Storage Merton Privacy Policy
This Privacy Policy explains how Storage Merton collects, uses, stores, and protects personal data relating to customers and prospective customers in our service area. It also explains your rights under the UK General Data Protection Regulation and related data protection laws, and how you can exercise those rights.
By using Storage Merton services, visiting our premises, or contacting us, you acknowledge that you have read and understood this Privacy Policy. This policy applies to all Storage Merton customers and prospective customers in our area, regardless of how you interact with us.
Who we are and scope of this policy
Storage Merton is a storage service provider operating in the local area. We act as the data controller for the personal data we collect and process about you in connection with our services, including enquiries, bookings, contracts, payments, and on-site access.
This Privacy Policy applies to all customers, potential customers, visitors to our premises, and individuals who contact us about our storage services, whether in person, by post, by electronic means, or through any other communication channel.
Types of personal data we collect
We collect and process different types of personal data depending on how you interact with us and what services you use. This may include:
Identification and contact details: name, title, postal address, contact preferences, and other information you choose to provide when communicating with us.
Account and contract information: customer reference numbers, storage unit details, contract start and end dates, correspondence relating to your contract, and service preferences.
Payment and billing information: payment method details processed via secure payment providers, billing address, records of invoices, and payment history. We do not store full payment card details; these are handled securely by our payment processors.
Usage and communication data: records of your communications with us, notes of enquiries or complaints, log records of access to storage units where relevant, and information about how you use our services.
Security and access information: information collected by security systems at our premises, which may include CCTV footage and access logs, where such systems are in operation for safety and security purposes.
Technical information: if you use our online services, we may collect limited technical data such as your browser type and basic diagnostic information needed to operate and secure our online tools. We aim to minimise the use of cookies and similar technologies, and where they are used for non-essential purposes, we seek your consent where required by law.
How we collect your personal data
We may collect personal data directly from you when you:
Request information or a quotation about our storage services.
Enter into a storage agreement or other contract with us.
Use or access our storage facilities.
Communicate with us by any means.
Visit our premises where security systems are in operation.
We may also obtain personal data indirectly from third parties, such as payment processors, identity verification services where used, or partners that refer you to us, but only where this is consistent with data protection law and this Privacy Policy.
Lawful bases for processing your data
We only process your personal data where we have a lawful basis under the UK General Data Protection Regulation. Depending on the context, we rely on the following lawful bases:
Contract: to take steps at your request before entering into a contract and to perform our contract with you. This includes processing required to set up your storage agreement, manage your account, process payments, and provide access to your storage unit.
Legal obligation: to comply with legal and regulatory requirements, including tax and accounting rules, health and safety obligations, and obligations to assist law enforcement or regulatory authorities where we are legally required to do so.
Legitimate interests: to pursue our legitimate business interests in a way that is proportionate and respects your privacy. These interests may include maintaining the security of our premises and systems, preventing and detecting fraud, managing our business operations, improving our services, and handling customer enquiries and complaints. When we rely on this basis, we balance our interests against your rights and freedoms.
Consent: in limited cases where we seek your clear, informed consent for specific processing that is not necessary for a contract, legal obligation, or legitimate interest. Where we rely on consent, you may withdraw it at any time by contacting us, and this will not affect the lawfulness of processing carried out before your withdrawal.
How and why we use your personal data
We use your personal data for purposes including:
Providing storage services: to set up, administer, and manage your storage agreement, including account creation, facility access, and day-to-day service delivery.
Customer support and communication: to respond to enquiries, provide service updates, handle complaints, and communicate with you about your account and any changes to our services or terms.
Billing and payments: to issue invoices, process payments through our payment processors, manage arrears, and maintain appropriate records for accounting and tax purposes.
Security and fraud prevention: to help protect our premises, property, customers, and staff, including through access controls, CCTV where in operation, and monitoring for fraudulent or unlawful activity.
Business management and improvement: to monitor service usage, perform internal reporting, train staff, and improve the quality and efficiency of our services while respecting data minimisation principles.
Data retention and storage periods
We keep your personal data only for as long as necessary for the purposes for which it was collected, including for legal, accounting, or reporting requirements. Retention periods may vary depending on the type of data and the context of processing, but we apply the following general principles:
Customer account and contract data: retained for the duration of your contract and for a period afterwards to manage any queries, disputes, or claims, and to comply with legal retention requirements. This period is typically several years after the end of your contract, in line with limitation periods under applicable law.
Billing and payment records: retained for the time required by tax, accounting, and financial regulations, which usually require records to be kept for a number of years.
Security and CCTV data: where CCTV or similar systems are in use, footage and access logs are retained only for a short period unless a longer retention is necessary for investigating an incident, responding to a request from authorities, or managing a legal claim.
Enquiry and communication records: retained for an appropriate period to respond to your enquiry, manage ongoing correspondence, and demonstrate how we handled communications, especially where there is a risk of dispute.
At the end of the relevant retention period, we securely delete or anonymise your personal data so that it can no longer be associated with you.
Sharing your personal data and use of processors
We do not sell your personal data. We may share your information in limited circumstances with carefully selected third parties where necessary and in accordance with data protection law, including:
Service providers and processors: third parties that provide services to us, such as payment processing, IT hosting and support, security and CCTV system providers, document storage, and professional advisers. These providers act as processors on our behalf and are only permitted to use your personal data in accordance with our instructions and for the purposes described in this Privacy Policy.
Public authorities and regulators: where we are required to do so by law, court order, or regulatory obligation, or where disclosure is necessary to protect our rights, property, customers, or staff.
Professional advisers: such as lawyers, accountants, or insurers, where reasonably necessary for the establishment, exercise, or defence of legal claims or for compliance and audit purposes.
Where any transfer of data involves a destination outside the United Kingdom or the European Economic Area, we take appropriate safeguards to ensure that your personal data remains adequately protected in line with applicable data protection laws.
Your data protection rights
You have a number of rights under the UK General Data Protection Regulation in relation to your personal data. Subject to certain conditions and legal exemptions, these include:
Right of access: you can request confirmation as to whether we process your personal data and obtain a copy of that data together with certain information about how it is processed.
Right to rectification: you can ask us to correct inaccurate or incomplete personal data that we hold about you.
Right to erasure: in certain circumstances, you can request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected or where you withdraw consent and there is no other lawful basis for processing.
Right to restriction of processing: you can ask us to restrict the processing of your personal data in specific situations, such as while we are verifying its accuracy or dealing with an objection you have raised.
Right to data portability: where processing is based on your consent or on a contract and carried out by automated means, you can request a copy of your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
Right to object: you can object to processing based on our legitimate interests on grounds relating to your particular situation. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for legal claims.
Rights in relation to consent: where we rely on your consent for processing, you can withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before you withdrew consent.
You also have the right to lodge a complaint with the relevant supervisory authority if you consider that your data protection rights have been infringed. We encourage you to contact us first so we can try to resolve your concerns.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. When we make changes, we will revise the date of the latest version and, where appropriate, inform you through our usual communication channels or by displaying a notice at our premises.
We encourage you to review this Privacy Policy periodically so that you remain informed about how we collect, use, and protect your personal data as a Storage Merton customer in our area.
