Storage Sidcup Privacy Policy
This Privacy Policy explains how Storage Sidcup collects, uses, stores, and protects personal data relating to customers and prospective customers in the Sidcup area. It is intended to provide clear information in accordance with the UK General Data Protection Regulation and associated data protection laws. By using our services or contacting us, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage Sidcup customers, prospective customers, and account holders within the Sidcup area who use or enquire about our storage units, related services, or facilities. It covers personal data collected through face-to-face interactions, telephone discussions, written correspondence, and any digital channels we may use, as well as information generated in the course of providing our services.
Personal Data We Collect
We may collect and process the following categories of personal data, depending on how you interact with us and which services you use:
Identification and contact details such as full name, residential address, billing address, and other basic contact details.
Account and contract information such as customer reference numbers, storage unit numbers, contract dates, services selected, payment history, and records of your communications and enquiries.
Payment and billing information such as limited payment card details as required for processing charges, bank details where necessary, payment confirmations, and associated invoicing information. Where third party payment processors are used, they may process certain payment details on our behalf.
Security and access data such as CCTV footage at our premises, access control logs, number plate information where applicable, and records of entry and exit to the facility, to help ensure the safety and security of customers, staff, and property.
Technical and usage data where applicable such as information about how you interact with any online tools or customer portals we may provide, including log-in times, actions taken, and error or support logs.
Lawful Bases for Processing Your Data
Storage Sidcup processes personal data only where there is a lawful basis under the UK GDPR. Depending on the situation, we may rely on one or more of the following:
Contract: We process personal data to enter into and perform contracts for storage and related services, including setting up an account, managing your bookings, issuing invoices, and administering your use of our facility.
Legal obligation: We may process and retain certain information to meet legal and regulatory requirements, including tax, accounting, health and safety, or law enforcement requirements, and to cooperate with authorised authorities where legally required.
Legitimate interests: We process personal data for our legitimate business interests, provided that these interests are not overridden by your rights and freedoms. This includes ensuring the security of our site and assets, preventing fraud, managing business operations, improving our services, and handling queries and complaints.
Consent: In limited cases, we may rely on your explicit consent, for example for certain types of optional communications or marketing activities. Where we rely on consent, you are free to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
How We Use Your Personal Data
We use personal data to provide and manage storage services, including processing bookings, setting up contracts, issuing invoices, processing payments, and providing customer support.
We use your data to maintain the security and integrity of our premises, including through CCTV monitoring, access control systems, and incident management or investigation.
We use data to communicate with you about your account, your storage unit, renewals, changes to terms, and other essential service messages.
We may use aggregated or de-identified information to monitor overall occupancy, improve our services, plan for capacity, and manage our business operations.
Where permitted, and where lawful bases such as legitimate interests or consent apply, we may use your contact details to provide information about similar products or services that may be of interest to you. You can object to such communications at any time.
Retention of Your Personal Data
Storage Sidcup retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements.
In general, we keep customer account and contract records for a period after the end of the contractual relationship, to enable us to respond to queries, deal with disputes, and meet legal obligations. The exact retention period may vary depending on the type of information and applicable legal requirements.
CCTV footage and access logs are retained for a limited period necessary for security and investigative purposes, unless a longer retention is required because of an ongoing incident, dispute, or law enforcement request.
Where personal data is no longer needed, we will securely delete, anonymise, or otherwise remove it from our systems and records in a way that respects your privacy.
Data Processors and Third Parties
Storage Sidcup may engage selected third parties to act as data processors and service providers. These processors may provide services such as payment processing, secure data storage, accounting or administrative support, customer management systems, or security and CCTV maintenance.
Where we use processors, they act only on our documented instructions, are subject to appropriate confidentiality obligations, and are required to implement suitable technical and organisational measures to safeguard personal data. They are not permitted to use your personal data for their own purposes.
We may also share personal data where necessary with professional advisers such as auditors or legal professionals, or with law enforcement or regulatory authorities where we are legally required to do so or where it is necessary to protect our rights, property, or the safety of others.
We do not sell personal data. We also do not use your personal data for automated decision-making producing legal or similarly significant effects on you, without human involvement, within the context of our storage services.
Security of Your Personal Data
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include controlled access to systems and premises, secure storage, role-based access rights, staff training, and regular reviews of our data handling practices.
While we take reasonable steps to protect your personal data, no system is completely secure. You are also responsible for safeguarding any credentials or access codes issued to you and for notifying us promptly if you suspect any unauthorised use of your account or access rights.
Your Data Protection Rights
Under the UK GDPR, individuals have several important rights in relation to their personal data. Subject to certain legal conditions and exemptions, you may have the right to:
Access: Request confirmation of whether we hold personal data about you and, if so, obtain a copy of that data along with certain information about how it is processed.
Rectification: Request correction or completion of inaccurate or incomplete personal data that we hold about you.
Erasure: Request deletion of personal data where there is no longer a lawful basis for us to keep it, for example where the data is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for processing.
Restriction: Request that we limit the processing of your personal data in certain circumstances, for example while we are investigating a concern about its accuracy or use.
Objection: Object to processing of your personal data that is based on legitimate interests, including certain types of direct marketing, on grounds relating to your particular situation.
Portability: Where processing is based on your consent or on a contract and is carried out by automated means, request to receive personal data you have provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another controller, where technically feasible.
If you wish to exercise any of your data protection rights, you can contact us using the contact details provided in your contract documentation or on our official communications. We may need to request specific information from you to help us confirm your identity and ensure your rights are respected securely.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. The most current version will apply to our processing of your personal data. We encourage you to review this Privacy Policy periodically to stay informed about how we handle and protect your information.
