Privacy Policy - Strawberryhill Storage

This Privacy Policy explains how Strawberryhill Storage collects, uses, stores, shares, and protects personal data when providing storage services to customers in the area. It applies to all Strawberryhill Storage customers in area, including prospective customers, current customers, former customers, visitors to our premises, and individuals who interact with us in connection with our services. We are committed to handling personal data in a lawful, fair, transparent, and secure manner in accordance with applicable data protection law, including the UK GDPR and the Data Protection Act 2018.

1. Personal Data We Collect

We collect only the information necessary to operate our storage services, manage customer accounts, meet legal obligations, and protect our business, premises, and customers. The categories of personal data we may collect include:

Identity details such as name, date of birth, and proof of identity.
Contact details such as address, telephone number, and email address.
Account and contract information such as booking details, unit allocation, payment status, rental history, and correspondence relating to your account.
Financial information such as billing records, payment method details, and transaction confirmations. We do not intentionally store full card details where this is handled by secure payment providers.
Security and access information such as CCTV images, gate access records, visitor logs, delivery notes, incident reports, and records of interactions with our staff.
Communication records including emails, phone messages, complaint records, and other service-related communications.
Technical data when you use digital systems associated with our services, such as IP address, device information, and access logs.

We may also collect information voluntarily provided by you when you make an enquiry, request a quote, sign a storage agreement, report a problem, or update your account details. Where needed, we may collect limited information about third parties, such as alternative contact persons or authorised users, but only where you have provided that information or where it is necessary to deliver our services.

2. How We Use Personal Data

We use personal data for the following purposes:

to set up and manage storage accounts;
to verify identity and prevent fraud;
to process payments and maintain financial records;
to provide access to storage units and site facilities;
to communicate with customers about bookings, service changes, payments, notices, and account administration;
to maintain security, monitor site activity, and protect property and individuals;
to deal with complaints, disputes, insurance matters, and legal claims;
to comply with statutory, regulatory, tax, accounting, and record-keeping obligations;
to improve our services, systems, and customer experience;
to carry out internal administration and business management.

We will not use personal data in a way that is incompatible with the purposes for which it was collected, unless we are legally permitted to do so.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis to process your personal data. Strawberryhill Storage relies on one or more of the following lawful bases:

Performance of a contract

We process personal data where it is necessary to enter into or perform our storage agreement with you. This includes account administration, billing, access management, and customer service.

Legal obligation

We process data where required to comply with laws and regulations, including accounting, tax, fraud prevention, and other legal duties.

Legitimate interests

We may process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include site security, CCTV monitoring, service improvement, incident handling, and protecting against theft, damage, or unlawful activity. Where we rely on legitimate interests, we consider the potential impact on individuals and apply safeguards where appropriate.

Consent

In limited situations, we may rely on your consent, for example for optional marketing communications where required by law. If we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Vital interests

In rare cases, we may process personal data to protect someone’s life or physical safety.

4. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet contractual, legal, accounting, and operational requirements. Retention periods vary depending on the type of data and the purpose for which it is used.

In general:

customer account and contract records are retained for the duration of the relationship and for a reasonable period afterward;
financial and tax records are retained for the period required by law;
incident, dispute, and claims-related records are kept as long as necessary to resolve issues and defend legal rights;
CCTV and access logs are typically retained for a limited period unless needed longer for security, investigation, or legal reasons.

When personal data is no longer needed, we will securely delete, anonymise, or archive it in accordance with our retention practices. Retention periods are reviewed regularly to ensure we do not keep data longer than necessary.

5. Data Sharing and Processors

We may share personal data with trusted third parties where necessary to operate our business, provide our services, and comply with the law. Where a third party processes data on our behalf, it acts as a processor under a written contract requiring appropriate security and confidentiality measures.

Examples of processors and recipients may include:

Payment service providers who securely process card and online payments;
IT and cloud service providers who host systems, email, storage, and security tools;
Accountancy, auditing, and professional advisers who support legal, financial, or compliance obligations;
Security providers who assist with alarms, CCTV systems, monitoring, or site protection;
Maintenance and facilities contractors who require limited access to perform work;
Debt recovery, legal, and insurance providers where necessary to manage unpaid balances, disputes, or claims;
Public authorities and regulators where disclosure is required by law or in response to lawful requests.

We only disclose the minimum amount of data necessary for the relevant purpose. We do not sell personal data. If data is transferred outside the UK or EEA, we will ensure appropriate safeguards are in place, such as an adequacy decision or approved contractual protections.

6. Security Measures

We use reasonable technical and organisational measures to protect personal data from loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, secure storage, staff training, encryption, CCTV, network security, and restricted permissions.

Although we take data security seriously, no system can be guaranteed to be completely secure. We therefore review our controls regularly and update them when appropriate. In the event of a personal data breach, we will act promptly and in accordance with our legal obligations.

7. Your Rights

Subject to legal conditions and exemptions, you have the following rights in relation to your personal data:

Right of access – to request a copy of the personal data we hold about you;
Right to rectification – to ask us to correct inaccurate or incomplete information;
Right to erasure – to request deletion of your data in certain circumstances;
Right to restriction – to ask us to limit how we process your data in certain situations;
Right to object – to object to processing based on legitimate interests or direct marketing;
Right to data portability – to receive certain data in a portable format where applicable;
Right to withdraw consent – where processing is based on consent;
Right to complain – to raise concerns with the relevant data protection authority if you believe your rights have been infringed.

To help us protect your privacy, we may request information to verify your identity before responding to rights requests. We aim to respond within the legal time limits applicable under data protection law.

8. Children’s Data

Our services are generally intended for adults. We do not knowingly collect personal data from children except where it is incidentally provided in connection with a customer account, emergency contact, or authorised access arrangement. Where children’s data is involved, we will process it only where lawful and necessary.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data handling practices. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically.

10. Our Commitment to Privacy

Strawberryhill Storage is committed to treating personal data with care and respect. We aim to ensure that information is collected for clear purposes, used only when lawful, retained for no longer than necessary, and protected by appropriate safeguards. If you use our services in the area, you can expect us to handle your personal data in line with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

Summary of key points: we collect only what is needed to provide secure storage services, use personal data under a valid lawful basis, keep it for appropriate periods, share it only with trusted processors and lawful recipients, and respect your rights under data protection law.