Storage Hoxton Privacy Policy
This Privacy Policy explains how Storage Hoxton collects, uses, stores and shares personal data relating to our customers and prospective customers in the Storage Hoxton service area. It also describes your rights under the UK General Data Protection Regulation and applicable data protection laws.
By using our storage services, visiting our premises or otherwise interacting with us, you acknowledge that you have read and understood this Privacy Policy. We may update this notice from time to time and will indicate when it was last revised.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage Hoxton customers, including individual and business customers, in our operational area. It covers personal data collected through service enquiries, bookings, contracts, payments, access control systems, CCTV on our premises, and any other interactions directly related to our storage services.
Who is responsible for your personal data
Storage Hoxton is the data controller for the personal data described in this Privacy Policy. As data controller, we decide how and why your personal data is processed and ensure that such processing is carried out in compliance with applicable data protection laws.
Personal data we collect
We collect and process different categories of personal data depending on how you interact with us. This may include:
Identification and contact details: name, postal address, billing address, date of birth where required for verification, and other basic identification information. We also collect non-electronic contact details such as postal address, as well as electronic contact preferences where you choose to share them with us.
Contract and account information: storage unit number, contract start and end dates, rental terms, authorised users for a unit, records of correspondence, and account status information such as payment history and arrears.
Payment and billing data: information necessary to process payments and manage billing, such as partial card details or transaction references. We do not store full payment card details when a payment processor is used; these are handled securely by the relevant payment processor.
Security and access data: access logs where an access control system is used, records of entry to and exit from our premises, CCTV recordings captured on and around our facilities, incident reports, and information relating to lost keys or access devices.
Communications data: records of your communications with us, for example queries, complaints, feedback, and the content of any correspondence relating to your account or potential use of our services.
Marketing preferences: information about whether you wish to receive direct marketing relating to our storage services, and your responses if you choose to update or withdraw consent for such marketing.
How we collect your data
We collect personal data directly from you when you contact us, request a quote, sign a storage contract, make a payment, visit our premises, or communicate with us in relation to our services. We may also receive limited personal data from third parties, such as payment processors confirming whether a transaction has been successful, or from public sources where we need to verify address or identity information to prevent fraud or recover debts.
Lawful bases for processing
We only process your personal data where we have a lawful basis to do so under data protection law. Depending on the specific activity, we rely on one or more of the following lawful bases:
Contract: processing is necessary to enter into a contract with you or to perform a contract for storage services, including managing your bookings, payments, and access to your storage unit.
Legal obligation: processing is necessary for us to comply with legal or regulatory requirements, such as tax and accounting rules, law enforcement requests, safety obligations, and record keeping duties.
Legitimate interests: processing is necessary for our legitimate interests or those of a third party, provided that your interests and fundamental rights do not override those interests. These legitimate interests include operating and improving our storage facilities, ensuring the security and safety of our premises, preventing and detecting crime or fraud, managing business operations, and defending our legal rights.
Consent: in some circumstances we may ask for your consent, for example, for certain types of direct marketing. Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.
How we use your personal data
We use your personal data for the following purposes:
To provide and manage storage services: setting up your account, preparing and managing contracts, allocating storage units, processing payments, managing renewals and terminations, and communicating with you about your storage arrangements.
To maintain safety and security: monitoring access to our premises, using CCTV to protect people and property, investigating incidents or suspicious activities, and cooperating with law enforcement where required.
To administer our business: record keeping, accounting, auditing, handling queries and complaints, training staff, and managing risk, insurance, and legal claims.
To communicate with you: responding to your questions, sending you service messages such as payment reminders or contract updates, and providing important notices about changes to our policies or operations.
To conduct marketing and service improvements: with your consent where required, informing you about relevant storage offers, and analysing anonymised or aggregated data to improve the efficiency, safety, and quality of our services.
Data sharing and processors
We may share your personal data with selected third parties where necessary for the purposes described in this Privacy Policy and where we have a lawful basis to do so.
Service providers and processors: we use trusted third-party service providers to help us deliver our services and manage our business, such as payment processors, IT and cloud storage providers, security and CCTV maintenance providers, and professional advisers including accountants or legal advisers. These third parties act as data processors and are only allowed to process your personal data in accordance with our instructions and applicable data protection laws.
Professional and legal recipients: we may share information with insurers, legal representatives, courts, law enforcement agencies, or regulatory bodies where necessary to comply with legal obligations, protect our rights, or assist in the prevention and investigation of crime or fraud.
We do not sell your personal data to third parties. Where we use processors, we ensure that appropriate contracts and safeguards are in place to protect your personal data and maintain its confidentiality and security.
International transfers
If we transfer personal data outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place to protect your information, such as using standard contractual clauses or transferring data to countries that have been deemed to provide an adequate level of protection by the relevant authorities.
Data retention
We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. In determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your data, and whether we can achieve those purposes through other means.
Generally, we retain contract and billing records for the duration of your relationship with us and for a period thereafter as required by tax and accounting regulations. Security and access records, including CCTV footage, are kept for shorter periods unless a longer retention is justified, for example in relation to an incident, dispute, or legal claim.
When data is no longer required, we securely delete or anonymise it so that it can no longer be associated with you.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data. These are subject to certain conditions and exemptions, and we may ask you to verify your identity before acting on a request. Your rights include:
Right of access: you can request confirmation that we are processing your personal data and obtain a copy of the personal data we hold about you, together with certain information about how and why we process it.
Right to rectification: you can ask us to correct or complete personal data that is inaccurate or incomplete.
Right to erasure: in certain circumstances, you can request that we delete your personal data, for example where the data is no longer needed for the purposes for which it was collected, you have withdrawn consent and there is no other legal basis, or you have successfully objected to processing.
Right to restriction of processing: you can ask us to restrict the processing of your personal data in certain situations, such as where you contest its accuracy or object to its processing and we are considering your request.
Right to object: you can object to our processing of your personal data where we are relying on legitimate interests as our lawful basis, including profiling based on those interests. You also have an absolute right to object to your personal data being used for direct marketing.
Right to data portability: where processing is based on consent or on a contract and carried out by automated means, you can request that we provide you with your personal data in a structured, commonly used and machine-readable format, or that we transmit it to another controller where technically feasible.
Right to withdraw consent: where we rely on your consent to process personal data, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.
How to exercise your rights and complaints
If you wish to exercise any of your data protection rights or have questions about how we handle your personal data, you can contact Storage Hoxton using the contact details provided in your contract documentation or on our premises. We will respond to your request in accordance with applicable legal time limits.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe that your data protection rights have been infringed. We encourage you to contact us first so that we can try to resolve your concerns directly.
Changes to this Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our services, legal requirements, or how we process personal data. Any significant changes will be communicated where appropriate, and the updated policy will apply from the date it is made available.
