Privacy Policy - Westcombepark Storage

This Privacy Policy explains how Westcombepark Storage collects, uses, stores, shares, and protects personal data in connection with our storage services. It applies to all Westcombepark Storage customers in the area, including prospective customers, current customers, former customers, authorised users, and any individual whose personal data is processed by us in the course of providing storage-related services.

We are committed to handling personal data in a lawful, fair, and transparent manner in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy is intended to help you understand what data we collect, why we collect it, how long we keep it, who may process it on our behalf, and what rights you have over your personal information.

1. Personal Data We Collect

We collect only the data necessary to provide and manage our services, comply with legal obligations, and protect our business and customers. The types of personal data we may collect include:

Identity information such as your name, date of birth, and proof of identity where required.
Contact details such as your address, email address, and telephone number.
Account and contract information such as service dates, unit allocation, payment records, and correspondence.
Payment information such as billing details, transaction records, and limited financial information needed to process payments.
Security information such as access logs, CCTV footage, incident reports, and information relating to site entry and exit.
Communication data such as enquiries, complaints, requests, and any other communications you send to us.
Usage and technical data where relevant, such as device or system logs connected to security or service management tools.

We normally collect personal data directly from you when you complete forms, enter into a contract, make a payment, communicate with us, or use our facilities. In some cases, we may receive data from third parties such as payment providers, identity verification services, insurers, or legal and regulatory bodies.

2. How We Use Personal Data

Westcombepark Storage uses personal data for the following purposes:

To set up and manage customer accounts and storage agreements.
To verify identity and prevent fraud, misuse, or unlawful activity.
To process payments, refunds, and account-related transactions.
To communicate with customers about their contracts, payments, or service matters.
To maintain site safety, security, and operational records.
To handle disputes, complaints, and claims.
To meet legal, tax, accounting, and regulatory obligations.
To improve our services, systems, and customer experience.

We only use personal data for the purposes stated in this policy or for closely related purposes that would reasonably be expected. We do not sell personal data.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis to process your personal data. Depending on the activity, Westcombepark Storage may rely on one or more of the following bases:

Performance of a Contract

We process personal data when it is necessary to enter into or perform a storage agreement, manage your account, provide access to storage services, collect payments, and respond to service-related requests.

Compliance with a Legal Obligation

We may process personal data to comply with legal and regulatory requirements, including accounting, tax, fraud prevention, safety, and record-keeping obligations.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include protecting property, maintaining security, preventing crime, managing disputes, and improving our operations.

Consent

In limited cases, we may rely on your consent, for example where it is required for a specific optional service or communication. Where consent is used, you have the right to withdraw it at any time.

4. Data Sharing and Processors

We may share personal data with trusted third parties that help us deliver our services. These parties act as processors when they process personal data on our instructions, or as independent controllers where they determine their own purposes for processing.

Examples of processors may include:

Payment processors that handle card and online payment transactions.
IT and cloud service providers that support our storage systems, email, and record management.
Security service providers that support CCTV, alarms, access control, or site monitoring systems.
Administrative and account service providers that assist with invoicing, document management, and customer support tools.
Professional advisers such as accountants, auditors, insurers, and legal advisers.

We require processors to handle personal data securely, confidentially, and only in accordance with our lawful instructions. They are not permitted to use your data for their own unrelated purposes.

We may also disclose personal data where required by law, court order, government authority, law enforcement, or to protect our rights, customers, staff, or property.

5. International Transfers

Where personal data is transferred outside the UK, we will take appropriate steps to ensure it is protected to a standard that is consistent with applicable data protection law. This may include the use of approved contractual protections or transfers to countries recognised as providing adequate protection.

6. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, insurance, and reporting requirements. Retention periods may vary depending on the type of data and the reason for processing.

Customer and contract records are usually retained for the duration of the relationship and for a further period after it ends in case of disputes or legal claims.
Payment and accounting records are retained for the period required by tax and financial laws.
Security records, including access logs and CCTV, are kept only for as long as needed for safety, incident investigation, or crime prevention purposes.
Enquiry and correspondence records are kept for as long as needed to resolve the matter and to support business administration.

When data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you.

7. Security of Personal Data

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures may include access controls, encryption, staff training, system monitoring, secure storage, and restricted physical access to records.

While we work hard to protect personal data, no system can be guaranteed to be completely secure. If a personal data incident occurs, we will assess the situation and take appropriate action in line with our legal obligations.

8. Your Rights

Depending on the circumstances and the legal basis for processing, you have a number of rights under data protection law. These include:

The right of access to obtain a copy of the personal data we hold about you.
The right to rectification to correct inaccurate or incomplete data.
The right to erasure in certain situations, also known as the right to be forgotten.
The right to restrict processing in certain circumstances.
The right to object to processing based on legitimate interests or direct marketing.
The right to data portability where processing is based on consent or contract and carried out by automated means.
The right to withdraw consent where processing relies on consent.
The right to lodge a complaint with the Information Commissioner’s Office if you are concerned about how your data has been handled.

To exercise your rights, you may need to provide sufficient information to verify your identity. Some rights are subject to conditions or exemptions under law, so they may not always apply in every case.

9. Children’s Data

Our services are generally intended for adults. We do not knowingly collect personal data from children except where necessary and lawful, for example where a minor is named in a relevant record or emergency situation. If we become aware that we have collected data unlawfully from a child, we will take appropriate steps to delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will apply from the date it is issued. We encourage customers to review this policy periodically so they remain informed about how their data is handled.

11. Key Principles

Westcombepark Storage is committed to the following principles when processing personal data:

Lawfulness, fairness, and transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality
Accountability

These principles guide how we collect, use, retain, and protect personal data throughout the customer relationship. If you continue to use our services, you acknowledge that your information may be processed as described in this Privacy Policy, subject always to your legal rights and our obligations under data protection law.