Storage Pentonville Privacy Policy
This Privacy Policy explains how Storage Pentonville collects, uses, stores and protects personal data relating to customers and prospective customers. It applies to all Storage Pentonville customers and users of our services in the surrounding area, whether you contact us online, by post, or in person at our premises.
We are committed to processing your personal data in a lawful, fair and transparent way in accordance with the UK General Data Protection Regulation and all applicable data protection laws.
Personal Data We Collect
We collect and process different categories of personal data depending on how you interact with us and the services you use. This may include:
Identification data such as full name, title, date of birth, and a copy or details of an identification document where required for security and contractual purposes.
Contact details such as correspondence address, billing address, and details required to communicate with you.
Account and contract data such as unit number, contract start and end dates, payment status, invoices, correspondence relating to your agreement with us, and records of any changes to your contract.
Payment and transaction data such as payment method, account or card details provided to our payment processors, payment history, and details of charges, refunds or arrears. We do not retain full card details once processed, and we use secure third-party payment processors for card transactions.
Access and security data such as access codes, fob or key records, logs of entry to and exit from the facility where the system records such events, and information relating to any incidents or security investigations.
Communication data such as records of your enquiries, complaints, feedback, call notes, or messages that you send to us in relation to our services.
Technical and usage data such as basic information about how you use our website or online portals, including date and time of access, pages visited and general interaction patterns, collected using essential cookies or similar technologies where applicable.
Purposes and Lawful Bases for Processing
We process your personal data only when we have a lawful basis to do so. Depending on the context, we rely on one or more of the following legal grounds:
Contract performance. We process your identification, contact, access, payment and account data to provide storage services, manage your bookings, administer your contract, collect payments, handle arrears, arrange access to units and respond to your service-related enquiries.
Legal obligations. We may process your data to comply with legal and regulatory requirements, including record keeping obligations, tax and accounting rules, anti-fraud and crime prevention laws, and obligations to cooperate with law enforcement or regulatory authorities where we are legally required to do so.
Legitimate interests. We may process your data where it is necessary for our legitimate business interests and where these interests are not overridden by your rights and freedoms. These interests may include ensuring the security of our premises and customers, improving our services and customer experience, managing business operations, defending legal claims, and maintaining appropriate records of our dealings with customers.
Consent. In limited circumstances, we may rely on your consent, for example, where we wish to send you certain types of marketing communications that are not based on our legitimate interests, or where we use non-essential cookies or similar technologies that require consent. Where processing is based on consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting or reporting requirements. The specific retention period will depend on the nature of the data and the context of collection.
In general, we keep customer account and contract information for a period after the end of the contractual relationship so that we can address any queries or disputes, comply with statutory retention periods, and demonstrate proper record keeping. Financial records are kept for the period required under tax and accounting laws.
Access and security logs may be retained for a shorter period, sufficient to investigate incidents and ensure the safe operation of our facility, unless they form part of an investigation or legal claim, in which case they may be kept until the matter is resolved.
When personal data is no longer required, we will take steps to delete it securely or anonymise it so that it is no longer capable of identifying you.
Data Processors and Third Parties
We may share your personal data with selected third parties who act as our data processors. These processors provide services that support our operations, such as payment processing, customer management systems, invoicing tools, cloud storage, facility management software and IT support.
Where we use processors, they are only permitted to process your personal data on our documented instructions, for the specific purposes we determine, and subject to appropriate confidentiality and security obligations. They are not allowed to use your data for their own independent purposes.
We may also share data with other third parties acting as independent controllers where required by law or where necessary for our legitimate interests, such as professional advisers, insurers, auditors, law enforcement agencies, courts or regulatory authorities. Any such disclosures will be limited to what is necessary in the circumstances and carried out in accordance with data protection law.
Where personal data is transferred outside the UK or European Economic Area, we will ensure that appropriate safeguards are in place, such as adequacy decisions, contractual protections or other lawful transfer mechanisms, to ensure that your data is afforded a level of protection essentially equivalent to that in the UK.
Security of Your Personal Data
We take appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures may include access controls, secure storage systems, encryption or pseudonymisation where appropriate, regular security reviews, staff training, and procedures to deal with suspected data breaches.
While we take reasonable steps to secure your data, no system can be completely secure. If we identify a personal data breach that is likely to result in a risk to your rights and freedoms, we will act in line with our legal obligations, which may include notifying you and the relevant supervisory authority.
Your Data Protection Rights
Under data protection law, you have several rights in relation to the personal data we hold about you. These rights may be subject to conditions, limitations or exemptions under applicable law, but we will always consider your request and explain the outcome.
Right of access. You can request confirmation of whether we process your personal data and obtain a copy of that data, together with certain information about how it is used.
Right to rectification. You can ask us to correct or complete personal data that is inaccurate or incomplete.
Right to erasure. You can request that we delete your personal data in certain circumstances, for example where it is no longer needed for the purposes for which it was collected, or where you withdraw consent and there is no other lawful basis for processing.
Right to restriction. You can ask us to restrict the processing of your personal data in specific situations, such as where you contest its accuracy or object to our processing and we are considering your request.
Right to data portability. In certain circumstances, you can request that we provide you with the personal data you have given to us in a structured, commonly used, machine-readable format, or that we transmit it to another controller, where this is technically feasible.
Right to object. You can object to processing based on our legitimate interests, including profiling, and we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where processing is needed for legal claims. You also have an absolute right to object to direct marketing at any time.
Rights in relation to automated decision making. If we ever use solely automated decision making that produces legal effects or similarly significant effects for you, we will inform you and explain your rights in relation to such processing.
Exercising Your Rights and Complaints
If you wish to exercise any of your data protection rights or have questions about how we handle your personal data, you can contact us using the usual contact details for Storage Pentonville. We may need to verify your identity before acting on your request to protect your data from unauthorised access.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you are concerned about the way we process your personal data. We would, however, appreciate the opportunity to address your concerns directly in the first instance.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations or the services we provide. Any changes will apply from the date we publish the updated version. We encourage you to review this Privacy Policy periodically to stay informed about how we process your personal data.
