Storage Locksbottom Customer Privacy Policy
This Privacy Policy explains how Storage Locksbottom collects, uses, stores and protects personal data relating to all Storage Locksbottom customers in our service area. It also explains the lawful bases we rely on under the UK General Data Protection Regulation and your rights in relation to that personal data.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage Locksbottom customers and prospective customers within our operating area, including individuals acting on behalf of a business customer. It covers personal data collected when you enquire about our services, enter into a storage agreement, access our facilities, make payments, or otherwise interact with us, whether in person, by post, by phone or online.
Personal Data We Collect
We may collect and process the following categories of personal data, depending on how you use our services:
Identification data, such as full name, title, date of birth and proof of identity documents where required for security and fraud prevention.
Contact details, such as home or business address, billing address, and any email or other contact information you choose to share with us to manage your account and provide services.
Account and contract data, such as storage unit number, key or access code details, contract start and end dates, services requested, communications with us and records of consents.
Payment and transaction data, such as payment method, payment status, invoices, transaction history and related records necessary for accounting and tax purposes. We do not store full card details if card payments are processed by a payment service provider.
Security and access data, such as access logs, entry and exit records, CCTV footage from our facilities, incident reports and information needed to manage security and safety.
Preference and communication data, such as your marketing preferences, records of enquiries, complaints and feedback, and information about how you prefer us to contact you.
How We Collect Personal Data
We obtain personal data directly from you when you request a quotation, sign a storage agreement, contact us with an enquiry, visit our premises or otherwise communicate with us. We may also collect data indirectly, for example through security systems at our facilities such as access control systems and CCTV. In some circumstances we may receive information from third parties, such as payment service providers, business partners or publicly available sources, where this is necessary to administer your contract or meet legal obligations.
Lawful Bases for Processing
We process your personal data only where we have a lawful basis under data protection law. Depending on the specific activity, the lawful basis may be:
Contract. We process personal data to take steps at your request before entering into a contract and to perform our storage agreement with you. This includes processing necessary to set up your account, manage your storage unit, take payments and provide customer service.
Legal obligation. We process personal data where this is required to comply with legal and regulatory obligations, including tax and accounting rules, security and safety requirements, and obligations to law enforcement or regulatory bodies where applicable.
Legitimate interests. We may process personal data where it is necessary for our legitimate interests and these are not overridden by your rights and interests. This includes ensuring the security of our premises, preventing fraud, managing and improving our services, and defending legal claims.
Consent. In limited cases, we may rely on your consent, for example for certain optional marketing communications. Where we rely on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
How We Use Personal Data
We use personal data for the following purposes:
To provide storage services to you, including creating and managing your customer account, administering your contract, managing access to your storage unit and communicating with you about your agreement and any changes to our services.
To process payments and manage billing, including issuing invoices, recording payments, dealing with arrears and maintaining accounting records.
To maintain safety and security at our facilities, including monitoring access, operating CCTV systems, preventing and investigating incidents, and managing health and safety obligations.
To respond to enquiries, complaints and requests, and to provide general customer support before, during and after your contract.
To manage our business operations, including service quality monitoring, staff training, performance measurement and planning for future services.
To meet legal, regulatory and compliance requirements, including responding to lawful requests from authorities and managing legal claims or disputes.
To send you information about services that may be relevant to you, where you have given your consent or where we are otherwise permitted by law to do so. You can opt out of marketing at any time.
Data Retention
We keep personal data only for as long as necessary for the purposes for which it was collected, and to meet any legal, accounting or reporting requirements. The exact retention period depends on the type of data and the context in which it is processed.
In general, we retain core account and contract records for a period after your storage agreement ends, to deal with any queries or disputes and to satisfy legal and tax obligations. Security and access data, including CCTV recordings and access logs, are retained for shorter periods unless an incident requires us to keep them for longer. When personal data is no longer required, we securely delete or anonymise it.
Data Sharing and Processors
We may share personal data with carefully selected third parties who help us operate our business and deliver services. These third parties act as data processors and process personal data on our instructions and on our behalf.
Categories of processors may include providers of data storage and hosting services, payment processing services, customer management systems, security and access control services, and professional advisers such as accountants or legal advisers. We require all processors to implement appropriate technical and organisational measures to protect your personal data and to process it only as necessary to provide their services to us.
We may also share personal data with other third parties in limited circumstances, for example with law enforcement or regulatory authorities where required by law, or with professional advisers and insurers in connection with legal claims or business restructuring. In such cases, those third parties act as separate controllers and are responsible for their own compliance with data protection laws.
We do not sell your personal data.
International Transfers
If we transfer personal data outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place to protect your data, in accordance with data protection laws. These safeguards may include the use of standard contractual clauses or other mechanisms recognised by relevant authorities.
Security of Your Data
We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include secure access controls, staff training, physical security at our locations, and regular review of our security procedures. While we take reasonable steps to protect your personal data, no system can be guaranteed to be completely secure.
Your Data Protection Rights
Under data protection laws, you have a number of rights in relation to your personal data, subject to certain conditions and exemptions.
Right of access. You can request confirmation of whether we process your personal data and obtain a copy of that data, together with information about how it is processed.
Right to rectification. You can ask us to correct or complete personal data that is inaccurate or incomplete.
Right to erasure. In certain circumstances, you can request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected or where you withdraw consent and there is no other lawful basis for processing.
Right to restriction. You can ask us to restrict the processing of your personal data in certain situations, for example while we verify the accuracy of data that you contest.
Right to data portability. In certain circumstances, you can request that we provide your personal data in a structured, commonly used and machine readable format, or that we transmit it to another controller where technically feasible.
Right to object. You have the right to object to processing based on our legitimate interests, including profiling related to those interests. You also have an absolute right to object to direct marketing.
Rights in relation to automated decision making. You have rights in relation to decisions based solely on automated processing, including profiling, where they have legal or similarly significant effects for you.
If you wish to exercise any of these rights, we may need to verify your identity before responding. We aim to reply within the time limits set by law.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, our data processing practices or applicable laws. Any changes will be made available to customers, and the updated version will apply from the date it is issued. We encourage you to review this Policy periodically so that you remain informed about how we handle personal data.
