Storage Crayford GDPR Privacy Policy
This Privacy Policy explains how Storage Crayford collects, uses, stores and protects personal data relating to customers and prospective customers in our service area. It is designed to comply with the UK General Data Protection Regulation and the Data Protection Act 2018. This policy applies to all Storage Crayford customers and any individuals who make enquiries or otherwise interact with our services in the area we serve.
Data Controller
Storage Crayford is the data controller for the personal data described in this Privacy Policy. As data controller, Storage Crayford determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection laws.
Personal Data We Collect
We collect and process different categories of personal data depending on your relationship with us, including:
Identification and contact details such as full name, postal address, billing address, contact address, and any other address you provide for correspondence. We also collect information such as job title or company name where a storage unit is used for business purposes.
Account and contract information such as customer account numbers, contract start and end dates, unit numbers, access permissions, payment terms, and communication preferences.
Payment and transaction information such as amounts paid, payment method type and billing history. We do not store full card details; where card payments are taken, these are handled securely by our chosen payment processors.
Security and access information such as CCTV footage within and around our premises, access control logs, visit dates and times, vehicle registration numbers where recorded for security purposes, and records of keys, fobs, or codes issued.
Communication records such as enquiries, service requests, complaints, and any other correspondence relating to your use of our services or your interest in our services.
Website and usage information such as basic technical data sent by your browser when you visit our website, including IP address, device information and pages visited, to the extent this is necessary for security, analytics and service improvement.
How We Collect Personal Data
We collect personal data directly from you when you contact us, request a quote, sign a storage agreement, make a payment, visit our premises or communicate with us in any way. We may also receive personal data from third parties such as payment service providers, business partners or comparison sites where you have given them permission to share this information with us.
Lawful Bases for Processing
Storage Crayford processes personal data only where we have a lawful basis under the UK GDPR. Depending on the situation, we rely on the following lawful bases:
Performance of a contract: We process your personal data to take steps at your request before entering into a contract and to perform our contract with you. This includes creating and managing your account, providing storage services, handling payments, and communicating with you about your contract.
Legal obligation: We process personal data where necessary to comply with legal and regulatory obligations, such as tax, accounting, health and safety, and crime prevention laws.
Legitimate interests: We process personal data where necessary for our legitimate interests, provided these are not overridden by your interests or fundamental rights and freedoms. Our legitimate interests include maintaining site security, preventing and investigating fraud and theft, managing and improving our services, handling customer enquiries, and protecting our property and business operations.
Consent: In some cases, we may rely on your consent, for example for certain marketing communications where consent is required. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
How We Use Your Personal Data
We use the personal data we collect for the following purposes:
To create and administer customer accounts and contracts, allocate storage units, manage access permissions and provide customer support.
To process payments, manage invoices, handle billing queries and maintain accurate financial records.
To ensure the security and safety of our customers, staff, premises and property, including the use of CCTV and access logs.
To communicate with you about your account, bookings, contract renewals, key or access changes, and any important updates affecting your use of our services.
To handle enquiries, complaints and disputes, and to enforce our contract terms where necessary.
To comply with legal and regulatory requirements, respond to requests from law enforcement or regulatory authorities where we are required to do so, and protect our legal rights.
To analyse usage patterns and trends so that we can improve our services, pricing, facilities and customer experience, using aggregated or de-identified data wherever possible.
Data Sharing and Processors
We do not sell your personal data. We may share personal data with carefully selected third parties where necessary for the purposes described above and where we have a lawful basis. These third parties act as data processors or, in some cases, as separate controllers.
Data processors we may use include payment service providers to process card or electronic payments, IT and cloud service providers who host our systems and data, security and CCTV system providers and maintenance contractors, and professional advisers such as accountants or auditors who support our business operations.
Where we use processors, they are only permitted to process personal data on our instructions, for specified purposes, and must provide appropriate technical and organisational measures to protect the data. We maintain written agreements with all processors to ensure compliance with data protection requirements.
We may also share limited personal data with insurers, law enforcement agencies, courts, regulatory bodies, and other authorities where we are required or permitted by law, or where necessary to establish, exercise or defend legal claims.
Data Retention
Storage Crayford retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to meet legal, accounting or reporting requirements.
Customer account and contract information is generally retained for the duration of your contract and for a reasonable period afterwards to handle enquiries, resolve disputes and comply with legal obligations. This period will typically align with applicable limitation periods under UK law.
CCTV footage and access logs are retained for a limited period to support the security of our premises and the investigation of incidents. Retention periods for these records are determined based on security needs and legal considerations.
Financial and transactional records are kept for periods required by tax and accounting laws. Where data is no longer required, we will securely delete or anonymise it.
International Transfers
Where personal data is transferred outside the United Kingdom, for example because a cloud service provider uses servers in another country, we ensure that appropriate safeguards are in place. These may include adequacy regulations recognising a territory as providing an equivalent level of data protection, or standard contractual clauses approved by relevant authorities. We take steps to ensure that your rights and protections travel with your data.
Data Security
We take reasonable and appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or damage. These measures include access controls, physical security at our premises, staff training, secure storage of records, and the selection of reputable service providers who are required to implement robust security practices.
Your Data Protection Rights
As a data subject in relation to Storage Crayford, you have certain rights under the UK GDPR, subject to legal conditions and exceptions. These include:
The right of access to obtain confirmation as to whether we process your personal data and to receive a copy of that data, along with information about how it is used.
The right to rectification of inaccurate or incomplete personal data we hold about you.
The right to erasure, sometimes called the right to be forgotten, where there is no longer a lawful basis for us to continue processing your data.
The right to restrict processing in certain circumstances, for example while a complaint or accuracy issue is being investigated.
The right to object to processing based on our legitimate interests, and the right to object to direct marketing at any time.
The right to data portability, allowing you to request certain personal data in a structured, commonly used and machine readable format, and to request that it is transmitted to another controller where technically feasible.
If you make a request to exercise your rights, we will respond in accordance with applicable legal timeframes. We may need to verify your identity before responding in order to protect your data from unauthorised access.
Marketing Communications
We may use your contact details to send you information about our services that may be of interest to you. Where required by law, we will only send such communications with your consent. You can opt out of receiving marketing communications at any time. Opting out of marketing does not affect service or transactional communications that are necessary for the performance of our contract with you.
Policy Scope and Updates
This Privacy Policy applies to all customers and prospective customers of Storage Crayford within our service area, as well as any individuals who interact with our services or premises. We may update this policy from time to time to reflect changes in our practices, legal requirements or service offerings. Any significant changes will be explained in a revised version of this policy, which will be made available to customers.
Concerns and Complaints
If you have concerns about how Storage Crayford handles your personal data, you can raise this with us and we will do our best to address your concerns. You also have the right to lodge a complaint with the relevant supervisory authority for data protection matters in the United Kingdom.
