Storage Goddington Privacy Policy
This Privacy Policy explains how Storage Goddington collects, uses, stores, and protects personal data relating to our self-storage and associated services. It applies to all Storage Goddington customers in our service area, including prospective customers, current customers, and former customers whose data we continue to hold for a limited time. By engaging with our services, you acknowledge that you have read and understood this Privacy Policy.
Who We Are and Scope of This Policy
Storage Goddington is the controller of the personal data described in this Privacy Policy. As the data controller, we determine the purposes and means of processing your personal data in connection with the provision of storage and related services. This Privacy Policy applies to all personal data processed by Storage Goddington about customers and potential customers within our operating area, whether that data is collected online, in person, over the phone, or in written correspondence.
Types of Personal Data We Collect
We collect and process different categories of personal data as necessary to provide and manage our services. This may include:
Identification data such as full name, title, date of birth, and a copy or reference of an identification document, where required for verification purposes.
Contact details such as home or business address, billing address, and other address details relevant to our services.
Communication details such as your preferred communication method and the content of communications you send to us or we send to you.
Contract and account data such as unit number, contract start and end dates, services selected, payment terms, deposit information, and communication records associated with your account.
Payment and billing data such as payment method details, partial card identifiers where necessary for transaction processing, payment history, invoices, and credit notes. We do not store full payment card details when payment is processed through secure payment providers.
Security and access data such as access codes, key or fob identifiers, entry and exit logs, and closed circuit television recordings taken in and around our premises, where CCTV is in use for security and safety.
Technical and usage data such as information about how you interact with our website or online systems, including log information and service preferences, where applicable.
How We Collect Personal Data
We collect personal data directly from you when you request a quote, reserve or rent a storage unit, sign a contract, make a payment, visit our premises, or communicate with us. We may also collect data when you use our website or other online services. In some cases, we may receive personal data from third parties acting on your behalf, such as agents or family members, or from service providers assisting with payment processing and identity verification, where applicable and lawful.
Lawful Basis for Processing
We process your personal data only where there is a lawful basis under the General Data Protection Regulation. Depending on the context, we rely on one or more of the following lawful bases:
Performance of a contract: We process personal data that is necessary to enter into, administer, and fulfil our contract with you, including providing storage services, managing your account, and handling your requests and queries.
Legal obligations: We process personal data where necessary to comply with legal and regulatory requirements, such as tax and accounting rules, security and safety obligations, and law enforcement requests when we are legally required to respond.
Legitimate interests: We may process personal data where it is necessary for our legitimate business interests, provided your interests and fundamental rights do not override those interests. This can include maintaining security of our premises, preventing fraud and misuse of our services, improving our services and customer experience, and managing disputes or enforcing our contractual rights.
Consent: In certain cases, we may rely on your explicit consent, for example, for specific optional communications or activities that are not strictly necessary for our contractual relationship. Where we rely on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
How We Use Your Personal Data
We use the personal data we collect for the following purposes:
To provide, manage, and administer storage and associated services you request, including the creation and maintenance of your customer account.
To process payments, issue invoices, manage deposits, and maintain accurate financial records.
To communicate with you about your contract, account status, access arrangements, changes to our services, and important notices.
To ensure the safety and security of our premises, customers, and staff, including verifying identity where appropriate and operating access controls and CCTV systems.
To handle queries, requests, complaints, and disputes, and to enforce our contractual terms.
To comply with legal and regulatory obligations, such as record keeping, reporting requirements, and responding to lawful requests from public authorities.
To protect our legitimate business interests, for example by preventing misuse or damage to our property and investigating incidents.
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected or as required by applicable laws and regulations. The retention period will depend on the category of data and the context in which it is processed.
Contract and account data, including identification and contact details associated with your storage agreement, are retained for the duration of your contract and for a defined period afterward to address potential queries, disputes, or legal claims, and to comply with tax and accounting obligations.
Payment records and related financial documentation are retained for the period required by financial and tax regulations.
CCTV footage and access logs are retained for a limited period necessary to ensure security and to investigate any incidents, unless a longer retention is required due to an ongoing investigation or legal proceedings.
When personal data is no longer needed, we will securely delete or anonymise it so that it can no longer be associated with an identifiable individual.
Data Processors and Third Parties
We may share personal data with carefully selected third party service providers acting as data processors on our behalf. These processors are engaged to support our operations and may provide services such as payment processing, secure data hosting, customer management systems, and security or maintenance services.
All processors are required to handle personal data strictly in accordance with our instructions, to implement appropriate technical and organisational measures to protect the data, and to comply with applicable data protection laws. They are not permitted to use your personal data for their own independent purposes.
We may also share personal data with other third parties where required by law, to protect our legal rights, to assist in the detection or prevention of fraud or other unlawful activities, or in connection with a potential or actual sale, merger, or reorganisation of part or all of our business, provided that any such sharing is carried out lawfully and with appropriate safeguards.
We do not sell your personal data to third parties.
International Data Transfers
Where we engage processors or service providers located outside the United Kingdom or the European Economic Area, or where data may be accessed from such locations, we take steps to ensure that an adequate level of protection is in place. This may include relying on adequacy decisions in respect of certain countries or using appropriate safeguards such as standard contractual clauses. Further information about safeguards for international transfers can be provided on request.
How We Protect Your Personal Data
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures may include access controls, secure storage systems, encryption or pseudonymisation where appropriate, staff training, and regular review of our security procedures. While no system can be completely secure, we regularly assess our safeguards to maintain a level of security appropriate to the risks associated with our processing activities.
Your Data Protection Rights
Under the General Data Protection Regulation and applicable data protection laws, you have a number of rights in relation to your personal data. These rights apply to all Storage Goddington customers in our service area, subject to certain conditions and legal limitations.
Right of access: You have the right to request confirmation as to whether we process personal data about you and, if so, to access that personal data and obtain information about how it is processed.
Right to rectification: You have the right to request correction of inaccurate personal data and completion of incomplete data concerning you.
Right to erasure: In certain circumstances, you have the right to request that we delete your personal data, for example where the data is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and there is no other legal basis for processing.
Right to restriction of processing: You may have the right to request that we restrict the processing of your personal data in specific situations, such as while we verify the accuracy of data or assess an objection raised by you.
Right to data portability: Where processing is based on consent or on a contract and carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, and machine readable format and to transmit that data to another controller, where technically feasible.
Right to object: You have the right to object to processing based on our legitimate interests, including profiling where applicable, on grounds relating to your particular situation. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is required for the establishment, exercise, or defence of legal claims.
Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
You also have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data infringes applicable data protection laws.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. When we make material changes, we will take reasonable steps to inform you, for example by updating the effective date and, where appropriate, providing a notice in our communications or at our premises. We encourage you to review this Privacy Policy periodically to stay informed about how we handle personal data.
