Storage Elephant and Castle Privacy Policy
This Privacy Policy explains how Storage Elephant and Castle collects, uses, stores and protects the personal data of its customers and prospective customers in the Elephant and Castle area. It is intended to comply with the UK General Data Protection Regulation, the EU General Data Protection Regulation, and other applicable data protection laws. This Privacy Policy applies to all individuals who enquire about, use, or have used Storage Elephant and Castle services within the Elephant and Castle area.
Who we are and scope of this policy
Storage Elephant and Castle provides storage and related services to customers in the Elephant and Castle area. In relation to the personal data described in this Privacy Policy, Storage Elephant and Castle acts as the data controller. This means we determine the purposes and means of processing your personal data.
This Privacy Policy covers personal data collected online and offline, including data collected in person at our location, through telephone enquiries, through forms, and through any other interactions you may have with us as a customer or prospective customer within the Elephant and Castle area.
Personal data we collect
We collect and process different categories of personal data depending on the service you use and the way you interact with us. The personal data we may collect includes:
Identification and contact details such as full name, postal address, billing address, contact address in the Elephant and Castle area, date of birth, and identification document details where required to confirm your identity.
Contact information such as email address and communication preferences where provided, so that we can manage your booking, send confirmations, and respond to enquiries.
Contract and account information such as details of the storage unit or services you have booked, contract start and end dates, payment status, and related records of your interactions with us.
Payment and billing information such as payment method details and transaction records. We do not store full payment card details where a payment processor handles transactions, but we may retain partial information necessary for accounting and fraud prevention.
Usage and operational information such as access logs, unit entry and exit records where access control systems are used, and information relating to the safe and secure operation of our storage facilities.
Security and CCTV data such as images captured on CCTV in and around our facilities, recorded for security, health and safety, and crime prevention purposes.
Communication records such as emails or other written correspondence you send to us, notes relating to telephone calls or queries, and any complaints or feedback you provide.
How we collect your personal data
We collect personal data directly from you when you make an enquiry, request a quote, reserve or rent a storage unit, enter into a contract with us, make a payment, or communicate with us in any way. We may also collect personal data from you when you visit our premises, including through CCTV and access control systems.
In some cases, we may receive personal data about you from third parties where this is necessary for the performance of a contract or where you have given your consent to the third party to share your data with us. This could include payment processors or other service providers involved in your transaction with us.
Lawful basis for processing your personal data
We only process your personal data where we have a lawful basis for doing so under applicable data protection laws. The lawful bases we rely on are:
Contractual necessity. We process your personal data when it is necessary to enter into or perform a contract with you, such as to set up and manage your storage services, process payments, provide customer support, and communicate with you about your account.
Legal obligation. We process certain personal data to comply with legal and regulatory obligations, including tax and accounting requirements, identity verification obligations where applicable, health and safety laws, and obligations to cooperate with law enforcement or regulatory authorities.
Legitimate interests. We process personal data where it is necessary for our legitimate business interests and where your interests and fundamental rights do not override those interests. This includes using CCTV for security and crime prevention, maintaining and improving our services, managing our business operations, preventing fraud and misuse of our facilities, and handling enquiries and complaints.
Consent. In limited circumstances, we may rely on your consent, for example for certain optional marketing communications. Where processing is based on consent, you can withdraw your consent at any time by contacting us, and this will not affect the lawfulness of processing carried out before consent was withdrawn.
How we use your personal data
We use the personal data described above for the following purposes:
To create and manage your customer account, administer your contract, allocate and manage storage units, and provide related services in the Elephant and Castle area.
To process payments and manage billing, including issuing invoices, handling payment queries, and maintaining financial records.
To provide customer service, respond to enquiries and complaints, and communicate important information about your booking, terms and conditions, and any changes to our services or policies.
To maintain the safety and security of our facilities, customers, staff, and property, including through CCTV monitoring, access control, and incident reporting.
To comply with legal, regulatory, and law enforcement requirements, including where we are required to retain or disclose certain information.
To manage our business operations, including internal reporting, auditing, quality assurance, and service improvement.
Data processors and third party recipients
We may share your personal data with carefully selected third parties who act as data processors on our behalf. These processors are only permitted to handle your personal data in accordance with our instructions and for the specific purposes described in this Privacy Policy. They are required to implement appropriate technical and organisational measures to protect your personal data.
Typical categories of data processors and third party recipients include:
Payment service providers who process payments and handle billing on our behalf.
IT and system support providers who maintain our systems, databases, and security infrastructure.
Security and CCTV system providers who support the operation and maintenance of access control and surveillance systems.
Professional advisers such as accountants or legal advisers where necessary for business administration and compliance.
We may also share personal data with law enforcement agencies, regulatory authorities, or other third parties where we are required to do so by law or where this is necessary to protect our rights, your rights, or the rights of others.
International transfers
Where personal data is transferred outside the United Kingdom or the European Economic Area by our processors or service providers, we will ensure that appropriate safeguards are in place to protect your personal data in accordance with applicable data protection laws. This may include the use of standard contractual clauses or other recognised transfer mechanisms.
Data retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected and to meet legal, regulatory, and operational requirements. The specific retention period depends on the type of data and the context in which it is processed.
Contract and account information is generally retained for the duration of your contract and for a period afterwards to deal with any queries, disputes, or legal obligations, including tax and accounting requirements.
Payment and transaction records are retained for the period required by tax, accounting, and financial regulations.
CCTV footage is retained for a limited period necessary for security and incident investigation, unless a longer retention period is required in connection with a specific incident or legal obligation.
When personal data is no longer required for the purposes for which it was collected, we will securely delete or anonymise it.
Your data protection rights
Under data protection law, you have a number of rights in relation to your personal data. These rights apply to all Storage Elephant and Castle customers in the Elephant and Castle area, subject to certain legal conditions and limitations.
Right of access. You have the right to obtain confirmation as to whether we process your personal data and, if so, to request a copy of the personal data we hold about you.
Right to rectification. You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
Right to erasure. In certain circumstances, you have the right to request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected or where you withdraw consent and there is no other lawful basis for processing.
Right to restriction of processing. You have the right to request that we restrict the processing of your personal data in certain situations, for example while we investigate a concern you have raised about its accuracy.
Right to data portability. In certain cases, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine readable format and to request that we transmit that data to another controller where technically feasible.
Right to object. You have the right to object to processing of your personal data based on our legitimate interests, on grounds relating to your particular situation. We will stop processing your personal data unless we have compelling legitimate grounds to continue or where processing is required for legal claims.
Right to withdraw consent. Where we rely on your consent to process your personal data, you can withdraw your consent at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.
You also have the right to lodge a complaint with the relevant supervisory authority if you believe that your data protection rights have been infringed.
Security of your personal data
We take appropriate technical and organisational measures to protect your personal data from unauthorised access, accidental loss, destruction, or damage. These measures include physical security controls at our facilities, access controls, and measures designed to maintain the confidentiality and integrity of personal data.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make changes, we will update the date of the policy and take appropriate steps to inform you of any significant changes where required by law.
