Storage Castelnau Privacy Policy
This Privacy Policy explains how Storage Castelnau collects, uses, stores and protects personal data relating to its customers and prospective customers. It applies to all Storage Castelnau customers and users of our services in our operating area, whether you contact us online, by post or in person at our premises.
We are committed to complying with the UK General Data Protection Regulation and all applicable data protection laws. This Privacy Policy is intended to provide clear information about what we do with your personal data and how you can exercise your rights.
Data Controller
Storage Castelnau is the data controller in respect of the personal data we collect and process about you. As data controller, we determine the purposes and means of the processing of your personal data in connection with the provision of our storage and related services.
Personal Data We Collect
We may collect and process the following categories of personal data when you interact with us or use our services:
Identification and contact data, such as your name, postal address, billing address, contact address, and other contact details necessary for communication.
Contract and account data, such as details of the storage unit or services you have booked, contract dates, payment history, invoices, correspondence related to your contract, and any preferences you communicate to us.
Payment and billing data, such as payment method, partial card or account details as required for transaction processing, and records of payments made to us. Full payment details may be processed securely by our appointed payment service providers.
Verification and security data, such as copies of identity documents where required for security or legal reasons, vehicle registration numbers used to access the site, access logs relating to entry systems, and CCTV footage recorded on our premises for security and safety.
Communication data, such as enquiries, complaints, feedback, and other communications you send to us, as well as records of our responses.
Technical and usage data, such as data generated through access control systems, and limited information about how you use our services or interact with our website, to the extent that this constitutes personal data.
How We Collect Your Data
We collect personal data from the following sources:
Directly from you when you contact us to request information, obtain a quote, sign a storage agreement, make a payment, visit our premises, or communicate with us by any means.
Automatically when you access our premises, for example through CCTV systems, vehicle recognition or access control devices used for security and operational management.
From third parties, such as payment service providers who confirm that a payment has been made, or other service providers who support our operations and may share limited information necessary for us to provide our services.
Lawful Basis for Processing
We process your personal data only where we have a lawful basis under GDPR. Depending on the context, we rely on the following lawful bases:
Contract. We process personal data where this is necessary to enter into or perform a contract with you. This includes providing quotes, setting up and managing your storage unit, taking payments, communicating with you about your contract, and handling account administration.
Legal obligation. We process certain personal data to comply with legal obligations, such as record keeping, tax and accounting requirements, prevention of fraud, and responding to lawful requests from public authorities.
Legitimate interests. We process personal data where necessary for our legitimate interests, provided these are not overridden by your rights and freedoms. These interests include ensuring the security of our premises and customers through access control and CCTV, managing and improving our services, handling queries and complaints, and protecting our business from misuse or unlawful activity.
Consent. In limited situations, we may rely on your consent, for example where we send you certain types of marketing or promotional information that are not based on our legitimate interests. When we rely on consent, you are free to withdraw it at any time.
How We Use Your Personal Data
We use personal data for the following purposes:
To provide storage and related services, including processing bookings, managing your account, maintaining access to your unit, and ensuring the proper performance of our contract with you.
To communicate with you, including responding to your enquiries, sending administrative messages about your contract or payments, and providing information relevant to the safe and efficient use of our facilities.
To manage payments and billing, including issuing invoices, processing payments, managing arrears, and keeping appropriate financial records.
To maintain security and safety at our premises, including controlling access to the site, monitoring facilities using CCTV in accordance with applicable laws, and investigating incidents or suspected breaches.
To meet our legal and regulatory obligations, including record retention, responding to legal claims or requests, and cooperating with law enforcement where lawfully required.
To improve and manage our business, including monitoring service performance, planning capacity, training staff, and enhancing customer experience.
Data Retention
We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements.
Contract and account data is generally retained for the duration of your contract and for a period afterwards to deal with any queries, disputes or legal obligations. The specific retention period may vary depending on the nature of the data and applicable legal requirements.
Financial records, including invoices and payment information, are retained for the period required by tax and accounting laws.
CCTV footage and access logs are retained for a limited period necessary for security, incident investigation and legitimate business interests, unless a longer retention period is required in specific cases, such as for ongoing investigations or legal claims.
When personal data is no longer required, we will delete it or anonymise it so that you can no longer be identified.
Data Processors and Third Parties
We may share your personal data with carefully selected third parties who act as data processors on our behalf. These processors are only permitted to process your data in accordance with our instructions and for the purposes described in this Privacy Policy. They are required to implement appropriate technical and organisational measures to protect your data.
Examples of such processors include payment processing providers, IT and cloud service providers, providers of access control and CCTV systems, document storage and destruction services, and professional advisers who support our business operations.
Where necessary, we may also share personal data with third parties acting as independent data controllers, such as insurers, legal advisers, accountants, and public authorities or law enforcement agencies where required by law or in order to protect our rights or the rights of others.
We do not sell your personal data. We also do not transfer your personal data outside the United Kingdom or European Economic Area unless appropriate safeguards are in place, such as standard contractual clauses or equivalent measures required by data protection law.
Security of Your Personal Data
We take appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include access controls, secure storage, staff training and regular review of our data protection practices.
While we take reasonable steps to protect your data, no system can be completely secure. You also have a role in keeping your information safe by letting us know promptly if you suspect any unauthorised use of your account or personal data.
Your Data Protection Rights
You have a number of rights under data protection law in relation to your personal data. Subject to certain conditions and exemptions, these include the right to:
Access your personal data and obtain a copy, together with information about how it is processed.
Request correction of inaccurate or incomplete personal data.
Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and there is no other legal basis for processing, or where the data has been unlawfully processed.
Request restriction of processing of your personal data in certain circumstances, for example while we verify its accuracy or our legitimate interests.
Object to processing based on our legitimate interests, including profiling, on grounds relating to your particular situation. We will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for legal claims.
Object to direct marketing at any time. Where you object, we will cease processing your personal data for direct marketing purposes.
Request the transfer of your personal data to you or to another controller, where technically feasible and where the processing is based on consent or contract and carried out by automated means.
Withdraw consent where we rely on consent as the lawful basis for processing. Withdrawal of consent does not affect the lawfulness of processing carried out before your withdrawal.
You may exercise your rights by contacting us using the contact details provided in your contract or other communications from Storage Castelnau. We may need to verify your identity before responding to certain requests. We aim to respond within the time limits set by data protection law.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or data protection practices. Any changes will be made available through our usual communication channels or at our premises. The updated version will apply from the date it is issued.
We encourage you to review this Privacy Policy periodically so that you remain informed about how we handle your personal data as a customer of Storage Castelnau in our operating area.
