropriate. Where consent is used, you may withdraw it at any time.

Vital interests and public interest

In rare situations, we may process data to protect someone’s vital interests or where it is necessary for a task carried out in the public interest or under official authority.

5. Data sharing and processors

We may share personal data with trusted third parties only when necessary and only under appropriate safeguards. These parties act as processors or independent controllers depending on the service provided.

Examples of processors may include:

payment service providers that process card or electronic payments;
IT and cloud service providers that host systems, communications, and records;
security providers that support CCTV, alarms, or access control systems;
customer management or administration providers that help run our operations;
professional advisers such as accountants, auditors, insurers, or legal advisers;
delivery, maintenance, and operational support providers where necessary for service delivery.

We require processors to keep your information secure, to use it only on our instructions, and to comply with data protection law. We do not sell personal data.

We may also disclose personal information where required by law, by a court order, or to protect the rights, property, safety, or security of Stroudgreen Storage, our customers, or others.

6. International transfers

If any of our processors or service providers store or access data outside the United Kingdom, we will ensure appropriate safeguards are in place. These may include adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms required by data protection law.

7. Data retention

We keep personal data only for as long as necessary for the purpose for which it was collected, including for legal, accounting, tax, security, and operational needs. Retention periods may vary depending on the type of data and our legal obligations.

In general:

customer account and contract records are retained for the duration of the relationship and for a reasonable period afterwards;
payment and transaction records are retained in line with financial and tax requirements;
security records such as access logs or CCTV are kept only for as long as necessary for security and incident management;
correspondence and complaint records are retained for as long as needed to resolve the matter and protect legal interests;
data that is no longer required is securely deleted, anonymised, or archived.

Where retention is based on legal requirements, we will keep data for the minimum period necessary to comply with those obligations.

8. How we protect your data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures may include access controls, staff training, secure storage, encryption where appropriate, and regular review of our practices.

Although we take reasonable steps to protect information, no system can be guaranteed to be completely secure. We therefore encourage customers to help protect their own information by keeping relevant account details secure and notifying us promptly of suspected misuse.

9. Your rights

Under data protection law, you have certain rights regarding your personal data. These rights may be subject to legal limits and exceptions. They include:

Right of access – to request a copy of the personal data we hold about you;
Right to rectification – to ask us to correct inaccurate or incomplete data;
Right to erasure – to request deletion of your data in certain circumstances;
Right to restriction – to ask us to limit how we use your data in certain cases;
Right to data portability – to receive certain data in a structured, commonly used format;
Right to object – to object to processing based on legitimate interests or direct marketing;
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time;
Right not to be subject to solely automated decisions – where applicable, you have rights in relation to automated decision-making.

To exercise your rights, you may contact us using the appropriate service channels. We may need to verify your identity before responding. We aim to respond within the legal timeframe.

10. Marketing preferences

We will only send marketing communications where permitted by law. You may opt out of marketing at any time. Even if you opt out of marketing, we may still send service messages that are necessary for your account or storage arrangement.

11. Cookies and similar technologies

If we use online systems that rely on cookies or similar technologies, these may be used for essential functionality, performance, and security. Any such tools will be used in accordance with applicable law and our internal privacy practices.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal, operational, or security requirements. The latest version will apply to the processing of personal data from the date it takes effect. We encourage customers to review the policy periodically.

13. Complaints and further rights

If you have concerns about how your personal data is handled, you have the right to raise the issue with the relevant data protection authority. You may also contact us through the appropriate customer service route so that we can review and address your concern.

This Privacy Policy is intended to provide clear information about how Stroudgreen Storage processes personal data and the safeguards in place to protect it.