Storage Enfield Lock Privacy Policy
This Privacy Policy explains how Storage Enfield Lock collects, uses, stores, and protects personal data relating to our customers and prospective customers in the Enfield Lock area. It also sets out your rights under applicable data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018.
By using Storage Enfield Lock services or contacting us in relation to our services, you acknowledge that you have read and understood this Privacy Policy.
Scope and Controller Responsibility
This Privacy Policy applies to all Storage Enfield Lock customers, former customers, and prospective customers in the Enfield Lock area, including individuals, sole traders, and representatives of business customers who interact with us in any way.
Storage Enfield Lock determines the purposes and means of processing your personal data and acts as the data controller for that data.
Types of Personal Data We Collect
We may collect and process the following categories of personal data, depending on how you interact with us and the services you use:
Identification and contact data: name, postal address, billing address, contact address, and similar identifying information you provide.
Account and service data: customer number, unit number, contract details, start and end dates of your storage agreement, information about the size and type of storage unit, access control records where applicable, and records of payments due or received.
Payment and transaction data: limited payment information such as payment method, payment history, and billing records processed through our payment service providers. We do not store full card details when card payments are processed by third party providers.
Communication data: records of your enquiries, complaints, feedback, and any other communications with us, whether in person, by post, or by other means.
Security and access data: logs of access to the site and storage units where access control or security systems are in use, including time and date of entry and exit, and where in operation, closed circuit television images captured for security purposes.
Technical data: basic technical information relating to your access to our online presence where applicable, such as device type and general configuration data provided by your device or browser.
How We Collect Your Personal Data
We may collect personal data directly from you when you enquire about our services, request a quote, enter into a storage agreement, make payments, visit our site, or communicate with us for any reason.
We may also receive personal data from third parties where this is necessary to set up or manage your account, process payments, undertake identity or credit checks where applicable, or comply with legal obligations.
Purposes and Lawful Bases for Processing
We process your personal data only where we have a lawful basis to do so. The main purposes and corresponding lawful bases are as follows:
To provide storage services: we process identification, contact, account, and payment data to set up, administer, and perform your storage agreement. The lawful basis is performance of a contract or taking steps at your request before entering into a contract.
To manage billing and payments: we process payment and transaction data to issue invoices, process payments, handle arrears, and manage refunds. The lawful basis is performance of a contract and our legitimate interest in managing our business operations.
To maintain security and prevent crime: we process security and access data, including access logs and CCTV images where used, to protect customers, staff, property, and stored goods, and to prevent and detect crime. The lawful basis is our legitimate interests in ensuring site security and, where necessary, compliance with legal obligations.
To communicate with you: we process identification, contact, and communication data to respond to enquiries, provide customer support, send service-related notices about your unit or agreement, and handle complaints. The lawful basis is performance of a contract and our legitimate interests in providing effective customer service.
To comply with legal and regulatory obligations: we may process any relevant personal data needed to comply with accounting, tax, law enforcement, or other legal requirements. The lawful basis is compliance with a legal obligation.
To protect and enforce our rights: we may process personal data to establish, exercise, or defend legal claims, recover debts, or manage disputes. The lawful bases are our legitimate interests and, where appropriate, legal obligations.
Data Retention
We retain personal data only for as long as is reasonably necessary for the purposes described in this Privacy Policy, including to meet legal, regulatory, tax, accounting, or reporting requirements.
Customer account and contract data are generally retained for the duration of your agreement and for a period after it ends to deal with queries, disputes, or potential legal claims, and to meet legal record-keeping requirements.
Payment and transaction records are retained for the period required by applicable tax and accounting laws.
Security and CCTV records, where used, are retained for a limited period appropriate to the security purpose and then securely deleted or overwritten, unless required for evidence in connection with an incident or legal claim.
When we no longer have a lawful basis or business need to retain your personal data, it will be securely deleted, anonymised, or otherwise irreversibly removed from our systems.
Data Processors and Third Party Recipients
We may share your personal data with third parties who act as data processors on our behalf to support the operation of our business and the delivery of our services. These may include:
Payment service providers who process card or electronic payments and manage payment security.
IT and cloud service providers who host or maintain our systems, data storage, and backup services.
Security service providers involved in access control, CCTV operation, or site security.
Professional advisers such as accountants, auditors, or legal advisers where this is necessary to obtain professional advice or meet our legal obligations.
These processors are only permitted to process your personal data in accordance with our instructions, for the purposes specified by us, and subject to appropriate confidentiality and security obligations.
We may also share personal data with third parties acting as independent controllers where required by law or where necessary to protect our legal rights, including law enforcement authorities, regulatory bodies, or courts.
International Data Transfers
Where it is necessary for us to transfer your personal data outside the United Kingdom or the European Economic Area, we will only do so where appropriate safeguards are in place to protect your data, such as adequacy decisions, standard contractual clauses, or other legally recognised mechanisms, and we will ensure that your rights continue to be protected.
Security of Your Personal Data
We implement appropriate technical and organisational measures designed to protect your personal data from unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, physical security at our site, secure storage systems, and staff training on data protection responsibilities.
While we take reasonable steps to protect your personal data, no system can be guaranteed to be completely secure. We continually review and enhance our security measures in line with applicable standards and legal requirements.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data, subject to certain conditions and lawful limitations:
Right of access: you can request confirmation of whether we process your personal data and obtain a copy of that data, along with information about how it is used.
Right to rectification: you can request that inaccurate or incomplete personal data be corrected or completed.
Right to erasure: in certain circumstances, you can request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected, or where you withdraw consent and no other lawful basis applies.
Right to restriction of processing: you can request that we restrict the processing of your personal data in specific situations, such as while we verify its accuracy or consider an objection.
Right to object: you can object to processing based on our legitimate interests, on grounds relating to your particular situation. We will stop processing unless we can demonstrate compelling legitimate grounds or the processing is required for legal claims.
Right to data portability: where processing is based on your consent or on a contract and carried out by automated means, you can request that we provide your personal data in a structured, commonly used, machine-readable format or transmit it to another controller where technically feasible.
Right to withdraw consent: where we rely on your consent for particular processing activities, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.
You also have the right to lodge a complaint with the applicable data protection supervisory authority if you believe that your rights have been infringed.
Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we provide. Any updates will be effective from the date of publication. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.
Continued use of Storage Enfield Lock services after changes to this Privacy Policy are published will be taken as your acknowledgement of those changes, to the extent permitted by law.
