Storage Archway Customer Privacy Policy
This Privacy Policy explains how Storage Archway collects, uses, stores, and protects personal data of all Storage Archway customers in our service area. It also describes the lawful bases we rely on under the General Data Protection Regulation, how long we keep data, when we use processors, and the rights you have as a data subject.
Scope and Who We Are
This Privacy Policy applies to all customers and prospective customers of Storage Archway in our operating area, including individuals acting on behalf of businesses who use our storage services. It covers personal data collected in person at our facilities, by phone, through our website, and via any other communication channels we use to provide and manage our services.
Personal Data We Collect
We collect only the personal data that is necessary for the purposes described in this Privacy Policy. The categories of data we may collect include:
Identification and contact details, such as full name, postal address, billing address, and communication preferences. Account details, such as customer reference numbers, storage unit numbers, access credentials, and security permissions. Contract and billing information, such as service contracts, payment history, invoicing records, and basic payment details necessary to process transactions. Security and access data, such as gate or door entry logs, visit records, and, where used at our facilities, CCTV footage for security and safety. Communication records, such as enquiries, complaints, feedback, and correspondence related to your account or our services. Technical usage data, such as basic information about your interactions with our website or customer portals, including timestamps, pages visited, and device or browser information to maintain service security and performance.
We do not intentionally collect special categories of personal data such as health information, political opinions, or biometric data, and we ask that you do not provide such information to us unless it is strictly necessary and you choose to disclose it.
Purposes of Processing and Lawful Bases
We process personal data only where we have a lawful basis under the GDPR. Depending on the context, we rely on one or more of the following grounds:
Contractual necessity. We process data to enter into and perform our contract with you, including setting up and managing your storage unit, processing payments, providing customer support, and ensuring you can access the facility. Without this data, we may not be able to provide you with our services.
Legitimate interests. We process data where it is necessary for our legitimate business interests and where these interests are not overridden by your rights and freedoms. Examples include maintaining the security of our premises, preventing fraud, ensuring the integrity of access control systems, improving our services, and managing business operations and reporting.
Legal obligations. We process data where necessary to comply with legal and regulatory obligations, such as tax, accounting, and record-keeping requirements, and obligations to cooperate with law enforcement or regulatory authorities when required by applicable law.
Consent. In limited cases, we may rely on your consent, for example for sending certain types of direct marketing communications where this is required by law. Where we rely on consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
How We Use Your Personal Data
We use the data we collect for the following main purposes:
To create and manage customer accounts and storage agreements. To verify identity and authorize access to our facilities. To operate and monitor facility security, including access control systems and CCTV where in use. To handle payments, invoicing, and any related financial administration. To provide customer service, respond to enquiries, and handle feedback or complaints. To send necessary service-related communications, such as notices about access, safety, changes to terms, or issues that may affect your use of our services. To maintain and improve our services, premises, and business operations, including internal reporting and analysis carried out on an aggregated or de-identified basis where possible. To comply with applicable laws, respond to lawful requests, and protect our legal rights.
Data Processors and Sharing of Personal Data
We may share personal data with trusted third parties who act as processors on our behalf. These processors only process data under our instructions and are bound by contractual obligations to implement appropriate technical and organisational measures to protect your data.
Typical categories of processors include providers of information technology and system maintenance services, payment service providers and invoicing systems, security and access control system providers, and professional service firms that assist us with administration or business operations. We ensure that any processors we use are carefully selected and provide adequate guarantees regarding data protection.
We may also share data with other third parties where required by law, such as regulatory authorities, law enforcement bodies, and courts, or where necessary to establish, exercise, or defend legal claims. We do not sell your personal data.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including meeting any legal, accounting, or reporting requirements. The specific retention period depends on the type of data and the context of our relationship with you.
In general, customer account and contract data is retained for the duration of your storage agreement and for a defined period afterwards to handle queries, resolve disputes, and comply with legal obligations. Financial and transaction records are retained for the period required by applicable tax and accounting laws. Security records such as access logs and CCTV footage, where used, are retained for shorter periods unless required for an ongoing investigation, dispute, or legal proceeding.
Once data is no longer needed, we will securely delete or anonymise it so that it can no longer be associated with an identifiable individual.
International Transfers
Where we use processors or service providers located outside the United Kingdom or European Economic Area, or where data is otherwise transferred internationally, we take steps to ensure that an adequate level of protection is in place. This may include relying on adequacy decisions, or implementing appropriate safeguards such as standard contractual clauses.
Data Security
We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include access controls, secure storage, and restrictions on who can access personal data within our organisation and among our processors.
Your Data Protection Rights
Under the GDPR, you have several rights in relation to your personal data, subject to certain conditions and exceptions in the law. These include:
Right of access. You can request confirmation of whether we process your personal data and obtain a copy of that data.
Right to rectification. You can ask us to correct inaccurate or incomplete personal data that we hold about you.
Right to erasure. In certain circumstances, you can request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected or where you withdraw consent and there is no other legal basis for processing.
Right to restriction of processing. You can request that we restrict the processing of your personal data in certain situations, such as while we verify its accuracy or consider an objection.
Right to data portability. Where processing is based on consent or on a contract and carried out by automated means, you may request to receive your data in a structured, commonly used, and machine-readable format and to have it transmitted to another controller where technically feasible.
Right to object. You can object to processing based on our legitimate interests, including profiling, on grounds relating to your particular situation. You also have the right to object at any time to the use of your data for direct marketing.
Rights related to consent. Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.
Exercising Your Rights and Complaints
If you wish to exercise any of your data protection rights, or if you have questions about how we handle your personal data, you can contact us using the contact methods published on our main customer information channels. We may need to verify your identity before responding to certain requests to protect your privacy and security.
You also have the right to lodge a complaint with your local data protection authority if you believe that our processing of your personal data infringes applicable data protection laws. We encourage you to contact us first so that we can attempt to resolve any concerns directly.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data processing practices. Any revised version will be made available through our usual customer communication channels and will apply from the date of publication. We recommend that you review this Privacy Policy periodically to stay informed about how we protect your personal data.
