Storage Chalk Farm Privacy Policy
This Privacy Policy explains how Storage Chalk Farm collects, uses, stores and shares personal data relating to customers and prospective customers in the Storage Chalk Farm service area. It also explains your rights under the UK General Data Protection Regulation and the Data Protection Act 2018.
By using our storage services, making an enquiry or otherwise interacting with Storage Chalk Farm, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage Chalk Farm customers and prospective customers in our operating area, including individuals, sole traders and representatives of corporate clients. It covers personal data collected online, by telephone, in person at our facilities and through any other communication channels we use to provide our services.
Data Controller
Storage Chalk Farm is the data controller in relation to the personal data described in this Privacy Policy. As data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring that such processing complies with applicable data protection laws.
Personal Data We Collect
We may collect and process the following categories of personal data when you use our services or contact us:
Identification and contact details: name, postal address, billing address, contact address, and other basic contact information you provide, such as general communication preferences.
Account and contract data: customer reference numbers, storage unit numbers, contract start and end dates, payment history, information about services you have purchased or enquired about, and correspondence relating to your account.
Payment and financial information: information required to process payments such as partial card details or transaction references. We do not store full payment card details when using third-party payment processors.
Security and access data: records of facility access where relevant, such as entry times using access control systems, CCTV footage from cameras in and around our premises, and records of any security incidents.
Communications data: information contained in your enquiries, feedback, complaints or other communications with us, including any information you choose to provide in those communications.
Technical data: limited technical information from your interactions with our online services, such as device information, basic log data and information required to maintain the security and performance of our website.
Purposes and Lawful Bases for Processing
We only process your personal data where we have a lawful basis under data protection law. Depending on the context, we may rely on the following lawful bases:
Contract: We process your personal data to enter into a storage agreement with you and to perform our contract, such as setting up your account, managing your bookings, enabling access to your storage unit, handling payments and responding to your service-related queries.
Legal obligations: We process certain personal data to comply with legal and regulatory requirements, including record-keeping obligations, tax and accounting rules, and health and safety or security-related obligations.
Legitimate interests: We process personal data where it is necessary for our legitimate interests or those of a third party, and where your interests and fundamental rights do not override those interests. These legitimate interests include managing and improving our services, maintaining the security of our premises and systems, preventing fraud or misuse of our facilities, handling general enquiries and defending legal claims.
Consent: In some cases we may rely on your consent, for example for certain forms of direct marketing where consent is required by law. When we rely on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet any legal, accounting or reporting requirements.
In general, we retain customer account and contract information for the duration of your relationship with us and for a period after your contract ends, in line with applicable limitation periods for legal claims and statutory retention requirements. CCTV footage, access control records and similar security data are retained for shorter periods, unless required to investigate an incident or comply with a legal obligation.
We regularly review the personal data we hold and securely delete or anonymise data that is no longer required for the purposes for which it was collected.
Data Processors and Third Parties
We may engage third-party service providers to process personal data on our behalf. These providers act as data processors and are only permitted to process your data in accordance with our documented instructions and for the purposes we specify.
Typical categories of processors include payment processing providers, IT hosting and support services, security and access control service providers, document storage and shredding services, and professional advisers such as accountants or legal advisers where necessary.
We ensure that all processors are bound by appropriate contractual obligations to protect your personal data, maintain its confidentiality and implement suitable technical and organisational measures to safeguard it.
We may also share personal data with other third parties where required by law, to protect our rights or the rights of others, or in connection with a business reorganisation. Any such sharing will always be carried out in accordance with data protection law.
International Transfers
Where we use service providers or systems that involve the transfer of personal data outside the United Kingdom or the European Economic Area, we take steps to ensure that your data is afforded an equivalent level of protection. This may include using countries that have been recognised as providing an adequate level of protection or implementing standard contractual clauses or other appropriate safeguards.
Security of Your Personal Data
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, unlawful processing, accidental loss, destruction or damage.
Measures may include access controls, secure storage, encryption where appropriate, regular security reviews, staff training and policies designed to ensure that personal data is handled responsibly and in line with this Privacy Policy.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data, subject to certain conditions and exemptions.
Right of access: You have the right to obtain confirmation as to whether we process your personal data and to request a copy of the personal data we hold about you.
Right to rectification: You have the right to request the correction of inaccurate or incomplete personal data we hold about you.
Right to erasure: In certain circumstances, you may have the right to request the deletion of your personal data, for example where it is no longer necessary for the purposes for which it was collected or where you withdraw consent and there is no other lawful basis for processing.
Right to restriction: You may have the right to request that we restrict the processing of your personal data in certain situations, such as while we verify the accuracy of the data or consider an objection you have raised.
Right to object: You have the right to object to processing based on our legitimate interests, including profiling, and to object at any time to your personal data being used for direct marketing.
Right to data portability: In certain cases, you have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format and to request that we transmit it to another controller where technically feasible.
Where we rely on consent, you also have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Exercising Your Rights and Complaints
If you wish to exercise any of your data protection rights or have questions about how we handle your personal data, you can contact us using the details provided on our website or in your contract documentation.
You also have the right to lodge a complaint with the data protection supervisory authority in the United Kingdom if you are concerned about the way we process your personal data.
Updates to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. When we make significant changes, we will take appropriate steps to bring the update to your attention. The most recent version of the Privacy Policy will apply to the processing of your personal data.
We encourage you to review this Privacy Policy periodically so that you remain informed about how we protect your personal data at Storage Chalk Farm.
