Privacy Policy - Hamptonhill Storage

Effective Date: This Privacy Policy applies to all Hamptonhill Storage customers in the area and explains how we collect, use, share, store, and protect personal data in accordance with the UK GDPR and the Data Protection Act 2018.

1. Who We Are

Hamptonhill Storage provides storage services to individuals and businesses in the area. For the purposes of data protection law, Hamptonhill Storage is the data controller for the personal data described in this Privacy Policy. This means we decide why and how your personal data is used.

We are committed to handling personal data lawfully, fairly, and transparently. We only collect information that is relevant and necessary for the provision and management of our storage services, security, administration, compliance, and communication with customers.

2. Personal Data We Collect

We may collect and process the following types of personal data:

Identity information: name, title, date of birth, and identification details where required for verification.
Contact information: postal address, billing address, email address, and telephone number.
Account and contract information: rental agreement details, customer reference number, payment history, correspondence, and service preferences.
Payment information: bank account details, card-related information processed through secure payment providers, and records of transactions.
Security and access information: access logs, CCTV images, site entry records, vehicle registration details, and key or access code records where applicable.
Communications: enquiries, complaints, notices, and any other information you choose to provide to us.
Technical information: limited information collected when you interact with our systems, such as device identifiers or usage data, where relevant to service security and performance.

We do not intentionally collect special category personal data unless it is provided by you and is necessary for a specific lawful purpose. Special category data includes information about health, religion, ethnicity, political views, or other sensitive matters. If such information is received accidentally, we will handle it with appropriate care and restrict access.

3. How We Use Your Personal Data

We use personal data for the following purposes:

to create and manage your storage account;
to provide storage services and maintain contractual records;
to process payments, deposits, invoices, refunds, and arrears;
to verify identity and prevent fraud or unauthorised use;
to manage access to our premises and maintain site security;
to communicate with you about your agreement, service changes, or operational issues;
to handle complaints, queries, and customer support;
to meet legal, tax, insurance, and regulatory obligations;
to exercise or defend legal claims;
to improve our services, systems, and security measures.

We will only use your data for the purposes stated above or for compatible purposes that are reasonably expected in the context of our services.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for each processing activity. Hamptonhill Storage relies on the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you, such as managing your storage agreement, charging fees, and providing access to your unit.

Legal Obligation

We process some data to comply with legal requirements, including accounting, tax, fraud prevention, health and safety, and record-keeping obligations.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided your rights and freedoms do not override those interests. Examples include protecting our premises, preventing crime, improving operations, and managing customer relations. When relying on legitimate interests, we assess the impact on your privacy and apply safeguards.

Consent

In limited cases, we may rely on your consent, for example for certain optional communications or uses that are not necessary for the contract or our legitimate interests. Where consent is used, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Vital Interests

In rare circumstances, we may process data where it is necessary to protect someone’s life or physical safety.

5. Sharing Your Data and Processors

We do not sell your personal data. We may share it only where necessary and appropriate with trusted third parties acting as processors or, in some cases, independent controllers.

Processors may include:

payment service providers;
accounting and bookkeeping services;
IT hosting, cloud storage, and software suppliers;
security monitoring providers and CCTV service providers;
maintenance and facilities contractors;
professional advisers such as lawyers, insurers, and auditors;
debt recovery or enforcement service providers, where necessary and lawful.

All processors are required to process personal data only on our instructions, keep it secure, and comply with applicable data protection obligations. We ensure appropriate contractual safeguards are in place before any personal data is shared.

We may also disclose data to public authorities, regulators, or law enforcement where required by law or where necessary to protect our rights, customers, staff, or property.

6. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including for legal, accounting, reporting, and dispute-resolution requirements. Retention periods vary depending on the type of data and the nature of our relationship with you.

Examples of retention practice include:

Contract and account records: retained for the duration of the agreement and for a reasonable period afterwards to handle disputes or legal claims.
Financial records: retained in line with tax and accounting requirements.
Security logs and CCTV data: retained only as long as needed for site security, incident investigation, or lawful evidence handling.
Correspondence and complaints: kept for the time needed to address the matter and maintain an accurate record.

When data is no longer required, we will delete it securely, anonymise it, or archive it where lawful and appropriate.

7. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These may include access controls, staff confidentiality obligations, secure storage, password protection, and regular review of security practices.

Although we take reasonable steps to protect your information, no system is completely secure. If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will act in accordance with our legal obligations, including notifying the relevant authority and affected individuals where required.

8. Your Rights

Depending on the circumstances, you have the following rights under data protection law:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete data.
Right to erasure: to request deletion of your data in certain situations.
Right to restriction: to ask us to limit how we use your data in certain cases.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to data portability: to receive certain data in a structured, commonly used format where processing is based on consent or contract and carried out by automated means.
Right to withdraw consent: where we rely on consent, you may withdraw it at any time.

You also have the right to complain to the Information Commissioner’s Office if you believe your data protection rights have been infringed. We encourage you to raise any concerns with us first so that we can try to resolve the issue promptly.

9. Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. If this changes, we will update this Privacy Policy and provide you with the required information and safeguards.

10. Children’s Data

Our services are intended for adults and businesses. We do not knowingly collect personal data from children in connection with our storage services. If we become aware that we have collected such data without a valid legal basis, we will delete it or seek appropriate parental or guardian consent where relevant.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data handling practices. Any updated version will apply from the date it is published or otherwise communicated to customers. We recommend reviewing this policy periodically to stay informed about how your data is protected.

12. Contact and Further Information

This Privacy Policy is intended to give you a clear and transparent explanation of how Hamptonhill Storage processes personal data. If you have questions about how we use your information, or if you wish to exercise your rights, you may contact us through our usual customer communication channels. We will respond in accordance with applicable data protection law.

Summary: Hamptonhill Storage processes customer data lawfully, securely, and transparently for storage services, with clear retention rules, trusted processors, and GDPR rights.