Privacy Policy - Wapping Storage

This Privacy Policy explains how Wapping Storage collects, uses, stores, shares, and protects personal data for all Wapping Storage customers in the area. It applies to all individuals who use, enquire about, or otherwise interact with Wapping Storage services in the area, whether in person, by phone, by email, through forms, or via any other communication method. We are committed to handling personal data in a lawful, fair, and transparent manner in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Wapping Storage takes privacy seriously and only processes personal data where there is a valid legal reason to do so. This policy is intended to help customers understand what information is collected, why it is collected, how long it is kept, who may receive it, and what rights individuals have in relation to their information.

1. Information We Collect

We may collect and process personal data that is necessary to provide storage-related services, manage customer accounts, maintain security, and comply with legal and operational obligations. The type of information collected may vary depending on the services used.

Identity information: name, date of birth, and similar details used to identify a customer or authorised user.
Contact information: postal address, email address, and telephone number.
Account and service information: booking details, unit number, access permissions, payment status, and service preferences.
Payment information: payment records, billing details, and transaction history. We do not retain full card details unless required by a payment provider’s secure systems.
Security and access data: entry logs, CCTV footage where applicable, and records of access to the premises or storage units.
Correspondence: emails, letters, call notes, and other communications relating to enquiries, complaints, or service requests.
Technical information: limited data such as IP address or device-related information where customers interact with digital systems used to manage services.

We may also collect information from third parties when necessary, such as identity verification providers, payment processors, or legal and regulatory bodies. Where appropriate, we will ensure that any such collection is carried out in accordance with data protection law.

2. How We Use Personal Data

We use personal data for the following purposes:

to create and manage customer accounts;
to provide storage services and maintain access control;
to process payments and manage invoicing;
to verify identity and prevent fraud;
to maintain the safety and security of customers, staff, property, and premises;
to respond to enquiries, complaints, and support requests;
to meet legal, tax, insurance, and regulatory obligations;
to enforce contracts and manage disputes;
to improve service quality and internal business operations.

We only use personal data for purposes that are specific, explicit, and legitimate. If we need to use data for a new purpose that is not compatible with the original reason it was collected, we will take steps to ensure that the use is lawful and appropriately communicated.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis before processing personal data. Depending on the activity, we rely on one or more of the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with a customer. This includes setting up storage services, managing access, billing, and handling routine account administration.

Legal Obligation

We may process personal data where needed to comply with a legal obligation, including tax, accounting, fraud prevention, regulatory requirements, and lawful requests from authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by the rights and freedoms of the individual. This may include securing the premises, preventing misuse of services, improving operations, and maintaining internal records. Where we rely on legitimate interests, we assess the impact carefully and take appropriate safeguards.

Consent

In limited situations, we may rely on consent, for example for certain optional communications or specific uses of data that are not covered by another lawful basis. Where consent is used, individuals may withdraw it at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

4. Retention of Personal Data

We keep personal data only for as long as it is necessary for the purposes for which it was collected, or for as long as required by law. Retention periods may vary depending on the type of data and the reason for holding it.

Customer account records: retained for the duration of the service relationship and for a reasonable period afterwards for administration, dispute resolution, and record-keeping.
Payment and invoicing records: retained for the period required by financial, tax, and accounting laws.
Security records and access logs: retained for a limited period unless needed longer for incident investigation, legal claims, or safety reasons.
Correspondence and complaint records: retained for the time necessary to respond, resolve issues, and maintain evidence of communications.
Legal claims or disputes: where a claim or investigation is ongoing, data may be retained until the matter is concluded.

When personal data is no longer needed, we will securely delete, anonymise, or destroy it. We do not keep data indefinitely without a lawful reason.

5. Processors and Data Sharing

We may share personal data with trusted third-party processors who help us operate the business and deliver services. These processors act on our instructions and are required to protect personal data under written contractual terms. Examples may include:

payment service providers;
IT and cloud service providers;
security and CCTV system providers;
accounting and bookkeeping services;
identity verification or fraud prevention services;
legal, insurance, or professional advisers;
delivery, maintenance, or facilities management providers where relevant.

We may also disclose personal data where required by law, court order, regulatory request, or to protect our rights, customers, staff, or property. Any third party that receives data is expected to handle it securely and only for the intended purpose.

Wapping Storage does not sell personal data. We also do not share personal data with third parties for their own marketing purposes unless we have a lawful basis to do so and the individual has been informed where required.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. These measures may include access restrictions, encryption where appropriate, secure storage systems, staff training, and internal procedures for handling data securely.

While no system can be guaranteed to be completely secure, we work to reduce risks and to respond promptly to any suspected data incident. Where required by law, we will notify relevant authorities and affected individuals of a personal data breach.

7. Your Rights

Individuals have a number of rights under data protection law. These rights may apply in full or in part depending on the circumstances and the lawful basis for processing.

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete information.
Right to erasure: to request deletion of personal data in certain situations.
Right to restriction: to request that processing be limited in certain cases.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to data portability: to receive certain data in a structured, commonly used, machine-readable format.
Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.
Right to complain: to raise concerns with the relevant data protection authority if you believe your rights have been infringed.

Requests to exercise these rights will be considered in accordance with applicable law. We may need to verify identity before acting on a request to protect your privacy and prevent unauthorised disclosure.

8. Children’s Data

Our storage services are not designed for children, and we do not knowingly collect personal data from children in the ordinary course of business. If we become aware that we have collected such information without appropriate authority, we will take steps to remove it in line with legal requirements.

9. International Transfers

Where personal data is transferred outside the United Kingdom, we will ensure that suitable safeguards are in place to protect it. These safeguards may include adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms permitted under data protection law.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, business practices, or service arrangements. Any updated version will apply from the date it is made available. We encourage customers to review it periodically so they remain informed about how personal data is handled.

11. Summary of Commitments

Wapping Storage is committed to processing personal data lawfully, securely, and transparently. We collect only the information needed to provide and manage our services, rely on lawful bases such as contract, legal obligation, legitimate interests, and consent where appropriate, retain data only for as long as necessary, and use processors that are contractually bound to protect information. Customers in the area have rights over their personal data, and we will respect and support those rights in accordance with GDPR requirements.

This policy applies to all Wapping Storage customers in the area.