Storage Frognal Privacy Policy
This Privacy Policy explains how Storage Frognal collects, uses, shares and protects personal data of its customers and prospective customers. It applies to all Storage Frognal customers in our operating area, including individuals and businesses who use or enquire about our storage services.
Controller and scope
Storage Frognal is the controller of the personal data described in this Privacy Policy. This means we determine the purposes and means of processing your personal data. This Privacy Policy covers personal data collected in person at our premises, by telephone, through online forms, and via any other method where we interact with you in connection with our storage services.
Types of personal data we collect
We collect and process different categories of personal data depending on your relationship with us and how you use our services. The types of data we may collect include the following.
Identification and contact data such as full name, postal address, billing address, contact address, date of birth where required by law or for verification, and preferred method of contact.
Contact details such as email address and any other contact details that you choose to provide to us so we can communicate with you about your storage arrangements, billing, and enquiries.
Contract and account data such as storage unit number, contract start and end dates, services selected, billing history, payment status, and correspondence relating to your account or any disputes.
Payment and transaction data such as payment method details, partial card information where required for billing, transaction references, amounts paid, refunds, and associated accounting records. We do not store full payment card details when this is handled by a secure payment provider.
Security and access data such as vehicle registration numbers where needed for access control, access codes, key or fob references, entry and exit logs for the facility, and any records created by security systems we operate.
Technical and usage data such as basic device and browser information, IP address, and information about how you access our online services if we provide them, for example completing an enquiry form or managing your booking online.
Communication data such as records of emails, letters, or notes of telephone conversations and any instructions, feedback, or complaints you provide.
How we collect personal data
We may collect your personal data directly from you when you make an enquiry, request a quote, sign a storage agreement, make a payment, access our premises, or contact us for any reason. We may also receive personal data indirectly from third parties such as payment processors, referencing agencies, or authorised representatives you have instructed to act on your behalf.
Lawful basis for processing
We process your personal data only where we have a lawful basis under the General Data Protection Regulation and applicable data protection laws. Depending on the circumstances one or more of the following bases will apply.
Performance of a contract. We process data that is necessary to provide our storage services, set up and manage your account, take payment, communicate with you about your booking, and respond to requests in connection with your contract.
Compliance with legal obligations. We may process data where the law requires us to do so, for example to keep certain financial and transaction records, comply with tax and accounting rules, respond to lawful requests from public authorities, or support crime prevention and security obligations.
Legitimate interests. We may process personal data where this is necessary for our legitimate business interests and where these interests are not overridden by your rights and interests. Examples include managing and improving our services and facilities, ensuring the security and safety of our premises, preventing fraud and misuse of our services, and handling enquiries or complaints. When relying on this basis, we balance our interests against your privacy rights.
Consent. In limited situations we may rely on your consent, for example sending certain types of marketing communications or using optional cookies or analytics if we provide online services. Where we rely on consent you can withdraw it at any time, and this will not affect processing carried out before consent was withdrawn.
Purposes for which we use personal data
We use personal data for the following purposes.
To provide and manage storage services including setting up customer accounts, allocating storage units, managing access, and recording your use of the facility.
To manage billing and payments including issuing invoices, taking and recording payments, arranging refunds where necessary, and maintaining financial and accounting records.
To communicate with you including responding to enquiries, confirming bookings, sending notices about your contract, informing you of changes to our terms or policies, and providing customer support.
To maintain security and safety at our premises including operating access control systems, maintaining logs of entries and exits, and taking reasonable steps to protect people, property, and our facilities.
To manage our business including planning and monitoring occupancy, improving services, training staff, and handling disputes or legal claims.
To comply with legal and regulatory requirements including tax, accounting, and record-keeping obligations, as well as cooperating with authorised public authorities when required by law.
Data sharing and processors
We do not sell or trade your personal data. We may share personal data with carefully selected third parties where necessary for the purposes described in this Privacy Policy.
Service providers acting as processors may handle personal data on our behalf and under our instructions. These may include providers of payment processing services, secure data storage and cloud hosting services, customer management systems, accounting and invoicing tools, and providers of security or access control systems. We only use processors that provide sufficient guarantees to implement appropriate technical and organisational measures to protect your data.
Professional advisers such as accountants, auditors, legal advisers, or insurance providers may receive personal data where this is necessary for them to provide their services and to protect our legal rights and comply with our obligations.
Public authorities and law enforcement agencies may receive personal data where we are required to disclose it by law or where disclosure is necessary to protect the safety and security of individuals, our premises, or our legitimate interests, subject to applicable legal safeguards.
Where we share personal data with processors, we put written contracts in place requiring them to keep your data confidential, use it only for the agreed purposes, and apply appropriate security protections.
International transfers
Where we use service providers located outside the United Kingdom or European Economic Area, or where personal data is accessed from outside these regions, we take appropriate steps to ensure that your data is protected in line with applicable data protection laws. These may include using jurisdictions that have been recognised as providing an adequate level of protection or entering into data transfer agreements using approved safeguards.
Data retention
We keep personal data only for as long as necessary to fulfil the purposes for which it was collected and to meet legal, accounting, or reporting requirements. The retention period will vary depending on the type of data and the context in which it was collected.
In general, we retain contract, billing, and transaction data for a number of years after the end of your relationship with us, in line with legal and tax requirements. Access logs and security related data may be kept for a shorter period, unless required for an investigation or legal claim. Enquiry records and communication data may be kept for a reasonable period to manage our relationship with you and to handle any follow-up or disputes.
When data is no longer required, we will either securely delete or anonymise it so that it can no longer be linked to an identifiable person.
Security of personal data
We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, disclosure, or destruction. These measures include access controls, staff training, secure storage arrangements, and the use of reputable service providers that apply suitable security practices. While we take reasonable steps to protect your data, no system can be completely secure and we cannot guarantee absolute security.
Your data protection rights
As a data subject you have a number of rights under data protection law in relation to the personal data we hold about you. These rights apply to all Storage Frognal customers in our operating area, subject to certain legal limitations and conditions.
Right of access. You can request confirmation of whether we process your personal data and obtain a copy of that data together with certain information about how we use it.
Right to rectification. You can ask us to correct inaccurate or incomplete personal data. We may need to verify the accuracy of the new information before making changes.
Right to erasure. In some circumstances you can request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected and we have no legal reason to keep it. This right is subject to legal and contractual requirements that may require us to retain some data.
Right to restriction of processing. You can request that we restrict the processing of your data, for example while we check its accuracy or consider an objection you have raised.
Right to object. You can object to processing that is based on our legitimate interests, including certain forms of profiling. We will stop processing your data unless we have compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is required for legal claims.
Right to data portability. Where processing is based on consent or on a contract and is carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, and machine readable format, and to request that it is transmitted to another controller where technically feasible.
Right to withdraw consent. Where we rely on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.
You also have the right to lodge a complaint with a supervisory authority if you consider that our processing of your personal data infringes applicable data protection laws.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or how we process personal data. When we make significant changes, we will take reasonable steps to inform you. The most current version of this Privacy Policy will always apply to the personal data we process.
