Privacy Policy - Hadleywood Storage

This Privacy Policy explains how Hadleywood Storage collects, uses, stores, shares, and protects personal data relating to customers and prospective customers. It applies to all Hadleywood Storage customers in area, including individuals who enquire about storage services, hold a storage agreement, visit our premises, or interact with us in connection with our services.

We are committed to handling personal data in accordance with the UK GDPR and the Data Protection Act 2018. We aim to be clear, fair, and transparent about the information we collect and the purposes for which it is used. This policy should be read alongside any terms and conditions that apply to your storage arrangement.

1. Personal Data We Collect

We collect only the information that is necessary for the provision, administration, and security of our services. Depending on your interaction with us, we may collect the following categories of personal data:

Identity information such as your name, date of birth, and identification details where required for verification.
Contact information such as address, email address, and telephone number.
Account and contract information such as storage unit details, agreement dates, payment status, and customer reference numbers.
Financial information such as billing records, payment history, and transaction details. We do not generally store full card details where payments are processed by a payment provider.
Security information such as access logs, CCTV records, alarm events, and records of site entry or exit where applicable.
Communication records such as emails, messages, complaint details, and notes of service calls or customer support interactions.
Technical information where you use digital services, such as IP address, device information, and usage data.

We do not intentionally collect special category data unless it is necessary for a specific legal reason or disclosed by you in correspondence. If such information is provided, we will handle it with additional care and only where we have a lawful basis to do so.

2. How We Use Personal Data

We use personal data for the following purposes:

to provide storage services and manage your account;
to verify identity and prevent fraud;
to process payments and manage invoicing;
to maintain security at our premises and protect property;
to respond to enquiries, complaints, and service requests;
to comply with legal and regulatory obligations;
to enforce agreements, resolve disputes, and recover amounts owed;
to improve our services, systems, and internal processes;
to keep appropriate business records.

We will only use personal data in ways that are compatible with the purposes for which it was collected, unless we have a lawful basis to do otherwise.

3. Lawful Basis for Processing

We process personal data only where a lawful basis applies under the UK GDPR. The main lawful bases we rely on are:

Performance of a Contract

We process your data where it is necessary to enter into or perform a storage agreement with you, manage your account, provide access to your storage unit, collect payment, and deliver customer support connected with the agreement.

Legal Obligation

We process personal data where we must do so to comply with legal requirements, including accounting and tax obligations, fraud prevention duties, and obligations to maintain records or respond to lawful requests from authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include protecting our property and customers, preventing unauthorised access, managing our business efficiently, and handling disputes or claims.

Consent

In limited cases, we may rely on consent, for example where it is required for certain optional communications or specific uses of data. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Sharing Personal Data and Processors

We do not sell personal data. However, we may share personal data with trusted third parties where necessary for the operation of our services, compliance with the law, or protection of our rights. These third parties act as processors or, in some cases, independent controllers.

Processors may include:

payment service providers that handle card or bank transactions;
IT and cloud service providers that support our systems and secure data storage;
accounting and bookkeeping providers;
security providers, including CCTV and alarm monitoring services;
property maintenance or facilities management providers;
professional advisers such as lawyers, insurers, and auditors where necessary;
debt recovery or credit control providers where lawful and appropriate.

Where we use processors, they are required to process personal data only on our instructions and to maintain appropriate security and confidentiality measures. We take reasonable steps to ensure that processors are bound by suitable contractual and data protection obligations.

We may also disclose personal data where necessary to law enforcement agencies, courts, regulators, or other public authorities, or where disclosure is required by law or necessary to protect the rights, safety, or property of Hadleywood Storage, our customers, or others.

5. International Transfers

Where personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place. These may include adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms approved under applicable data protection law. We will take steps to ensure that data transferred internationally receives a level of protection that is essentially equivalent to that provided in the UK.

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, including for legal, accounting, insurance, or reporting obligations. Retention periods depend on the type of information and the reason it is held.

In general:

customer and contract records are retained for the duration of the agreement and for a further period required for legal or business purposes;
payment and accounting records are retained for the period required by tax and financial regulations;
security records such as access logs or CCTV footage are retained for a limited period unless needed for an investigation, claim, or legal process;
correspondence and complaint records are kept as long as needed to manage the issue and for subsequent reference where necessary.

When personal data is no longer required, we will securely delete, anonymise, or destroy it in a manner appropriate to the nature of the record.

7. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. These measures may include access controls, password protection, secure storage, staff training, and regular review of internal procedures.

No system can be guaranteed to be completely secure, but we are committed to maintaining reasonable safeguards and improving them where necessary. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will act in accordance with applicable legal requirements.

8. Your Rights

Subject to certain conditions and exemptions under data protection law, you have the following rights in relation to your personal data:

Right of access to obtain a copy of the personal data we hold about you;
Right to rectification to have inaccurate or incomplete data corrected;
Right to erasure in certain circumstances, sometimes called the right to be forgotten;
Right to restrict processing in certain situations;
Right to object to processing based on legitimate interests or direct marketing;
Right to data portability where processing is based on consent or contract and carried out by automated means;
Right to withdraw consent where processing is based on consent;
Right to complain to the relevant supervisory authority if you believe your rights have been infringed.

If you make a request, we may need to verify your identity before responding. We will respond within the time limits required by law and may extend the period where a request is complex or numerous.

9. Children’s Data

Our services are intended for adults and businesses. We do not knowingly collect personal data from children except where it is incidental and necessary in a lawful context. If we become aware that we have collected data inappropriately, we will take appropriate steps to delete or protect it.

10. Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, unless this is permitted by law and appropriate safeguards are in place. If this changes, we will update this policy to explain the logic involved and your rights in relation to such processing.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data handling practices. Any revised version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically.

12. Summary of Our Commitment

Hadleywood Storage is committed to processing personal data lawfully, fairly, and transparently. We collect only the information needed to operate our storage services, we use it for clear and legitimate purposes, and we retain it only as long as necessary. We rely on appropriate lawful bases, use trusted processors under contract, and respect your data protection rights.

By using our services, you acknowledge that your personal data may be processed as described in this Privacy Policy and in accordance with applicable data protection law.