Privacy Policy - Blackfriars Storage

This Privacy Policy explains how Blackfriars Storage collects, uses, stores, shares, and protects personal data relating to its customers and prospective customers. It applies to all Blackfriars Storage customers in the area, including individuals and businesses that use, enquire about, or otherwise interact with our storage services. We are committed to handling personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Blackfriars Storage provides storage services to customers in the local area. For the purposes of data protection law, we are the data controller for the personal data we collect and process in connection with our services. This means we determine the purposes and means of processing personal data.

2. Personal Data We Collect

We only collect personal data that is necessary for the operation of our business and the provision of our services. The types of information we may collect include:

Identity data such as your name, title, and any business name you provide.
Contact data such as address details, email address, and telephone number.
Account and contract data such as storage unit details, booking records, service preferences, and contract terms.
Payment data such as billing details, payment status, and transaction records.
Access and security data such as entry logs, security records, and information used to maintain site safety.
Communications data such as enquiries, complaints, feedback, and correspondence with us.
Technical data that may be collected when you interact with our systems, including device information or usage information where relevant.

We do not intentionally collect special category data unless it is required by law or you choose to provide it for a specific reason. If such data is ever processed, we will apply additional safeguards.

3. How We Use Personal Data

We use personal data for the following purposes:

to register enquiries and manage customer accounts;
to provide storage services and administer contracts;
to process payments, refunds, and account administration;
to maintain site safety, security, and access control;
to respond to questions, complaints, or requests;
to meet legal and regulatory obligations;
to prevent fraud, unauthorised access, and misuse of services;
to improve our operations, records, and customer experience;
to defend or establish legal claims where necessary.

We process personal data only where there is a lawful basis to do so. We will not use your data for purposes that are incompatible with the reasons for which it was collected unless we have a valid legal basis and have informed you where required.

4. Lawful Basis for Processing

Under data protection law, we must identify a lawful basis for each processing activity. Depending on the context, Blackfriars Storage may rely on one or more of the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes setting up a storage agreement, managing your account, providing access to your storage unit, and handling billing or service administration.

Legal Obligation

We may process personal data where needed to comply with a legal obligation, such as tax, accounting, fraud prevention, health and safety, or lawful requests from public authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Examples include maintaining security, improving services, preventing misuse, managing business records, and protecting our property and customers.

Consent

In limited cases, we may rely on your consent, for example where we collect data for specific optional purposes that are not covered by another lawful basis. Where consent is used, you may withdraw it at any time.

5. Data Sharing and Processors

We may share personal data with trusted third parties where necessary to operate our business and provide our services. These third parties act either as processors or, in limited cases, as independent controllers.

Our processors may include:

Payment service providers that help process transactions securely.
IT and hosting providers that support our systems, data storage, and security.
Security service providers that assist with alarms, monitoring, access control, or site protection.
Administrative service providers that help manage bookings, records, or communications.
Professional advisers such as accountants, auditors, insurers, and legal advisers, where necessary.

All processors are required to handle personal data in accordance with data protection law, to act only on our instructions, and to apply appropriate technical and organisational measures to protect the information they process.

We may also disclose personal data where required by law, court order, or regulatory authority, or where necessary to establish, exercise, or defend legal claims. Blackfriars Storage does not sell personal data.

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including for legal, accounting, insurance, and dispute resolution requirements. The retention period depends on the type of data and the reason it was collected.

Customer and contract records are retained for the duration of the service relationship and for a reasonable period afterwards.
Financial and transaction records are retained for the period required by tax and accounting laws.
Security and access records are retained only as long as needed for safety, incident management, or operational purposes.
Communications are retained for as long as needed to handle the enquiry, complaint, or ongoing relationship.

When personal data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you.

7. Data Security

We take reasonable and appropriate measures to protect personal data against accidental loss, unlawful access, misuse, alteration, or disclosure. These measures may include access restrictions, secure storage, staff training, and regular review of our procedures. No system is completely secure, but we work to minimise risks and to ensure personal data is handled responsibly.

8. Your Rights

As a data subject under UK GDPR, you have a number of rights in relation to your personal data. These rights may be subject to legal limitations and exemptions. Your rights include:

The right of access to request a copy of the personal data we hold about you.
The right to rectification to ask us to correct inaccurate or incomplete data.
The right to erasure to request deletion of your data in certain circumstances.
The right to restrict processing to limit how we use your data in specific situations.
The right to data portability to receive certain data in a structured, commonly used format.
The right to object to processing based on legitimate interests or direct marketing.
The right to withdraw consent where processing relies on consent.
The right to lodge a complaint with the relevant supervisory authority if you believe your rights have been infringed.

We encourage customers to contact us with any concerns about the way personal data is handled so that we can address issues promptly and fairly. We may need to verify your identity before responding to a rights request.

9. Children’s Data

Our services are primarily intended for adults and businesses. We do not knowingly collect personal data from children unless it is necessary for a lawful purpose and appropriate safeguards are in place. If we become aware that we have collected data from a child without a valid basis, we will take steps to delete it where required.

10. International Transfers

If personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place to protect it. These may include adequacy regulations, standard contractual clauses, or other lawful mechanisms approved under applicable data protection law.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our services, or how we process personal data. The latest version will apply from the date it is made available. We encourage customers to review it periodically so they remain informed about how their information is handled.

12. Summary of Our Commitment

Blackfriars Storage is committed to processing personal data lawfully, securely, and only when necessary. We collect information to provide storage services, manage our business, and meet legal obligations. We retain data for appropriate periods, work with processors under strict safeguards, and respect the rights of every customer in the area who uses our services.

By using Blackfriars Storage services, customers in the area acknowledge that their personal data may be processed as described in this Privacy Policy.