Storage Elmstead Privacy Policy
This Privacy Policy explains how Storage Elmstead collects, uses, stores and protects personal data about customers and prospective customers in our service area. It also explains your rights under the UK General Data Protection Regulation, the EU General Data Protection Regulation where applicable, and related data protection laws.
This Privacy Policy applies to all Storage Elmstead customers and anyone who makes an enquiry about our storage services in the area that we operate. By using our services or contacting us, you acknowledge that you have read and understood this Policy.
Who we are and scope of this Policy
Storage Elmstead is a storage service provider offering units and related services to residential and business customers. For the purposes of data protection law, Storage Elmstead is the data controller of the personal data described in this Policy. This means we decide how and why your personal data is used and are responsible for ensuring it is handled lawfully.
This Policy covers personal data we collect directly from you, data generated in the course of providing our services, and data obtained from third parties in limited circumstances.
Personal data we collect
We may collect and process the following categories of personal data when you contact us, enter into a storage agreement, or use our services:
Identification and contact details, such as your full name, postal address, billing address, contact address, and details necessary to identify you as a customer.
Account and contract information, such as customer reference numbers, storage unit details, start and end dates of contracts, and related correspondence with you.
Payment and billing information, such as payment method details and records of payments made or due. We do not store full card details where a payment processor is used; this information is handled by our payment processing providers.
Communication data, such as records of emails, letters or other communications you send to us or that we send to you, including enquiries and complaints.
Security and access information, such as records of visits to the facility, access codes or key allocation details, and any incident reports where they relate to you.
Technical data, such as limited device and usage information where you interact with our online content, for example basic log information and cookie data where required for site functionality and security.
In some circumstances, we may also collect information required to meet legal and regulatory obligations, including information used to verify your identity and to prevent fraud.
How we use your personal data and lawful bases
We only use your personal data when we have a lawful basis under data protection law. Depending on the context, we rely on one or more of the following lawful bases:
Performance of a contract. We use your data to provide and manage storage services you have requested, including setting up and administering your storage agreement, taking payments, managing access to units, and communicating with you about your contract.
Compliance with legal obligations. We process personal data where necessary to comply with legal and regulatory requirements, including tax and accounting obligations, record keeping duties, and obligations relating to security and crime prevention.
Legitimate interests. We process data where it is necessary for our legitimate business interests and where these are not overridden by your rights and interests. These interests include managing and improving our services, ensuring safety and security of our premises, handling queries and complaints, recovering debts, and conducting limited direct marketing to existing or recent customers about similar services.
Consent. In cases where we are required to obtain your consent, such as for certain types of direct marketing or non-essential cookies, we will only process your data after you have given clear consent. You can withdraw your consent at any time.
Data retention and storage
We keep personal data only for as long as necessary to fulfil the purposes for which we collected it, including to satisfy legal, accounting or reporting requirements.
In general, we follow these guidelines:
Customer and contract records are usually retained for a period after your contract ends to enable us to respond to queries, manage potential disputes, and comply with legal and tax obligations.
Payment and financial records are kept for the periods required by tax and financial regulations.
Communications and enquiry records are retained for a period that allows us to respond effectively to your query and maintain a clear history of our interactions.
Security-related incident data is retained for as long as necessary to investigate and resolve incidents and meet our legal obligations.
When personal data is no longer required for any lawful purpose, we will securely delete, anonymise or destroy it in line with our retention procedures.
Processors and sharing of personal data
We do not sell your personal data. We may share your personal data with third parties where it is necessary for the purposes described in this Policy, where required by law, or where you have provided your consent.
Service providers acting as data processors may process personal data on our behalf in accordance with our instructions and data protection law. These may include:
Payment processing providers, who handle secure processing of card or electronic payments.
IT and systems providers, who support our customer management systems, email services, and security systems.
Professional advisers, including accountants and legal advisers, who may need access to certain data in order to provide us with professional services.
We ensure that any data processors we use provide sufficient guarantees to implement appropriate technical and organisational measures so that processing meets legal requirements and protects your rights.
We may also share personal data with public authorities, law enforcement or regulators where required by law or where necessary to protect our rights, your safety or the safety of others.
International transfers
Where we or our processors transfer personal data outside the United Kingdom or European Economic Area, we will ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or other suitable protection mechanisms recognised under data protection law.
Security of your personal data
We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Measures may include access controls, secure storage, encryption or pseudonymisation where appropriate, regular review of our systems and procedures, and staff training on data protection responsibilities.
While we take reasonable steps to protect your information, no system can be guaranteed as completely secure. We therefore cannot promise absolute security of your data but are committed to acting promptly if we become aware of any breach that affects your personal data.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data. These rights apply in most circumstances and may be subject to certain conditions or exemptions.
Right of access. You have the right to request confirmation that we process your personal data and to obtain a copy of that data, together with information about how and why we use it.
Right to rectification. You have the right to request that we correct any inaccurate or incomplete personal data that we hold about you.
Right to erasure. In certain circumstances, you have the right to request that we delete your personal data. This right is not absolute and may be limited where we need to retain data to comply with legal obligations or to establish, exercise or defend legal claims.
Right to restriction of processing. You may request that we restrict the processing of your personal data in certain situations, for example while we verify the accuracy of the data or consider an objection you have raised.
Right to data portability. Where processing is based on your consent or on a contract and carried out by automated means, you may request a copy of your personal data in a commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
Right to object. You have the right to object at any time to our processing of your personal data where we rely on legitimate interests, including profiling. We will stop processing unless we have compelling legitimate grounds which override your interests and rights or where processing is required for legal claims. You also have an absolute right to object to direct marketing at any time.
Rights in relation to automated decision-making. If we were to make decisions about you based solely on automated processing that have legal or similarly significant effects, you would have rights to obtain human intervention and to express your point of view. We will inform you if we carry out such processing.
To exercise any of these rights, please contact us using the contact details provided on our main website or customer documentation. We may need to verify your identity before responding to your request.
Cookies and similar technologies
Where we use cookies or similar technologies on our online services, we only use those that are strictly necessary for the functioning and security of the site without your consent. For other categories of cookies, such as analytics or marketing cookies, we will seek your consent where required by law and provide further information at the point of use.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or how we handle personal data. Any changes will be posted in the latest version of this Policy. We encourage you to review this Policy periodically so that you remain informed about how we protect your information.
By continuing to use our services or to contact us after changes to this Policy take effect, you acknowledge the updated terms.
