Storage Crystal Palace Privacy Policy
This Privacy Policy explains how Storage Crystal Palace collects, uses, stores and protects personal data relating to our customers and prospective customers in the local area. It also explains your rights under applicable data protection laws, including the UK General Data Protection Regulation and the Data Protection Act 2018.
This Privacy Policy applies to all Storage Crystal Palace customers and anyone who makes an enquiry, request or booking for storage services in our operating area, whether in person, by post, or via our online channels.
Who we are and scope of this policy
Storage Crystal Palace is a storage services provider operating in the Crystal Palace area. For the purposes of data protection law, Storage Crystal Palace is the data controller for the personal data described in this Privacy Policy. This means we determine how and why your personal data is processed when you use our storage services or contact us about them.
By using our services or providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy. We may update this Privacy Policy from time to time and will use appropriate means to inform you of any material changes.
Personal data we collect
We only collect personal data that is relevant and necessary for the provision and management of our storage services. The type of personal data we collect may include:
Identification and contact details such as your full name, postal address, billing address, contact address, and any other address you provide to us, together with details of the storage unit you occupy and dates of your agreement.
Contract and account information such as details of your storage agreement, start and end dates, unit size, access permissions you set for nominated persons, payment status, invoices, and correspondence relating to your account.
Payment and transaction information such as the method of payment used, payment history, and transaction records associated with your storage contract. We do not store full payment card details when payments are processed through third party payment providers.
Communication data such as enquiries, complaints, customer service communications, and any information you voluntarily provide when you contact us or respond to surveys or feedback requests.
Security and access information such as records of visits to our facility where necessary for security and safety, including access logs or entry records used to monitor who enters or leaves the storage site.
Technical information when you visit our website such as IP address, device information, basic analytical data and information about how you interact with our online content, where this is collected through standard website technologies. This data is generally used in an aggregated or pseudonymised form for website performance and security.
Lawful bases for processing your personal data
We process your personal data only where we have a valid legal basis to do so. Depending on the context, we may rely on the following lawful bases under UK data protection law:
Contractual necessity to enter into and perform our storage agreement with you, including to set up your account, manage your booking, facilitate access to your unit, provide customer service, invoice you, collect payments, and administer the ongoing contract.
Legal obligation to comply with applicable laws and regulations, including record keeping, tax and accounting requirements, and any obligations to cooperate with law enforcement or regulatory authorities where we are legally required to do so.
Legitimate interests pursued by Storage Crystal Palace, such as ensuring the security of our premises and customers property, maintaining and improving our services, protecting our business from fraud or misuse, and managing queries or disputes. When we rely on legitimate interests, we assess and balance our interests against your rights and interests and only proceed where our interests are not overridden.
Consent where required by law, for example for certain types of direct marketing communications or for optional analytical or preference cookies on our website. Where we rely on consent, you are free to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
How we use your personal data
We use the personal data we collect for the following purposes:
To set up, administer and manage your storage contract, including processing bookings, allocating units, facilitating access, and managing renewals or terminations.
To communicate with you regarding your contract, payments, changes to our services, updates to this Privacy Policy, service notifications and responses to your enquiries.
To process payments, manage billing and invoices, handle overdue accounts and, where necessary, recover debts owed to us.
To maintain the safety and security of our premises, customers, and staff, including the use of access logs and related security measures.
To manage our business operations, including internal record keeping, accounting, auditing, and quality assurance.
To improve our services and customer experience, including analysing how our website and services are used, and assessing customer feedback where provided.
To comply with legal and regulatory requirements, respond to lawful requests from authorities and exercise or defend legal claims.
Data retention and storage
We keep your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy and to meet any legal, accounting or reporting requirements. The specific retention periods may vary depending on the type of data and the purpose of processing.
Typically, we retain your core contract and billing information for a number of years after the end of your storage agreement, to comply with tax and accounting laws and to enable us to respond to queries or disputes about your contract. Communications and enquiry records may be retained for a period necessary to resolve the query or handle any follow up, and then archived or deleted in line with our retention schedules.
Security and access records are kept only for as long as they are needed for security, safety and incident investigation purposes, unless a longer retention period is required by law or necessary in connection with a specific incident.
When personal data is no longer required, we will securely delete or anonymise it so that it can no longer be linked to an identifiable individual.
Data processors and sharing of personal data
We may share your personal data with carefully selected third parties that support us in providing our services, in accordance with data protection law. These third parties act as data processors on our behalf and are only permitted to process your personal data in accordance with our instructions and for the purposes defined in this Privacy Policy.
Such processors may include payment processing providers that handle card or online payments for your storage fees, IT and cloud service providers that host our systems and data, providers of customer management software, and professional advisers such as accountants or legal advisers where necessary for our business operations.
We require all processors to implement appropriate technical and organisational measures to protect your personal data and to maintain confidentiality. They are not allowed to use your personal data for their own purposes.
We may also share your personal data with other third parties in limited circumstances, for example with law enforcement agencies, courts or regulators where we are legally required or permitted to do so, or with debt collection agencies and legal advisers where necessary to recover unpaid charges or to protect our rights.
We do not sell your personal data to third parties.
International data transfers
Where any of our service providers or their systems are located outside the United Kingdom, we will take steps to ensure that your personal data is given a level of protection substantially similar to that provided in the UK. This may include using standard contractual clauses or relying on other appropriate safeguards permitted by data protection law.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data, subject to certain conditions and exceptions. These rights include:
The right of access to obtain confirmation as to whether we process your personal data and to receive a copy of the personal data we hold about you, together with certain additional information.
The right to rectification to have inaccurate or incomplete personal data corrected or updated.
The right to erasure in certain circumstances, for example where the data is no longer needed for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for processing.
The right to restriction of processing to limit the way in which we process your personal data in certain situations, such as while we are considering a request for rectification or objection.
The right to object to processing where we rely on legitimate interests, including profiling based on those interests, and we will stop processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims.
The right to data portability to receive personal data you have provided to us in a structured, commonly used and machine readable format and, where technically feasible, to have it transmitted to another controller, where the processing is based on consent or contract and carried out by automated means.
Where we rely on your consent for processing, you also have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.
How to exercise your rights and complaints
If you wish to exercise any of your data protection rights, or have any questions about this Privacy Policy or how Storage Crystal Palace handles your personal data, you can contact us using the contact methods made available on our website or at our premises.
You also have the right to lodge a complaint with the data protection supervisory authority in the United Kingdom if you believe that your data protection rights have been infringed. We would, however, encourage you to contact us first so that we can try to resolve your concerns directly.
Changes to this Privacy Policy
We may update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements or for other operational reasons. Any updated version will be made available through our usual communication channels. We encourage you to review this Privacy Policy periodically to stay informed about how we process and protect your personal data.
This Privacy Policy applies to all current and former Storage Crystal Palace customers and prospective customers within our service area, and forms part of our commitment to managing your personal data fairly, lawfully and transparently.
