Storage Cudham Privacy Policy
This Privacy Policy explains how Storage Cudham collects, uses and protects personal data about customers and prospective customers in our service area. It is intended to meet the requirements of the UK General Data Protection Regulation and related data protection laws. By using our services, contacting us or providing your personal data, you acknowledge that you have read and understood this Privacy Policy.
Scope of this Privacy Policy
This Privacy Policy applies to all individuals and organisations who enquire about, use or have used storage or related services provided by Storage Cudham within our operating area. It covers personal data collected through any channel, including in person, by post, through our website forms, and through other written or verbal communications.
Data Controller
Storage Cudham is the data controller in respect of the personal data we collect and process about you. As data controller we determine the purposes and means of processing your personal data and are responsible for ensuring that such processing complies with applicable data protection law.
Personal Data We Collect
We may collect and process the following categories of personal data about you when you use our services or contact us:
Identification details such as full name, title and proof of identity details that you provide to us when entering into a storage agreement or making an enquiry. Contact details such as postal address, billing address, service address, and any contact names for your account. Communication details such as email address and correspondence history, including written communications and records of telephone or in person conversations relevant to your account or enquiry. Contract and account information such as contract start and end dates, unit numbers, access arrangements, payment status and notes relating to the provision of storage or related services. Payment and transaction information such as method of payment, payment history and amounts paid. We do not store full card details; these are handled by our payment service providers. Usage and access information such as access logs for storage facilities, including dates and times of entry where applicable, and records relating to security and safety within our premises. Compliance and security information such as copies of documentation or information necessary to comply with legal, regulatory or insurance requirements and to prevent fraud or misuse of services.
We generally do not seek to collect special categories of personal data. If you choose to provide such information to us in connection with your contract or enquiry, it will be processed only where strictly necessary and in accordance with data protection law.
How We Collect Your Data
We collect personal data directly from you when you contact us to request information, a quotation or to make a booking, when you complete forms or agreements, when you communicate with us regarding your account, and when you access or use our storage facilities. We may also receive information from third parties who act on your behalf, such as authorised representatives or professional advisers, where they are legitimately involved in your contract or enquiry.
Lawful Bases for Processing
We process your personal data only where we have a lawful basis to do so under data protection law. Depending on the context, this may include:
Contract: Processing that is necessary to enter into a storage agreement with you or to perform our obligations under an existing agreement, such as managing bookings, providing access to units, handling payments and responding to service requests. Legal obligation: Processing that is necessary to comply with legal and regulatory duties, including tax and accounting rules, health and safety requirements, insurance obligations and cooperation with lawful requests from public authorities. Legitimate interests: Processing that is necessary for our legitimate business interests, provided that your interests and fundamental rights do not override those interests. This includes managing and improving our services, safeguarding our premises, preventing fraud and misuse, handling queries and disputes, and maintaining accurate business records. Consent: In limited circumstances, we may rely on your consent, for example for specific types of optional communications not directly related to your contract. Where we rely on consent, you have the right to withdraw it at any time.
How We Use Your Personal Data
We use the personal data we collect for the following purposes:
To respond to enquiries, provide quotations and supply information about our services that you request. To set up, administer and manage storage contracts, including identity verification, access arrangements and updates about your unit or account. To process payments, issue invoices and manage billing queries or arrears. To maintain security and safety at our premises, including monitoring access and investigating incidents or complaints. To manage our relationship with you, including communications about changes to terms, notices regarding your unit, renewals and termination of services. To keep internal records that are necessary for business planning, audit, insurance and compliance purposes. To comply with legal and regulatory obligations, including those relating to tax, accounting, record keeping, fraud prevention and requests from law enforcement or regulators.
Data Processors and Other Recipients
We may share your personal data with trusted third parties who process data on our behalf in order to provide our services. These processors may include:
Payment service providers who process card payments and manage secure payment transactions. IT service providers who support our systems, storage of digital records, and security of our data. Professional advisers such as accountants or legal advisers where required for the management of our business and compliance with legal obligations. Insurers and insurance intermediaries where necessary in connection with insurance policies, claims or risk management.
These data processors are only permitted to use your personal data in accordance with our instructions and are required to implement appropriate technical and organisational measures to protect your data.
We may also share personal data, where lawful and necessary, with public authorities, law enforcement bodies, regulatory organisations or courts, for example in response to lawful requests or to establish, exercise or defend legal claims.
Data Retention
We keep personal data only for as long as is necessary for the purposes for which it was collected, including for the purposes of satisfying legal, accounting or reporting requirements. The precise retention period will depend on the nature of the information and the reason for its collection.
As a general guideline, we retain basic customer and contract records for a period that allows us to manage ongoing relationships, respond to queries and exercise or defend potential legal claims after the end of a contract. Financial and transaction records may be retained for longer periods to comply with statutory tax and accounting rules. Access logs and other security-related records may be kept for shorter periods unless they are required in connection with an incident, dispute or investigation.
When personal data is no longer required, we take steps to delete it securely or to anonymise it so that it can no longer be associated with you.
Data Security
We take appropriate technical and organisational measures to protect the personal data we hold from unauthorised access, accidental loss, destruction or damage. These measures may include physical security at our sites, restricted access to personal data, and safeguards implemented by our IT and payment service providers. While no system can be guaranteed as completely secure, we regularly review our protections and adjust them in light of legal requirements and industry practice.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to your personal data, subject to certain conditions and exemptions:
Right of access: You can request confirmation of whether we process your personal data and obtain a copy of that data, together with information about how it is used. Right to rectification: You can ask us to correct or complete personal data that you believe is inaccurate or incomplete. Right to erasure: In certain circumstances, you can request that we delete your personal data. This right does not apply where we are required to retain data by law or for legitimate business reasons. Right to restriction of processing: You can ask us to restrict how we use your personal data in specific situations, for example while we are verifying the accuracy of data or considering an objection. Right to object: You can object to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests or where processing is required for legal claims. Right to data portability: For data you have provided to us and which we process by automated means on the basis of contract or consent, you may request that we provide it to you in a commonly used format or, where technically feasible, transfer it to another controller.
If you wish to exercise any of these rights, you can contact us using the contact details on our website or in your contract documentation. We may need to verify your identity before responding to your request and will respond within the time limits set by law.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, business practices or legal obligations. The most recent version will always apply to our use of your personal data. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
Contact and Complaints
If you have any questions about this Privacy Policy or how we handle your personal data, you can contact us using the details provided on our official documents or website. You also have the right to raise concerns with the relevant data protection supervisory authority if you believe that your data protection rights have been infringed. We would, however, welcome the opportunity to address your concerns directly in the first instance.
