Storage Blackfriars Privacy Policy
This Privacy Policy explains how Storage Blackfriars collects, uses, stores and protects personal data relating to all customers in our service area. It also explains your rights under the UK General Data Protection Regulation and related data protection laws, and how you can exercise them. By using our storage services, visiting our premises, or interacting with us, you acknowledge that you have read this Privacy Policy.
Scope and who this policy applies to
This Privacy Policy applies to all Storage Blackfriars customers in our service area, including prospective customers who make enquiries, current customers with active storage contracts, and former customers whose data we still retain for lawful purposes. It also applies to individuals who contact us regarding our services on behalf of a business, as well as emergency contacts or authorised persons nominated by our customers.
Data controller
Storage Blackfriars is the data controller responsible for determining how and why your personal data is processed. We are committed to processing personal data lawfully, fairly and in a transparent manner and to complying with all applicable data protection laws.
Personal data we collect
We may collect and process the following categories of personal data about you when you enquire about, use or end our storage services:
Identity and contact details such as name, postal address, date of birth, and other basic identifying information, together with billing address and any alternative contact address you provide.
Account and contract data such as customer reference numbers, contract details, unit numbers, storage start and end dates, payment history, and records of communications related to your account.
Payment and transaction data such as payment method, partial card details used for verification, billing records, invoices and receipts. We do not store full card details; these are handled by our payment service providers.
Access and security data such as entry and exit logs, unit access records, key or fob identifiers, and in some cases vehicle registration numbers where required for access control and site security.
Communication data such as emails, written correspondence, and notes of telephone conversations or in-person discussions relating to your enquiry, contract, payments or any complaints.
Marketing preferences such as whether you wish to receive updates about offers, services and promotions from us and the channels through which you prefer to be contacted.
Technical and usage data where you use our online tools, such as information about device type, browser type and approximate location, collected through standard logging for security and performance. We do not use this data to identify you directly without a lawful basis.
How we collect your data
We collect personal data directly from you when you request a quote, complete a booking, sign a storage agreement, make a payment, contact us with a query, or update your details. We may also collect data when you visit our premises through our access control systems and security measures. In limited cases, we may receive personal data from third parties, such as a person acting on your behalf, a business that arranges storage for you, or law enforcement or regulatory bodies where legally required.
Purposes and lawful basis for processing
We process your personal data only when we have a lawful basis to do so. The main purposes and lawful bases are:
To provide storage services and manage your contract. This includes setting up your account, allocating a storage unit, processing payments, managing access, and responding to your queries. The lawful basis is the performance of a contract or steps taken at your request before entering into a contract.
To comply with legal and regulatory obligations. We may process and retain data to comply with tax, accounting, anti money laundering, crime prevention and health and safety obligations, and to respond to lawful requests from authorities. The lawful basis is compliance with a legal obligation.
To maintain site security and prevent fraud or crime. We use access logs and other security related information to protect customers, staff and property, to investigate incidents, and to support law enforcement where required. The lawful basis is our legitimate interests in ensuring security and preventing unlawful activity.
To manage our relationship with you. This includes notifying you about changes to terms, policies or services, handling complaints, and seeking feedback to improve our services. The lawful bases are performance of a contract and our legitimate interests in running our business and improving services.
To send you marketing communications. If you are an individual customer, we will only send you electronic marketing communications where we have your consent or where permitted by law. You may opt out of marketing at any time. The lawful basis is your consent or our legitimate interests, depending on the type of communication and your relationship with us.
To protect and defend our legal rights. We may process data in connection with potential or actual legal claims, debt recovery, or to enforce our terms and conditions. The lawful basis is our legitimate interests in protecting our business and defending claims.
Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting and reporting requirements.
Customer contract and billing records are normally retained for a defined period after your contract ends to meet tax and accounting obligations and to address any disputes or queries. Access and security records are retained for a shorter period, unless they are required for an ongoing investigation or legal claim. Marketing preference records are retained so we can respect your choices about how we contact you.
When data is no longer needed, we will securely delete or anonymise it. Retention periods may vary depending on the type of data, the nature of our relationship with you, and legal requirements.
Data processors and third party recipients
We use carefully selected third party service providers to help us deliver our services and manage our business. These service providers act as data processors and process personal data on our behalf and under our instructions.
Examples of processors and third party recipients include payment processing providers who handle card and online payments for us, IT and hosting providers who supply and maintain our systems and data storage infrastructure, security and access control system providers, and professional advisers such as accountants or legal advisers, where necessary.
Where we use processors, we ensure that they are subject to appropriate contractual and security obligations to protect your data and only process it for the purposes we specify. We do not sell your personal data to third parties.
International transfers
Where it is necessary for technical or operational reasons for personal data to be transferred outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place. These may include adequacy regulations, standard contractual clauses, or equivalent measures designed to protect your rights and provide a similar level of protection to that required under UK data protection law.
Your data protection rights
You have a number of rights in relation to your personal data, subject to certain conditions and exemptions under law.
Right of access. You can request confirmation of whether we process personal data about you and obtain a copy of that data, together with information about how it is used.
Right to rectification. You can ask us to correct inaccurate personal data and to complete incomplete information.
Right to erasure. In certain circumstances, you can request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected and we have no other lawful basis for retaining it.
Right to restriction of processing. You can ask us to restrict the processing of your data in certain situations, such as while we check its accuracy or consider an objection you have raised.
Right to data portability. Where processing is based on consent or on a contract and carried out by automated means, you can request that we provide your personal data in a structured, commonly used and machine readable format or ask us to transmit it to another controller where technically feasible.
Right to object. You can object at any time to processing that is based on our legitimate interests, including profiling related to those interests, and we will stop processing unless we have compelling legitimate grounds or the processing is needed for legal claims. You always have the right to object to direct marketing and we will honour this without question.
Rights in relation to automated decision making. Storage Blackfriars does not routinely make decisions about you based solely on automated processing that have legal or similarly significant effects. If this changes, we will update this policy and inform you where required.
Exercising your rights and complaints
If you wish to exercise any of your rights or raise a concern about how we process your personal data, you can contact us using the usual customer contact channels you use for your account or enquiries. We will respond to your request in accordance with legal time limits and may need to verify your identity before acting on your request to protect your data.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe that your data has not been handled in compliance with applicable law. We encourage you to contact us first so we can try to resolve your concerns directly.
Security of your data
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These measures include access controls, staff training, secure storage systems and regular review of our security practices. While no system can be guaranteed as completely secure, we work to ensure that the level of security we apply is appropriate to the nature of the data and the risks involved.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in the law, our services or our data processing practices. The updated version will be made available to customers and will apply from the date it is issued. You should review this Privacy Policy periodically to stay informed about how we handle your personal data.
