Privacy Policy - Frognal Storage

This Privacy Policy explains how Frognal Storage collects, uses, stores, shares, and protects personal data. It applies to all Frognal Storage customers in the area, including prospective customers, current customers, and individuals who interact with us in connection with storage services, account management, billing, access control, and related support. We are committed to handling personal data in a lawful, fair, and transparent manner in line with the UK GDPR and the Data Protection Act 2018.

1. Who We Are

Frognal Storage provides storage services and related operational support. In the course of delivering those services, we may act as a data controller when deciding why and how personal data is processed. This means we are responsible for ensuring that your personal data is managed appropriately and that your rights are respected.

2. Information We Collect

We only collect personal data that is necessary for the purposes set out in this policy. The categories of information we may collect include:

Identity data: name, title, and similar identifiers.
Contact data: address, email address, telephone number, and billing address.
Account and service data: customer reference numbers, storage unit details, access dates, service preferences, and account history.
Payment data: payment status, transaction references, and limited billing information required to process charges and maintain records.
Verification data: documents or information used to verify identity, authorisation, or eligibility where required for security or legal reasons.
Security data: CCTV footage, access logs, incident records, and other data collected to protect people, property, and premises.
Communication data: correspondence and records of enquiries, complaints, requests, and service-related communications.

We generally do not seek to collect special category data. If such data is provided to us by you, we will handle it carefully and only where a lawful basis exists.

3. How We Use Personal Data

We use personal data for the following purposes:

to provide storage services and manage customer accounts;
to verify identity and prevent unauthorised access;
to process payments, maintain financial records, and manage outstanding balances;
to communicate with customers about service matters;
to operate and secure our premises, including access monitoring and incident investigation;
to comply with legal, regulatory, tax, accounting, and insurance obligations;
to resolve disputes, handle complaints, and enforce contractual rights;
to improve our operations, systems, and customer service where permitted by law.

We do not use personal data for unrelated purposes and we do not sell personal data.

4. Lawful Basis for Processing

We process personal data only where a lawful basis under the UK GDPR applies. Depending on the context, our lawful bases may include:

Contract

We process data where it is necessary to enter into or perform a contract with you. This includes setting up storage services, managing your account, issuing invoices, and providing access to your storage unit.

Legal Obligation

We may process data to comply with laws and regulations, including accounting, tax, fraud prevention, health and safety, and lawful disclosure requests.

Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your rights and freedoms. This may include protecting our premises, preventing fraud, managing access control, improving service quality, and responding to incidents. Where we rely on legitimate interests, we consider the impact on individuals and apply appropriate safeguards.

Consent

In limited situations, we may rely on your consent, for example where it is required by law for specific communications or optional services. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Sharing and Processors

We may share personal data with trusted service providers and processors who act on our instructions and help us operate our business. These may include:

payment and billing service providers;
IT hosting, software, and systems maintenance providers;
security and monitoring providers;
professional advisers such as accountants, insurers, auditors, and legal advisers;
contractors engaged for operational support, repairs, or facilities management;
public authorities, regulators, law enforcement, or courts where required by law.

All processors are required to handle personal data securely, use it only for authorised purposes, and implement appropriate technical and organisational measures. We do not permit processors to use personal data for their own independent purposes.

6. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including for legal, accounting, and reporting requirements. Retention periods vary depending on the type of data and the reason it is held.

Customer account and contract records: retained for the duration of the service relationship and for a reasonable period afterwards to deal with claims, disputes, or audits.
Payment and invoice records: retained in line with financial and tax obligations.
Security records such as CCTV and access logs: retained only for as long as needed for security, incident management, or investigation purposes.
Correspondence and complaints: retained for the time needed to respond, resolve issues, and maintain records of outcomes.

When data is no longer required, we will delete it or anonymise it securely. We aim to retain only the minimum amount of information necessary.

7. Data Security

We use appropriate safeguards to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. These safeguards may include access controls, secure systems, staff training, physical security measures, and monitoring procedures. While no system can be guaranteed to be completely secure, we regularly review our controls and update them where appropriate.

8. International Transfers

If personal data is transferred outside the United Kingdom, we will ensure that suitable safeguards are in place to protect it in accordance with data protection law. These safeguards may include adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms.

9. Your Rights

Subject to legal limits, you have the following rights in relation to your personal data:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete data.
Right to erasure: to request deletion of data in certain circumstances.
Right to restrict processing: to request restricted use of your data in certain cases.
Right to data portability: to receive certain data in a structured, commonly used format where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we will respond in accordance with applicable law. We may need to verify your identity before acting on a request.

10. Children

Our services are intended for adults and business users. We do not knowingly collect personal data from children unless it is necessary in connection with a lawful service arrangement and appropriate safeguards are in place.

11. Complaints

If you have concerns about how we handle personal data, you have the right to raise them with us. You also have the right to lodge a complaint with the relevant data protection authority if you believe your rights have been infringed.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, guidance, or our operations. Any updated version will apply from the date it is issued unless stated otherwise. We encourage customers to review this policy periodically.

13. Summary of Our Commitments

Frognal Storage is committed to responsible data protection. We collect only what we need, use it for defined and lawful purposes, retain it only as long as necessary, and work with processors who are contractually bound to protect it. We respect your rights and aim to process your information fairly, securely, and transparently at all times.