Privacy Policy - Clapham Storage

This Privacy Policy applies to all Clapham Storage customers in the Clapham area and anyone who uses our services, visits our premises, or interacts with us in connection with storage, removals, collection, delivery, or related customer support.

1. Introduction

Clapham Storage is committed to protecting personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It also explains your rights and how they can be exercised.

We process personal data in a way that is lawful, fair, and transparent. We only collect information that is necessary for providing storage and related services, meeting legal obligations, improving our operations, and protecting our business and customers.

2. Data We Collect

We may collect and process the following categories of personal data:

Identity information: name, date of birth, and identification details where required for verification purposes.
Contact information: address, email address, telephone number, and billing details.
Account and service information: booking details, storage unit references, correspondence, payment history, and service preferences.
Payment information: transaction records and limited payment card information processed through secure payment providers. We do not store full card details unless strictly necessary and permitted by law.
Security information: CCTV footage, access logs, gate entry records, incident reports, and records of visitors to our premises where applicable.
Communications: emails, phone call notes, written messages, complaints, feedback, and any information you choose to provide to us.
Technical information: device and browser information, IP address, and usage data if you interact with our digital services.

We do not intentionally collect special category data unless it is necessary and you choose to provide it, or we are legally required to record it. Special category data includes information about health, religious beliefs, political opinions, biometrics, or similar sensitive personal data. If such data is processed, we will do so only where a lawful basis and additional condition under data protection law applies.

3. How We Use Personal Data

We process personal data for the following purposes:

To provide and manage storage services, bookings, access, and account administration.
To verify identity and prevent fraud, unauthorised access, or misuse of our services.
To process payments, invoices, refunds, and debt recovery where necessary.
To maintain the safety and security of our premises, staff, customers, and stored goods.
To respond to enquiries, complaints, and service requests.
To comply with legal and regulatory obligations, including tax, accounting, insurance, and health and safety requirements.
To monitor, analyse, and improve our services, systems, and customer experience.
To defend or establish legal claims and manage disputes.

We only use personal data for the purposes for which it was collected, unless we reasonably determine that we need to use it for another compatible purpose and such use is permitted by law.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for each use of personal data. Depending on the situation, we rely on one or more of the following bases:

Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes setting up your account, managing storage arrangements, taking payments, granting access to a unit, and handling service-related communications.

Legal Obligation

We may process data to comply with legal obligations, such as accounting requirements, tax law, fraud prevention duties, recordkeeping, insurance obligations, and responding to lawful requests from public authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests and those interests are not overridden by your rights and freedoms. This may include protecting our premises, managing business operations, preventing fraud, improving services, and maintaining accurate records. Where we rely on legitimate interests, we assess the impact on your privacy.

Consent

In limited circumstances, we may rely on your consent, for example for certain marketing activities or optional communications. Where consent is used, you may withdraw it at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

5. Retention of Personal Data

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, and reporting requirements.

Customer account and contract records: retained for the duration of the service relationship and for a reasonable period afterwards.
Financial and tax records: retained for the period required by law, which may include up to six years or longer where legally necessary.
Security records and CCTV: retained for a limited period unless required for an investigation, insurance matter, or legal claim.
Correspondence and complaints: retained for as long as needed to resolve the issue and for recordkeeping purposes.
Marketing preferences: retained until you opt out, unsubscribe, or request deletion where applicable.

When data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you. Retention periods may vary depending on the type of data and the legal or operational need to keep it.

6. Processors and Data Sharing

We may share personal data with trusted third parties who act as processors or independent controllers, only where necessary and in accordance with data protection law.

Processors may include:

payment service providers that handle secure payment processing;
IT and cloud service providers that support our systems, storage, and communications;
security providers that operate alarms, CCTV, access control, or monitoring services;
accountants, auditors, and professional advisers;
maintenance, delivery, and logistics providers supporting service delivery;
debt recovery agencies or legal advisers where necessary to enforce agreements or resolve disputes.

We require processors to process personal data only on our instructions, to implement appropriate security measures, and to keep the information confidential. Some third parties may act as independent controllers, for example banks, insurers, regulators, or law enforcement bodies. In those cases, their own privacy notices will apply.

We do not sell personal data. We may disclose information if required by law, to protect vital interests, to prevent fraud, or to establish, exercise, or defend legal rights.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff training, restricted permissions, and monitoring of systems and premises.

While we take reasonable steps to protect data, no system can be guaranteed to be completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will respond in accordance with applicable law and, where required, notify the relevant supervisory authority and affected individuals.

8. Your Rights

Subject to certain legal conditions and exemptions, you have the following rights under data protection law:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to correct inaccurate or incomplete information.
Right to erasure: to request deletion of your data in certain circumstances.
Right to restrict processing: to ask us to limit how we use your data in certain situations.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to data portability: to request transfer of data you provided to us, where applicable.
Right to withdraw consent: where we rely on consent, you may withdraw it at any time.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office if you believe your data protection rights have been violated. We encourage you to raise concerns with us first so we can try to resolve the matter promptly.

9. International Transfers

If personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place to protect it, such as adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms. We will take reasonable steps to ensure your information receives a level of protection consistent with UK data protection requirements.

10. Children’s Data

Our services are intended for adults. We do not knowingly collect personal data from children without appropriate authorisation and legal basis. If we become aware that we have collected such data in error, we will take steps to delete it where required.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data processing practices. Any revised version will apply from the date it is published or otherwise communicated. We encourage you to review this policy periodically so that you remain informed about how we handle personal data.

12. Summary of Our Commitment

Clapham Storage is committed to handling personal information responsibly, securely, and in compliance with data protection law. We collect only the data we need, use it for clear and lawful purposes, retain it only as long as necessary, and share it only with trusted processors or where required by law. We respect your rights and aim to ensure that all Clapham Storage customers in the area can use our services with confidence and trust.