Storage St Johns Privacy Policy
This Privacy Policy explains how Storage St Johns collects, uses, stores, and protects personal data relating to our customers and prospective customers. It applies to all individuals who use or enquire about our storage services in the Storage St Johns area, whether you contact us online, by post, or in person at our site.
1. Who we are and scope of this policy
Storage St Johns is a storage service provider offering storage units and related services to customers in the Storage St Johns area. For the purposes of the UK General Data Protection Regulation and the EU General Data Protection Regulation where applicable, Storage St Johns is the controller of the personal data described in this Privacy Policy.
This Privacy Policy applies to all Storage St Johns customers, former customers, and prospective customers in the Storage St Johns area, as well as any individuals who contact us with enquiries about our services.
2. What personal data we collect
We may collect and process the following categories of personal data, depending on how you interact with us and which services you use:
Identification and contact details. This includes your name, postal address, contact address, and other contact information you provide when you make an enquiry, request a quotation, or enter into a contract with us.
Contract and account information. This includes information about the storage unit you rent, the duration of your contract, payment history, and any correspondence relating to your agreement with us.
Payment and billing information. This includes information necessary to process your payments, such as payment method details and transaction records. We do not store full card details where payments are processed by a secure payment provider.
Access and security information. This includes information relating to your authorised access to our premises, such as unit numbers, access codes, or key details, and records of site visits where these are logged.
Communication data. This includes details of communications you send to us or we send to you, such as enquiries, complaints, feedback, and any responses or notes relating to those communications.
Technical and usage data. When you visit our website, we may collect limited technical information such as your IP address, browser type, and approximate location, as well as information about how you use the site. Where required, we will seek your consent for optional cookies or similar technologies.
Incident and legal information. Where necessary, we may collect information relating to security incidents, insurance claims, or legal disputes involving you and our services.
3. How and why we use your personal data
We use your personal data only where we have a valid lawful basis under data protection law. The main purposes and lawful bases are:
To provide our services and manage our contract with you. We process your personal data in order to set up your customer account, provide you with a storage unit, manage access and security, process payments, and handle any enquiries or requests you make. The lawful basis is that the processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
To comply with legal and regulatory obligations. We may process your personal data where necessary to meet our legal obligations, such as tax, accounting, anti fraud, and health and safety requirements, and to cooperate with law enforcement or regulatory authorities where we are legally required to do so.
To protect our legitimate interests. We may process personal data where it is necessary for our legitimate business interests, provided your interests and fundamental rights do not override those interests. This may include maintaining the security of our premises, preventing and detecting fraud, managing and improving our services, handling complaints, and asserting or defending legal claims.
To send you service communications. We use your contact details to send you important information about your contract or our services, such as changes to terms and conditions, notices about your storage unit, or updates about payments and access. This is based on the performance of our contract and our legitimate interests in effective service administration.
To send you marketing communications. We may use your contact details to inform you about services, offers, or updates that we believe may be of interest to you. Where required by law, we will obtain your consent before sending electronic marketing, and you can opt out at any time.
4. Data retention
We keep personal data only for as long as is necessary in view of the purposes for which it was collected and any legal or regulatory requirements. In general, this means:
Customer and contract records. We usually retain core contract information, including identification details, contract documentation, and key correspondence, for up to six years after the end of your relationship with us. This is to comply with legal and accounting obligations and to enable us to deal with any legal claims.
Payment and billing records. We retain payment data and billing records for the period required by tax and accounting laws, which is typically up to six years.
Enquiries from non customers. Information relating to enquiries from individuals who do not become customers is normally retained for a shorter period, usually up to two years, unless we are required to keep it longer for legal reasons.
Security and incident records. Information relating to access, incidents, or investigations may be retained for as long as is reasonably necessary for security, insurance, or legal purposes.
When personal data is no longer required, we will securely delete or anonymise it so that it can no longer be associated with you.
5. Data processors and third party recipients
We may share your personal data with trusted third parties who act as processors on our behalf. These third parties are only permitted to process your personal data in accordance with our instructions and are required to implement appropriate security measures. Examples of such processors include:
Payment processing providers who handle card or electronic payments and related transaction services.
IT and hosting providers that supply, maintain, and support our information systems, website, and data storage solutions.
Professional advisers, such as accountants or legal advisers, who assist us with our business operations and compliance obligations.
We may also share your personal data with third parties acting as independent controllers where necessary and lawful, for example with law enforcement agencies, regulatory bodies, insurance providers, or courts where we are required to do so or where it is necessary to establish, exercise, or defend legal claims.
Where we transfer personal data outside the United Kingdom or European Economic Area, we will ensure that appropriate safeguards are in place, such as standard contractual clauses or other approved mechanisms, to protect your data in accordance with data protection law.
6. How we protect your data
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These measures include access controls, secure storage systems, appropriate training for staff who handle personal data, and procedures for dealing with suspected data breaches.
While we take reasonable steps to safeguard your personal data, no system or transmission of information via the internet can be guaranteed to be completely secure. You are also responsible for keeping any access codes or passwords relating to our services secure and confidential.
7. Your data protection rights
You have a number of rights in relation to the personal data we hold about you. These rights are subject to certain conditions and exemptions set out in data protection law. Your rights include:
Right of access. You can request confirmation that we process your personal data and obtain a copy of that data, together with certain information about how we use it.
Right to rectification. You can ask us to correct or complete personal data that is inaccurate or incomplete.
Right to erasure. In certain circumstances, you can ask us to delete or remove your personal data, for example where it is no longer needed for the purposes for which it was collected or where you have withdrawn consent and there is no other lawful basis for processing.
Right to restriction of processing. You can request that we restrict our use of your personal data in certain situations, such as while we are checking its accuracy or considering an objection you have raised.
Right to object. You can object to the processing of your personal data where we are relying on legitimate interests as our lawful basis. We will stop processing unless we have compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for legal claims. You can also object at any time to our use of your personal data for direct marketing.
Right to data portability. Where our processing is based on your consent or on a contract and is carried out by automated means, you can ask to receive your personal data in a structured, commonly used, and machine readable format and to have it transmitted to another controller where technically feasible.
Right to withdraw consent. Where we rely on your consent to process your personal data, you can withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before you withdrew consent.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe that your data protection rights have been infringed. We encourage you to contact us in the first instance so that we can attempt to resolve any concerns.
8. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. Any changes will take effect when the updated policy is made available. We recommend that you review this policy periodically so that you remain informed about how we process your personal data.
