Storage Nine Elms Privacy Policy
This Privacy Policy explains how Storage Nine Elms collects, uses, stores, and shares personal data relating to customers and prospective customers in the Nine Elms area. It also explains your rights under the UK General Data Protection Regulation and related data protection laws. This Privacy Policy applies to all Storage Nine Elms customers and users of our services located in the area we operate.
By using our services, making an enquiry, or otherwise providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy.
Who We Are and Scope of This Policy
Storage Nine Elms is the controller of the personal data described in this Privacy Policy. Controller means we determine how and why your personal data is processed. This Privacy Policy covers all personal data we process about individual customers, prospective customers, and individuals acting on behalf of business or organisational customers within the Nine Elms area.
Personal Data We Collect
We collect and process personal data that is necessary for the performance of our storage services and for related business operations. The types of personal data we may collect include:
Identification and contact details such as your name, postal address, billing address, contact address, date of birth where needed for verification, and other similar identifiers.
Contact information such as your email address, correspondence address, and other direct communication details you choose to provide.
Contract and account information such as storage unit number, contract start and end dates, payment status, booking details, move-in and move-out dates, and preferences relating to your storage arrangements.
Payment and billing information such as payment method details, billing history, invoices, and transaction records. Card and bank details are processed by secure payment providers and are not stored by us beyond what is necessary for record-keeping and compliance.
Security and access information such as access codes, visit logs, CCTV footage in and around our premises, incident reports, and records of communications relating to security matters.
Communication data such as emails, letters, and records of telephone or in-person enquiries, complaints, or feedback.
Technical data such as basic information collected when you visit our website or digital services, including device information, approximate location, and logs generated by our systems to maintain security and performance.
How We Collect Personal Data
We may collect personal data directly from you when you contact us to request a quote, reserve or rent a storage unit, sign a contract, make a payment, visit our premises, or communicate with us by any means.
We may also receive personal data from third parties where it is lawful to do so, for example from payment service providers, professional advisers, business partners, or public authorities for fraud prevention or legal compliance.
Purposes and Lawful Bases for Processing
We process your personal data only where we have a lawful basis under data protection law. The main purposes and their corresponding lawful bases are as follows:
To provide storage services and manage your account. This includes setting up your contract, managing bookings, facilitating payments, providing access, and responding to your enquiries. The lawful basis is that processing is necessary for the performance of a contract or to take steps at your request before entering into a contract.
To ensure the security and integrity of our premises and services. We may use CCTV, access logs, and security incident reports to protect customers, staff, and property, and to prevent and detect crime. The lawful bases are our legitimate interests in ensuring safety and security and, where appropriate, compliance with legal obligations.
To manage payments, billing, and debt collection. We process transaction records, invoices, and related data to collect and refund payments, maintain financial records, and manage any outstanding sums. The lawful bases are the performance of a contract, compliance with legal obligations relating to accounting and taxation, and our legitimate interests in recovering debts.
To communicate with you about your contract and our services. This includes service updates, notices relating to access or changes in terms, and responses to your questions and complaints. The lawful bases are performance of a contract and our legitimate interests in effective customer service.
To comply with legal and regulatory requirements. We may process and retain personal data to meet obligations under laws relating to tax, accounting, fraud prevention, law enforcement requests, health and safety, and other regulatory requirements. The lawful basis is compliance with legal obligations.
To send you service-related marketing or information about similar services. Where permitted by law, we may send you information about services that are similar to those you have already purchased or enquired about. The lawful basis is our legitimate interests in promoting our services. You can opt out at any time.
Where we rely on consent as a lawful basis, we will request your clear and specific agreement, and you may withdraw your consent at any time.
Data Retention
We retain personal data for no longer than is necessary for the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements.
In general, we retain contract and account information for a period after your contract ends, to handle queries, disputes, or legal claims and to comply with our record-keeping obligations. The exact retention period may vary depending on the type of document and applicable legal requirements.
CCTV footage and access logs are retained for shorter periods, unless a longer retention is required in connection with an incident, dispute, or legal request.
When personal data is no longer required, we will delete it securely or anonymise it so that it can no longer be linked back to you.
Data Processors and Third Parties
We may share your personal data with trusted service providers who act as data processors on our behalf. These processors may include:
Payment service providers that process card and online payments.
IT and cloud hosting providers that store data and support our systems.
Security and maintenance providers that support CCTV, access control, and building management systems.
Professional advisers such as accountants, auditors, and legal advisers where necessary for legitimate business and compliance purposes.
These processors are contractually required to process your personal data only on our instructions, to protect it appropriately, and not to use it for their own purposes.
We may also share personal data with third parties acting as independent controllers where required by law or where it is necessary to protect our rights, customers, staff, or property, for example with law enforcement agencies, regulators, courts, or insurers.
International Data Transfers
Where personal data is transferred outside the United Kingdom or European Economic Area by our service providers, we will ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or equivalent protections, in line with data protection law.
Your Data Protection Rights
You have a number of rights under data protection law in relation to the personal data we hold about you. These rights include:
The right of access. You can request confirmation of whether we process your personal data and receive a copy of that data, together with certain information about how it is processed.
The right to rectification. You can ask us to correct inaccurate or incomplete personal data we hold about you.
The right to erasure. In some circumstances, you can ask us to delete your personal data, for example where it is no longer needed for the purposes for which it was collected, or where you withdraw consent and there is no other lawful basis for processing.
The right to restriction of processing. You can ask us to restrict the processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to our use of it.
The right to data portability. Where processing is based on consent or on a contract and is carried out by automated means, you may have the right to receive personal data you provided in a structured, commonly used, and machine-readable format and to request that it is transferred to another controller.
The right to object. You can object to processing of your personal data which is based on our legitimate interests, including profiling, and we will stop processing unless we can demonstrate compelling legitimate grounds or the processing is needed for legal reasons. You can always object to direct marketing and we will stop sending it.
Rights related to consent. Where we rely on your consent to process personal data, you may withdraw that consent at any time. This will not affect the lawfulness of processing that took place before consent was withdrawn.
Security of Your Personal Data
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. Measures may include restricted access controls, secure storage, encryption where appropriate, staff training, regular reviews of security practices, and the careful selection of our service providers.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. Any significant changes will be communicated in an appropriate manner. The most recent version will always apply to the personal data we hold and process.
If you continue to use our services after any change to this Privacy Policy, we will treat this as your acknowledgement that you have read and understood the updated terms.
