Storage Tower Hill Privacy Policy
This Privacy Policy explains how Storage Tower Hill collects, uses, stores, and protects personal data of its customers. It applies to all Storage Tower Hill customers in our service area who use our storage facilities and related services, whether as individuals or on behalf of a business.
Storage Tower Hill is committed to protecting your privacy and handling your personal data in accordance with applicable data protection laws, including the General Data Protection Regulation and the UK GDPR, where applicable.
Data Controller
Storage Tower Hill is the controller of the personal data described in this Privacy Policy. As the controller, Storage Tower Hill determines the purposes and means of processing your personal data when you engage our services, visit our premises, or otherwise interact with us.
Personal Data We Collect
We collect and process different types of personal data depending on how you interact with us and which services you use. The categories of personal data we may collect include:
Identification and contact details, such as your name, postal address, billing address, and other contact information you provide when you enquire about or sign a storage agreement.
Account and contract information, including storage unit numbers, contract start and end dates, payment history, and communication records related to your storage agreement.
Payment and billing information, such as payment method details and transaction information needed to process your payments and manage invoices and refunds. We do not store full card details where payments are processed through a secure payment provider.
Security and access data, such as CCTV footage on or around our premises, gate or door access logs, and records of visits to your storage unit, where such systems are in place for security and safety.
Communication data, including queries, complaints, feedback, and any correspondence with us in person, by post, or through other communication channels you choose to use.
Technical data, such as IP address, device information, and basic usage data when you visit our website, to ensure the security and functionality of our online services.
Purposes and Lawful Basis for Processing
We only process your personal data where we have a valid lawful basis under data protection law. The main purposes for which we process personal data and the lawful bases we rely on include:
To provide storage and related services. We process identification, contact, account, contract, payment, and security data to set up and administer your storage agreement, manage your account, allocate storage units, and provide customer support. The lawful basis is performance of a contract or taking steps at your request before entering into a contract.
To manage billing and payments. We process payment and billing information to collect fees, manage direct debits or other payment methods, and handle refunds or queries. The lawful basis is performance of a contract and our legitimate interests in managing our business operations.
To maintain the safety and security of our premises. We may use CCTV, access control systems, and visitor records to prevent and detect crime, safeguard customers, staff, and property, and investigate incidents. The lawful basis is our legitimate interests in ensuring security and safety.
To communicate with you. We process your contact and communication data to respond to enquiries, send service messages, provide contract updates, notify you of changes to our terms or this Privacy Policy, and manage complaints. The lawful basis is performance of a contract, compliance with legal obligations, and our legitimate interests in effective customer service.
To comply with legal and regulatory obligations. We may process your personal data to meet our obligations under tax, accounting, health and safety, law enforcement, or other legal requirements. The lawful basis is compliance with legal obligations.
To improve our services and business operations. We may use limited aggregated or pseudonymised data for reporting, planning, and service improvement. Where personal data is used, the lawful basis is our legitimate interests in developing and managing our services.
Data Retention
We keep your personal data only for as long as is necessary for the purposes set out in this Privacy Policy and to meet our legal and regulatory obligations.
Customer and contract records are typically retained for a period after your contract ends to handle any queries, disputes, or legal claims, and to meet tax and accounting requirements.
Payment and billing information is retained in accordance with statutory retention periods under tax and financial reporting laws.
CCTV recordings and access logs are kept for a limited period that is appropriate for security purposes and, where necessary, to investigate incidents or respond to requests from law enforcement. After that period, they are securely deleted or overwritten.
Where we no longer need your personal data for the purposes described above, we will either delete it securely or anonymise it so that it can no longer identify you.
Data Processors and Sharing of Personal Data
In order to provide our services and manage our business, we may share your personal data with carefully selected third parties who act as processors on our behalf. These may include:
Payment service providers that process your payments securely on our behalf.
IT and hosting providers that supply and maintain our software systems, data storage, and communication tools.
Security service providers that support CCTV systems, access control systems, or alarm monitoring where such services are used.
Professional advisers such as accountants, lawyers, or auditors, where necessary for legitimate business or legal reasons.
We require all processors to handle your personal data only in accordance with our instructions, to keep it secure, and to comply with data protection laws.
We may also share personal data with public authorities, law enforcement agencies, or regulators when required to do so by law or where it is necessary to protect our rights, property, or the safety of our customers, staff, or the public.
We do not sell your personal data to third parties.
International Transfers
Where we use service providers or systems that involve transferring personal data outside the United Kingdom or the European Economic Area, we take steps to ensure that appropriate safeguards are in place. These may include using countries that have been recognised as providing an adequate level of data protection, or putting in place standard contractual clauses or equivalent safeguards approved by data protection authorities.
How We Protect Your Data
We implement technical and organisational measures designed to keep your personal data secure. These measures may include access controls, physical security at our premises, secure storage systems, and staff training in data protection and confidentiality.
While we take reasonable steps to protect your personal data, no system can be completely secure. We continually review and update our security measures to reduce risks and protect against unauthorised access, loss, or misuse.
Your Data Protection Rights
Under data protection law, you have certain rights in relation to your personal data. These rights may be subject to specific conditions and legal exceptions. Your rights include:
The right of access. You can request confirmation of whether we process your personal data and obtain a copy of that data, along with information about how it is used.
The right to rectification. You can request that we correct inaccurate personal data or complete incomplete data.
The right to erasure. In certain circumstances, you can request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected, or where you withdraw consent and there is no other lawful basis.
The right to restrict processing. You can request that we restrict how we use your personal data in certain situations, such as while we are considering a request to rectify or erase your data.
The right to data portability. Where processing is based on consent or on a contract and carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
The right to object. You can object to processing based on our legitimate interests, including profiling, where you believe your rights and freedoms outweigh our interests.
The right to withdraw consent. Where we rely on your consent for processing, you can withdraw your consent at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.
You also have the right to lodge a complaint with a supervisory authority if you believe that your personal data has been processed in a way that does not comply with data protection law.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data processing practices. Any changes will take effect when the updated Privacy Policy is made available to customers. We encourage you to review this Privacy Policy periodically so that you remain informed about how we use and protect your personal data.
