Storage Bellingham Privacy Policy
This Privacy Policy explains how Storage Bellingham collects, uses, stores, and protects personal data relating to our customers and prospective customers in our service area. It also explains your rights under the General Data Protection Regulation and related data protection laws, and how you can exercise those rights in relation to your personal data.
Scope and Data Controller
This Privacy Policy applies to all Storage Bellingham customers, including individuals and businesses that enquire about, use, or have used our storage services in our operating area. It also applies to visitors to our physical premises and users of any digital services that we provide for the purpose of offering or managing storage solutions.
For the purposes of data protection law, Storage Bellingham is the data controller. This means that we determine the purposes and means of the processing of personal data that we collect in connection with the provision of our services.
Personal Data We Collect
We collect and process different categories of personal data, depending on how you interact with us and the services you use. This may include:
Identification data, such as your full name, date of birth, and, where necessary, government issued identification details.
Contact details, such as your postal address, billing address, and any other contact details you choose to share with us.
Customer account and contract data, such as storage unit numbers, contract start and end dates, payment terms, records of correspondence with you, and service history.
Payment and billing information, such as the payment method used, billing history, and records of invoices and receipts. We do not store full payment card details when a third party payment processor is used.
Security and access data, such as access logs, entry and exit times, vehicle registration numbers where relevant, and, where installed, CCTV footage captured in and around our facilities.
Technical and usage data, such as information about your interactions with our digital services, including date and time of access, pages viewed, and basic device information, where this is necessary for security, service provision, or service improvement.
Lawful Bases for Processing
We only process your personal data where we have a lawful basis to do so. Depending on the context, we rely on the following lawful bases:
Contract performance. We process personal data to take steps at your request before entering into a storage agreement, to manage and perform our contract with you, and to provide customer support. Without this data we may not be able to provide our services to you.
Legal obligations. We process personal data when necessary to comply with legal duties, such as tax, accounting, the prevention of fraud, security and safety obligations, and to respond to lawful requests from public authorities.
Legitimate interests. We process personal data when it is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and freedoms. These interests include ensuring the security of our premises and customers, managing and improving our services, maintaining accurate records, handling queries and complaints, and protecting and enforcing our contractual and legal rights.
Consent. In some circumstances we may rely on your consent, for example for certain optional communications or where we are required to do so by law. When we rely on consent, you are free to withdraw it at any time and we will stop the relevant processing.
How We Use Your Personal Data
We use the personal data we collect for the following purposes:
To respond to enquiries, provide information about our services, and manage bookings and reservations.
To set up and administer customer accounts, prepare and manage contracts, and provide storage and related services.
To process payments, manage billing, and maintain accounting and financial records.
To manage access to our facilities, monitor security, and protect our customers, staff, property, and assets, including through the use of access logs and, where in place, CCTV systems.
To communicate with you about your account, services, changes to our terms and policies, and operational issues that may affect our services.
To handle complaints, resolve disputes, and enforce our contractual terms and conditions.
To comply with applicable laws and regulations and to cooperate with regulatory authorities, law enforcement, and courts where lawfully required.
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. The length of time personal data is kept will depend on factors such as the duration of your contract with us, legal limitation periods, regulatory requirements, and our need to keep records to resolve queries or disputes.
Customer account and contract data are generally retained for the duration of the contract and for a period afterwards to comply with legal obligations and to establish, exercise, or defend legal claims. Financial and billing records may be retained for the periods required by tax and accounting laws. Security and access data, including CCTV images where used, are retained for a limited period necessary for security and incident investigation purposes, unless a longer retention period is required in relation to a specific incident or legal obligation.
Data Processors and Sharing of Personal Data
We may share your personal data with third parties who act as data processors on our behalf. These service providers process personal data only in accordance with our instructions and under a written contract that requires them to implement appropriate technical and organisational measures to protect your data. Such processors may include:
Payment processing providers that facilitate payments and refunds.
IT, software, hosting, and cloud service providers that support our customer management systems, security systems, and digital services.
Professional advisers, such as legal and accounting professionals, where necessary to obtain advice or protect our legal rights.
We may also share personal data with other third parties in the following cases, acting as independent controllers:
Where we are required to do so by law or in response to a lawful request by public authorities.
Where it is necessary to establish, exercise, or defend legal claims.
In connection with a business transaction such as a restructuring, merger, or transfer of operations, where permitted by law.
International Transfers
Where we transfer personal data outside the United Kingdom or the European Economic Area, we do so in compliance with applicable data protection law. This may involve using countries that have been recognised as providing an adequate level of data protection, or implementing appropriate safeguards such as standard contractual clauses approved by relevant authorities. Further details about these safeguards can be provided where required by law.
Your Data Protection Rights
Under data protection law, you have several rights in relation to the personal data that we hold about you. These rights may be subject to certain conditions and legal exceptions, but we will always respond to any request to exercise your rights in accordance with applicable law. Your rights include:
Right of access. You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data, together with information about how we use it.
Right to rectification. You have the right to request that we correct or complete any inaccurate or incomplete personal data we hold about you.
Right to erasure. In certain circumstances, you have the right to request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected or where you withdraw consent on which the processing is based.
Right to restriction. You have the right to request that we restrict the processing of your personal data in certain situations, for example while we investigate a concern about its accuracy.
Right to data portability. Where our processing is based on your consent or on a contract and carried out by automated means, you may have the right to receive the personal data you provided to us in a structured, commonly used, and machine readable format and to transmit it to another controller, where technically feasible.
Right to object. You have the right to object to processing based on our legitimate interests, including profiling, where we rely on those interests. We will stop processing unless we can demonstrate compelling legitimate grounds which override your interests, rights, and freedoms, or where processing is required for legal claims.
Right to withdraw consent. Where we rely on consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
You also have the right to lodge a complaint with a data protection supervisory authority if you believe that we have not complied with data protection law in the way we have processed your personal data.
Security of Your Personal Data
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are designed to ensure a level of security appropriate to the risks presented by the processing and the nature of the personal data.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. When we make material changes, we will take appropriate steps to bring those changes to your attention, for example by making the updated version available at our premises or through our digital services. The date of the latest version will always be indicated so that you can see when it was last revised.
