Privacy Policy - Walthamstow Storage

This Privacy Policy explains how Walthamstow Storage collects, uses, shares, stores, and protects personal data in connection with its storage services. It applies to all Walthamstow Storage customers in the area, including prospective customers, account holders, authorised users, and any individual whose personal data is processed in connection with our services.

We are committed to handling personal data in a lawful, fair, and transparent manner, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable privacy laws. This policy sets out the categories of information we collect, the lawful bases on which we process it, how long we retain it, the third parties we use to process data on our behalf, and the rights available to individuals.

1. Information We Collect

We collect only the information necessary to provide and manage our storage services, meet legal obligations, and protect our business, customers, and facilities. The categories of personal data we may collect include:

Identity information: name, date of birth, and similar identifying details.
Contact information: postal address, email address, and telephone number.
Account and contract details: storage unit number, tenancy records, booking details, payment status, and service preferences.
Payment information: billing details, payment card data, bank account information, and transaction records. Where card payments are processed, this is generally handled by secure payment providers and not stored in full by us.
Verification data: documents or information used to verify identity, address, or eligibility where needed for security or legal compliance.
Security and access records: CCTV footage, entry logs, gate access records, alarm activity, and site visit history.
Communications: emails, letters, call notes, complaints, claims, and other correspondence relating to the service.
Technical data: device and usage data when you interact with our digital systems, such as IP address, browser type, and basic log information.

We normally collect personal data directly from you when you enquire about, sign up for, or use our storage services. We may also collect information from authorised representatives, payment providers, debt recovery partners, insurance providers, public sources, or other parties where appropriate and lawful.

2. How We Use Personal Data

We use personal data for the following purposes:

to assess enquiries and provide quotes or availability information;
to enter into and manage customer agreements;
to verify identity and prevent fraud;
to process payments, refunds, and account administration;
to allocate, secure, and manage storage units;
to communicate about your account, service changes, and operational matters;
to maintain safety and security on our premises;
to investigate incidents, disputes, damage, loss, or misuse;
to comply with legal, regulatory, tax, insurance, and accounting obligations;
to establish, exercise, or defend legal claims;
to improve our services, systems, and operational performance.

We only process personal data where we have a lawful basis to do so. In many cases, more than one lawful basis may apply.

3. Lawful Basis for Processing

Contract

We process personal data when it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes managing bookings, providing access to storage units, billing, and account administration.

Legal Obligation

We may process personal data where needed to comply with legal obligations, including accounting, tax, fraud prevention, safety requirements, and responding to lawful requests from authorities.

Legitimate Interests

We process certain personal data for our legitimate business interests, provided these interests are not overridden by your rights and freedoms. These interests may include protecting our premises, preventing theft or misuse, managing risk, improving services, handling disputes, and maintaining accurate business records. Where we rely on legitimate interests, we consider the impact on individuals and implement safeguards.

Consent

In limited situations, we may rely on your consent, for example for certain optional communications or specific data uses where consent is the most appropriate basis. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Sharing and Processors

We may share personal data with trusted third parties that process data on our behalf or act as independent controllers. These parties are used only where necessary and are subject to appropriate contractual and security safeguards.

Processors may include:

IT and cloud service providers that host our systems, store records, or support communications;
payment processors that handle card and electronic transactions;
security providers that support CCTV, access control, monitoring, or alarm systems;
accounting and bookkeeping providers that assist with financial administration;
insurance-related service providers where claims, cover, or incidents must be managed;
customer service and administration providers that help manage bookings, notices, or support tasks;
legal, audit, and professional advisers where advice or compliance support is needed;
debt recovery or credit reference partners where lawful and necessary for overdue accounts.

We may also disclose personal data if required by law, court order, law enforcement request, or to protect the rights, property, or safety of Walthamstow Storage, our customers, or others. Where we use processors, they are permitted to act only on our instructions and must protect the data appropriately.

5. Retention of Personal Data

We keep personal data only for as long as necessary for the purposes for which it was collected, including legal, accounting, operational, and security requirements. Retention periods vary depending on the type of data and the reason it is held.

Customer account and contract records are typically retained for the duration of the relationship and for a reasonable period afterwards to deal with claims, disputes, or legal obligations.
Financial and tax records are usually retained for the period required by law.
Security records and CCTV footage are retained for a limited period unless required longer for an investigation, incident, or legal process.
Communications and complaint records may be retained while the matter is active and thereafter for a period necessary for reference, compliance, or defence of claims.

When data is no longer needed, we delete it securely or anonymise it so that it can no longer identify you.

6. Data Security

We take appropriate technical and organisational measures to protect personal data against accidental loss, unlawful use, unauthorised access, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, system monitoring, and restricted permissions. While we do our best to protect data, no system can be guaranteed completely secure.

7. International Transfers

If personal data is transferred outside the UK, we ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms. We only transfer data where necessary and where suitable protection can be maintained.

8. Your Rights

Under data protection law, you may have the following rights in relation to your personal data:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete data.
Right to erasure: to request deletion of your data in certain circumstances.
Right to restriction: to ask us to limit how we use your data in certain situations.
Right to data portability: to receive certain data in a structured, commonly used format where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent.
Right to complain: to raise concerns with the relevant data protection authority if you believe your rights have been infringed.

To help protect privacy, we may need to verify your identity before responding to a request. Some rights may be limited where we have a legal obligation or another lawful reason to retain or process the information.

9. Children’s Data

Our services are intended for adults. We do not knowingly collect personal data from children unless it is provided incidentally in relation to an adult customer or where required for a specific lawful purpose. If we become aware that we have collected data from a child inappropriately, we will take reasonable steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data protection practices. The latest version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to remain informed about how personal data is handled.

Effective scope: This policy applies to all Walthamstow Storage customers in the area and to all personal data processed by us in connection with our storage operations.

By using our services, you acknowledge that your personal data may be processed as described in this Privacy Policy.