Privacy Policy - Elmersend Storage

Elmersend Storage is committed to protecting the privacy and personal data of all customers in area. This Privacy Policy explains how we collect, use, store, share, and protect personal information in accordance with applicable data protection laws, including the GDPR where relevant. This policy applies to all Elmersend Storage customers in area and to any person who interacts with our storage services, facilities, systems, or staff.

1. Who We Are

For the purposes of data protection law, Elmersend Storage acts as a data controller in relation to the personal data we collect and determine the purposes and means of processing. Where we use third parties to process data on our behalf, they act as data processors under our instructions, unless they independently determine their own purposes for processing.

2. Personal Data We Collect

We collect only the personal data necessary to provide storage services, manage our business operations, and meet legal obligations. Depending on your relationship with us, we may collect the following information:

Identity information, such as name, date of birth, and identification details where required for account verification or security purposes.
Contact information, such as mailing address, billing address, email address, and telephone number.
Account and service information, including storage unit details, booking records, payment records, service preferences, and correspondence.
Financial information, such as payment method details, transaction history, and invoice records. We do not store full payment card data where this is processed securely by a payment provider.
Security and access information, including CCTV footage, entry logs, access codes, and other records related to facility safety and access control.
Communication records, such as emails, messages, complaints, queries, and notes from telephone or in-person interactions.
Technical information, such as device identifiers, browser data, and basic usage information where our systems or digital tools capture this.

We generally do not seek to collect special category data unless you voluntarily provide it or it is necessary in exceptional circumstances, for example, to support a legal claim or make an adjustment for a disability. If we do collect special category data, we will handle it with extra protection and only where permitted by law.

3. How We Use Personal Data

We use personal data for the following purposes:

to provide and manage storage services and related administration;
to verify identity and prevent fraud, misuse, and unauthorized access;
to process payments, issue invoices, and manage accounts;
to maintain security, including monitoring access to premises and protecting property;
to communicate with customers about services, billing, account matters, and operational updates;
to resolve disputes, handle complaints, and support customer service;
to comply with legal, regulatory, tax, accounting, and insurance obligations;
to improve our services, systems, safety procedures, and business operations.

We will only use your personal data in ways that are compatible with the purpose for which it was collected, unless we reasonably consider that we need to use it for another lawful purpose and that purpose is compatible with the original one.

4. Lawful Basis for Processing

Under GDPR principles, we rely on one or more of the following lawful bases when processing personal data:

Contract

We process data where it is necessary to enter into or perform our contract with you. This includes managing your storage account, providing access to your unit, taking payment, and carrying out customer support related to the services you have requested.

Legal Obligation

We process data where required to comply with legal obligations, including tax, accounting, security, consumer, or record-keeping requirements.

Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided your rights and interests do not override those interests. Our legitimate interests may include protecting our premises, preventing crime or fraud, improving our services, defending legal claims, and ensuring proper business administration. Where required, we assess and balance these interests against potential impacts on your privacy.

Consent

In limited circumstances, we rely on your consent, for example where it is the most appropriate basis for a particular communication or optional service. Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, tax, security, and contractual requirements. Retention periods vary depending on the type of data and the reason for holding it.

Customer account and contract records are generally retained for the duration of the relationship and for a reasonable period afterward to handle disputes, legal claims, and administrative matters.
Payment and accounting records are retained for the period required by law and standard business practice.
Security records, such as access logs and CCTV footage, are retained for a limited period unless needed for an investigation, legal matter, or safety incident.
Correspondence and support records are kept as long as necessary to respond to your request and maintain business records.

When personal data is no longer required, we will securely delete, anonymize, or archive it in line with our retention procedures. We do not keep personal data indefinitely.

6. Sharing Personal Data and Processors

We do not sell personal data. We may share personal data with trusted third parties only where necessary and lawful. These may include:

Payment processors who handle secure payment transactions;
IT and cloud service providers that support data storage, email, systems management, or security tools;
Professional advisers, including legal, insurance, accounting, or audit providers;
Security and monitoring providers, such as CCTV or access control service operators;
Public authorities, regulators, law enforcement, or courts where disclosure is required by law or necessary to protect rights, property, or safety.

Where these third parties process personal data on our behalf, they do so as processors under written agreements that require them to protect data, use it only for specified purposes, and implement appropriate technical and organizational safeguards. Processors are not permitted to use your data for their own independent purposes.

7. International Transfers

If personal data is transferred outside the country or jurisdiction in which it was collected, we will ensure appropriate safeguards are in place where required by law. These safeguards may include standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms. We aim to ensure that your personal data remains protected to a standard consistent with applicable data protection requirements.

8. Data Security

We use reasonable technical and organizational measures to protect personal data against unauthorized access, accidental loss, disclosure, alteration, or destruction. These measures may include access controls, secure systems, staff training, physical security arrangements, and restricted internal access based on need.

While we take data security seriously, no method of transmission or storage is completely secure. We therefore cannot guarantee absolute security, but we continuously work to reduce risk and improve our safeguards.

9. Your Rights

Subject to applicable law, you may have the following rights in relation to your personal data:

Right of access – to request confirmation of whether we process your data and to obtain a copy of that data.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain circumstances.
Right to restriction – to request that we limit the way we use your data in certain situations.
Right to object – to object to processing based on legitimate interests or direct marketing, where applicable.
Right to data portability – to receive certain data in a structured, commonly used, machine-readable format and, where feasible, have it transmitted to another controller.
Right to withdraw consent – where processing is based on consent, to withdraw that consent at any time.

These rights are not absolute and may be subject to legal exceptions or limitations. If we cannot comply with a request in full, we will explain why where permitted to do so.

10. Children’s Data

Our services are intended for adults and business customers. We do not knowingly collect personal data from children except where necessary and lawful. If we become aware that we have collected data from a child without appropriate authorization, we will take reasonable steps to delete it.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or the way we process personal data. Any updated version will apply from the date it takes effect. We encourage customers to review the policy periodically to stay informed about how we protect personal information.

12. Summary of Our Commitment

Elmersend Storage processes personal data fairly, lawfully, and transparently. We collect only what we need, use it for clear and legitimate purposes, keep it only as long as necessary, and share it only with trusted processors or where required by law. We respect the rights of our customers in area and aim to maintain high standards of privacy, security, and accountability in every part of our operation.