Storage Hanworth Privacy Policy
This Privacy Policy explains how Storage Hanworth collects, uses, stores and protects personal data relating to our self-storage and associated services. It applies to all Storage Hanworth customers and prospective customers in our service area, as well as visitors to our premises who provide personal data in the course of using or enquiring about our services.
We are committed to complying with the UK General Data Protection Regulation and the Data Protection Act 2018. We only process personal data where we have a lawful basis and where it is necessary for clearly defined purposes.
Personal data we collect
We may collect and process the following categories of personal data when you enquire about, enter into, or use our storage services:
Identity and contact details, including name, postal address, billing address, contact address, and other basic contact details you choose to provide. Identification information, such as date of birth and identity document details, where required to verify your identity and for security or legal compliance. Contract and account information, including storage unit details, rental start and end dates, payment history, services used, and any correspondence relating to your contract. Payment and billing information, such as partial card details and transaction records processed through our chosen payment providers. We do not store full payment card details when this is handled securely by a third-party payment processor. Communication and enquiry records, including information you provide when you contact us by post or in person, feedback about our services, and records of any complaints. Security and access data, including CCTV footage on and around our premises, access logs from entry systems, and information relating to incidents, accidents or security investigations. Website and usage data, where applicable, such as basic technical and usage information collected when you visit our online pages or send us electronic communications.
How and why we use your personal data
We process personal data only where we have a lawful basis under data protection law. The main purposes and lawful bases are as follows:
To provide storage services and manage our contract with you. We use your personal data to set up and manage your customer account, allocate storage units, administer payments, manage renewals, and respond to any queries or service issues. Our lawful basis is the performance of a contract or taking steps at your request before entering into a contract.
To comply with legal and regulatory obligations. We may be required to verify your identity, maintain accurate records for tax and accounting purposes, and cooperate with law enforcement or regulatory authorities where we are legally obliged to do so. Our lawful basis is compliance with a legal obligation.
To protect our premises, property and the safety of customers, visitors and staff. We may use CCTV, access logs and incident reports to prevent and detect crime, to investigate complaints or incidents, and to maintain a safe environment. Our lawful basis is our legitimate interests in site security and the protection of people and property, balanced against your rights and freedoms.
To manage and improve our business and services. We may use aggregated and minimal personal data to analyse service usage, improve our processes, train staff, and maintain accurate internal records. Where possible, we anonymise or pseudonymise data. Our lawful basis is our legitimate interests in running and developing our business efficiently and effectively.
To communicate with you. We may contact you about your existing contract, changes to our terms and conditions, service updates, payment reminders or other essential information. Our lawful basis is the performance of a contract and our legitimate interests in providing effective customer service. Where required for optional marketing or promotional messages, we will rely on your consent or our legitimate interests, and you can opt out at any time.
Data retention and storage
We keep personal data only for as long as it is reasonably necessary for the purposes described in this Privacy Policy and as required by applicable laws and regulations.
Customer contract data, including identity, contact and contract details, is generally retained for a period after your contract ends. This period allows us to respond to queries, handle any legal claims and meet tax or accounting requirements. CCTV and security data are typically retained for a shorter period, unless an incident or investigation means a longer retention period is necessary. Financial and transaction records are retained in line with statutory requirements for accounting and taxation purposes.
When personal data is no longer required, it is securely deleted, anonymised or destroyed in a way that protects your privacy.
Sharing your personal data and data processors
We do not sell your personal data. We may share your personal data with selected third parties where necessary for the purposes described in this Privacy Policy and where permitted by law.
Third parties that act as data processors on our behalf may include payment processors who handle card payments and direct debits, IT and cloud service providers who host or support our systems and data storage, security and CCTV service providers who supply and maintain security systems, and professional advisers such as accountants or legal advisers where necessary for legitimate business or legal purposes. These processors are only permitted to use your data in accordance with our instructions, must keep it secure, and must comply with data protection law.
We may also share personal data with third parties who act as independent data controllers, for example banks or financial institutions that process your payments in their own right, law enforcement and regulatory bodies where we are required to do so by law, or debt collection agencies and courts when it is necessary to enforce our contractual rights. In such cases, the third party is responsible for how they handle your data and you should refer to their privacy information.
If we were ever to be involved in a business sale, merger or reorganisation, your personal data may be shared with the relevant parties as part of that process, subject to appropriate confidentiality and data protection safeguards.
International transfers
Where our service providers or their systems are located outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place before any personal data is transferred. This may include using countries that have been deemed to provide an adequate level of protection, or using approved standard contractual clauses or equivalent legal mechanisms.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data. These rights apply to all Storage Hanworth customers and other individuals whose data we process, subject to certain legal limitations and exemptions.
Right of access. You have the right to request confirmation that we process your personal data and to obtain a copy of that data, along with certain information about how and why we process it.
Right to rectification. You have the right to ask us to correct inaccurate personal data and to complete any incomplete information we hold about you.
Right to erasure. In certain circumstances, you may ask us to delete your personal data. This right is not absolute and may not apply where we need to retain data for legal or contractual reasons.
Right to restriction of processing. You may request that we restrict the way we process your data, for example while we investigate a concern about its accuracy or our use of it.
Right to data portability. In limited cases where processing is based on consent or on a contract and is carried out by automated means, you may request the transfer of your personal data to you or to another organisation in a structured, commonly used and machine-readable format.
Right to object. You have the right to object to certain types of processing based on our legitimate interests, including any direct marketing activities. We will consider your objection and stop processing unless we have compelling legitimate grounds that override your interests, rights and freedoms, or where the processing is required for legal claims.
Right to withdraw consent. Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
How we protect your personal data
We take appropriate technical and organisational measures to protect your personal data from unauthorised access, accidental loss, destruction or damage. These measures may include access controls, secure storage systems, staff training and regular review of our data protection practices. While we take reasonable steps to safeguard your data, no system can be guaranteed to be completely secure.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or data protection best practice. Any updates will take effect from the date they are published or otherwise communicated. We encourage you to review this Privacy Policy periodically to stay informed about how we process and protect your personal data.
