Storage New Malden Privacy Policy
This Privacy Policy explains how Storage New Malden collects, uses, stores and protects personal data relating to our customers and prospective customers within our service area. It is intended to help you understand what information we collect, the lawful bases we rely on, how long we keep your data and what rights you have under data protection law.
This Privacy Policy applies to all interactions you have with Storage New Malden as a self-storage customer, business customer, or prospective customer in the local area, whether you contact us in person, by post, by electronic communication, or through any other method.
Who this Privacy Policy applies to
This Privacy Policy applies to all individuals who are Storage New Malden customers or prospective customers within our service area. It covers personal data relating to individuals acting in a personal capacity and individuals acting on behalf of a business, such as directors, partners, or employees who interact with us in connection with storage services.
By using our services or by providing your personal data to us, you acknowledge that your personal data will be processed in accordance with this Privacy Policy and applicable data protection legislation, including the UK General Data Protection Regulation and the Data Protection Act 2018.
Personal data we collect
We may collect and process the following categories of personal data about you when you enquire about, reserve or use our storage facilities:
Identification information such as full name, title, date of birth, and proof of identity details shown on documents you provide to us.
Contact information such as home or business address, billing address, and any communication addresses you provide to us.
Account and contract information such as storage unit numbers, contract start and end dates, payment terms and related correspondence about your account.
Payment and transaction information such as payment card details processed through secure payment providers, bank transfer references and records of invoices, payments and refunds.
Communication records such as emails you send to us, letters, records of telephone conversations where kept, and notes of meetings or discussions relating to your account or enquiry.
Security and access information such as CCTV footage in and around our premises, access logs, unit entry records and any incident reports for security and safety purposes.
Technical and usage information where relevant, such as device information, basic connection data and usage records relating to any online portals or digital systems we provide for managing your storage account.
How we collect personal data
We collect personal data directly from you when you contact us, request a quote, reserve a unit, sign a storage agreement, make a payment, or otherwise communicate with us. We may also receive limited personal data about you from third parties where this is necessary, for example from payment processors confirming that a payment has been made, or from law enforcement authorities where they request or provide information in connection with an investigation.
Lawful basis for processing
We process your personal data only where we have a lawful basis under data protection law. Depending on the circumstances, the lawful basis may be one or more of the following:
Performance of a contract. We process personal data where this is necessary to enter into or perform a storage contract with you, including setting up your account, managing access to your unit, taking payment and providing customer service.
Compliance with legal obligations. We process personal data where we are required to do so by law, such as for tax and accounting rules, insurance requirements, health and safety obligations, and responding to lawful requests from authorities.
Legitimate interests. We process personal data where it is necessary for our legitimate business interests and where your interests and fundamental rights do not override those interests. These interests include operating safe and secure storage facilities, preventing and detecting crime, managing our business relationship with you, improving our services and defending legal claims.
Consent. In limited circumstances we may rely on your consent, for example where required for certain types of optional marketing. Where we rely on consent, you may withdraw it at any time, and we will stop the activity that depends on consent.
How we use your personal data
We use the personal data we collect for the following purposes:
To respond to your enquiries, provide quotes and discuss storage options.
To verify your identity, set up your customer account and prepare and manage storage contracts.
To administer your account, including invoicing, processing payments, managing deposits, handling arrears and communicating with you about your storage arrangement.
To manage security and access to our premises, including monitoring CCTV, maintaining access logs and addressing any incidents or safety concerns.
To manage our business operations, including internal administration, accounting and reporting.
To comply with applicable laws, regulations and guidance and to cooperate with lawful requests and investigations by regulatory bodies and law enforcement agencies.
To exercise or defend legal claims, recover debts owed to us and manage disputes.
Where lawful, to contact you with important updates about our services, changes to our terms and this Privacy Policy.
Data retention
We keep personal data only for as long as necessary for the purposes for which it was collected, or as required by law. The precise retention period will depend on the type of data and the reason it was collected, but we apply the following general principles:
Customer account and contract records are retained for the duration of your contract and for a reasonable period afterwards to deal with any queries, disputes or legal claims, and to comply with legal and regulatory requirements.
Financial and transactional records, including invoices and payment records, are retained for the periods required by tax and accounting laws.
CCTV footage and security logs are retained for a limited period necessary for security and investigation purposes, unless a particular recording is required to be kept longer in connection with an incident, insurance claim or legal matter.
Communications such as emails and correspondence are retained in line with our general retention periods for customer and contract information.
When personal data is no longer required, we will securely delete or anonymise it so that it can no longer be associated with you.
Data processors and third parties
We may share your personal data with trusted third parties who act as data processors on our behalf. These providers are only permitted to process your personal data in accordance with our instructions and for the purposes set out in this Privacy Policy. They must implement appropriate technical and organisational measures to protect your data.
Examples of processors and third parties we may use include:
Payment processing and merchant service providers to handle card payments and other financial transactions.
IT and cloud service providers who host or support our business systems, data storage, communication tools and security systems.
Professional advisers such as accountants, auditors, legal advisers and insurance providers where necessary for our business operations and to manage risks.
Security and maintenance contractors who support the operation and safety of our premises.
We may also share your personal data with other third parties where required by law or where necessary to protect our rights, property or safety, or the rights, property or safety of our customers or others.
International data transfers
Where any of our service providers or their systems are located outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place before any personal data is transferred. These safeguards may include reliance on an adequacy regulation, the use of contractual clauses that have been approved by data protection authorities, or other measures permitted by applicable law to ensure an adequate level of data protection.
How we protect your data
We take the security of your personal data seriously. We implement a range of technical and organisational measures to help protect it against unauthorised access, disclosure, alteration or destruction. These measures include secure storage systems, controlled access to records, staff training, and regular review of our security practices. While we strive to protect your personal data, no system can be guaranteed as completely secure.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data. These rights apply subject to certain conditions and exemptions and may depend on the lawful basis on which we process your data. Your rights include:
The right of access. You can request confirmation of whether we hold personal data about you and request a copy of that data.
The right to rectification. You can ask us to correct inaccurate or incomplete personal data we hold about you.
The right to erasure. In certain circumstances, you can ask us to delete your personal data, for example where it is no longer needed for the purposes for which it was collected and we do not have another lawful basis to retain it.
The right to restrict processing. You can ask us to restrict the processing of your personal data in certain situations, for example while we verify the accuracy of the data.
The right to data portability. Where we process your personal data based on your consent or on a contract with you and the processing is carried out by automated means, you may request that we provide your data in a structured, commonly used and machine readable format and transfer it to another controller where technically feasible.
The right to object. You can object to the processing of your personal data where our lawful basis is our legitimate interests, including profiling based on those interests. We will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims.
Rights in relation to automated decision making and profiling. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you, unless certain conditions apply.
You also have the right to lodge a complaint with the relevant data protection authority if you believe that your personal data has been processed in a way that does not comply with data protection laws.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or services. Any changes will apply from the date we publish the updated version. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.
