Storage Soho Privacy Policy
This Privacy Policy explains how Storage Soho collects, uses, stores and protects personal data relating to our customers and prospective customers. It applies to all Storage Soho customers and prospective customers in our service area, whether you interact with us online, by telephone, in writing, or in person at our facilities.
Storage Soho acts as a data controller for the personal data described in this Privacy Policy. We are committed to processing your personal data lawfully, fairly and transparently in accordance with applicable data protection laws, including the UK General Data Protection Regulation and the Data Protection Act.
Personal Data We Collect
We collect and process different types of personal data depending on how you interact with us and the services you use. The categories of data we may collect include:
Identification and contact details such as name, postal address, billing address, contact address, and details of authorised persons linked to your account.
Account and contract information such as unit number, rental start and end dates, services taken, payment status, deposit details, discount or promotion usage, and correspondence relating to your contract.
Financial and payment information such as billing history, payment methods used, transaction amounts, and payment dates. Where necessary we may process partial card details or bank account identifiers supplied in the course of taking or refunding payments, but we do not store full card details beyond what is required for lawful processing.
Identity verification information such as date of birth, identification document details and copies, proof of address, and any other documents you provide to verify your identity or your right to rent storage space.
Communication data such as records of queries, complaints, feedback, call notes, and any other communications you send to us or that we send to you in relation to your account.
Technical and usage data relating to your use of our website or digital services, which may include IP address, browser type, access times, pages viewed and similar usage information collected through standard logs or similar technologies.
Security and access data such as access control logs, entry and exit times, and, where applicable, closed circuit television footage of areas in and around our premises that are monitored for security and safety purposes.
How And Why We Use Your Data
We only process your personal data where we have a lawful basis to do so. The main purposes and lawful bases for processing are:
To provide storage services and manage your contract. This includes setting up your account, verifying your identity, managing access to your unit, processing payments, handling deposits and refunds, and communicating with you about your contract. The lawful basis is the performance of a contract or taking steps at your request before entering into a contract.
To manage our business operations. This includes service administration, customer relationship management, improving our services, maintaining accurate records, and preparing management information. The lawful basis is our legitimate interests in efficiently operating and improving our business, provided that your interests and rights do not override these interests.
To ensure security and safety at our sites. This includes monitoring access logs and, where used, CCTV recordings to deter and investigate crime, protect people and property, and support health and safety. The lawful basis is our legitimate interests in maintaining security and safety and, where applicable, compliance with legal obligations.
To comply with legal and regulatory obligations. This covers requirements arising under tax, accounting, anti money laundering and other applicable laws, as well as responding to lawful requests from public authorities or law enforcement. The lawful basis is compliance with legal obligations.
To communicate service updates. We may contact you with essential service messages about your contract, facility access, changes to our terms or policies, or urgent operational issues. The lawful basis is performance of a contract and our legitimate interests in keeping you informed about matters that affect your use of the service.
To send marketing communications. With your consent, or where permitted by law based on our legitimate interests, we may send you information about our services, special offers or related products that may be of interest to you. You can opt out of marketing communications at any time.
Data Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, including for the purposes of satisfying legal, accounting or reporting requirements.
In practice this means that account and contract information is typically kept for the duration of your contract and for a defined period afterwards to deal with queries, disputes or legal claims, and to comply with mandatory retention requirements such as tax or financial recordkeeping obligations.
Security and access data, including access logs and any CCTV footage, is retained for a shorter period that is appropriate for security and incident investigation purposes, unless a particular recording or record needs to be kept longer because it is relevant to an ongoing investigation, dispute or legal matter.
Where we have relied on your consent for processing, and you withdraw that consent, we will stop the relevant processing and, where appropriate, securely delete or anonymise the associated data, subject to any overriding legal requirements to retain certain information.
When personal data is no longer required, we will securely delete, destroy or anonymise it in line with our data retention and information security procedures.
Sharing Your Personal Data
We may share your personal data with carefully selected third parties, including data processors that provide services on our behalf. These third parties are only permitted to process your personal data according to our instructions and for the specified purposes, and they must implement appropriate security measures.
Examples of recipients include payment processing providers, customer relationship management and billing system providers, secure document storage and shredding services, information technology support and hosting providers, and professional advisors such as accountants and legal advisers.
Where necessary, we may also share personal data with insurers, security and access control system providers, and, in appropriate circumstances, with law enforcement agencies, courts, regulatory authorities or other public bodies where we are legally required or permitted to do so.
We do not sell your personal data to third parties. Any data sharing is conducted in accordance with data protection law and with appropriate safeguards in place.
International Data Transfers
Some of our service providers may be located outside the United Kingdom or may use infrastructure located in other countries. Where personal data is transferred internationally, we ensure that an adequate level of protection is in place.
This may include the use of countries that have been recognised as providing an adequate level of data protection, or the implementation of appropriate safeguards such as standard contractual clauses approved for use under data protection law. We also assess the practical implications of such transfers and, where necessary, implement additional measures to protect your data.
Your Data Protection Rights
As a data subject, you have certain rights in respect of your personal data under data protection law. These rights apply to all Storage Soho customers and prospective customers in our service area, subject to any legal limitations or exemptions. Your rights include:
The right of access. You can request confirmation that we process your personal data and obtain a copy of that data, along with information about how we use it.
The right to rectification. You can ask us to correct or complete personal data that is inaccurate or incomplete.
The right to erasure. In certain circumstances, you can request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected, or where you withdraw consent and no other lawful basis exists for the processing.
The right to restrict processing. You can request that we restrict the processing of your personal data in specific situations, for example while we consider a request for rectification or objection.
The right to object. You can object to processing that is based on our legitimate interests, including profiling based on those interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for legal claims. You always have the right to object to direct marketing.
The right to data portability. Where processing is based on consent or contract and is carried out by automated means, you can request to receive the personal data you provided in a structured, commonly used and machine readable format, and to have that data transmitted to another controller where technically feasible.
The right to withdraw consent. Where we rely on your consent to process personal data, you may withdraw that consent at any time. This will not affect the lawfulness of processing before withdrawal.
If you wish to exercise any of these rights, we may need to request certain information from you to confirm your identity and ensure your rights are respected securely.
Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction or damage.
Measures include access controls, staff training on data protection responsibilities, secure storage of physical records, and the use of suitable safeguards for electronic systems. While no system can be guaranteed as completely secure, we regularly review our controls to reduce risks and maintain an appropriate level of protection.
Changes To This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal requirements. Any updated version will apply from the date it is made available. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
