Storage Keston Privacy Policy
This Privacy Policy explains how Storage Keston collects, uses and protects personal data in connection with our storage services. It applies to all Storage Keston customers, prospective customers and users of our services in our operating area. We are committed to handling personal data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation and all applicable data protection laws.
Who This Policy Applies To
This Privacy Policy applies to individuals who use or enquire about Storage Keston services, visit our premises, or otherwise interact with us as a private individual or as a representative of a business. By engaging with us, you acknowledge that you have read and understood this Privacy Policy.
Categories of Personal Data We Collect
We only collect personal data that is necessary for providing and managing our storage services and for running our business. The categories of data we may collect include:
Identity information such as full name, title, date of birth and identification document details where required for security or verification.
Contact information such as billing address, service address, correspondence address and, where provided, communication preferences.
Account information such as customer reference numbers, unit numbers, access codes, contract details, rental history and payment history.
Payment information such as limited payment card details or bank details to process payments and maintain records of transactions. We do not store full payment card details where a secure payment processor is used.
Security and access information such as CCTV footage on our premises, access logs, vehicle registration numbers used to enter our site, and records of key or security token allocation.
Communication information such as copies of correspondence, enquiries, complaints, feedback and records of telephone or in-person discussions where notes are taken for service and legal purposes.
Technical information such as the type of device or browser you use to access any online services we may provide, IP address, and basic usage data for security and performance monitoring. We do not collect more technical data than is necessary for security and service provision.
How We Collect Your Data
We collect personal data directly from you when you contact us, request a quote, sign a storage agreement, make a payment, access our premises or communicate with us by any means. We may also receive data from third parties where this is necessary, for example from payment processors in relation to payment confirmation, from law enforcement agencies when required by law, or from business partners who introduce you to our services.
Lawful Bases for Processing
We process personal data only when a lawful basis under GDPR applies. Depending on the context, we may rely on the following lawful bases:
Contract: to take steps at your request before entering into a storage agreement and to perform our contract with you, including managing your account, administering bookings, processing payments and providing customer support.
Legal obligation: to comply with legal and regulatory requirements, including record keeping, taxation, responding to lawful requests from authorities, and maintaining appropriate security and safety measures.
Legitimate interests: to operate, improve and secure our business, such as preventing and detecting fraud or criminal activity, ensuring the security of our premises, maintaining CCTV systems, managing business planning and service development, and handling customer enquiries and complaints. When relying on legitimate interests, we balance those interests against your rights and reasonable expectations.
Consent: in limited circumstances where we wish to send you certain types of direct marketing or optional communications and you choose to opt in. You may withdraw your consent at any time.
How We Use Your Personal Data
We use your personal data for the following purposes:
Setting up and managing your customer account, including creating and updating records related to your storage unit, access rights and contact details.
Preparing, administering and enforcing storage agreements, including issuing invoices, managing renewals, handling arrears and resolving disputes.
Processing payments and maintaining accurate financial records for accounting and tax purposes.
Maintaining the safety and security of our premises, customers, staff and property, including the use of CCTV, access controls and incident logs.
Providing customer service and support, including responding to enquiries, handling complaints and communicating with you about any changes to your services or to this Privacy Policy.
Improving and managing our services and business operations, including monitoring usage patterns, performing analysis in aggregated form and planning future capacity or improvements.
Meeting our legal and regulatory obligations, including cooperating with law enforcement or regulatory bodies when we are legally required to do so.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy and to meet our legal, accounting or reporting obligations. The retention period will vary depending on the type of data and the context of our relationship with you.
Customer account and contract information is generally kept for the duration of the storage agreement and for a period after it ends, to handle any queries or legal issues and to comply with legal retention requirements.
Financial and transaction records are kept for the period required by tax, accounting and company legislation.
CCTV footage and security access logs are retained for a limited period that allows us to investigate incidents and ensure the safety and security of the site, after which they are securely deleted or overwritten unless required for an ongoing investigation.
Where no specific legal retention period applies, we determine the appropriate period based on the volume, nature and sensitivity of the personal data and the potential risk of harm from unauthorised use or disclosure.
Sharing and Processors
We may share personal data with trusted third parties that act as data processors on our behalf. These processors only process data in accordance with our documented instructions and with appropriate security measures in place. Typical categories of processors include:
Payment processing providers that handle card or bank payments securely.
IT and cloud service providers that supply data storage, customer management or communication systems.
Security, access control and CCTV system providers that help us operate and maintain our security infrastructure.
Professional advisers such as accountants, auditors or legal advisers, where this is necessary to support our business and comply with our obligations.
We may also share personal data with independent controllers in limited circumstances, for example with law enforcement agencies, courts, regulators or other government bodies when we are required or permitted by law, or in connection with the prevention or detection of crime. Where required, we ensure that appropriate safeguards are in place before transferring data outside the United Kingdom or European Economic Area.
Your Data Protection Rights
Under data protection law you have a number of rights in relation to your personal data. These rights apply subject to certain conditions and exemptions. You have the right to:
Access: request confirmation of whether we process your personal data and obtain a copy of the data we hold about you, together with certain information about how it is used.
Rectification: ask us to correct or complete personal data that is inaccurate or incomplete.
Erasure: request that we delete your personal data in certain circumstances, for example where it is no longer needed for the purposes for which it was collected, or where you withdraw consent and there is no other lawful basis for processing.
Restriction: ask us to restrict the processing of your personal data in certain situations, for example while we are verifying its accuracy or assessing an objection you have raised.
Objection: object to processing based on our legitimate interests where you consider that your rights and interests outweigh those of Storage Keston, including the right to object to direct marketing at any time.
Data portability: request that we provide certain personal data in a structured, commonly used and machine readable format or transfer it to another controller where technically feasible and where the processing is based on consent or contract and carried out by automated means.
Withdrawal of consent: where we rely on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing that took place before consent was withdrawn.
To exercise any of these rights, you can contact us using the details provided in your agreement or on our official communication materials. We may need to verify your identity before responding to your request.
Security of Your Data
We take appropriate technical and organisational measures to safeguard personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures may include controlled access to systems, secure storage, staff training and regular review of our security practices. While we strive to protect your personal data, no system can be completely secure and you should take care when providing information and keep your account details confidential.
Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations or data protection practices. The latest version will be made available through our usual communication channels. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.
