Privacy Policy - Ruxley Storage

Ruxley Storage is committed to protecting the privacy and personal data of our customers, visitors, and anyone who interacts with our services. This Privacy Policy explains how we collect, use, store, share, and protect personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all Ruxley Storage customers in the area, including individuals and business customers who use our storage services, make enquiries, or otherwise engage with us.

1. Who We Are

For the purposes of data protection law, Ruxley Storage acts as the data controller for the personal data described in this Privacy Policy. This means we determine the purposes and means of processing personal data. We are responsible for ensuring that your data is handled lawfully, fairly, and transparently.

2. Information We Collect

We may collect and process different types of personal data depending on your relationship with us and the services you use. The personal data we collect may include:

Identity data such as your name, title, and date of birth where needed for verification.
Contact data such as your address, email address, and telephone number.
Account and contract data such as customer reference details, storage unit information, tenancy or service records, and billing information.
Payment data such as payment method details and transaction records. Where card payments are used, these may be processed by secure payment providers rather than stored by us directly.
Verification data such as identification documents or proof of address when required for fraud prevention, legal compliance, or account setup.
Usage data such as entry records, access logs, and interactions with our services.
Correspondence data such as messages, complaints, feedback, or enquiries you send to us.
Security data such as CCTV footage, alarm records, and access monitoring where used to protect our premises, staff, customers, and property.

We may also collect limited technical information if you interact with digital systems connected to our services, such as device details or log data. We only collect personal data that is relevant and necessary for the purposes described in this policy.

3. How We Use Your Data

We process personal data for specific and legitimate purposes, including:

Providing storage services and managing your customer account.
Setting up and administering contracts.
Processing payments and handling invoicing.
Verifying identity and preventing fraud.
Managing access to storage premises and maintaining security.
Dealing with enquiries, complaints, and customer support requests.
Meeting legal, tax, insurance, and regulatory obligations.
Improving service quality, operational efficiency, and customer experience.
Establishing, exercising, or defending legal claims.

We will only use your personal data where we have a valid lawful basis and where such use is compatible with the original purpose for which the data was collected.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for processing your personal data. Depending on the circumstances, we rely on one or more of the following bases:

Contract: We process data where it is necessary to enter into or perform a contract with you, such as providing storage services, managing your account, or processing payments.
Legal obligation: We process data where required to comply with applicable laws, including tax, accounting, safety, fraud prevention, and regulatory requirements.
Legitimate interests: We process data where it is necessary for our legitimate business interests, provided your interests and fundamental rights do not override those interests. This may include security monitoring, service improvement, and defending legal claims.
Consent: In limited situations, we may rely on your consent, for example where required for a specific optional purpose. If we rely on consent, you may withdraw it at any time.

Where we process special category data, if any, we will do so only when a lawful condition applies and additional safeguards are in place. This is not expected to be routine.

5. Retention of Personal Data

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including meeting legal, accounting, contractual, and security obligations. Retention periods vary depending on the type of information and the reason it is held.

Customer and contract records are usually retained for the duration of the relationship and for a reasonable period afterwards.
Payment and invoicing records may be retained for statutory accounting and tax purposes.
Security records such as CCTV footage may be retained for a limited period unless needed for an incident investigation or legal matter.
Correspondence and complaint records may be kept for as long as necessary to resolve the matter and demonstrate proper handling.
Identification or verification records may be retained where required by law or to protect against fraud and unauthorised claims.

When personal data is no longer required, it will be securely deleted, anonymised, or otherwise disposed of in a safe and appropriate manner.

6. Who We Share Data With

We may share personal data with trusted third parties who act as processors or, in some cases, independent controllers. We only share data where necessary and subject to appropriate safeguards. These may include:

IT and cloud service providers that support our systems, data storage, and communications.
Payment service providers that process transactions securely on our behalf.
Security providers supporting access control, alarms, or CCTV systems.
Professional advisers such as accountants, legal advisers, insurers, or auditors.
Public authorities where disclosure is required by law or necessary to respond to lawful requests.

Where processors handle personal data on our behalf, they are required to act only on our instructions, keep data secure, and comply with data protection law. We do not sell personal data.

Processors and Safeguards

Any processor engaged by Ruxley Storage must provide appropriate technical and organisational measures to protect personal data. We take steps to ensure that contracts with processors include confidentiality obligations, security requirements, and restrictions on unauthorised use or disclosure. If personal data is transferred outside the UK, we will ensure that appropriate legal safeguards are in place.

7. Data Security

We use appropriate measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, password protections, staff training, data minimisation, secure storage, and monitoring of systems and premises. While no system can be guaranteed completely secure, we take privacy and security seriously and review our safeguards regularly.

8. Your Rights

Depending on the circumstances and legal basis for processing, you have the following rights under data protection law:

Right of access to request a copy of the personal data we hold about you.
Right to rectification to ask us to correct inaccurate or incomplete data.
Right to erasure in certain cases, such as where the data is no longer needed or consent is withdrawn and no other lawful basis applies.
Right to restriction to request that we limit how we use your data in specific circumstances.
Right to object to processing based on legitimate interests or direct marketing, where applicable.
Right to data portability for data provided to us, where processing is based on consent or contract and carried out by automated means.
Right to withdraw consent at any time where we rely on consent for processing.

You also have the right to complain to the Information Commissioner’s Office if you believe your data protection rights have been breached. We encourage you to contact us first so we can try to resolve any concerns promptly.

9. Cookies and Similar Technologies

If we operate online services or digital systems, we may use cookies or similar technologies to support functionality, improve performance, and understand usage patterns. Where required, we will provide appropriate notice and obtain consent for non-essential cookies. You can manage cookie preferences through your browser settings or available controls.

10. Children’s Data

Our services are intended for adults. We do not knowingly collect personal data from children unless it is necessary and lawful in connection with a customer relationship or legal requirement. If we become aware that we have collected data from a child without an appropriate legal basis, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our operations, legal requirements, or data protection practices. The most current version will apply to your use of our services. We encourage customers to review this policy periodically so they remain informed about how their data is handled.

Ruxley Storage is committed to treating personal data with care, respect, and accountability. We aim to process information in a transparent and lawful manner so that customers can use our services with confidence.