Privacy Policy - Preston Storage

This Privacy Policy explains how Preston Storage collects, uses, stores, shares, and protects personal data relating to all Preston Storage customers in the area. It applies to customers, prospective customers, visitors, contractors, and any other individuals whose personal data we process in connection with our storage services. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with applicable data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our services or interacting with us, you acknowledge that your personal data may be processed as described in this Privacy Policy.

1. Who We Are

Preston Storage provides storage-related services to individuals and businesses in the area. In the context of data protection law, we act as the data controller for the personal data we collect and process about our customers and other individuals, unless otherwise stated. This means we determine the purposes and means of processing that data.

2. Personal Data We Collect

We collect only the information necessary to provide and manage our services, comply with legal obligations, and operate our business. Depending on your relationship with us, we may collect the following categories of personal data:

Identity data such as your name, title, and any identification information you provide.
Contact data such as your address, email address, and telephone number.
Account and service data including booking details, storage unit information, access records, contract details, and service preferences.
Payment data such as billing information, payment status, and transaction records. We do not store full card details unless necessary and permitted by the payment process used.
Verification data such as copies of identification documents where required for identity checks, fraud prevention, or legal compliance.
Security and access data including CCTV footage, entry logs, and records of site access where applicable.
Communication data such as emails, letters, phone notes, and other correspondence with you.
Technical data such as device or browser information if you use any digital systems we provide.

We may also receive personal data from third parties, such as payment providers, referral partners, identity verification services, or legal and regulatory bodies where required.

3. How We Use Personal Data

We use personal data for the following purposes:

to register and manage customer accounts;
to provide storage services and administer contracts;
to verify identity and prevent fraud;
to process payments, refunds, and outstanding balances;
to communicate with customers about bookings, access, service changes, and administrative matters;
to monitor safety, security, and site access;
to maintain accurate records and internal administration;
to comply with legal, tax, accounting, and regulatory obligations;
to resolve disputes, investigate incidents, and enforce agreements;
to protect the rights, property, and safety of Preston Storage, our customers, staff, and visitors.

We do not use personal data for purposes that are incompatible with the reasons for which it was collected unless we have a lawful basis to do so.

4. Lawful Basis for Processing

We process personal data only where we have a lawful basis under data protection law. Depending on the circumstances, one or more of the following bases may apply:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes managing your storage booking, delivering the service, handling payments, and maintaining your account.

Legal Obligation

We may process personal data where required to comply with legal obligations, including accounting, tax, record-keeping, fraud prevention, and lawful requests from authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. This may include maintaining security, preventing misuse of our premises, improving operations, and managing business records.

Consent

In limited cases, we may rely on your consent, for example where required for certain marketing or optional services. Where we rely on consent, you may withdraw it at any time.

Vital Interests

In rare situations, we may process personal data to protect someone’s vital interests, such as in an emergency involving health or safety.

We carefully assess each processing activity to ensure there is a valid lawful basis before we collect or use personal data.

5. Sharing Personal Data and Processors

We may share personal data with trusted third parties where necessary for the purposes described in this Policy. These third parties may act as processors or, in some cases, as independent controllers.

Examples of processors or service providers may include:

payment processors;
IT and cloud service providers;
accounting and bookkeeping providers;
identity verification providers;
security monitoring and CCTV system providers;
contract management and administrative support services;
professional advisers such as auditors, insurers, legal advisers, and consultants.

Where we use processors, they are only permitted to process personal data on our instructions and must implement appropriate technical and organisational safeguards. We require them to protect data, keep it confidential, and use it only for the services they provide to us.

We may also disclose personal data where required by law, regulation, court order, or lawful request from a public authority, or where necessary to establish, exercise, or defend legal claims.

6. International Transfers

If any personal data is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place so that the data remains protected to a standard essentially equivalent to UK data protection requirements. Such safeguards may include adequacy regulations or approved contractual protections.

7. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, tax, or reporting obligations. The length of retention depends on the type of data and the reason for processing.

Customer and contract records are generally retained for the duration of the contract and for a further period needed for legal, tax, or dispute-resolution purposes.
Payment and financial records are retained for the period required by accounting and tax laws.
Security records such as CCTV footage and access logs are kept for a limited period unless needed for an incident, investigation, or legal matter.
Correspondence is retained for as long as necessary to manage your enquiry, account, or any related dispute.
Verification records are kept only as long as necessary for the purpose for which they were collected and in line with legal obligations.

When personal data is no longer required, we will securely delete, anonymise, or destroy it.

8. Data Security

We take the security of personal data seriously and use appropriate measures to protect it from unauthorised access, disclosure, alteration, loss, or destruction. These measures may include access controls, secure storage, confidentiality obligations, staff training, and system safeguards.

While no system can be guaranteed to be completely secure, we regularly review and improve our safeguards to reduce risk.

9. Your Rights

Under data protection law, you have a number of rights in relation to your personal data. These rights may apply depending on the circumstances and the legal basis for processing.

Right of access – you may request access to the personal data we hold about you.
Right to rectification – you may ask us to correct inaccurate or incomplete data.
Right to erasure – you may request deletion of your data in certain circumstances.
Right to restrict processing – you may ask us to limit how we use your data in certain situations.
Right to object – you may object to processing based on legitimate interests or direct marketing.
Right to data portability – you may request certain data in a structured, commonly used format where applicable.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

These rights are not absolute and may be subject to legal exceptions or limitations.

10. How We Handle Requests

If you wish to exercise your rights, we may need to verify your identity before responding. We aim to respond without undue delay and within the time limits required by law. In some cases, we may need additional information to locate your records or to confirm the scope of your request.

If we are unable to comply fully with a request, we will explain the reason, where permitted by law.

11. Marketing

If we send marketing communications, we will do so only where allowed by law. You may opt out of marketing communications at any time. Operational or service-related messages that are necessary for your contract or account will still be sent where appropriate.

12. Children

Our services are not directed at children, and we do not knowingly collect personal data from children except where necessary and lawful, such as in connection with authorised account holders or site access arrangements.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will apply from the date it is published or otherwise communicated to you. We encourage you to review this Policy periodically.

14. Summary of Our Commitments

We collect only the personal data needed to run our storage services.
We process personal data under a valid lawful basis.
We keep data only for as long as necessary.
We use processors who are contractually bound to protect data.
We respect and support your rights under data protection law.

Preston Storage is committed to treating your personal data with care, transparency, and respect. This Privacy Policy applies to all Preston Storage customers in area and is intended to ensure that your information is handled responsibly and in line with applicable legal requirements.