Storage Hillingdon Privacy Policy
This Privacy Policy explains how Storage Hillingdon collects, uses, stores, and protects your personal data when you use our storage services. It applies to all Storage Hillingdon customers and prospective customers within the Hillingdon area, including individuals, sole traders, partnerships, and corporate clients who interact with us, visit our premises, or use our services.
We are committed to safeguarding your privacy and handling your personal data in a lawful, fair, and transparent way, in accordance with applicable data protection laws, including the UK General Data Protection Regulation and the Data Protection Act 2018.
Personal data we collect
We collect and process different categories of personal data depending on how you interact with us and the services you use. This may include:
Identity and contact details such as name, postal address, billing address, date of birth, and any identification documents you provide for verification or security checks.
Contact preferences and communication history such as your preferred contact method, records of communications between you and Storage Hillingdon, and notes relating to your enquiries or service use.
Contract and account information such as storage unit number, start and end dates of your storage agreement, payment status, and information about the goods you store where this is required for contractual or insurance purposes.
Payment and billing information such as payment method details, transaction records, billing history, and any invoices or credit notes issued in connection with your storage services. We do not store full card details where payments are processed via secure third party payment providers.
Security and access data such as access control records, entry and exit logs, CCTV images, vehicle registration numbers where recorded, and records of incidents or security checks on site.
Technical and usage information when you visit our website, such as IP address, browser type, device identifiers, and information about how you navigate and interact with our online content, where this is collected by cookies or similar technologies.
Purposes and lawful bases for processing
We only process your personal data where we have a lawful basis to do so. The primary purposes and corresponding lawful bases include:
To provide storage services and manage our relationship with you. This includes setting up your account, managing your storage unit, processing payments, handling enquiries, and providing customer support. The lawful basis is that processing is necessary for the performance of a contract or to take steps at your request before entering into a contract.
To comply with legal and regulatory obligations. We may need to retain certain records, verify your identity, assist law enforcement, or meet tax and accounting requirements. The lawful basis is compliance with a legal obligation.
To maintain safety and security at our premises. We use CCTV, access logs, and incident records to help protect customers, staff, property, and goods stored at our facilities. The lawful basis is our legitimate interests in maintaining a safe and secure environment, balanced against your rights.
To manage our business operations. This includes internal reporting, quality assurance, staff training, planning and forecasting, and the management of financial risk. The lawful basis is our legitimate interests in operating and improving our business.
To communicate marketing information. With your consent where required by law, we may send you information about services, offers, and updates that may be relevant to you. You can withdraw consent or opt out of marketing at any time. The lawful basis is consent or, in some cases, our legitimate interests in promoting our services, where this is permitted and you have a clear opportunity to object.
To handle complaints, queries, or legal claims. We may need to process your data to investigate and respond to complaints or to establish, exercise, or defend legal claims. The lawful basis is our legitimate interests in protecting our legal rights and resolving disputes.
Data retention
We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements.
In general, customer account and contract data is retained for a period after the end of your storage agreement, to enable us to respond to queries, handle potential disputes, and comply with record keeping obligations. Financial records are usually retained for statutory periods required for tax and accounting laws.
CCTV recordings and access logs are kept for a limited period, which is usually short, unless they are required for the investigation of an incident, to support a claim, or to comply with legal obligations. Where data is retained longer due to an ongoing matter, it will be securely deleted or anonymised once it is no longer required.
When personal data is no longer needed, we will delete it securely or anonymise it so that it can no longer be associated with you.
Data processors and third parties
We may use carefully selected third party service providers who act as data processors and process personal data on our behalf. These processors are only permitted to process your data in accordance with our instructions and for the purposes we specify. They must also implement appropriate security measures to protect your data.
Examples of such processors include providers of payment processing services, customer relationship management systems, cloud storage or data hosting, IT support and maintenance, and providers of CCTV or access control systems.
We may also share personal data with other third parties where we are legally required or permitted to do so, such as law enforcement agencies, regulatory bodies, professional advisers, or insurers, but only to the extent necessary for the relevant purpose.
Where personal data is transferred outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place to protect your data in accordance with data protection laws, such as standard contractual clauses or equivalent measures.
Security of your personal data
We take the security of your personal data seriously. We have implemented appropriate technical and organisational measures designed to protect your information from unauthorised access, accidental loss, alteration, or disclosure.
These measures may include controlled access to premises, use of passwords and access controls for systems, encryption or pseudonymisation where appropriate, regular review of security procedures, and staff training in data protection and information security.
While we take reasonable steps to protect your data, no system can be guaranteed as completely secure. We continually review and enhance our security controls in line with industry practices and legal requirements.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data. These rights apply in most circumstances, subject to certain conditions and exemptions. Your rights include:
The right of access. You can request confirmation of whether we process your personal data and request a copy of the information we hold about you, along with certain details about how it is used.
The right to rectification. You can ask us to correct or complete personal data that is inaccurate or incomplete.
The right to erasure. In certain circumstances you can request that we delete your personal data. This is sometimes referred to as the right to be forgotten. We may not be able to delete data where we have a legal obligation or compelling legitimate grounds to retain it.
The right to restrict processing. You can ask us to suspend the processing of your personal data in certain situations, for example while we verify its accuracy or consider an objection.
The right to data portability. In some cases, you can request that we provide your personal data in a structured, commonly used and machine readable format and that we transfer it to another controller where this is technically feasible.
The right to object. You can object to our processing of your personal data where we are relying on legitimate interests, including profiling, or where we are using your data for direct marketing. We will stop processing your data unless we can demonstrate compelling legitimate grounds or the processing is for legal claims.
The right to withdraw consent. Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
You also have the right to lodge a complaint with the relevant supervisory authority if you believe your data protection rights have been infringed. We encourage you to contact us first so we can address your concerns directly.
Changes to this Privacy Policy
We may update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. Any updates will take effect when the revised policy is made available. We recommend that you review this Privacy Policy periodically to stay informed about how we protect your personal data.
