Storage Barbican Privacy Policy
This Privacy Policy explains how Storage Barbican collects, uses, stores and protects personal data relating to our customers and prospective customers in our service area. It also explains your rights under the UK General Data Protection Regulation and any applicable local data protection laws. By using our services, contacting us or visiting our premises, you acknowledge that you have read and understood this Privacy Policy.
Who this Privacy Policy applies to
This Privacy Policy applies to all individuals who use Storage Barbican services, make enquiries about our services, visit our premises, or otherwise interact with us in our operating area. It also applies to individuals who act on behalf of business customers, such as directors, employees or authorised representatives whose personal data we process in connection with the provision of storage and related services.
Personal data we collect
We may collect and process the following categories of personal data, depending on how you interact with us and which services you use:
Identification and contact details such as name, residential or business address, billing address, nationality, date of birth, and identification document details where required for security or legal purposes.
Contact and communication details such as email address, postal address and any other contact details you choose to provide, along with records of communications with us, including enquiries, complaints and feedback.
Contract and account information such as storage unit number, contract dates, services selected, payment history, access rights to units, and correspondence relating to your account.
Payment and transaction data such as payment method, partial card details where processed by our payment processor, payment status, invoices and receipts. We do not store full payment card details when card payments are processed by a third-party payment processor.
Security and access data such as CCTV recordings on and around our premises, access control logs, entry and exit records, and data relating to the use of security tokens or codes where applicable.
Technical and usage data relating to our online services such as internet protocol address, device information, and basic usage information if you use any online account tools we provide.
How we collect personal data
We collect personal data directly from you when you request a quote, sign a storage agreement, make a payment, contact us by any communication channel, visit our premises, or use any online tools we provide for account management.
We may also receive personal data from third parties where this is necessary for the performance of our contract with you or where you have authorised those third parties to share information with us. These may include payment service providers, identification verification services, or persons you appoint as authorised contacts for your account.
Purposes and lawful bases for processing
We process your personal data only when we have a valid lawful basis under data protection law. The purposes for which we process data and the associated lawful bases include:
To provide storage and related services. We process identification, contact, contract and payment data to set up and manage your account, allocate units, process payments, and administer your contract. The lawful basis is performance of a contract or taking steps at your request before entering into a contract.
To comply with legal and regulatory obligations. We may process identification, account, payment and security data to comply with tax, accounting, fraud prevention, crime prevention and other regulatory obligations. The lawful basis is compliance with a legal obligation.
To protect our premises, customers and staff. We process CCTV recordings and access control data to maintain the security of the premises, to detect and investigate incidents, and to protect property and safety. The lawful basis is our legitimate interests in ensuring security and preventing crime.
To manage customer relationships and communications. We process contact and communication details to respond to enquiries, handle complaints, provide service notifications and manage renewals. The lawful basis is performance of a contract and our legitimate interests in providing effective customer service.
To send service-related information and limited marketing communications. We may send you information about similar services that we provide where permitted by law. The lawful basis is our legitimate interests in promoting and developing our business, and, where required, your consent. You may opt out of marketing communications at any time.
To improve our services and operations. We may use aggregated or de-identified information derived from your data to help us review, maintain and improve our services and premises. The lawful basis is our legitimate interests in operating and developing our business.
Data retention
We retain personal data for no longer than is necessary for the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements.
Contract and billing records, including basic account information and transaction history, are generally retained for a period that allows us to comply with applicable tax and financial record-keeping obligations. CCTV footage and access control data are typically retained for a shorter period, limited to what is required for security and incident investigation purposes, unless an incident requires a longer retention period.
When we no longer need personal data, we will securely delete or anonymise it so that it can no longer be associated with an identifiable individual.
Data processors and sharing of personal data
We may share your personal data with carefully selected third parties who act as data processors on our behalf. These processors are only permitted to process your data in accordance with our instructions, for specified purposes, and are required to implement appropriate technical and organisational measures to protect your data.
Typical categories of processors include providers of payment processing services, cloud-based data storage and backup services, customer relationship management tools, access control and security system providers, and professional advisers who support our operations.
We may also share personal data with third parties where required by law, regulation or court order, or where it is necessary to protect the safety of individuals or the security of our premises. In the event of a business reorganisation, merger or transfer, personal data may be shared with parties involved in that process, subject to appropriate safeguards.
We do not sell your personal data to third parties.
International transfers
If we transfer personal data outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place to protect your personal data, such as the use of standard data protection clauses approved by relevant authorities or transfers to countries that have been recognised as providing an adequate level of data protection.
How we protect your data
We implement technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures may include access controls, encryption, secure storage systems, staff training in data protection and written policies and procedures that govern how data is handled.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data, subject to certain conditions and exemptions:
The right of access. You have the right to request confirmation that we process your personal data and to obtain a copy of that data, along with information about how we use it.
The right to rectification. You have the right to request that inaccurate or incomplete personal data about you is corrected or updated.
The right to erasure. In some circumstances, you may have the right to request that your personal data is deleted, for example where it is no longer necessary for the purposes for which it was collected and we have no legal obligation to retain it.
The right to restrict processing. You may request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to our processing.
The right to data portability. Where we process your data on the basis of your consent or a contract and by automated means, you may have the right to receive your personal data in a structured, commonly used and machine-readable format and to request that it is transmitted to another controller where technically feasible.
The right to object. You have the right to object to processing of your personal data that is based on our legitimate interests, including profiling based on those interests. You also have the right to object at any time to the processing of your personal data for direct marketing purposes.
The right to withdraw consent. Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent.
You also have the right to lodge a complaint with a supervisory authority if you believe that your data protection rights have been infringed.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or data protection practices. Any changes will take effect when the updated Privacy Policy is made available. You should review this Privacy Policy periodically to stay informed about how we process your personal data.
