Storage Tokyngton Privacy Policy
This Privacy Policy explains how Storage Tokyngton collects, uses, stores and protects personal data relating to individuals who use our services or otherwise interact with us. It applies to all Storage Tokyngton customers and prospective customers in the local area, as well as visitors to our premises and individuals who contact us regarding our services.
We are committed to safeguarding your privacy and handling your personal data in a transparent and lawful manner in accordance with the UK General Data Protection Regulation and other applicable data protection laws.
1. Data Controller
Storage Tokyngton is the data controller for the personal data described in this Privacy Policy. This means that we determine the purposes and means of processing your personal data and are responsible for ensuring that such processing complies with data protection law.
2. Categories of Personal Data We Collect
We collect and process different types of personal data depending on your relationship with us and the services you use. This may include:
Identification data: name, title, date of birth, customer reference numbers, identification document details when required for verification.
Contact data: postal address, billing address, contact preferences, and similar details you provide so we can communicate with you.
Account and contract data: records of the storage unit or services you rent, contract start and end dates, payment history, service usage, and correspondence relating to your contract.
Payment and billing data: details necessary to process payments such as partial card details, transaction records, bank transfer information, billing history and invoices. We do not store full card data when this is processed by a secure payment provider.
Security and access data: information relating to access to our storage site, including access codes, logs of entry and exit, CCTV footage in and around our premises, and information about any incidents or security investigations.
Communication data: records of communications with you, including enquiries, complaints, feedback, and any information you provide when you contact us in person, by post or via electronic means.
Technical data: limited information generated when you interact with our website or digital services, such as IP address, device identifiers, and pages accessed, to help us maintain and improve our services.
3. How We Collect Your Data
We collect personal data directly from you when you:
Request a quote or information about our services.
Enter into a storage contract or other service agreement with us.
Make a payment or set up a recurring payment arrangement.
Contact us with a query, feedback or complaint.
Visit our premises, including areas covered by CCTV.
Use our website or online tools that we provide.
We may also receive personal data from third parties, such as payment processors, credit reference agencies, or law enforcement and other authorities where necessary and lawful.
4. Lawful Bases for Processing
We will only process your personal data when we have a valid legal basis to do so. Depending on the specific activity, we rely on the following legal bases:
Performance of a contract: to take steps at your request before entering into a contract and to perform our contractual obligations to you, such as providing storage services, managing your account, and processing your payments.
Legal obligations: to comply with legal and regulatory requirements, including tax and accounting rules, record-keeping duties, security obligations, and cooperation with law enforcement or regulatory authorities where required by law.
Legitimate interests: to pursue our legitimate business interests, provided these are not overridden by your rights and interests. These interests include managing and improving our services, ensuring the security of our site and customers, preventing and detecting fraud or misuse, and handling customer enquiries and complaints.
Consent: in limited cases, we may rely on your consent, for example for certain types of optional marketing communications or where we are required to obtain consent by law. Where processing is based on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.
5. Purposes of Processing
We use your personal data for the following purposes:
To provide and manage storage and related services you have requested.
To set up and administer your account, including identity verification where appropriate.
To process payments, issue invoices, and manage any debts or disputes.
To maintain the security of our premises, units and customers, including through access controls and CCTV monitoring.
To communicate with you about your contract, service updates, changes to terms and this Privacy Policy.
To respond to enquiries, handle complaints and provide customer support.
To improve our services, premises and customer experience, including through analysis of service usage and feedback.
To comply with legal obligations and cooperate with legitimate requests from public authorities.
6. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to meet legal, accounting or reporting requirements.
Customer contract records, billing information and related correspondence are typically retained for a period required by tax and accounting laws after the end of the contract. Security and access logs, including CCTV footage, are kept for a shorter period, unless a longer retention period is necessary in connection with an incident, claim or investigation.
When personal data is no longer needed, we will either securely delete it or irreversibly anonymise it so that it can no longer be linked to an identifiable individual.
7. Data Processors and Third Parties
We use carefully selected third party service providers who act as data processors on our behalf. These processors only process personal data according to our documented instructions and are bound by contractual obligations to implement appropriate technical and organisational measures to protect your data.
Typical processors and third parties may include:
Payment processing providers who facilitate electronic transactions.
IT and cloud service providers who host our systems, data and backups.
Security service providers who support CCTV systems, access control or incident management.
Professional advisers, such as accountants or legal advisers, where necessary for the operation of our business.
Where we are legally required or permitted to do so, we may also share personal data with public authorities, law enforcement agencies, courts or regulators.
We do not sell your personal data. We do not allow our processors to use your personal data for their own independent purposes.
8. International Data Transfers
Where we transfer personal data outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place to protect your data in line with data protection law. This may include the use of standard contractual clauses or other recognised transfer mechanisms.
9. Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data. These rights apply to all Storage Tokyngton customers and individuals in the area whose data we process, subject to certain legal limitations:
Right of access: you can request confirmation of whether we process your personal data and obtain a copy of the data, along with information about how we use it.
Right to rectification: you can ask us to correct or complete personal data that is inaccurate or incomplete.
Right to erasure: in certain circumstances, you can request that we delete your personal data. This right is not absolute and may be subject to legal or contractual retention requirements.
Right to restriction of processing: you can ask us to restrict the processing of your personal data in certain situations, for example while we verify accuracy or consider an objection.
Right to data portability: where processing is based on consent or contract and carried out by automated means, you can request that we provide your personal data in a structured, commonly used and machine-readable format, or transmit it to another controller where technically feasible.
Right to object: you can object to processing based on our legitimate interests, on grounds relating to your particular situation. We will stop such processing unless we have compelling legitimate grounds or need to continue for legal claims.
Rights in relation to consent: where we have relied on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing that took place before consent was withdrawn.
You also have the right to lodge a complaint with a data protection supervisory authority if you believe that your data protection rights have been infringed.
10. Security of Your Personal Data
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction or damage. These measures include physical security at our premises, access controls, staff training, and procedures for managing suspected data breaches.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time in order to reflect changes to our processing activities, legal requirements or business practices. The updated version will apply from the date it is made available. You should review this Privacy Policy periodically to stay informed about how we handle your personal data.
Continued use of our services or continued interaction with us after any changes take effect will indicate your acknowledgment of the updated Privacy Policy.
