Storage Holloway Privacy Policy
This Privacy Policy explains how Storage Holloway collects, uses, stores and protects personal data in connection with our storage and related services. It applies to all Storage Holloway customers in our service area, as well as prospective customers who make enquiries or visit our premises.
We are committed to complying with the UK General Data Protection Regulation and the Data Protection Act, and to handling your personal data lawfully, fairly and transparently.
Data Controller
Storage Holloway is the data controller for the personal data described in this Privacy Policy. This means we decide why and how your personal data is processed when you use our services, visit our premises, or otherwise interact with us.
Personal Data We Collect
We collect and process different types of personal data, depending on how you interact with us and which services you use. The categories of personal data we may collect include the following.
Identity and contact details such as name, postal address, billing address, identification document details if required for verification, and basic contact details such as town or city of residence.
Account and contract information such as customer account numbers, unit or storage identification, contract start and end dates, payment status, and records of communications with you about the services.
Payment and transaction details such as information related to payments you make to us, including the amount, date and method of payment. We do not store your full payment card details where a third party payment processor is used.
Usage and service information such as access times to the facility where access control systems are in place, records of unit allocation or changes, and information about the services you use and your preferences.
Security and surveillance information such as CCTV footage captured on or around our premises, where used for security and safety purposes, and incident reports relating to security, safety or insurance matters.
Enquiry and communication data such as details provided when you request a quote, complete an enquiry form, visit our premises, or contact us by other means, as well as records of our communications with you.
How We Collect Personal Data
We generally collect personal data directly from you when you make an enquiry, enter into a storage agreement, make a payment, or contact us with a question or request.
We may also collect personal data automatically when you enter our premises, for example through CCTV systems and access control systems that record visits for security and operational reasons.
In some cases we may receive personal data from third parties, for example where a third party makes a booking on your behalf, where our service partners provide information required to deliver the services, or where law enforcement or insurers share information with us in connection with a particular incident.
Lawful Basis for Processing
We only process your personal data when we have a lawful basis under data protection law. Depending on the circumstances, we rely on one or more of the following lawful bases.
Contractual necessity: We process your personal data when it is necessary to enter into or perform a contract with you, for example to set up your storage unit, manage your account, take payments and provide customer support.
Legal obligation: We process your personal data when it is necessary to comply with our legal obligations, such as record keeping, tax and accounting requirements, and responding to requests from law enforcement or regulatory authorities.
Legitimate interests: We process personal data when it is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests. These legitimate interests include protecting the security of our premises and customers, preventing and detecting crime and fraud, managing and improving our services, and handling claims or disputes.
Consent: In limited cases, we may rely on your consent to process your personal data, for example for certain types of marketing communications where consent is required. Where we rely on consent, you may withdraw it at any time, and this will not affect the lawfulness of processing carried out before consent was withdrawn.
How We Use Personal Data
We use the personal data described above for the following main purposes.
To provide and manage our storage and related services, including setting up and administering your contract, allocating storage units, managing access, handling payments, and providing customer service.
To maintain the safety and security of our customers, staff and premises, including monitoring access, operating CCTV where in place, preventing and detecting crime, and supporting investigations.
To manage our business operations, including record keeping, accounting, billing, auditing, reporting, service improvement and training.
To communicate with you, including responding to your enquiries, sending you information about your account or any changes to our terms or policies, and managing any requests or complaints.
To comply with legal and regulatory obligations and to establish, exercise or defend legal claims, including working with insurers, law enforcement and regulatory bodies where required.
Data Retention
We keep personal data only for as long as is necessary for the purposes for which it was collected, and to meet our legal and regulatory obligations. Retention periods may vary depending on the type of data and the context in which it was collected.
In general, we retain customer contract and billing records for a period required under applicable tax and accounting laws. CCTV footage and access records are retained for a shorter period, unless they are required for the investigation of a specific incident, in which case they may be kept for longer as evidence. Information related to queries, complaints or claims may be retained for as long as needed to resolve the issue and for a reasonable period afterwards in case of follow up.
When personal data is no longer required, we will delete it securely or anonymise it so that it can no longer be associated with any identifiable individual.
Sharing Personal Data and Processors
We may share your personal data with carefully selected third parties where necessary for the purposes described in this Privacy Policy, and always in accordance with data protection law.
Service providers and processors: We may use third party companies to provide services on our behalf, such as payment processing, information technology and system support, security and surveillance maintenance, and professional services such as accountants or legal advisers. These third parties act as processors and may only process your personal data in accordance with our instructions. We require them to implement appropriate security measures to protect your data.
Business partners and insurers: We may share personal data with business partners or insurers where this is necessary to provide our services, manage risk, or handle claims and disputes.
Authorities and law enforcement: We may disclose personal data to courts, law enforcement agencies, regulators or other authorities where we are legally required to do so, or where it is necessary to protect our rights, property or the safety of our customers or staff.
We do not sell your personal data. If we were to undergo a business reorganisation, merger or sale, your personal data may be transferred as part of that process, in which case we would ensure that appropriate safeguards are in place.
International Transfers
If we transfer personal data outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place, such as adequacy regulations or standard contractual clauses, to protect your data and ensure it remains subject to an equivalent level of protection.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data. These rights may be subject to certain conditions and exemptions.
Right of access: You have the right to request confirmation that we process your personal data and to receive a copy of that data, along with certain information about how and why we process it.
Right to rectification: You have the right to ask us to correct or complete personal data that is inaccurate or incomplete.
Right to erasure: In certain circumstances, you may have the right to request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected, or where you have withdrawn consent and there is no other lawful basis for processing.
Right to restriction of processing: You may have the right to request that we restrict the processing of your personal data in certain situations, for example while we consider a request to rectify your data.
Right to data portability: Where processing is based on your consent or on a contract and carried out by automated means, you may have the right to receive your personal data in a structured, commonly used and machine readable format and to transmit it to another controller.
Right to object: You have the right to object, on grounds relating to your particular situation, to processing that we carry out on the basis of legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is required for legal claims.
Where we rely on consent for processing, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before it was withdrawn.
You also have the right to lodge a complaint with a supervisory authority if you are concerned about the way we handle your personal data. We encourage you to contact us first so we can address your concerns directly.
Security of Your Personal Data
We use appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include physical security for our premises, access controls, and procedures for handling and storing information.
While we take reasonable steps to protect your personal data, no system can be completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority where required by law.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or how we process personal data. Any changes will take effect when the updated policy is made available. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
