Privacy Policy - Harmondsworth Storage

This Privacy Policy explains how Harmondsworth Storage collects, uses, stores, shares, and protects personal data when providing storage services to customers in the Harmondsworth area. It applies to all Harmondsworth Storage customers in area, including prospective customers, current customers, former customers, and any individuals who interact with us in connection with our services.

We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy sets out the types of information we collect, the reasons we collect it, the lawful bases on which we rely, how long we keep it, who may process it on our behalf, and the rights available to individuals.

1. Information We Collect

We collect only the personal data necessary to provide and manage our storage services, maintain security, comply with legal obligations, and improve our operations. The information we may collect includes:

Identity information such as your name, date of birth, and title.
Contact information such as your postal address, email address, and telephone number.
Account and service details such as storage unit references, booking details, rental dates, payment records, and service preferences.
Verification information such as copies of identification documents where required for identity checks or fraud prevention.
Financial information such as payment method details, billing history, and transaction records.
Security information such as access logs, entry records, CCTV footage, incident reports, and visitor details.
Correspondence and communications such as emails, written enquiries, complaints, and notes of calls or messages.
Technical data where applicable, including device and usage information collected when you interact with digital systems used to support our services.

We normally collect personal data directly from you when you enquire about, sign up for, or use our services. In some cases, we may receive data from third parties such as payment providers, identity verification services, insurance providers, or legal and regulatory bodies where permitted by law.

2. How We Use Personal Data

We use personal data for the following purposes:

To register and manage customer accounts.
To provide storage services and administer access to units or premises.
To process payments, invoices, refunds, and account balances.
To verify identity and prevent fraud, theft, misuse, or unauthorised access.
To communicate with customers about their account, service updates, and operational matters.
To manage queries, complaints, disputes, and claims.
To maintain safety, security, and site integrity.
To comply with legal, tax, accounting, insurance, and regulatory obligations.
To defend or establish legal claims and protect our rights and property.
To improve service quality, internal processes, and customer experience.

We do not use personal data for purposes that are incompatible with the reasons for which it was originally collected unless we have a valid lawful basis to do so.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis to process personal data. Depending on the context, Harmondsworth Storage relies on one or more of the following lawful bases:

Contract – processing is necessary to enter into or perform a contract with you, such as setting up a storage agreement, taking payment, and providing services.
Legal obligation – processing is necessary to comply with legal and regulatory requirements, including tax, accounting, and record-keeping duties.
Legitimate interests – processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include site security, fraud prevention, service administration, and internal record management.
Consent – in limited situations where we rely on your freely given, specific, informed, and unambiguous consent, you may withdraw that consent at any time.

Where special category data is collected, which is expected to be rare, we will only process it where an appropriate condition under data protection law applies and where additional safeguards are in place.

4. Sharing Personal Data and Processors

We may share personal data with trusted third parties who help us operate our business and deliver services. These third parties act as processors or independent controllers depending on the nature of their role.

Processors are organisations that process personal data on our behalf under contractual instructions and appropriate confidentiality and security safeguards. Examples may include:

IT and cloud service providers that host or maintain systems.
Payment processing providers that handle card or electronic transactions.
Identity verification and fraud prevention providers.
Security service providers, including alarm monitoring or CCTV support services.
Accountancy, audit, and administrative service providers.
Professional advisers such as lawyers, insurers, and consultants where necessary.

We may also disclose personal data to law enforcement, courts, regulators, debt recovery services, or other authorities where required by law or where disclosure is necessary to protect our legal rights, customers, staff, or property.

We require processors to process personal data only on documented instructions, to keep it confidential, to implement appropriate security measures, and not to use it for their own purposes.

5. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, tax, insurance, and reporting obligations. The retention period depends on the nature of the data and the reason for holding it.

In general:

Customer account and contract records are kept for the duration of the relationship and for a further period where needed for legal claims or compliance.
Payment and invoicing records are kept for the period required by tax and accounting law.
Security logs and CCTV footage are kept for a limited period unless an incident requires longer retention.
Correspondence and complaint records are retained for as long as necessary to resolve the matter and manage any follow-up obligations.

When personal data is no longer required, we will securely delete, destroy, or anonymise it.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, and regular review of internal procedures.

Although we take reasonable steps to protect information, no system can be guaranteed to be completely secure.

7. Your Rights

Under data protection law, individuals have a number of rights in relation to their personal data. Subject to legal limits and exemptions, you may have the right to:

Access your personal data and receive a copy of it.
Rectify inaccurate or incomplete information.
Erase personal data in certain circumstances.
Restrict processing in certain situations.
Object to processing based on legitimate interests or direct marketing.
Data portability for data you provided to us, where processing is based on consent or contract and carried out by automated means.
Withdraw consent where processing is based on consent.
Not be subject to automated decision-making that has legal or similarly significant effects, where applicable.

You may also have the right to lodge a complaint with the UK Information Commissioner’s Office if you are concerned about how your personal data is handled. We encourage individuals to raise concerns directly so we can address them promptly.

8. Children’s Data

Our services are intended for adults and business users. We do not knowingly collect personal data from children except where it is necessary and lawful in connection with a customer’s account or where required by law. If we become aware that we have collected personal data from a child without an appropriate lawful basis, we will take steps to delete it.

9. International Transfers

If any personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place to protect it in accordance with applicable law. These safeguards may include adequacy regulations, standard contractual clauses, or other approved transfer mechanisms.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. Any updated version will apply from the date it is made available. We encourage customers to review this policy periodically so they remain informed about how their personal data is handled.

11. Summary of Key Points

What we collect

We collect identity, contact, account, payment, security, and communication data needed to operate our storage services.

Why we use it

We use it to provide services, manage accounts, secure our premises, meet legal obligations, and resolve issues.

Who processes it

Trusted processors such as IT providers, payment processors, security services, and advisers may handle data on our behalf.

How long we keep it

We retain data only as long as necessary for service delivery, compliance, and legal protection.

Your rights

You may access, correct, delete, restrict, object to, or port your data, and you may withdraw consent where relevant.

Harmondsworth Storage applies this policy to all customers in area and is committed to respecting privacy and maintaining compliance with data protection law.