Storage Oakleigh Park Privacy Policy
This Privacy Policy explains how Storage Oakleigh Park collects, uses, stores and protects personal data relating to customers and prospective customers. It applies to all individuals using Storage Oakleigh Park services in the surrounding area, whether you contact us online, by phone, in person or through any other method.
Storage Oakleigh Park acts as a data controller for the personal data described in this policy. We process personal data in accordance with the United Kingdom General Data Protection Regulation and the Data Protection Act 2018, together referred to as GDPR in this policy.
Personal Data We Collect
We collect and process different types of personal data depending on how you interact with us and which services you use. The categories of data we may collect include:
Identification data such as name, title, date of birth and government issued identification details where required for security and fraud prevention.
Contact details such as home address, billing address, email address and contact preferences.
Contract and account information such as storage unit number, contract start and end dates, services selected, payment status, correspondence about your bookings and any special instructions relevant to your use of the storage facility.
Payment information such as records of payments made, payment method, bank or card details where necessary for processing payments, and related billing information. Card details are handled securely and may be processed by approved payment processors on our behalf.
Security and access data such as CCTV footage in and around the facility, access logs, entry codes, visit times and other information required to maintain the safety and security of the site.
Communication data such as records of enquiries, complaints, feedback and any other communication you have with us by phone, email, online forms or in person.
Technical data such as IP address, device information, and basic usage data associated with visiting our website or online portals, to help us operate and secure our online services.
Lawful Basis for Processing
We only process personal data where we have a lawful basis under GDPR. Depending on the circumstances, the lawful basis will be one or more of the following:
Contract. We process personal data to enter into and perform our contract with you for storage and related services. This includes managing bookings, handling payments, providing customer service, controlling access to the facility and administering your account.
Legal obligation. We may process personal data where necessary to comply with legal or regulatory obligations. This can include tax and accounting rules, health and safety requirements, crime prevention measures and responding to lawful requests from authorities.
Legitimate interests. We may process personal data where it is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights. This includes running and improving our services, protecting our property and customers, maintaining site and network security, preventing fraud and managing business operations.
Consent. In limited cases, we may rely on your consent, for example for certain forms of direct marketing by electronic means where consent is required. Where we rely on consent, you can withdraw it at any time by contacting us using the details in this policy or by using any unsubscribe options we provide.
How We Use Your Personal Data
We use personal data for the following purposes:
To set up, manage and terminate storage agreements, including identification checks, contract administration and customer communications.
To process payments, issue invoices and manage billing and debt recovery.
To provide customer service, respond to enquiries and resolve complaints or disputes.
To operate, monitor and secure the storage facility, including through CCTV, access control systems and incident reporting.
To maintain and improve our services, premises, systems and customer experience.
To send service messages such as contract notices, updates about your storage unit and changes to our terms or policies.
To send marketing communications about our services where permitted by law and, where required, with your consent. You can opt out of marketing at any time.
To meet legal and regulatory requirements and cooperate with law enforcement or regulatory authorities where necessary.
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet any legal, accounting or reporting obligations. The retention periods may vary depending on the category of data and our legal obligations.
In general:
Customer contract information, billing records and related correspondence are kept for a period required by applicable tax and financial regulations after the end of your contract, after which they are securely deleted or anonymised.
CCTV footage and access logs are typically retained for a limited period necessary for security and investigation purposes, unless a longer retention is required due to a specific incident or legal claim.
Marketing data is kept for as long as you remain subscribed or otherwise engaged with our communications and is deleted or anonymised once you opt out or where we determine that it is no longer needed.
We regularly review the personal data we hold and securely dispose of data that is no longer required.
Data Processors and Sharing of Personal Data
We may share personal data with carefully selected third parties who act as data processors on our behalf. These processors are engaged to provide services necessary for the operation of Storage Oakleigh Park and are only permitted to process personal data in accordance with our instructions and applicable law.
Examples of processors and third party recipients include:
Payment service providers who process card or bank payments and related financial transactions.
IT and cloud service providers who host our systems, maintain databases, provide software tools or support our communication channels.
Security and maintenance contractors who help operate and maintain the physical site, security systems and access controls.
Professional advisers such as accountants, auditors or legal advisers where this is necessary for our legitimate interests and legal obligations.
Debt collection agencies or similar service providers where necessary to recover sums owed under our contract.
Where required by law, we may also share data with government bodies, law enforcement or regulatory authorities.
We do not sell your personal data. Any sharing of data is limited to what is necessary and appropriate, and we take steps to ensure that processors provide adequate safeguards for your personal data.
International Transfers
Where we use processors or service providers located outside the United Kingdom or European Economic Area, we ensure that appropriate safeguards are in place for any international transfers of personal data. These safeguards may include adequacy decisions, standard contractual clauses or other mechanisms recognised under GDPR.
Your Data Protection Rights
Under GDPR, you have a number of rights in relation to your personal data. These rights are subject to certain conditions and exemptions, but in general include:
Right of access. You have the right to request confirmation that we process your personal data and to obtain a copy of that data, together with information about how we use it.
Right to rectification. You have the right to request correction of inaccurate personal data and completion of incomplete data.
Right to erasure. In certain circumstances, you have the right to request that we delete your personal data, for example where the data is no longer needed for the purposes for which it was collected or where you withdraw consent and no other lawful basis applies.
Right to restriction. You have the right to request that we restrict our processing of your personal data in certain situations, such as while we consider a challenge you have raised.
Right to data portability. In some cases, you may request that we provide your personal data in a structured, commonly used and machine readable format, or that we transmit it to another controller where technically feasible.
Right to object. You have the right to object to processing based on our legitimate interests, including profiling, and the right to object at any time to the processing of your personal data for direct marketing.
Rights in relation to automated decision making. Where we carry out automated decision making with legal or similarly significant effects, you have rights to obtain human intervention, express your view and contest the decision.
If you wish to exercise any of these rights, or if you have questions or concerns about how we handle your personal data, you can contact us using the contact details provided on our website or in your contract documents. We may need to verify your identity before responding to your request.
Complaints
If you are not satisfied with how we have handled your personal data, you can raise your concerns with us and we will do our best to resolve the issue. You also have the right to lodge a complaint with the data protection supervisory authority in the United Kingdom.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or services. Any updates will be made available through our usual communication channels. We encourage you to review this policy periodically to stay informed about how we handle your personal data.
