Privacy Policy - Snaresbrook Storage

This Privacy Policy explains how Snaresbrook Storage collects, uses, stores, and protects personal data in relation to our services. It applies to all Snaresbrook Storage customers in the area, including prospective customers, account holders, and individuals who interact with us in connection with storage services, access arrangements, billing, or customer support. We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable privacy laws.

1. Who we are

Snaresbrook Storage provides storage-related services to individuals and businesses. For the purposes of data protection law, we act as the data controller for the personal data we collect and use in connection with our services. This means we determine the purposes and means of processing personal data.

We take our responsibilities seriously and aim to process personal data fairly, lawfully, and transparently. We only collect information that is relevant and necessary for providing and managing storage services, meeting legal obligations, and improving our operations.

2. Personal data we collect

We may collect and process different types of personal data depending on your interaction with us. This may include:

Identity data: name, title, date of birth, and identification details where required.
Contact data: address, email address, telephone number, and billing address.
Account data: customer account details, booking information, service preferences, and payment status.
Financial data: payment card details, bank details, transaction records, and invoice information.
Access and security data: entry records, key or access card usage, and CCTV images where applicable.
Communication data: enquiries, correspondence, complaints, and service notes.
Technical data: device information, browser data, and usage logs if you interact with our digital systems.

We may also collect information from third parties where necessary, such as payment providers, identity verification services, insurers, or legal and regulatory authorities. Where we do so, we only collect data that is relevant and proportionate to the service or legal obligation involved.

3. How we use your personal data

We use personal data for the following purposes:

to register and manage customer accounts;
to provide storage services and related support;
to process payments, refunds, and invoices;
to verify identity and prevent fraud;
to manage access to storage facilities and ensure security;
to communicate important service updates or notices;
to respond to enquiries, complaints, and disputes;
to comply with legal and regulatory requirements;
to maintain accurate business records;
to improve our services, systems, and customer experience.

We do not use personal data for purposes that are incompatible with those stated in this policy unless we have a lawful basis to do so and, where required, we inform you in advance.

4. Lawful basis for processing

Under UK GDPR, we must have a lawful basis for each type of processing. We rely on the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes setting up your account, storing your items, managing access, handling payments, and providing customer support connected to the service.

Legal obligation

We process personal data where required to comply with legal duties, such as tax obligations, accounting requirements, fraud prevention, and requests from lawful authorities.

Legitimate interests

We may process personal data where it is necessary for our legitimate interests, provided your rights and freedoms do not override those interests. This may include protecting our premises, preventing misuse, improving service delivery, and maintaining operational security. When we rely on legitimate interests, we consider the impact on individuals and ensure safeguards are in place.

Consent

In limited circumstances, we may rely on your consent, for example for certain optional communications or specific processing activities. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Data retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements. Retention periods vary according to the type of data and the reason for processing.

Typical retention periods may include:

Customer and contract records: retained for the duration of the relationship and for a reasonable period afterwards to manage queries or disputes.
Financial and tax records: retained in line with statutory accounting and tax requirements.
Security records: retained for a limited period unless needed longer for an incident, investigation, or legal claim.
Communications: retained as long as needed to resolve the matter or for record-keeping purposes.

When personal data is no longer needed, we will delete, anonymise, or securely archive it in accordance with our retention procedures. Retention periods are reviewed regularly to ensure they remain appropriate.

6. Processors and third parties

We may share personal data with carefully selected third parties that help us operate our services. These may act as processors or, in some cases, independent controllers. We only share data where necessary and ensure that appropriate contractual and security safeguards are in place.

Examples of processors may include:

payment processing providers;
IT and cloud hosting providers;
customer relationship and communication service providers;
security and surveillance service providers;
professional advisers such as accountants, auditors, or legal advisers;
identity verification or fraud prevention service providers.

We may also disclose personal data to law enforcement, regulators, courts, or other public authorities where required by law or where disclosure is necessary to protect our rights, property, staff, customers, or the public.

Where processors handle personal data on our behalf, they are required to act only on our instructions, keep data secure, and comply with data protection law. We do not permit processors to use your personal data for their own unrelated purposes.

7. Data security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, staff training, secure storage, encryption where appropriate, and monitoring of our systems and facilities.

Although we take reasonable steps to protect data, no system can be guaranteed to be completely secure. If we become aware of a personal data breach that poses a risk to individuals, we will respond in line with our legal obligations, including notifying affected individuals and relevant authorities where required.

8. Your rights

Under data protection law, you have a number of rights in relation to your personal data. Subject to legal limits and exemptions, these include:

Right of access: you can request a copy of the personal data we hold about you;
Right to rectification: you can ask us to correct inaccurate or incomplete information;
Right to erasure: you can ask us to delete your personal data in certain circumstances;
Right to restriction: you can ask us to limit how we use your data in certain situations;
Right to data portability: you can request data you provided to us in a structured, commonly used format where applicable;
Right to object: you can object to processing based on legitimate interests or direct marketing;
Right to withdraw consent: where processing is based on consent, you can withdraw it at any time;
Rights related to automated decision-making: you have rights where decisions are made solely by automated means with legal or similarly significant effects, if applicable.

We will respond to valid requests within the time limits required by law. To protect privacy, we may need to verify your identity before fulfilling a request.

9. Marketing communications

We may send service-related communications that are necessary for the administration of your account or storage arrangements. We will only send marketing communications where permitted by law, and you may opt out at any time where such communications are not required for service delivery.

We respect your choices and aim to ensure any communications are relevant, proportionate, and lawful.

10. International transfers

If personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place to protect it. These may include adequacy regulations, standard contractual clauses, or other legally recognised transfer mechanisms. We assess such transfers to ensure an adequate level of protection is maintained.

11. Children’s data

Our services are not primarily directed at children, and we do not knowingly collect personal data from children unless it is necessary in connection with an account or service arrangement and lawfully provided by a responsible adult or authorised individual. If we learn that we have collected data unlawfully, we will take appropriate steps to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational requirements. Any updated version will apply from the date it is published or otherwise communicated. We encourage you to review the policy periodically to remain informed about how your data is used.

13. Additional information

If a conflict arises between this policy and any specific contract terms or legal requirements, the latter will prevail to the extent required by law. Nothing in this policy limits your statutory rights.

This Privacy Policy is intended to provide a clear, fair, and transparent explanation of our data handling practices. By using our services, you acknowledge that your personal data may be processed in accordance with this policy and applicable law.