Privacy Policy - Collierrow Storage

This Privacy Policy explains how Collierrow Storage collects, uses, stores, shares, and protects personal data. It applies to all Collierrow Storage customers in the area, including prospective customers, current customers, former customers, and authorised users who interact with our storage services, facilities, systems, or customer support processes.

We are committed to handling personal data in a way that is lawful, fair, transparent, and secure. This policy is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It should be read alongside any service terms, site rules, or other notices that may apply to specific services or locations.

1. Data We Collect

We collect personal data only where necessary for the operation of our storage services, the management of customer accounts, the protection of our premises, and compliance with legal obligations. The type of information we collect may include:

Identity information such as name, date of birth, and proof of identity documents where required.
Contact information such as postal address, billing address, email address, and telephone number.
Account and contract information such as storage unit number, booking details, payment status, service history, and correspondence records.
Payment information such as bank details, card details, transaction records, and refund or chargeback information.
Access and security information such as entry logs, CCTV images, vehicle registration details, and visitor records where applicable.
Communication information including emails, call notes, complaint details, and records of requests or instructions.
Technical information such as device identifiers, IP address, browser type, and usage data if you interact with digital systems used in connection with our services.

We normally collect personal data directly from you when you complete a booking, sign a contract, make a payment, contact us, or use our facilities. In some cases, we may receive information from third parties such as payment providers, identity verification services, insurance partners, debt recovery agents, or public authorities where lawful and appropriate.

2. How We Use Personal Data

We use personal data for the following purposes:

To set up and manage customer accounts and storage agreements.
To verify identity and prevent fraud, misuse, or unauthorised access.
To process payments, issue invoices, and manage refunds, arrears, or credits.
To provide customer support and respond to enquiries, complaints, or service requests.
To monitor and secure our premises, assets, and storage facilities.
To comply with legal and regulatory requirements, including tax, accounting, safety, and crime prevention duties.
To manage disputes, enforce contracts, or establish, exercise, or defend legal claims.
To improve our services, operations, and customer experience.

We will only use personal data for the purposes for which it was collected, unless we reasonably consider that another purpose is compatible with the original purpose or we are otherwise permitted or required by law.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for processing personal data. Depending on the activity, Collierrow Storage may rely on one or more of the following lawful bases:

Contract – processing is necessary to enter into or perform a storage contract, including account administration, billing, and service delivery.
Legal obligation – processing is necessary to comply with applicable laws, such as accounting, tax, health and safety, and fraud prevention requirements.
Legitimate interests – processing is necessary for our legitimate business interests, such as protecting our facilities, preventing misuse, improving services, and managing disputes, provided these interests are not overridden by your rights and freedoms.
Consent – where we rely on your consent, for example for certain optional marketing or specific non-essential processing. You may withdraw consent at any time where consent is the lawful basis.

Where special category data is involved, or where more sensitive information is processed, we will do so only where a specific condition under data protection law applies and additional safeguards are in place.

4. Sharing and Processors

We may share personal data where necessary with trusted third parties who assist us in providing and operating our services. These parties act either as independent controllers or as processors acting on our instructions. We take appropriate steps to ensure that any processor handles personal data securely and only for authorised purposes.

Examples of processors and service providers may include:

IT and hosting providers that store and maintain customer records, booking systems, or security systems.
Payment service providers that process card or bank transactions.
Identity verification and fraud prevention providers used to confirm identity or detect suspicious activity.
Security and surveillance providers that support site protection, alarm monitoring, or CCTV management.
Professional advisers such as accountants, auditors, insurers, or legal advisers.
Debt collection or recovery providers where payments are overdue and lawful recovery action is required.

We may also disclose personal data to public authorities, law enforcement, courts, regulators, or other third parties where required or permitted by law. If our business or any part of it is sold, transferred, or reorganised, personal data may be shared with relevant parties as part of that transaction, subject to applicable safeguards.

5. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, tax, insurance, or contractual requirements. The retention period depends on the type of data and the reason for processing.

In general:

Customer account and contract records are retained for the duration of the relationship and for a reasonable period after it ends.
Payment and invoicing records are retained for the period required by tax and accounting law.
Security logs, access records, and CCTV footage are retained for limited periods unless needed for an investigation, dispute, or legal claim.
Complaint, correspondence, and dispute records are retained for as long as necessary to resolve the matter and support legal compliance.

When personal data is no longer needed, it is securely deleted, anonymised, or otherwise disposed of in a safe and lawful manner.

6. Your Rights

Depending on your circumstances and the legal basis for processing, you may have the following rights under data protection law:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete information.
Right to erasure – to request deletion of personal data in certain circumstances.
Right to restriction – to ask us to limit how we use your data in certain situations.
Right to data portability – to receive certain data in a structured, commonly used, machine-readable format where applicable.
Right to object – to object to processing based on legitimate interests, including some forms of profiling or direct marketing.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe your personal data has been handled unlawfully or unfairly. Exercising these rights will not usually incur a fee, although requests that are clearly unfounded or excessive may be refused or charged where permitted by law.

7. Data Security

We use appropriate technical and organisational measures to protect personal data from unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, monitoring, and restricted administrative permissions.

Although no system can be guaranteed to be completely secure, we take the protection of data seriously and regularly review our safeguards. Staff and contractors who process personal data on our behalf are required to follow confidentiality and security procedures.

8. International Transfers

Where personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place to protect it in accordance with data protection law. This may include adequacy regulations, standard contractual clauses, or other approved transfer mechanisms.

9. Children

Our storage services are generally intended for adults and business users. We do not knowingly collect personal data from children except where it is necessary and lawful in connection with a customer account, authorised access, or legal requirement.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our services, or our data handling practices. Any revised version will apply from the date it is issued, and we encourage customers to review it periodically.

11. Summary of Principles

Collierrow Storage only processes personal data where it has a valid legal reason to do so, and it does so with respect for privacy, security, and proportionality. We collect only the information needed to provide storage services, protect our business, meet our legal obligations, and manage customer relationships responsibly. We retain data for limited periods, share it only with necessary processors or authorised third parties, and uphold the rights of individuals under applicable data protection law.

This policy applies to all Collierrow Storage customers in area and forms part of our commitment to transparent and compliant data handling.

By using Collierrow Storage services, you acknowledge that your personal data may be processed in accordance with this Privacy Policy and the requirements of applicable law.