Storage Thamesmead Privacy Policy
This Privacy Policy explains how Storage Thamesmead collects, uses, stores and shares personal data relating to individuals who use our storage services, make enquiries, or otherwise interact with us. This Policy applies to all Storage Thamesmead customers and prospective customers in the Thamesmead area, including any person acting on behalf of a business customer.
Storage Thamesmead acts as a data controller for the personal data it processes in connection with the provision of self-storage and related services. We are committed to safeguarding your privacy and processing your personal data in compliance with the UK General Data Protection Regulation and any other applicable data protection laws.
Personal Data We Collect
We collect and process different categories of personal data depending on how you interact with us and the services you use. The main categories of data we may collect include:
Identification and contact details such as name, postal address, billing address, contact address, and any company or trading name where relevant. We also collect details such as gender or title where provided voluntarily.
Account and contract information such as customer account numbers, contract start and end dates, storage unit number, access credentials, and correspondence relating to your contract, bookings or enquiries.
Payment and billing information such as records of payments, payment method used, charges, invoices, refunds and arrears. We do not store full card details when payments are processed through secure payment providers.
Communication records such as emails, letters and notes of telephone or in-person conversations, including enquiries, feedback, complaints and other service-related communications.
Security and access data such as CCTV footage on or around our premises, entry and exit logs, access control records, and information relating to incidents or security investigations.
Technical information such as IP address, device details, and usage data where you interact with any of our online services or digital platforms.
How We Collect Your Data
We may collect personal data from you directly when you request a quote, sign a storage agreement, make a payment, enter our premises, contact us by phone or in writing, or complete any forms we provide. Data is also collected where you use our website, portals or other digital services.
We may obtain data indirectly from third parties such as payment processors, credit reference agencies, or business partners where this is necessary for our services, fraud prevention, or to comply with legal obligations. Where required, we will notify you of any such indirect collection as soon as reasonably possible.
Lawful Basis for Processing
We process your personal data only where we have a lawful basis under data protection law. Depending on the specific processing activity, we may rely on one or more of the following bases:
Contractual necessity where processing is required to enter into or perform a contract with you, such as creating and managing your storage account, arranging access to units, handling payments, and delivering customer support.
Legal obligation where we must process and retain certain information to comply with legal or regulatory requirements, such as tax, accounting, fraud prevention, crime detection and reporting obligations.
Legitimate interests where processing is necessary for our legitimate business interests or those of a third party, provided your interests and fundamental rights do not override those interests. This may include ensuring site security, maintaining accurate records, improving services, handling queries, and defending legal claims.
Consent where we rely on your freely given, specific and informed consent for certain activities. If we ask for your consent, you can withdraw it at any time, although this will not affect processing already carried out prior to withdrawal.
How We Use Your Personal Data
We may use your personal data for the following purposes:
To set up, manage and administer your storage agreement and customer account.
To verify your identity and eligibility for our services where appropriate.
To process payments, issue invoices and manage billing or debt recovery activities.
To manage access to our premises and storage units, including the operation of security and safety systems.
To communicate with you about your contract, bookings, payments, access instructions, changes to terms, and service notifications.
To respond to your enquiries, feedback and complaints, and to provide customer support.
To maintain and improve our facilities, services and customer experience, including staff training and quality assurance.
To investigate and prevent fraud, theft, vandalism, or other unlawful or suspicious activity on our premises or in connection with our services.
To comply with our legal and regulatory obligations and to establish, exercise or defend legal claims.
Data Sharing and Processors
We may share your personal data with carefully selected third parties where necessary for the purposes described in this Policy and where we have a lawful basis to do so. These third parties may act as data processors, processing personal data on our instructions, or as independent controllers.
Categories of recipients may include:
Payment service providers who process transactions on our behalf.
IT and system support providers who host, maintain or support our business systems, storage management software, and security technologies.
Security service providers involved in the provision of CCTV systems, access control, alarms and site monitoring where necessary for the security of our premises and customers.
Professional advisers such as legal and accounting firms where needed to obtain advice or to protect our legal rights.
Debt recovery agencies or tracing agents where reasonably necessary to recover unpaid charges or locate customers.
Public authorities, law enforcement agencies, courts and regulators where required by law or to protect our rights, property, customers or staff.
Whenever we use data processors, we ensure that appropriate contractual and technical safeguards are in place so that your personal data is processed securely, lawfully and only for the purposes we have specified.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or to meet legal, regulatory, accounting or reporting requirements. When deciding how long to keep data, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure, the purposes of processing, and whether those purposes can be achieved by other means.
In general, we keep core customer and contract records for a period after the end of your storage agreement to handle any queries, legal claims or regulatory requirements. Security-related data such as CCTV footage and access logs is normally retained for a shorter period, unless it is required in connection with an incident, investigation or legal matter.
Once the relevant retention period has expired, we will securely delete or anonymise your personal data so that it can no longer be associated with you.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to the personal data we hold about you. Subject to certain conditions and exemptions, these may include the following:
The right of access to obtain confirmation of whether we process your personal data and to receive a copy of that data.
The right to rectification to request correction of inaccurate or incomplete personal data.
The right to erasure to request that we delete your personal data where there is no good reason for us to continue processing it, for example where you have successfully objected to processing or withdrawn consent.
The right to restriction of processing to request that we limit the way we use your data in certain circumstances, for example where you contest its accuracy or object to our use of it.
The right to object to processing where we rely on legitimate interests as our lawful basis and you believe your particular situation gives rise to grounds to object. You also have an absolute right to object to direct marketing.
The right to data portability to receive certain personal data in a structured, commonly used and machine-readable format and to have that data transmitted to another controller where technically feasible and where the processing is based on consent or contract.
Where we rely on consent as the lawful basis for processing, you have the right to withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing that took place before consent was withdrawn.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe that your rights have been infringed or that your personal data has been handled unlawfully.
Security of Your Data
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures may include controlled access to systems and premises, encryption, secure storage solutions, staff training, regular review of security practices, and incident response procedures.
International Data Transfers
Where we or our service providers transfer personal data outside the United Kingdom or European Economic Area, we will ensure that an adequate level of protection is in place. This may include reliance on adequacy regulations, the use of standard contractual clauses, or other appropriate safeguards permitted by data protection law.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. Any changes will take effect from the date they are published in the updated Policy. We encourage you to review this Policy periodically so that you remain informed about how we process and protect your personal data.
