Self Storage Crystal Palace Privacy Policy
This Privacy Policy explains how Self Storage Crystal Palace collects, uses, stores, and protects personal data relating to our customers and prospective customers. It applies to all Self Storage Crystal Palace customers and enquirers in the local area, including those who contact us, visit our premises, or use our storage services.
We are committed to protecting your privacy and handling your personal data in a lawful, fair, and transparent way in accordance with the UK General Data Protection Regulation and applicable data protection laws.
Scope of this Privacy Policy
This Privacy Policy applies to personal data processed in connection with the provision of self storage services by Self Storage Crystal Palace. It covers information we collect when you make an enquiry, request a quote, sign a storage agreement, access our facilities, or otherwise interact with us offline or online.
Types of personal data we collect
We may collect and process the following categories of personal data:
Identification data: name, title, date of birth, proof of identity details contained in documents you present to us such as passport or driving licence.
Contact details: home address, correspondence address, billing address, and, where provided, email address and other contact details.
Account and contract information: storage unit number, contract start and end dates, services selected, payment status, correspondence regarding your contract, and any additional services requested.
Payment and billing data: payment method details to the extent necessary to process payments, billing history, invoices, and records of transactions. Where payments are handled by a payment processor, card details are processed by that provider and not stored by us beyond what is legally and operationally necessary.
Security and access information: CCTV footage in and around our premises, access logs, gate entry records, and other security system data relating to your use of the facility.
Communication records: details of enquiries, complaints, feedback, and other communications with us, including notes of telephone conversations and in-person discussions.
Marketing preferences: your preferences in receiving marketing communications from us and your communication choices.
How we collect your personal data
We collect personal data directly from you when you:
request information or a quote;
enter into a storage agreement;
make a payment or update billing details;
visit our premises and use our access systems;
communicate with us by phone, in writing, or in person.
We may also collect limited personal data from third parties, such as payment processors, referencing agencies, or law enforcement authorities, where this is lawful and necessary for our services or to comply with legal obligations.
Lawful bases for processing your personal data
We process your personal data only where we have a lawful basis under data protection laws. The primary lawful bases we rely on are:
Performance of a contract: We process personal data to provide our storage services, manage your account, administer payments, and fulfil our contractual obligations to you.
Compliance with legal obligations: We process personal data to comply with our legal duties, including tax and accounting requirements, anti-fraud and crime prevention measures, and obligations to cooperate with law enforcement or regulatory authorities.
Legitimate interests: We process personal data where it is necessary for our legitimate interests, or the legitimate interests of a third party, and where these are not overridden by your rights and interests. This includes ensuring the security of our premises and customers, managing and improving our services, handling customer queries, maintaining business records, and protecting our business from fraud or misuse.
Consent: In specific cases, and where required by law, we may rely on your consent, for example for certain forms of direct marketing. Where we rely on consent, you have the right to withdraw it at any time.
Purposes for which we use your personal data
We use your personal data for the following purposes:
to provide, manage, and administer storage services you have requested;
to verify your identity and suitability for our services, where necessary;
to communicate with you about your enquiries, bookings, contracts, invoices, and any changes to our terms or policies;
to process payments, manage accounts, and recover any sums owed;
to ensure the safety and security of our premises, units, customers, and staff, including the use of CCTV and access control systems;
to maintain accurate business and financial records;
to respond to complaints, disputes, or legal claims;
to send you service-related information and, where permitted, marketing communications about our services and offers, which you can opt out of at any time;
to comply with applicable laws, regulations, and requests from public authorities.
Data retention and storage
We keep personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, including satisfying any legal, accounting, or reporting requirements.
In general, we retain:
contract and account data for the duration of your agreement and for a period after your contract ends, to deal with any queries, disputes, or legal obligations;
financial and transaction records for the period required by tax, accounting, and financial regulations;
CCTV and access control data for a limited period necessary for security and investigation purposes, unless a longer retention is required in connection with an incident or legal claim.
When personal data is no longer required, we will securely delete or anonymise it in accordance with our data retention procedures and applicable law.
Data processors and third parties
We may share your personal data with carefully selected third parties who act as data processors on our behalf. These include:
IT and systems providers that help us operate our storage management, access control, and security systems;
payment processing providers that handle card payments and other financial transactions;
professional advisers, such as accountants or legal advisers, where necessary for our legitimate interests or to meet legal obligations;
security and maintenance contractors who may have controlled access to systems or premises where personal data is processed.
These processors are only permitted to process your personal data in accordance with our instructions and for the purposes we specify. They are required to implement appropriate technical and organisational measures to protect your personal data.
We may also share personal data where required by law, for example with law enforcement agencies, regulatory bodies, or courts, or where this is necessary to establish, exercise, or defend legal claims.
International transfers
Where personal data is transferred outside the United Kingdom or the European Economic Area by our processors, we will take steps to ensure that appropriate safeguards are in place to protect your personal data in accordance with data protection law. This may include the use of standard contractual clauses or reliance on other recognised transfer mechanisms.
Security of your personal data
We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include physical security at our premises, controlled access to systems, and internal policies and training designed to maintain data security and confidentiality.
Your data protection rights
Under data protection laws, you have a number of rights in relation to your personal data. These include:
Right of access: You can request confirmation of whether we process your personal data and obtain a copy of that data, together with certain information about how it is processed.
Right to rectification: You can request that inaccurate or incomplete personal data about you is corrected or updated.
Right to erasure: In certain circumstances, you can request that we delete your personal data. This right is not absolute and may be subject to legal or contractual restrictions.
Right to restriction of processing: You can request that we restrict the processing of your personal data in specific situations, for example while we verify its accuracy or consider an objection.
Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request to receive your personal data in a structured, commonly used, and machine-readable format and have it transmitted to another controller where technically feasible.
Right to object: You can object at any time to processing of your personal data based on our legitimate interests, including profiling, and we will stop processing unless we have compelling legitimate grounds. You can also object at any time to the use of your personal data for direct marketing, in which case we will stop such marketing.
Right to withdraw consent: Where we rely on your consent to process personal data, you can withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before consent was withdrawn.
You also have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been infringed.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. Any changes will be made available through our usual communication channels or at our premises. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
