Storage Osterley Privacy Policy
This Privacy Policy explains how Storage Osterley collects, uses, stores, and protects personal data of customers in the Storage Osterley service area. It also describes your rights under the UK General Data Protection Regulation and related data protection laws. This Privacy Policy applies to all Storage Osterley customers and prospective customers using our self-storage services, whether you contact us online, by post, or in person at our premises.
Data Controller
Storage Osterley is the data controller for the personal data described in this Privacy Policy. As data controller, Storage Osterley determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection law.
Personal Data We Collect
We collect and process personal data that you provide directly to us, as well as certain data generated in the course of providing our services. The categories of personal data we may collect include the following.
Identification and contact details such as full name, home address, correspondence address, proof of identity details, and limited identity verification information, as well as contact details such as postal address and any communication preferences you tell us about.
Account and contract information such as customer account number, contract details, storage unit number, move-in and move-out dates, payment terms, deposit information, and records of your communications with us regarding your contract.
Payment and billing information such as billing address and basic transaction details relating to payments you make for storage services. Actual payment card or bank details are processed securely by third-party payment processors and are not stored in full by Storage Osterley except where required by law or necessary for resolving a payment issue.
Usage and operational data such as access logs showing dates and times when you access the facility, records of gate or door entry where access control systems are used, and details of services requested, including any additional services related to your storage unit.
Security and CCTV data including images recorded on CCTV systems at and around our premises. CCTV is used for security, safety, and crime prevention and may incidentally capture your image when you visit our facility.
Communication data such as records of email and postal correspondence, notes from telephone conversations, and any complaints or enquiries you make about our services.
Lawful Basis for Processing
Storage Osterley processes your personal data only where we have a lawful basis under the UK General Data Protection Regulation. Depending on the circumstances, we rely on the following legal bases.
Performance of a contract. We process your personal data where it is necessary to enter into, perform, or manage a storage contract with you, including setting up your account, taking payment, managing access to your storage unit, and communicating with you about your contract.
Compliance with legal obligations. Certain processing is required in order to meet our legal and regulatory obligations, for example, maintaining appropriate accounting records, responding to lawful requests from law enforcement authorities, and complying with health and safety or security regulations.
Legitimate interests. We process personal data where it is necessary for our legitimate interests or the legitimate interests of a third party, provided that your interests and fundamental rights do not override those interests. For example, we rely on legitimate interests to use CCTV for security, to protect our premises and property, to prevent crime and fraud, to manage and improve our business operations, and to handle customer queries and complaints.
Consent. In limited circumstances, we may rely on your consent, for example, if we wish to send optional marketing communications by certain channels. Where we rely on consent, you are free to withdraw it at any time.
How We Use Your Personal Data
We use the personal data we collect for the following main purposes.
To manage customer relationships, including setting up your account, preparing and administering your storage agreement, communicating with you about your bookings, and providing customer service.
To process payments and manage billing, including issuing invoices, collecting payments, processing refunds where applicable, and managing any payment disputes.
To manage site access and security, including granting and monitoring access to the facility, using CCTV for safety and security, and protecting our staff, customers, and property.
To comply with legal and regulatory obligations, including record-keeping duties and responding to legitimate requests from public authorities.
To improve and develop our services, including monitoring usage patterns, handling feedback, and where appropriate, reviewing how our facilities are used in order to plan improvements and manage capacity.
Data Sharing and Processors
We may share your personal data with carefully selected third parties where necessary for the purposes described in this Privacy Policy and where permitted by law.
Service providers acting as data processors may process personal data on our behalf and under our instructions. These may include providers of storage and property management systems, access control and CCTV system providers, payment processing companies, IT hosting and support providers, document storage and destruction services, and professional advisers such as accountants or legal advisors.
Other recipients such as law enforcement agencies, regulatory authorities, courts, or other public bodies may receive your personal data where we are required or permitted by law to share it, for example in connection with crime prevention, fraud investigations, or legal proceedings.
Where we use data processors, we ensure that they are subject to contractual obligations to protect your personal data, use it only for the services we have requested, and process it in accordance with applicable data protection law.
International Transfers
In general, Storage Osterley aims to keep your personal data within the United Kingdom or the European Economic Area. If it becomes necessary to transfer your personal data to countries outside this area, we will ensure that appropriate safeguards are in place, such as standard contractual clauses or other legally recognised mechanisms, so that your data remains protected to a standard equivalent to that required under UK data protection law.
Data Retention
Storage Osterley retains personal data only for as long as is reasonably necessary for the purposes for which it was collected, including to meet any legal, regulatory, tax, accounting, or reporting requirements. When deciding on appropriate retention periods, we consider the nature and sensitivity of the data, the potential risk of harm from unauthorised use, the purposes for which we process it, and applicable legal requirements.
Customer account and contract information is typically kept for a period after your contract ends to allow us to respond to any subsequent queries, deal with any outstanding matters, and comply with record-keeping obligations. Payment and billing records are maintained in line with statutory retention periods for financial records. CCTV footage is usually retained for a short period unless a longer retention period is required in connection with an incident, investigation, or legal claim.
Once the relevant retention period has come to an end, or the data is no longer needed, we will securely delete or anonymise your personal data so that it can no longer be associated with you.
Your Data Protection Rights
Under data protection law, you have a range of rights in relation to the personal data that Storage Osterley holds about you. These rights may be subject to certain conditions and legal exceptions.
Right of access. You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data together with certain additional information.
Right to rectification. You have the right to ask us to correct any inaccurate personal data and to complete any incomplete data that we hold about you.
Right to erasure. In certain circumstances, you may have the right to request that we delete your personal data, for example where the data is no longer necessary for the purposes for which it was collected or where you withdraw consent and there is no other lawful basis for processing.
Right to restriction of processing. You have the right to ask us to restrict the processing of your personal data in certain situations, such as where you contest the accuracy of the data or object to our processing and we are considering that objection.
Right to object. You may object to our processing of your personal data where we are relying on legitimate interests as our lawful basis. We will stop processing your data unless we can demonstrate compelling legitimate grounds which override your interests, rights, and freedoms, or the processing is required for legal claims.
Right to data portability. In certain circumstances, you may have the right to receive personal data that you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to withdraw consent. Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe that your data protection rights have been infringed.
Security of Your Personal Data
Storage Osterley takes appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include access controls, appropriate security policies, staff training, and secure storage of physical and electronic records. While no system can be completely secure, we work to ensure that our safeguards are appropriate to the level of risk.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or how we process personal data. The most current version will always apply to the personal data we hold about you. Where appropriate, we may notify you of significant changes by a method we consider suitable, for example by updating information at our premises or within customer communications.
