Privacy Policy - Harrowonthehill Storage

This Privacy Policy explains how Harrowonthehill Storage collects, uses, shares, stores, and protects personal data in connection with the provision of storage services. It applies to all Harrowonthehill Storage customers in area, including prospective customers, current customers, former customers, and any individuals who interact with us in relation to storage enquiries, bookings, payments, site access, account management, and customer support.

We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We aim to be transparent about what data we collect, why we collect it, how long we keep it, who may process it on our behalf, and what rights individuals have over their personal data.

1. Data We Collect

We collect only the personal data necessary to provide and manage our storage services, maintain security, and meet legal obligations. The categories of personal data we may collect include:

Identity details: name, date of birth, title, and identification information where required for verification.
Contact details: address, email address, telephone number, and emergency contact information where provided.
Account and contract details: storage unit number, booking history, contract dates, service preferences, correspondence records, and account notes.
Payment information: billing details, payment status, transaction records, and limited payment card information processed through secure payment providers. We do not retain full card details where this is not necessary.
Access and security data: CCTV images, gate access records, alarm logs, and site entry or exit information where applicable.
Communication data: emails, messages, call notes, complaint records, and other communications with our staff or service providers.
Technical data: IP address, device data, browser type, and usage information if you interact with our digital systems.

We generally collect personal data directly from you when you make an enquiry, sign a storage agreement, provide payment details, contact us, or use our services. In some cases, we may receive information from third parties, such as identity verification providers, payment processors, contractors, or legal and regulatory authorities.

2. How We Use Personal Data

We use personal data for specific and legitimate purposes, including:

creating and managing customer accounts and storage agreements;
verifying identity and preventing fraud;
processing payments, refunds, and outstanding balances;
providing access to storage facilities and maintaining site security;
responding to enquiries, requests, complaints, and disputes;
keeping accurate business, tax, and legal records;
monitoring and improving our services, systems, and customer experience;
protecting our customers, staff, assets, and premises;
complying with legal and regulatory obligations.

We will only use personal data in ways that are compatible with the purposes for which it was collected, unless we reasonably believe another lawful basis applies and the new use is compatible with the original purpose.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis to process personal data. Harrowonthehill Storage relies on the following lawful bases, depending on the context:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes setting up storage agreements, managing access, taking payments, administering accounts, and delivering the services you request.

Legal Obligation

We process personal data where necessary to comply with our legal obligations, such as tax, accounting, fraud prevention, health and safety, safeguarding, and responding to lawful requests from authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests. Examples include protecting our property, operating CCTV for security, monitoring site access, maintaining records, preventing misuse of our services, and improving operational efficiency.

Consent

In limited circumstances, we rely on your consent, for example where required for optional marketing communications or other voluntary processing activities. Where processing is based on consent, you may withdraw that consent at any time.

4. Sharing and Processors

We may share personal data with trusted third parties where necessary to deliver our services, operate our business, and meet legal obligations. These third parties act as processors or independent controllers depending on the circumstances.

Processors may include:

IT and software providers: companies that host or support our customer management systems, security tools, email systems, or record-keeping platforms.
Payment processors and financial service providers: organisations that process payments and help manage billing, refunds, and fraud checks.
Security providers: suppliers of CCTV systems, alarm monitoring, access control, and maintenance services.
Professional advisers: accountants, auditors, insurers, legal advisers, and similar professionals acting on our behalf or in support of our operations.
Maintenance and service contractors: authorised contractors who require limited access to carry out repairs, inspections, or operational support.

Where we engage processors, we ensure appropriate contractual safeguards are in place. Processors may only process personal data on our instructions and are required to keep it secure and confidential.

We may also disclose personal data to public authorities, regulators, courts, law enforcement agencies, or other third parties where required or permitted by law, or where necessary to protect our rights, customers, staff, and property.

5. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, security, or reporting requirements. Retention periods vary depending on the type of data and the reason for processing.

As a general approach:

Customer contract and account records are usually retained for the duration of the relationship and for a reasonable period afterwards to manage claims, disputes, and legal obligations.
Payment and accounting records are retained for the period required by tax and financial laws.
Security records, including CCTV, are retained only for the period necessary for security and incident investigation purposes, unless needed longer for a legal claim or investigation.
Enquiry and correspondence records are kept for as long as needed to handle the enquiry and for an appropriate period afterwards.

When personal data is no longer required, we will securely delete, destroy, or anonymise it in accordance with our retention procedures.

6. Security of Personal Data

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures may include access controls, password protection, secure storage, staff training, restricted permissions, and supplier oversight.

While no system can be guaranteed to be completely secure, we work to maintain a level of security appropriate to the nature of the data we process and the risks involved.

7. Your Rights

Under data protection law, individuals have a number of rights in relation to their personal data. Subject to certain conditions and exemptions, you may have the right to:

Access the personal data we hold about you;
Rectify inaccurate or incomplete personal data;
Erase your personal data in certain circumstances;
Restrict our processing in certain situations;
Object to processing based on legitimate interests or direct marketing;
Data portability for data you provided to us where processing is based on consent or contract and carried out by automated means;
Withdraw consent where we rely on consent;
Complain to the Information Commissioner’s Office if you believe your rights have been infringed.

We may need to verify your identity before responding to a rights request. We will respond within the time limits required by law and keep you informed if an extension is necessary.

8. Children’s Data

Our storage services are intended for adults and business users. We do not knowingly collect personal data from children except where it is necessary and lawful, such as emergency contact details provided by an adult customer. If we become aware that we have collected data unlawfully, we will take appropriate steps to delete it.

9. International Transfers

Where personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place to protect it in accordance with applicable data protection law. These safeguards may include adequacy regulations, standard contractual clauses, or equivalent protection mechanisms.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. Any revised version will apply from the date it is made available. We encourage customers to review this policy periodically to stay informed about how we protect personal data.

11. Summary of Key Principles

Harrowonthehill Storage is committed to processing personal data lawfully, fairly, and transparently. We collect only what we need, use it for clear purposes, keep it only as long as necessary, and share it only with trusted processors or when required by law. We also respect the rights of individuals and aim to handle all personal data with care, confidentiality, and accountability.

This Privacy Policy applies to all Harrowonthehill Storage customers in area.