Privacy Policy - Camberwell Storage

Camberwell Storage is committed to protecting the privacy and personal data of all customers in the area. This Privacy Policy explains how we collect, use, store, share, and protect personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all Camberwell Storage customers in the area, including prospective customers, current customers, former customers, and any individuals who interact with us in relation to storage services.

1. Who We Are

For the purposes of data protection law, Camberwell Storage acts as the data controller for the personal data described in this policy. This means we determine why and how personal data is processed when you use our storage services, make an enquiry, sign a storage agreement, or otherwise interact with us.

2. Personal Data We Collect

We collect only the information necessary to provide storage services, manage customer accounts, protect our facilities, and meet legal obligations. The types of personal data we may collect include:

Identity data such as your name, title, and date of birth where required.
Contact data such as billing address, correspondence address, email address, and telephone number.
Account data such as account reference numbers, booking details, storage unit details, and payment status.
Financial data such as payment card details or bank account information, where needed for transactions. Payment data may be handled by secure third-party payment providers.
Identification data such as copies of identification documents where we are required to verify identity for security or legal reasons.
Security data such as CCTV footage, access logs, alarm records, and records of entry or exit from the site.
Communication data such as emails, letters, phone call records, and customer service correspondence.
Usage data such as information about your interactions with our services, booking requests, and service preferences.

We do not intentionally collect special category data unless you choose to provide it in communication with us or it is necessary to comply with a legal obligation. If special category data is processed, we will only do so where a lawful basis under data protection law applies.

3. How We Collect Personal Data

We collect personal data in several ways:

Directly from you when you complete an enquiry, request a quote, sign an agreement, make a payment, or contact us.
Automatically when you use our premises, such as through access control systems and CCTV.
From third parties, including payment processors, identity verification providers, legal advisers, debt recovery services, or public authorities where relevant and lawful.

We aim to collect data fairly and transparently, and only for specific, legitimate purposes.

4. How We Use Your Data

We use personal data for the following purposes:

To set up and manage customer accounts.
To provide storage services and maintain accurate records.
To process payments, refunds, and outstanding balances.
To verify identity and carry out fraud prevention checks.
To maintain safety, security, and the proper operation of our facilities.
To communicate with you regarding your account, service changes, notices, or administrative matters.
To comply with legal and regulatory requirements.
To handle disputes, complaints, insurance claims, or legal claims.

We do not sell personal data. We also do not use personal information for unrelated purposes without ensuring there is a lawful basis to do so.

5. Lawful Basis for Processing

Under the UK GDPR, we must have a lawful basis to process personal data. Depending on the circumstances, we may rely on one or more of the following bases:

Contract

We process your data when it is necessary to enter into or perform a contract with you. This includes managing your storage agreement, processing payments, and delivering the services you request.

Legal Obligation

We process data where needed to comply with legal obligations, such as accounting rules, tax requirements, fraud prevention obligations, or requests from law enforcement or regulators.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided your rights and freedoms do not override those interests. This may include protecting our premises, maintaining site security, preventing misuse of services, improving service quality, and managing operational administration. We always consider whether such processing is proportionate and necessary.

Consent

In limited situations, we may rely on your consent, for example where you choose to receive certain optional communications. Where consent is used, you may withdraw it at any time.

6. Sharing Your Personal Data

We may share personal data with trusted third parties who help us provide services or meet legal obligations. These parties act as processors or, in some cases, independent controllers. We only share data where necessary and under appropriate safeguards.

Processors We Use

Payment processors to handle secure card or bank payments.
IT and software providers that support booking systems, customer records, email services, and data storage.
Security service providers that support alarm systems, access control, and CCTV operation.
Professional advisers such as accountants, auditors, insurers, and legal advisers.
Debt recovery or credit control providers where necessary for unpaid invoices or breach of contract.
Identity verification or fraud prevention services used to confirm identity or reduce the risk of misuse.

All processors are required to act only on our instructions, protect the confidentiality of your data, and implement appropriate technical and organisational security measures.

Other Disclosures

We may also disclose personal data to law enforcement, courts, regulators, or other public authorities where required by law or necessary to protect our legal rights, property, staff, customers, or the public.

7. International Transfers

If any of our processors store or access personal data outside the UK, we will ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or equivalent legal mechanisms approved under UK data protection law.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including meeting legal, accounting, security, and reporting obligations. Retention periods vary depending on the type of data and the reason for processing.

Customer account and contract data is usually retained for the duration of the contract and for a reasonable period afterwards for record-keeping and legal protection.
Financial and transaction records are kept for the period required by tax and accounting law.
Security records such as CCTV and access logs are kept only as long as necessary for safety, investigation, or incident management.
Correspondence and complaint records are retained for as long as needed to resolve issues and defend legal claims.

When data is no longer required, we will securely delete, destroy, or anonymise it.

9. Your Rights

Under data protection law, you have several rights in relation to your personal data. These rights may apply depending on the legal basis for processing and the circumstances of your request.

Right of Access

You can request a copy of the personal data we hold about you and information about how we use it.

Right to Rectification

You may ask us to correct inaccurate or incomplete personal data.

Right to Erasure

In certain situations, you may request that we delete your personal data. This right does not apply where we must retain information for legal or contractual reasons.

Right to Restrict Processing

You may ask us to limit how we use your data in specific circumstances, such as while accuracy is being checked.

Right to Object

You may object to processing based on legitimate interests, and in some cases to direct marketing where applicable.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you may have the right to receive your data in a structured, commonly used format.

Right to Withdraw Consent

If we rely on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing carried out before withdrawal.

Right to Complain

If you believe your data has been handled unlawfully, you have the right to complain to the UK Information Commissioner's Office or seek legal advice. We encourage you to raise concerns with us first so we can try to resolve them.

10. Security of Your Data

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access restrictions, encryption where appropriate, secure storage, staff training, and monitoring of security systems. While no system can be guaranteed to be completely secure, we work to maintain a high standard of protection.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, operational practices, or service arrangements. The most current version will apply to your use of our services. We encourage customers to review this policy periodically to stay informed about how personal data is handled.

12. Summary of Our Commitment

Camberwell Storage treats privacy seriously and processes personal data fairly, lawfully, and transparently. We collect only what is necessary, use it for defined purposes, share it only with trusted processors or where legally required, and keep it no longer than needed. Customers in the area can exercise their rights and expect their information to be handled with care and respect.