Storage Highgate Privacy Policy
This Privacy Policy explains how Storage Highgate collects, uses, stores, and protects personal data relating to individuals who use our storage services or interact with us in any way. It applies to all Storage Highgate customers in our service area, as well as prospective customers and any person who contacts or visits us.
We are committed to complying with the UK General Data Protection Regulation and all applicable data protection laws. This policy is designed to give you clear and transparent information about our data processing practices and your rights.
1. Data Controller
Storage Highgate is the data controller in respect of the personal data we collect and process about you. This means that we determine the purposes and means of processing your personal data and are responsible for ensuring such processing complies with applicable law.
2. Personal Data We Collect
We may collect and process the following categories of personal data, depending on how you interact with us and which services you use:
Identity and contact details: name, postal address, billing address, contact address, and any additional contact information you provide, such as your preferred communication details.
Customer account information: customer reference numbers, records of the storage unit(s) you rent, contract details, payment history, and information relating to your use of our services.
Payment and billing information: details necessary to process payments and refunds, such as billing identifiers and payment confirmations. We do not store full card details where payment is made by card; this information is handled by our payment processor.
Communication data: records of correspondence and communications with you, including enquiries, complaints, feedback, and any notes arising from calls or in-person discussions.
Security and access information: vehicle registration details if provided for site access control, CCTV footage from our premises for security and crime prevention purposes, and records of access to units where systems are in place to log entry and exit.
Website and technical data: limited technical information about how you use our website, such as pages visited, the device and browser type you use, and general analytical data, where this is collected through cookies or similar technologies in line with applicable law.
3. Purposes and Lawful Bases for Processing
We process your personal data only where we have a lawful basis to do so. The main purposes and lawful bases are as follows:
To provide storage services: we use your identity, contact, account, and billing information to set up and manage your contract, allocate and administer your storage unit, and provide ongoing customer service. The lawful basis is performance of a contract or taking steps at your request prior to entering into a contract.
To manage payments and accounts: we process payment and billing information to invoice you, collect payments, process refunds, and manage any arrears or disputes. The lawful basis is performance of a contract and our legitimate interests in managing our business and recovering debts.
To communicate with you: we use your contact and communication data to respond to your enquiries, inform you of important changes to your contract or our terms, send service notifications, and deal with complaints. The lawful basis is performance of a contract and our legitimate interests in maintaining effective communication with our customers.
To maintain safety and security: we process security and access information, including CCTV recordings and, where applicable, vehicle registration details, to protect our customers, staff, and property, and to prevent and detect crime. The lawful basis is our legitimate interests in ensuring site security and, where necessary, compliance with legal obligations.
To comply with legal obligations: we may process your personal data in order to comply with our legal and regulatory obligations, including tax, accounting, and record-keeping requirements, and to cooperate with law enforcement or regulatory authorities. The lawful basis is compliance with a legal obligation.
To improve our services: we may use website and technical data, together with anonymised or aggregated customer information, to monitor performance, analyse trends, and improve our services. Where we rely on cookies or similar technologies, we will do so in accordance with applicable law and, where required, your consent. The main lawful bases are our legitimate interests in developing and improving our services and, for certain website technologies, your consent.
4. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet any legal, accounting, or reporting requirements.
Customer contract and billing records are typically retained for a period necessary to administer the contract and then for a period required by law for tax and accounting purposes. After these periods expire, data will be securely deleted or anonymised.
CCTV and other security-related data are usually kept for a limited period, sufficient to investigate incidents or respond to requests from law enforcement, after which they are overwritten or securely deleted, unless longer retention is required for the investigation of a specific incident.
Correspondence and communication records may be retained for a reasonable period to allow us to manage ongoing enquiries, resolve disputes, and improve our services. Where possible, we will minimise the data we retain and limit access to it.
5. Data Processors and Sharing of Personal Data
We may share your personal data with trusted third parties who act as data processors on our behalf. These processors only process your data in accordance with our instructions, are bound by confidentiality obligations, and must implement appropriate technical and organisational measures to protect your data.
These may include:
Payment processing providers who handle payments and refunds.
IT and cloud service providers who host our systems and data, provide storage or backup, and maintain our software and security infrastructure.
Professional advisers, including accountants and legal advisers, to the extent necessary to obtain advice or comply with legal obligations.
Security service providers, including CCTV system providers and, where relevant, access control or alarm monitoring services.
We may also share personal data with third parties where required to do so by law, in connection with legal proceedings, to respond to requests from law enforcement or regulatory authorities, or to protect our rights, property, and the safety of our customers and staff.
In the event of a sale, merger, or other restructuring of our business, we may transfer your personal data to a successor organisation, in which case we will ensure that any such transfer is carried out in accordance with data protection law and that you are informed where required.
6. International Transfers
If any of our data processors or service providers are located outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place to protect your personal data, such as the use of standard contractual clauses or other mechanisms recognised by data protection law. You may contact us for more information about these safeguards where relevant.
7. Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to prevent unauthorised access, loss, misuse, alteration, or disclosure. These measures may include secure access controls, encryption where appropriate, staff training, and regular review of our systems and procedures.
While we take all reasonable steps to protect your personal data, no system can be completely secure. We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.
8. Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data. These rights may be subject to certain conditions and legal exemptions, but we will always respond to any request in accordance with the law.
Right of access: you have the right to request confirmation that we process your personal data and to obtain a copy of that data, together with certain information about how we process it.
Right to rectification: you have the right to request that inaccurate or incomplete personal data we hold about you is corrected or completed.
Right to erasure: in certain circumstances, you can request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected or where you withdraw consent and there is no other legal basis for processing.
Right to restriction of processing: you may request that we restrict the processing of your personal data in specific situations, such as where you contest its accuracy or object to our processing.
Right to object: you have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis. We will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is required for legal claims.
Right to data portability: where processing is based on your consent or on a contract and carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, and machine-readable format and to request that we transfer it to another controller where technically feasible.
Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. Any changes will take effect when the updated policy is made available. We encourage you to review this policy regularly to stay informed about how we protect your personal data.
