Storage Temple Customer Privacy Notice
This Privacy Policy explains how Storage Temple collects, uses, stores and protects personal data of all Storage Temple customers in the area in accordance with the General Data Protection Regulation and applicable local data protection laws. It also explains the rights that individuals have in relation to their personal data and how those rights can be exercised.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage Temple customers in the area, including prospective customers making enquiries, current customers with active contracts and former customers whose data we continue to hold for a limited time for legitimate purposes. It covers personal data collected through our premises, our website, written correspondence and any other communication channel we use to provide our services.
Types of Personal Data We Collect
We may collect and process the following categories of personal data relating to you as a customer or potential customer:
Identification and contact data, such as full name, postal address, billing address, date of birth, and identification document details where required for verification. Contact preferences where you have given them.
Communication data, such as records of enquiries, service requests, complaints and any correspondence you send to us or that we send to you.
Contract and account data, such as contract start and end dates, unit or space details, payment status, billing history, and details of services you have purchased or used.
Payment and transaction data, such as payment method details, transaction records and invoices processed through our payment providers. We do not store full card details when this is managed directly by a payment processor.
Security and access data, such as access logs, entry and exit times, CCTV footage in and around our facilities where cameras are in operation, and records of security incidents.
Technical data, where you use our online services, such as IP address, device data, basic usage data and log information generated when you interact with our online platforms.
Purposes of Processing and Lawful Basis
We only process personal data when we have a clear lawful basis under the GDPR. Depending on the context, we may rely on the following bases:
Contract. We process personal data to enter into and perform contracts with you, including setting up and managing your account, administering storage units or related services, processing payments, communicating about your contract, and dealing with service issues.
Legal obligation. We process personal data where it is necessary to comply with legal and regulatory requirements, including tax, accounting, safety, security, and record keeping obligations, and where we are required to assist law enforcement or regulatory authorities.
Legitimate interests. We process personal data where it is necessary for our legitimate business interests and where your interests and fundamental rights do not override those interests. This includes managing our facilities and security, preventing fraud and misuse, improving our services, handling queries and complaints, and defending or establishing legal claims.
Consent. In certain situations, we rely on your consent, for example for specific types of direct marketing that are not covered by legitimate interests, or for the use of optional cookies or similar technologies where required by law. Where processing is based on consent, you can withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal.
How We Use Personal Data
We use the personal data we collect for the following purposes:
To provide, manage and administer storage and related services you have requested, including customer support and account management.
To manage bookings, payments, invoicing, debt collection and financial administration associated with your use of our services.
To maintain the security of our premises, systems and customers, including the use of controlled access systems, CCTV monitoring where in place, and incident records.
To communicate with you about your account, services, changes to our terms and policies, and important operational information affecting your use of our facilities.
To improve and develop our services, operations and customer experience, including internal analysis and performance monitoring conducted with appropriate safeguards.
To comply with applicable laws, respond to lawful requests from authorities and protect our legal rights and interests.
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected and to meet our legal and regulatory obligations. The exact retention period can vary depending on the type of data and the applicable legal requirements.
Customer account and contract data is generally retained for the duration of your contract and for a period afterwards in line with limitation periods for legal claims and mandatory record keeping requirements for tax and accounting.
Payment and invoicing data is kept for the period required by financial and tax legislation, after which it is securely deleted or anonymised.
CCTV footage and access logs are retained for a shorter period, typically only as long as necessary for security and investigation purposes, unless a longer retention is required in connection with a specific incident or legal claim.
When we no longer need personal data, we will remove it from our systems or anonymise it so that it can no longer be linked to you.
Data Processors and Sharing of Personal Data
We may share personal data with trusted third parties who act as data processors on our behalf. These processors are only allowed to process personal data in accordance with our instructions and are required to implement appropriate security measures. Examples of processors we may use include:
IT and cloud service providers that host our systems, applications and data storage.
Payment service providers that securely process transactions and manage recurring payments.
Service and maintenance providers that support our facilities, access control and security systems.
Professional advisers such as accountants, auditors or legal advisers who assist us in running our business and complying with legal obligations.
Where required by law or where necessary to protect our rights, we may also share personal data with public authorities, regulatory bodies, law enforcement agencies or courts. When we do so, we ensure that the disclosure is limited to what is strictly necessary.
If any transfers of personal data are made to countries outside the European Economic Area or the United Kingdom, they will only occur where appropriate safeguards are in place in accordance with applicable data protection laws.
Security of Personal Data
We take the security of personal data seriously and implement technical and organisational measures designed to protect it against unauthorised access, loss, alteration, disclosure or destruction. These measures include access controls, physical security at our facilities, secure storage of records, and policies and training for staff who handle personal data. While no system can be guaranteed to be completely secure, we regularly review our security controls and take steps to address potential vulnerabilities.
Your Data Protection Rights
Under the GDPR and applicable data protection laws, you have certain rights in relation to your personal data. These rights may be subject to conditions and legal limitations. Your rights include:
Right of access. You have the right to obtain confirmation as to whether we process your personal data and to receive a copy of that data, together with certain information about how and why it is processed.
Right to rectification. You have the right to request correction of inaccurate personal data and completion of incomplete data relating to you.
Right to erasure. In certain circumstances, you have the right to request that we delete your personal data, for example where the data is no longer necessary for the purposes for which it was collected or where you withdraw consent and there is no other legal basis for processing.
Right to restriction. You have the right to request that we restrict the processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing based on legitimate interests.
Right to data portability. Where processing is based on your consent or on a contract and carried out by automated means, you may have the right to receive your personal data in a structured, commonly used and machine readable format and to transmit it to another controller, where technically feasible.
Right to object. You have the right to object to processing of your personal data where it is based on our legitimate interests, including profiling based on those interests. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where processing is required for legal claims. You also have the right to object at any time to direct marketing.
Right to withdraw consent. Where processing is based on your consent, you can withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
You also have the right to lodge a complaint with a data protection authority if you believe that our processing of your personal data infringes data protection law.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or the services we provide. When we make significant changes, we will take appropriate steps to inform you, which may include providing a clear notice on our premises or online. We encourage you to review this Privacy Policy periodically so that you remain informed about how we handle personal data of all Storage Temple customers in the area.
