Storage St Lukes Privacy Policy
This Privacy Policy explains how Storage St Lukes collects, uses, stores and protects personal data relating to our customers within our service area. It also sets out your rights under the UK General Data Protection Regulation and related data protection laws. By using our services, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage St Lukes customers in our operating area, including prospective customers who make enquiries, existing customers with active agreements, and former customers whose data we continue to hold for lawful purposes. It covers all personal data we process in connection with the provision of self-storage and related services, whether collected online, by telephone, or in person at our premises.
Personal Data We Collect
We only collect personal data that is necessary for the purposes described in this Privacy Policy. The types of data we may collect include:
Identification details, such as your full name, date of birth and identification document details where required for verification and security.
Contact information, such as your postal address, billing address, and any other contact details you choose to provide.
Account and contract information, such as unit number, rental term, payment history, correspondence history, and details of services you have requested.
Payment and billing information, such as payment method details processed through secure payment providers, as well as invoices, receipts and account balances.
Security and access information, such as CCTV footage in and around our site, access logs for entry systems and records of visits where required for security, safety, and fraud prevention.
Communication data, such as emails, letters, and records of telephone conversations where we maintain logs for customer service and contractual purposes.
Technical data, such as limited information about how you interact with our website or online systems, which may include your device type, browser, and pages visited, where this is necessary for site security and performance.
Purposes and Lawful Bases for Processing
We process your personal data only when we have a lawful basis under data protection law. Depending on the specific activity, the lawful basis will be one or more of the following:
Contract: We process personal data to take steps at your request before entering into a contract and to perform our contract with you. This includes setting up your account, administering your storage agreement, processing payments, providing access to your storage unit and communicating with you about your contract.
Legal obligation: We process personal data to comply with our legal and regulatory obligations. This may include record-keeping, tax and accounting requirements, responding to requests from law enforcement or other authorities, and health and safety obligations.
Legitimate interests: We process personal data for our legitimate business interests, provided these are not overridden by your rights and interests. Our legitimate interests include securing our premises and property, preventing and detecting fraud or criminal activity, maintaining and improving our services, handling customer enquiries and complaints, and managing our relationship with you as a customer.
Consent: In limited cases, we may rely on your consent, for example for certain forms of optional marketing. Where we rely on consent, you have the right to withdraw it at any time, and we will make it as easy to withdraw as it is to give.
Data Sharing and Processors
We do not sell your personal data. We may share your personal data with trusted third parties where this is necessary for the purposes set out in this Privacy Policy and where appropriate safeguards are in place.
Service providers and processors: We may use external companies to process personal data on our behalf and in accordance with our instructions. Typical examples include payment processors, accounting and billing providers, secure document storage services, IT and cloud service providers, and providers of CCTV or access control systems. These processors are only allowed to use your personal data for the services they provide to us and must keep it secure.
Professional advisers: We may share personal data with professional advisers such as auditors, accountants, legal advisers and insurers where this is necessary for them to provide services to us and to protect our legal rights.
Authorities and law enforcement: We may disclose personal data to law enforcement agencies, regulatory bodies, courts or other public authorities where we are legally required to do so or where this is necessary to protect our rights, property, safety or that of others.
Business transfers: In the event of a reorganisation, merger, sale or transfer of all or part of our business, personal data may be transferred to the new owner or operator in accordance with data protection law and subject to appropriate safeguards.
International Data Transfers
Where possible, we aim to store and process your personal data within the United Kingdom or European Economic Area. If we use service providers located outside these areas, we will ensure that appropriate safeguards are in place to protect your data in accordance with data protection law. This may include using standard contractual clauses or ensuring that the destination country has an adequate level of data protection recognised by the relevant authorities.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting or reporting requirements. The specific retention period will depend on the type of data and the context in which it was collected.
Customer account and contract data are typically retained for the duration of your contract and for a period after it ends. This allows us to manage any disputes, meet our legal obligations and maintain accurate financial and tax records.
Security and access data, such as CCTV footage and access logs, are retained for a shorter period, unless we need to keep them longer in connection with an incident, investigation or legal claim.
Where personal data is no longer required, we will securely delete, anonymise or destroy it in accordance with our data retention policies and applicable law.
How We Protect Your Data
We take appropriate technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration or destruction. These measures include access controls, secure storage, staff training, and the use of reputable service providers who apply suitable security standards. While no system can be completely secure, we regularly review and enhance our security measures to protect your data.
Your Data Protection Rights
As a customer of Storage St Lukes in our service area, you have a number of rights under data protection law. These rights may be subject to certain conditions and exemptions.
Right of access: You have the right to obtain confirmation as to whether we process your personal data and, if so, to receive a copy of that data and certain related information.
Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
Right to erasure: In certain circumstances, you have the right to request that we delete your personal data. This right is not absolute and may not apply where we need to retain the data for legal or legitimate business reasons.
Right to restriction of processing: You have the right to request that we restrict the processing of your personal data in certain situations, for example while we are investigating the accuracy of the data or our legitimate basis for processing it.
Right to data portability: In some circumstances, you have the right to receive personal data that you provided to us in a structured, commonly used and machine-readable format and to request that we transfer it to another controller where this is technically feasible.
Right to object: You have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where we need to process the data for legal claims.
Rights in relation to automated decision-making: Storage St Lukes does not carry out solely automated decisions that produce legal or similarly significant effects for customers in the context of our core storage services.
Right to withdraw consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.
Complaints and Further Information
If you are concerned about how we handle your personal data, you have the right to raise your concerns directly with us so that we can try to resolve the matter. You also have the right to lodge a complaint with the relevant supervisory authority responsible for data protection in your jurisdiction.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or the services we offer. When we make significant changes, we will take appropriate steps to bring them to your attention. You should review this Privacy Policy periodically so that you are aware of how we handle your personal data.
