Storage Mayfair Privacy Policy
This Privacy Policy explains how Storage Mayfair collects, uses, stores, and protects personal data belonging to all Storage Mayfair customers in our service area. It also sets out your rights under applicable data protection laws, including the UK General Data Protection Regulation and the EU General Data Protection Regulation where relevant.
By using Storage Mayfair services, making an enquiry, or entering into a storage agreement with us, you acknowledge that you have read and understood this Privacy Policy.
Who This Policy Applies To
This Privacy Policy applies to all individuals who use Storage Mayfair services or otherwise interact with us in our service area. This includes prospective customers, current customers, former customers, and individuals acting on behalf of a business or organisation that uses our storage services.
Types of Personal Data We Collect
We may collect and process the following categories of personal data, depending on your relationship with us and how you use our services:
Identification data such as full name, title, date of birth, and identification numbers where required for verification purposes.
Contact data such as residential or business address, billing address, and any contact preferences you provide.
Account and contract data such as storage unit number, contract details, start and end dates of your agreement, payment history, and information about your interactions with our customer service team.
Payment and billing data such as payment method details (excluding full card numbers where handled directly by payment processors), billing history, and records of payments made and amounts outstanding.
Security and access data such as access logs, gate or entry records, CCTV recordings within and around our premises where installed, and records of incidents or security-related events.
Communication data such as information contained in emails, letters, forms, or other communications you send to us, as well as notes of telephone conversations or in-person discussions where required for contract administration and security.
Technical data where you use our online services, such as IP address, device information, and basic usage data derived from your interactions with our website, to the extent necessary for security and service operation.
How We Collect Your Personal Data
We collect personal data directly from you when you make an enquiry, request a quote, sign a storage agreement, update your details, make a payment, or contact us for support.
We may also collect personal data from third parties where lawful and appropriate, for example from payment service providers confirming a transaction, or from professional advisers where they act on your behalf.
In addition, we may generate personal data through our own systems, such as access logs, billing records, and CCTV footage where applicable.
Lawful Bases for Processing
We rely on the following lawful bases under the GDPR to process your personal data:
Performance of a contract. We process personal data when it is necessary to enter into or perform our storage agreement with you. This includes setting up your account, managing your unit or space, handling payments, and providing customer support.
Compliance with legal obligations. We process personal data where we are required to do so by law. This may include tax and accounting requirements, responding to lawful requests from regulatory or law enforcement authorities, and complying with health and safety obligations.
Legitimate interests. We process certain data where it is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms. Examples include maintaining the security of our premises, preventing and detecting fraud, managing our business operations, improving our services, and retaining basic records of past customers for limited periods.
Consent. In some situations, we may rely on your consent, for example for certain direct marketing communications or optional services. Where we rely on consent, you can withdraw it at any time by contacting us, and withdrawal will not affect the lawfulness of processing carried out before withdrawal.
How We Use Your Personal Data
We use your personal data for the following purposes:
To provide, administer, and manage your storage services, including setting up and operating your account and contacting you about your agreement.
To process payments, manage invoices, and handle any billing queries or disputes.
To maintain the security and integrity of our premises, including managing access controls and operating any CCTV systems we use.
To respond to your enquiries, provide customer support, and handle complaints or incident reports.
To manage our relationship with you, including sending information about changes to our terms, this Privacy Policy, or our services where relevant.
To comply with legal, regulatory, and accounting requirements, such as record-keeping obligations and responding to lawful requests from authorities.
To protect our rights, property, and the safety of our staff, customers, and the public, including establishing, exercising, or defending legal claims.
Where permitted, to inform you about products or services that are similar to those you already use and that may be of interest to you, subject to your rights to object.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.
In general, this means we keep customer account and contract information for the duration of your agreement and for a period after it ends, in line with applicable limitation periods for legal claims and statutory record-keeping obligations. Payment and invoicing records are retained for periods required under tax and accounting laws.
CCTV footage, access logs, and security-related information are retained for shorter periods, unless an incident or investigation requires us to retain specific recordings or records for longer.
When personal data is no longer required, we will securely delete or anonymise it so that it can no longer be associated with you.
Data Processors and Third Parties
We may share your personal data with trusted third parties that act as data processors on our behalf. These processors may include:
IT and cloud service providers that host our systems and data.
Payment service providers that process payments and manage certain billing activities.
Security and maintenance providers that support the operation and safety of our premises and systems.
Professional advisers, such as accountants, auditors, or legal advisers, who act under our instructions and confidentiality obligations.
We require all processors to provide appropriate technical and organisational measures to protect your personal data and to process it only in accordance with our instructions and applicable law.
We may also share personal data with other third parties where required by law, or where necessary for the establishment, exercise, or defence of legal claims, or in connection with a business reorganisation or transfer, in line with your rights and applicable safeguards.
International Transfers
Where we work with processors or service providers located outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place for any personal data transfers, such as adequacy decisions or standard contractual clauses, in compliance with data protection law.
Your Data Protection Rights
Under the GDPR and applicable data protection laws, you have a number of rights in relation to your personal data, subject to certain conditions and exemptions:
Right of access. You have the right to request confirmation of whether we process your personal data and to receive a copy of that data, together with certain information about how we use it.
Right to rectification. You have the right to ask us to correct inaccurate personal data and to complete incomplete data.
Right to erasure. In certain circumstances, you may ask us to delete your personal data, for example where it is no longer necessary for the purposes for which it was collected or where you have withdrawn consent.
Right to restriction of processing. You may request that we restrict the processing of your personal data in certain situations, such as when you contest its accuracy or object to our processing.
Right to data portability. You may have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format and to transmit that data to another controller, where technically feasible and where the processing is based on consent or contract and carried out by automated means.
Right to object. You have the right to object to processing carried out on the basis of our legitimate interests, including profiling based on those interests, and to object at any time to the use of your personal data for direct marketing.
Rights related to consent. Where we rely on your consent, you may withdraw that consent at any time. Withdrawal will apply to future processing and will not affect the lawfulness of processing based on consent before its withdrawal.
To exercise any of these rights, please contact us using the contact methods provided through our usual customer service channels. We may need to verify your identity before responding to your request, and we will respond within the time limits set by data protection law.
Data Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include physical security at our premises, access controls, secure storage of records, and safeguards within our IT systems.
While we take reasonable steps to secure your data, no system can be guaranteed to be completely secure. You also play a role in keeping your information safe, for example by keeping access codes and any account information confidential.
Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. Any changes will apply from the date we publish the revised version. We encourage you to review this Privacy Policy periodically so that you remain informed about how we process your personal data.
