Storage Northwood Privacy Policy
This Privacy Policy explains how Storage Northwood collects, uses, stores, and protects personal data relating to our customers and prospective customers in our service area. It also explains your rights under applicable data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage Northwood customers and individuals who enquire about, use, or are affected by our storage services in our operating area. By entering into an agreement with us or providing personal data when making an enquiry, you acknowledge that you have read and understood this Privacy Policy.
Who is responsible for your data
Storage Northwood is the controller of the personal data described in this Privacy Policy. This means we decide why and how your personal data is collected and processed, and we are responsible for ensuring that such processing complies with applicable data protection laws.
Types of personal data we collect
We may collect and process the following categories of personal data about you:
Identification and contact details, such as your full name, postal address, billing address, and preferred contact details. Account and contract information, including customer account numbers, unit numbers, rental agreements, move-in and move-out dates, and details of any special instructions or services requested. Payment and billing information, such as payment card details provided at the time of booking or renewal and records of payments made. We do not store full payment card details where this is not necessary for the transaction. Communication records, including copies of correspondence, enquiry details, call notes, and any feedback or complaints submitted to us. Security and access information, such as CCTV footage in and around our premises, access logs for entry systems, and records relating to security incidents. Technical information, such as basic device and browser data captured when you visit our website, and usage data related to online booking forms and account portals, where applicable.
How we collect your personal data
We collect personal data directly from you when you make an enquiry, request a quote, visit our premises, sign a storage agreement, make a payment, or contact us for support. We may also collect data automatically when you visit our website, through basic logs and technical information generated by your browser or device.
In some cases, we may receive personal data from third parties, for example where a booking is made on your behalf by a business partner or where your details are provided as an emergency contact, subject to you being informed of this where required by law.
Lawful bases for processing
We only process your personal data when we have a lawful basis to do so. Depending on the circumstances, we rely on the following lawful bases:
Contract: We process your data when it is necessary to enter into or perform a storage contract with you, such as arranging a unit, managing your account, processing payments, and providing customer service.
Legal obligation: We may process your data where required to comply with legal obligations, such as tax and accounting requirements, fraud prevention, and responding to lawful requests from authorities.
Legitimate interests: We may process your data where it is necessary for our legitimate business interests, provided these are not overridden by your rights and freedoms. This includes maintaining the security of our premises, improving our services, managing business operations, and keeping appropriate business records.
Consent: In limited cases, we may rely on your consent, for example for certain types of optional marketing communications, where required by law. Where processing is based on consent, you have the right to withdraw that consent at any time.
How we use your personal data
We use your personal data for the following purposes:
To provide storage services and manage your account, including processing bookings, handling check-in and check-out, managing access to units, and issuing invoices. To communicate with you about your bookings, payments, changes to our terms, and important information regarding your storage unit or our premises. To maintain security and safety on site, including monitoring access, using CCTV to help prevent and detect crime, and managing incidents or disputes. To manage our business operations, including reporting, audit, accounting, and governance activities. To comply with legal and regulatory requirements, such as record keeping and responding to requests from law enforcement or other authorities. To send you information about our services that may be of interest to you, where permitted by law and subject to your choices regarding marketing communications.
Data processors and third-party recipients
We may share your personal data with trusted third parties that process data on our behalf. These service providers act as data processors and are only permitted to use your data in accordance with our instructions and applicable law. They must implement appropriate security measures to protect your data.
Examples of such processors include payment processing providers, IT and hosting providers, security and CCTV system providers, document storage or shredding companies, and professional advisers such as accountants or auditors acting under a duty of confidentiality.
We may also share your data with other third parties where we act as joint controllers or independent controllers, for example with law enforcement agencies, regulators, or insurers where this is necessary to comply with legal obligations, protect our rights, or defend legal claims.
International transfers
Where any of our processors or service providers are located outside the United Kingdom or European Economic Area, we will ensure that appropriate safeguards are in place before any personal data is transferred. These may include standard contractual clauses or other approved mechanisms designed to ensure a level of data protection essentially equivalent to that in the UK.
Retention of personal data
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required to meet legal, accounting, or reporting obligations. In determining appropriate retention periods, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, and whether we can achieve our purposes through other means.
In general, account and contract records are retained for a number of years after your relationship with us ends, to comply with legal and tax requirements and to manage any potential disputes. CCTV footage is usually kept for a shorter period, unless it is required for investigation of an incident, in which case it may be retained for longer. Where data is no longer required, it will be securely deleted, anonymised, or destroyed.
Your data protection rights
Under data protection law, you have certain rights in relation to your personal data. These rights are subject to legal conditions and exemptions, and we may need to verify your identity before responding to certain requests.
Right of access: You can request confirmation of whether we process your personal data and obtain a copy of that data, along with information about how it is used.
Right to rectification: You can ask us to correct or complete any inaccurate or incomplete personal data we hold about you.
Right to erasure: In certain circumstances, you can request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected and we have no legal obligation to retain it.
Right to restriction: You can ask us to restrict the processing of your data in specific circumstances, such as while we are verifying its accuracy or assessing an objection you have raised.
Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format, or that we transmit it to another controller where technically feasible.
Right to object: You can object to processing based on our legitimate interests, including profiling, and we will stop processing unless we have compelling legitimate grounds which override your interests or the processing is needed for legal claims. You always have the right to object to direct marketing.
Right to withdraw consent: Where we rely on your consent for processing, you may withdraw this at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.
How to exercise your rights or raise concerns
If you wish to exercise any of your data protection rights, or if you have questions or concerns about how we handle your personal data, you can contact us using the contact details provided on our main customer documentation or by visiting our premises. You also have the right to lodge a complaint with the relevant supervisory authority if you believe that your rights have been infringed.
Security of your personal data
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. While no system can be completely secure, we work to ensure that only authorised personnel and trusted processors have access to your data and that they are subject to confidentiality obligations.
Updates to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. The most current version will always be available from us, and where changes are material, we will take reasonable steps to inform you through appropriate channels. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
