Privacy Policy - Hackneymarshes Storage

This Privacy Policy explains how Hackneymarshes Storage collects, uses, stores, shares, and protects personal data in connection with our storage services. It applies to all Hackneymarshes Storage customers in the area, including individuals, households, businesses, and any authorised representatives who use our services, access our premises, or communicate with us on behalf of an account holder.

We are committed to processing personal data in a fair, lawful, transparent, and secure manner in accordance with the UK GDPR and the Data Protection Act 2018. We aim to collect only the information we need, use it for clear purposes, and keep it only for as long as necessary.

1. Information We Collect

We may collect and process the following categories of personal data:

Identity data, such as your name, title, date of birth, and identification details where required for account verification.
Contact data, such as postal address, email address, and telephone number.
Account and service data, including your storage unit details, contract information, booking history, payment status, and service preferences.
Financial data, such as billing information, payment card details processed through secure payment systems, invoices, and records of transactions.
Access and security data, including CCTV footage, gate access records, alarm logs, visitor records, and incident reports.
Communication data, such as emails, phone calls, messages, complaints, and notes relating to support or service queries.
Technical data, where applicable, such as IP address or device information if you interact with any online services we use for account management.

We generally collect personal data directly from you when you enquire about our services, sign a contract, make a payment, visit our premises, or contact us. We may also receive information from third parties, such as payment processors, identity verification providers, debt recovery providers, insurers, or public authorities where lawful and necessary.

2. How We Use Personal Data

We use personal data for the following purposes:

To set up and manage storage accounts.
To verify identity and prevent fraud.
To provide access to storage facilities and maintain site security.
To process payments, issue invoices, and manage arrears.
To communicate service updates, account notices, and operational information.
To respond to questions, complaints, and service requests.
To maintain internal records, audits, and legal compliance.
To defend, establish, or exercise legal claims.
To monitor the safety and security of our customers, staff, and property.

We will not use your personal data for purposes that are incompatible with the reasons it was collected unless we have a valid legal basis to do so.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis to process personal data. We rely on one or more of the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes setting up your storage agreement, managing access to your unit, collecting payments, and providing the services you request.

Legal Obligation

We process certain data to comply with legal obligations, such as tax, accounting, security, health and safety, fraud prevention, and responding to lawful requests from authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided your interests and rights do not override those interests. Examples include protecting our property, maintaining secure premises, managing business operations, preventing fraud, and improving service quality. When we rely on legitimate interests, we assess the impact on your rights and use safeguards where appropriate.

Consent

In limited circumstances, we may rely on your consent, for example where you choose to receive certain optional communications. Where consent is used, you may withdraw it at any time.

Vital Interests and Public Task

These bases are not typically used in our day-to-day storage operations, but may apply in exceptional circumstances, such as emergency situations or lawful obligations connected to public authorities.

4. Retention of Personal Data

We keep personal data only for as long as necessary for the purposes for which it was collected, including legal, accounting, insurance, and reporting requirements. Retention periods vary depending on the type of information and the reason we hold it.

Contract and account records are usually retained for the duration of the customer relationship and for a period after it ends to handle disputes, audits, and legal claims.
Financial and tax records are retained for the period required by law, typically several years after the end of the relevant financial year.
Security records, including CCTV images and access logs, are retained for a limited period unless an incident requires longer retention.
Correspondence and complaints may be retained for as long as necessary to resolve the matter and maintain a record of actions taken.

When personal data is no longer needed, we will delete it securely or anonymise it so that it can no longer identify you.

5. Sharing Personal Data and Processors

We may share personal data with trusted third parties where necessary and lawful. These third parties may act as processors or independent controllers depending on the service they provide. Where a processor acts on our behalf, they are only permitted to process data according to our instructions and must protect it appropriately.

Examples of processors and service providers may include:

Payment processors that handle secure card or bank transactions.
IT and cloud service providers that host or support our business systems.
Security providers that manage CCTV, alarms, or site monitoring systems.
Accountancy and administrative service providers that support bookkeeping, audit, and reporting functions.
Legal, debt recovery, or insurance providers where necessary to manage claims, recover debts, or protect our interests.

We may also disclose personal data to law enforcement, regulators, courts, or other public authorities where required by law or where disclosure is necessary to protect our rights, customers, staff, or premises.

Where data is transferred to third parties, we take steps to ensure appropriate contractual safeguards and data protection standards are in place.

6. Data Security

We take reasonable technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff training, and physical security arrangements. Although no system can be guaranteed completely secure, we work to maintain an appropriate level of protection based on the nature of the data and the risks involved.

7. Your Rights

Under data protection law, you have several rights regarding your personal data. These rights may be subject to limitations or exemptions in some cases. They include:

Right of access: You may request a copy of the personal data we hold about you.
Right to rectification: You may ask us to correct inaccurate or incomplete data.
Right to erasure: In certain circumstances, you may ask us to delete your personal data.
Right to restriction: You may ask us to limit the way we use your data in specific situations.
Right to object: You may object to processing based on legitimate interests or direct marketing.
Right to data portability: Where applicable, you may request your data in a structured, commonly used format.
Right to withdraw consent: If we rely on consent, you may withdraw it at any time.

You also have the right to raise concerns with the relevant data protection authority if you believe your rights have been infringed. We encourage you to raise any concerns with us first so we can address them promptly.

8. Automated Decision-Making

We do not usually make decisions about you based solely on automated processing that has legal or similarly significant effects. If this changes, we will inform you and explain your rights and options.

9. Children's Data

Our storage services are intended for adults and business users. We do not knowingly collect personal data from children except where it is provided lawfully by a parent, guardian, or authorised representative in connection with an account or service matter.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, business practices, or the services we provide. Any revised version will apply from the date it is issued. We encourage customers to review this policy periodically so they remain informed about how personal data is handled.

In summary, Hackneymarshes Storage processes personal data responsibly, only where we have a lawful basis, with limited retention, careful use of processors, and respect for your data protection rights. This policy applies to all Hackneymarshes Storage customers in area.