Storage Tolworth Privacy Policy
This Privacy Policy explains how Storage Tolworth collects, uses, stores and protects personal data relating to customers and prospective customers in the Tolworth area. It also describes your rights under the UK General Data Protection Regulation and the Data Protection Act 2018. This Privacy Policy applies to all Storage Tolworth customers and users of our services in the area, whether you rent a storage unit, make an enquiry, or visit our premises.
Data Controller
Storage Tolworth is the data controller for the personal data described in this Privacy Policy. As data controller, Storage Tolworth determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in accordance with applicable data protection laws.
Personal Data We Collect
We collect and process different types of personal data depending on how you interact with us and which services you use. The categories of personal data we may collect include:
Identification details, such as full name, title, date of birth and proof of identity documents you present to us, for example passport or driving licence details, where required to verify your identity.
Contact details, such as correspondence address, billing address, and any other service address you provide, as well as your preferred communication details so that we can contact you about your booking and our services.
Account and contract details, such as storage unit number, contract start and end dates, products and services you have purchased, payment history, and relevant information about your use of our facilities.
Payment information, such as limited card details or bank details that are processed through secure payment processors, and records of payments you make to us. We do not store full payment card details on our own systems.
Communication records, including emails, letters and other correspondence you send to us, and any notes we make about our interactions with you when you contact us with enquiries or support requests.
Security and access data, such as CCTV footage from cameras on and around our premises, vehicle registration numbers captured when entering our site, and access records from entry systems used to manage and secure our facilities.
Marketing preferences, including whether you have opted in or opted out of receiving marketing communications from us and your communication preferences where you have informed us of them.
How We Obtain Your Personal Data
We primarily obtain personal data directly from you when you contact us, request a quote, make a booking, sign a contract, access our facilities, or communicate with us in any other way. We may also obtain data from third parties where this is necessary and lawful, for example from credit reference agencies when we conduct identity or credit checks, or from payment providers when confirming that a payment has been successful.
Lawful Bases for Processing
We process your personal data using the lawful bases recognised by the UK GDPR. Depending on the specific processing activity, we may rely on one or more of the following lawful bases:
Contract. We process your personal data when it is necessary to enter into a contract with you, to provide our storage services, manage your account, process payments, and handle enquiries or requests related to your contract.
Legal obligation. We process certain information where we are required to do so by law, for example to comply with tax, accounting, anti money laundering, fraud prevention or other regulatory obligations, and to respond to lawful requests from public authorities.
Legitimate interests. We process personal data where it is necessary for our legitimate interests or the legitimate interests of a third party, provided these interests are not overridden by your rights and freedoms. This includes ensuring the security of our premises through CCTV and access systems, managing and improving our services, handling disputes or complaints, and sending limited service related communications.
Consent. In some cases we will ask for your consent before processing your personal data, for example for certain types of marketing communications. When we rely on consent, you are free to withdraw your consent at any time.
How We Use Your Personal Data
We may use the personal data we collect for the following purposes:
To create and manage your customer account, administer your contract, allocate and manage storage units, and provide customer service and support.
To process and record payments, issue invoices and statements, manage any arrears, and address billing queries or disputes.
To secure and monitor access to our premises, including by using CCTV and access control systems, and to protect our property and the property stored by our customers.
To communicate with you regarding your bookings, contract renewals, changes to our terms or policies, and service related information.
To send you marketing communications about our services and promotions where we are permitted to do so by law or where you have given your consent.
To manage our business operations, including internal administration, audits, reporting, and improving our services based on how customers use them.
To exercise or defend legal claims, manage complaints or disputes, and cooperate with law enforcement and regulatory authorities where this is required or permitted.
Data Retention
We keep your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Retention periods may vary depending on the type of data and our legal obligations.
Generally, we retain contract and billing records for a period required by tax and accounting laws after the end of your relationship with us. CCTV footage and access records are kept for a shorter period, which is limited to what is necessary for security and incident investigation purposes, unless they are required for longer due to an ongoing investigation or dispute.
When personal data is no longer required, we will securely delete or anonymise it so that it can no longer be associated with you.
Data Processors and Sharing of Personal Data
We may share your personal data with third parties who provide services to us and act as data processors on our behalf. These processors are only permitted to process your personal data in accordance with our instructions and must implement appropriate security measures. Examples of processors we may use include:
Payment processing providers that handle card and bank transactions.
IT and cloud service providers that host our systems, applications, and data storage.
Security providers responsible for CCTV monitoring and access control systems.
Professional advisers such as accountants and legal advisers who support our business operations.
We may also share personal data with other third parties where necessary and lawful, for example with law enforcement agencies, regulators, courts, or other public authorities when we are required to do so by law, or in order to exercise or defend legal claims.
We do not sell your personal data to third parties.
International Transfers
Where we use service providers that are located outside the United Kingdom or the European Economic Area, or that store data in such locations, we will ensure that appropriate safeguards are in place to protect your personal data. These safeguards may include the use of standard contractual clauses approved by relevant authorities or other legally recognised transfer mechanisms.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to the personal data we hold about you. These rights apply to all Storage Tolworth customers in the area, subject to certain limitations and exemptions. Your rights include:
Right of access. You have the right to request confirmation of whether we process your personal data and, if we do, to receive a copy of that data and certain additional information.
Right to rectification. You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
Right to erasure. You may ask us to delete your personal data in certain circumstances, for example where it is no longer needed for the purposes for which it was collected, or where you withdraw your consent and there is no other legal basis for the processing.
Right to restriction. You have the right to request that we restrict the processing of your personal data in certain situations, for example while we are verifying its accuracy or considering an objection you have raised.
Right to object. You may object to our processing of your personal data where we rely on legitimate interests as our lawful basis. You also have the right to object at any time to the processing of your personal data for direct marketing.
Right to data portability. In some cases, you may request that we provide your personal data in a structured, commonly used and machine readable format, or that we transmit it to another controller where technically feasible.
Right to withdraw consent. Where we rely on your consent to process your personal data, you can withdraw that consent at any time. This will not affect the lawfulness of processing that took place before consent was withdrawn.
You also have the right to lodge a complaint with the relevant supervisory authority if you believe that your personal data has been processed in a way that does not comply with data protection law.
Security of Your Personal Data
We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include access controls, password and authentication policies, secure storage, and staff training on data protection and information security.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or legal requirements. Any changes will be effective when the updated Privacy Policy is made available. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.
