Privacy Policy - Shepherdsbush Storage

Shepherdsbush Storage is committed to protecting the privacy and personal data of all customers in the area. This Privacy Policy explains how we collect, use, store, share, and protect personal data in accordance with the UK GDPR and the Data Protection Act 2018. It applies to all Shepherdsbush Storage customers in the area, including prospective customers, current customers, former customers, and any individuals who interact with us in relation to storage services.

1. Who We Are

For the purposes of data protection law, Shepherdsbush Storage acts as the data controller in relation to the personal data we collect and use. This means we decide why and how your personal data is processed. We are responsible for ensuring that your information is handled lawfully, fairly, and transparently.

This Policy covers data collected when you:

request information about storage services;
enter into a storage agreement;
use our storage facilities or related services;
communicate with us by phone, email, online forms, or in person;
visit our premises, where CCTV or access controls may be in use;
make payments or manage your account.

2. Personal Data We Collect

We collect only the personal data necessary for the operation and administration of our services. The categories of data we may collect include:

2.1 Identity and contact details

full name;
address;
email address;
telephone number;
date of birth where needed for identity verification;
business name and role, where relevant.

2.2 Account and contract information

storage unit details;
agreement dates;
billing preferences;
payment status;
service history;
communications regarding your account.

2.3 Financial and transaction data

payment records;
invoice information;
bank or card payment details processed through payment providers;
refund and adjustment records.

2.4 Security and access data

access logs;
CCTV images where applicable;
vehicle registration information where used for site access;
incident reports;
security-related notes.

2.5 Technical and communication data

IP address and device information if you use digital services;
email correspondence;
records of complaints, requests, and service interactions.

We do not intentionally collect special category data unless it is necessary and lawful to do so. If such data is provided to us, it will be handled with extra care and only where appropriate legal safeguards are in place.

3. How We Use Your Data

We use personal data for the following purposes:

to provide storage services and manage agreements;
to verify identity and prevent fraud;
to process payments and maintain accounting records;
to communicate with you about your account, billing, or service updates;
to manage site security, access, and property protection;
to handle queries, complaints, and disputes;
to comply with legal obligations, including tax, accounting, and regulatory requirements;
to defend or establish legal claims;
to improve our services and operational efficiency.

We will not use your personal data for purposes that are incompatible with those stated above without first informing you and, where required, obtaining a valid lawful basis.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for each use of your personal data. Shepherdsbush Storage relies on the following lawful bases:

4.1 Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes setting up accounts, providing storage facilities, collecting payment, and managing customer services.

4.2 Legal obligation

We may process data where necessary to comply with legal obligations, such as tax compliance, accounting rules, fraud prevention requirements, and lawful requests from public authorities.

4.3 Legitimate interests

We may process data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. This may include protecting premises, improving service quality, preventing misuse, and resolving operational issues. Where we rely on legitimate interests, we consider and balance the potential impact on you.

4.4 Consent

In limited situations, we may rely on your consent, for example for certain optional communications or specific uses that are not covered by another lawful basis. Where consent is used, you may withdraw it at any time.

5. Data Sharing and Processors

We may share personal data with trusted third parties that support our operations. These parties act as processors where they process data on our behalf and under our instructions, or as independent controllers where they determine their own purposes for processing.

Examples of processors and service providers may include:

payment service providers;
accounting and bookkeeping services;
IT hosting, software, and support providers;
security and CCTV maintenance providers;
customer communication tools;
professional advisers such as auditors or legal advisers.

We may also disclose personal data to:

law enforcement agencies or regulators where required by law;
debt recovery or dispute resolution services, where lawful and necessary;
insurers, courts, or other parties involved in claims or legal proceedings.

All processors are required to provide appropriate data protection safeguards, process data only on our instructions, and maintain confidentiality and security. We do not sell personal data.

6. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, or reporting requirements. Retention periods vary depending on the type of data and the reason for holding it.

In general:

contract and account records are retained for the duration of the customer relationship and for a period afterward;
payment and financial records are kept in line with statutory accounting and tax requirements;
security records such as access logs and CCTV footage are retained for a limited period unless needed for investigation or legal action;
correspondence and complaint records are retained long enough to manage the issue and any related follow-up;
where legal claims are possible, data may be retained for the relevant limitation period.

When data is no longer required, it is securely deleted, anonymised, or otherwise disposed of in a safe and lawful manner.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, staff confidentiality obligations, secure storage, encryption where suitable, and regular review of our procedures.

Although we take data security seriously, no system can be guaranteed to be completely secure. If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will respond in accordance with applicable law.

8. Your Rights

Under the UK GDPR, you have several rights in relation to your personal data. These rights may apply in full or in part depending on the legal basis for processing and the circumstances of the request.

8.1 Right of access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data.

8.2 Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

8.3 Right to erasure

In certain circumstances, you may request deletion of your personal data. This right is not absolute and may be limited where we must keep data for legal reasons.

8.4 Right to restriction

You may request that we restrict the processing of your data in certain situations, such as while accuracy or objection issues are being reviewed.

8.5 Right to object

You may object to processing based on legitimate interests. We will stop processing unless we have compelling grounds that override your interests, rights, and freedoms, or the processing is needed for legal claims.

8.6 Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request a copy of certain data in a structured, commonly used format.

8.7 Right to withdraw consent

If we rely on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

8.8 Right to complain

You have the right to raise concerns with the appropriate data protection authority if you believe your data rights have been infringed.

9. International Transfers

If personal data is transferred outside the UK, we will ensure that suitable safeguards are in place to protect it, such as adequacy regulations or approved contractual protections. We take steps to ensure that overseas processing remains consistent with applicable data protection standards.

10. Children’s Data

Our services are generally intended for adults. We do not knowingly collect personal data from children unless it is necessary in connection with a lawful customer relationship and appropriate safeguards are in place.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, services, or internal practices. The most current version will apply to your use of Shepherdsbush Storage services. We encourage customers to review it periodically to stay informed about how personal data is handled.

12. Acceptance of This Policy

By using Shepherdsbush Storage services or providing personal data to us, you acknowledge that you have read and understood this Privacy Policy. We will always aim to process your personal data fairly, transparently, and in a way that respects your privacy rights.

This Privacy Policy applies to all Shepherdsbush Storage customers in area.