Storage Wapping Privacy Policy
This Privacy Policy explains how Storage Wapping collects, uses, stores and protects personal data relating to customers and prospective customers in the Storage Wapping service area. It applies to all individuals who use our self‑storage, related services or who otherwise interact with us as customers, prospective customers or authorised representatives.
We are committed to complying with the UK General Data Protection Regulation and the EU General Data Protection Regulation where applicable, as well as other relevant data protection laws. This Privacy Policy is intended to provide clear and transparent information about our data processing activities.
Personal data we collect
We collect and process different categories of personal data depending on how you interact with us and the services you use. The data we may collect includes:
Identification and contact details such as name, postal address, billing address, contact address, nationality, date of birth, and identification details that may be required to verify your identity, for example an identity document reference number.
Contact information such as email address and other communication details you provide to us in order to receive quotes, booking confirmations, invoices, updates and service information.
Account and contract information such as customer account numbers, storage unit details, rental periods, payment history, contractual terms, communications relating to the contract and records of your preferences for services.
Payment information such as limited payment card information, payment method, transaction references and records of payments made. Card details are processed in accordance with applicable payment security standards and are not kept for longer than necessary.
Security and access information such as CCTV images in and around our premises, access control data, entry and exit logs, unit numbers, visit times and any incident reports relating to safety, security or misuse of facilities.
Communication records such as enquiries, quotes, complaints, feedback, call notes, and any correspondence you send to us or that we send to you in the course of providing our services.
Website and usage data where relevant, such as information you provide via online forms, basic technical data from your device, and records of the pages you visit on our site, where this is necessary to operate and secure our website and to respond to your requests.
Purposes and lawful bases for processing
We process your personal data only when we have a valid lawful basis under GDPR. Depending on the context, we rely on one or more of the following lawful bases.
Contract performance: We process personal data where it is necessary to enter into, manage and fulfil a contract with you, or to take steps at your request before entering into a contract. This includes providing storage services, managing bookings, processing payments, operating access systems, and communicating with you about your account.
Legal obligations: We process certain data to comply with legal and regulatory requirements, including record keeping obligations, tax and accounting rules, safety and security requirements and responsibilities to cooperate with law enforcement or regulatory authorities where required by law.
Legitimate interests: We process personal data where it is necessary for our legitimate interests or the legitimate interests of a third party, provided those interests are not overridden by your rights and freedoms. This includes ensuring the security of our premises and assets, preventing and detecting crime or fraud, monitoring and improving our services, handling queries and complaints, and managing business operations.
Consent: In some limited circumstances, we may rely on your consent, for example for certain types of optional marketing communications or where required by applicable law. When we rely on consent, you are free to withdraw it at any time, and we will explain how you can do so at the point at which consent is obtained.
Data retention
We keep personal data only for as long as is necessary for the purposes for which it was collected, and to satisfy any legal, accounting or reporting requirements. The length of time we retain data will depend on the type of information and the reason we process it.
In general, we will retain customer account and contract information for as long as you have an active contract with us and for a reasonable period afterwards, typically to handle any queries, disputes or legal claims. Payment records and invoices are normally kept for the period required by tax and accounting legislation.
CCTV images and access control data are retained for a limited period that enables us to investigate incidents, protect our premises, assist law enforcement where appropriate and ensure the security of our customers and staff. After this period expires, data is securely deleted or anonymised unless it must be retained longer in connection with an investigation or legal claim.
Where we hold data based on your consent and you withdraw that consent, we will cease processing the data for that purpose, subject to any separate lawful basis that might apply or legal obligations that require retention. When data is no longer required, we will delete or anonymise it in a secure manner.
Data sharing and processors
We do not sell your personal data. We may share personal data with carefully selected third parties where this is necessary for the purposes described in this Privacy Policy, and always in accordance with GDPR.
Service providers acting as data processors may process personal data on our behalf in areas such as payment processing, secure data hosting, information technology support, access control systems, CCTV system maintenance, customer relationship management, and professional advice such as legal or accounting services. These processors are only permitted to process your data in accordance with our written instructions, must keep it secure and may not use it for their own purposes.
We may also share personal data with other third parties acting as independent controllers where required by law or where necessary to protect our legitimate interests and those of our customers and staff. This may include law enforcement bodies, government agencies, regulatory authorities, insurers and professional advisers in connection with legal claims or regulatory matters.
If any processing involves the transfer of personal data outside the United Kingdom or the European Economic Area, we will ensure that an appropriate level of protection is in place, including through the use of adequacy regulations or standard contractual clauses, and that the transfer complies with GDPR requirements.
Security of personal data
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or damage. These measures include restricted access to systems and premises, the use of secure storage, regular monitoring of our security arrangements and staff training on data protection responsibilities.
While we take reasonable steps to safeguard your information, no system can be completely secure. We continually review and enhance our security measures to respond to emerging risks and to protect the personal data that we hold.
Your data protection rights
Under GDPR and applicable data protection laws, you have a number of rights in relation to the personal data that we hold about you. These rights apply to all Storage Wapping customers within our service area, subject to any limitations or exemptions set out in law.
Right of access: You have the right to request confirmation as to whether we process personal data about you and, where we do, to request a copy of that data together with certain related information.
Right to rectification: You have the right to request that inaccurate or incomplete personal data is corrected or updated without undue delay.
Right to erasure: In some circumstances, you have the right to request that we delete your personal data, for example where the data is no longer needed for the purposes for which it was collected, or where you withdraw consent and we have no other lawful basis to continue processing.
Right to restriction: You may have the right to request that we restrict our processing of your personal data in certain situations, for example while we verify the accuracy of the data or consider an objection you have raised.
Right to data portability: Where processing is based on your consent or on a contract and carried out by automated means, you may have the right to receive your personal data in a commonly used, machine readable format and to transmit that data to another controller where this is technically feasible.
Right to object: You have the right to object at any time to processing based on our legitimate interests, including profiling related to those interests. We will stop processing unless we can demonstrate compelling legitimate grounds. You also have an absolute right to object to direct marketing at any time.
Rights in relation to automated decision making: You have rights where we make decisions about you solely by automated means that have legal or similarly significant effects. Storage Wapping does not typically make such decisions in the ordinary course of providing storage services.
You also have the right to lodge a complaint with the relevant supervisory authority if you believe that your data protection rights have been infringed. We encourage you to contact us first so that we can address any concerns directly.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time in order to reflect changes in our services, legal requirements or data processing practices. When we make significant changes, we will take reasonable steps to inform you, for example by updating the version available at our premises or on our website. We encourage you to review this Privacy Policy periodically so that you remain informed about how we handle personal data at Storage Wapping.
