Storage Lisson Grove Privacy Policy
This Privacy Policy explains how Storage Lisson Grove collects, uses, stores, and protects personal data relating to its customers within the Storage Lisson Grove service area. It is intended to comply with the UK General Data Protection Regulation and other applicable data protection laws. By using our storage services, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all customers and prospective customers of Storage Lisson Grove within our operating area. It covers personal data obtained through our service contracts, enquiries, visits to our premises, use of our website or online booking tools, and other interactions with us in connection with our storage services.
Types of Personal Data We Collect
We collect and process different categories of personal data, depending on how you interact with us and which services you use. These categories may include:
Identification and contact details, such as your name, postal address, billing address, and preferred contact details.
Account and contract information, such as storage unit numbers, contract duration, pricing, billing history, and customer reference numbers.
Payment and transaction data, such as payment method details, transaction records, and information required for invoicing and accounting. We do not store full payment card details where this is handled by a secure payment processor.
Communication data, such as emails, written correspondence, and records of telephone or in-person enquiries relevant to your account or our services.
Security and access information, such as CCTV footage at our premises, access logs for entry to storage units and common areas, and incident reports relating to security or safety.
Technical and usage data, which may include information about how you use our website or online tools, such as device type, approximate location, and usage patterns, where such data is collected in accordance with applicable law.
Lawful Bases for Processing Personal Data
We process personal data only where we have a valid legal basis to do so. Depending on the specific processing activity, we rely on one or more of the following lawful bases:
Performance of a contract. We process personal data to enter into and perform our contract with you, including managing your storage unit, processing payments, handling enquiries, and providing customer support.
Compliance with legal obligations. We may process personal data to meet legal and regulatory requirements, including tax and accounting obligations, health and safety requirements, and obligations to assist law enforcement or regulatory authorities when lawfully required.
Legitimate interests. We may process personal data where this is necessary for our legitimate interests or the legitimate interests of a third party, provided these are not overridden by your rights and interests. Examples include maintaining the security of our premises, improving our services, managing business operations, and preventing fraud or misuse of our facilities.
Consent. In certain limited circumstances, we may rely on your consent to process specific categories of data or to send you certain forms of marketing communications. Where we rely on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
How We Use Your Personal Data
We use personal data for the following purposes:
To create and manage your customer account, administer storage contracts, allocate storage units, and manage move-in and move-out processes.
To process payments, manage invoicing and collections, and maintain accurate financial and transactional records.
To communicate with you regarding your storage arrangements, service updates, policy changes, and important notices relating to your account or the safe operation of our facilities.
To ensure the safety and security of customers, staff, and property at our premises, including the use of CCTV, access control systems, and security incident investigations.
To maintain and improve our services, premises, and customer experience, including monitoring usage trends, handling feedback, and training staff.
To comply with legal and regulatory obligations and to respond to lawful requests from public authorities, law enforcement, and regulators.
Data Processors and Third Parties
We may engage carefully selected third party service providers to process personal data on our behalf and in accordance with our instructions. These service providers act as data processors and are required to implement appropriate technical and organisational measures to protect your data. Data processors may include:
IT and cloud service providers that host our systems, storage platforms, and business applications.
Payment service providers that securely process card payments and other transactions.
Security service providers that support CCTV systems, alarm monitoring, and access control technologies.
Professional advisers such as accountants or legal advisers where necessary for the management of our business and compliance with legal obligations.
We do not sell your personal data to third parties. Where personal data is shared with third parties acting as independent controllers, such as public authorities or law enforcement, this is done only where we have a legal basis and are required or permitted by law.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Retention periods vary depending on the type of data and the applicable statutory or regulatory requirements.
Customer account and contract details are generally retained for a period after the end of the contract to deal with any queries, disputes, or legal claims, and to comply with accounting and tax obligations.
CCTV footage and access logs are retained for a limited period necessary for security, safety, and incident investigation, unless a longer retention period is required in connection with a specific incident, investigation, or legal requirement.
Where personal data is no longer required for the purposes for which it was collected and no longer needs to be retained under applicable law, it will be securely deleted, anonymised, or placed beyond further use.
International Data Transfers
Where we use service providers or systems located outside the United Kingdom or the European Economic Area, personal data may be transferred internationally. In such cases, we ensure that appropriate safeguards are in place, such as recognised adequacy decisions, standard contractual clauses, or equivalent legal mechanisms, to ensure that your data remains protected to a standard consistent with applicable data protection laws.
Security of Your Personal Data
We take the security of your personal data seriously and use reasonable and appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures may include secure access controls, encryption where appropriate, staff training, physical security at our premises, and regular review of our security practices.
Your Data Protection Rights
As a data subject, you have certain rights in relation to your personal data under applicable data protection laws. Subject to specific conditions and legal limitations, these rights may include:
The right of access, allowing you to request confirmation as to whether we hold personal data about you and to obtain a copy of that data.
The right to rectification, enabling you to request the correction of inaccurate or incomplete personal data.
The right to erasure, also known as the right to be forgotten, allowing you to request the deletion of your personal data where there is no compelling reason for its continued processing.
The right to restriction of processing, allowing you to request that we limit the processing of your personal data in certain situations.
The right to data portability, allowing you to receive certain personal data in a structured, commonly used, and machine readable format and to transmit that data to another controller where technically feasible.
The right to object, allowing you to object to the processing of your personal data where the legal basis is our legitimate interests or where data is processed for direct marketing.
The right to withdraw consent, where processing is based on your consent. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Exercising Your Rights
If you wish to exercise any of your data protection rights or have any questions about how we handle personal data, you can contact us using the contact details provided on our official customer documentation or at our premises. To protect your privacy, we may need to verify your identity before actioning your request.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. The most current version will always be made available to customers. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
