Privacy Policy - Debeauvoirtown Storage

This Privacy Policy explains how Debeauvoirtown Storage collects, uses, shares, stores, and protects personal data when providing storage services to customers in our area. It applies to all Debeauvoirtown Storage customers in area, including individuals and business customers who enquire about, reserve, rent, access, or manage storage units and related services. We are committed to processing personal data in a lawful, fair, transparent, and secure manner in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

1. Who We Are

Debeauvoirtown Storage is a storage services provider. For the purposes of data protection law, we act as the data controller for the personal data we collect and use in connection with our storage operations, customer administration, billing, security, and legal compliance. This means we determine the purposes and means of processing personal data.

2. Personal Data We Collect

We collect only the personal data that is relevant and necessary for operating our storage services, protecting our premises, and meeting our legal obligations. Depending on the services you use, we may collect the following categories of personal data:

Identity information: name, date of birth, and identification details provided during onboarding or verification.
Contact information: postal address, email address, and telephone number.
Account and transaction data: rental agreements, payment records, invoices, deposit information, and account status.
Access and security data: key fob or access code records, gate logs, CCTV footage, and incident reports.
Communication data: messages, enquiries, complaints, service requests, and notes relating to your account.
Technical data: limited device or system data collected when you interact with our systems, such as IP address or browser details where applicable.
Special category data: we do not intentionally collect special category data unless you voluntarily provide it and it is necessary for a specific lawful purpose, such as accommodating an accessibility request.

We do not seek to collect unnecessary personal data. Where possible, we minimise the information requested and retain it only as long as needed for the stated purpose.

3. How We Use Personal Data

We use personal data to provide storage services and manage our business operations. The main purposes include:

setting up and administering customer accounts;
verifying identity and preventing fraud;
processing payments, refunds, deposits, and account statements;
granting and controlling site access;
responding to enquiries, complaints, and service requests;
monitoring security and protecting customers, staff, and property;
maintaining accurate records and business administration;
meeting legal, regulatory, tax, insurance, and audit requirements;
resolving disputes and enforcing contractual rights;
improving service quality, operational efficiency, and customer experience.

We will only process personal data for the specific purposes described above or for compatible purposes where permitted by law. We do not sell personal data.

4. Lawful Basis for Processing

We only process personal data where we have a valid lawful basis under GDPR. Depending on the situation, we rely on one or more of the following bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes managing your storage agreement, taking payments, providing access, and communicating about the service.

Legal Obligation

We may process personal data where required to comply with legal or regulatory obligations, such as accounting rules, tax requirements, fraud prevention obligations, and lawful requests from public authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided your rights and freedoms do not override those interests. Examples include site security, CCTV monitoring, business administration, service improvement, and protecting against misuse or unlawful access. When relying on legitimate interests, we consider the impact on individuals and apply appropriate safeguards.

Consent

In limited circumstances, we may rely on your consent, for example where it is required for an optional communication or specific processing activity. When consent is used, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital Interests and Public Interest

These bases are unlikely to apply in ordinary storage service operations, but may be used in exceptional circumstances where needed to protect someone’s life or where processing is necessary for a task carried out in the public interest.

5. Sharing Personal Data and Processors

We may share personal data with trusted third parties when necessary for the operation of our services, compliance obligations, or business administration. Where a third party processes personal data on our behalf, it acts as a processor and may only use the data under our instructions and appropriate contractual safeguards.

Typical processors and recipients may include:

Payment processors for card and bank payment handling;
IT and hosting providers that support our systems, data storage, and cybersecurity;
Security service providers responsible for monitoring, alarms, or CCTV-related support;
Accounting and bookkeeping providers assisting with financial records and tax compliance;
Maintenance and facilities contractors where access to limited personal data is necessary to perform their work;
Professional advisers such as legal, insurance, or audit advisers;
Public authorities where disclosure is required by law, court order, or lawful request.

We require processors to implement appropriate technical and organisational measures to protect personal data and to process it only for specified purposes. Where data is transferred outside the European Economic Area, we ensure suitable safeguards are in place, such as approved transfer mechanisms, where required by law.

6. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, reporting, and dispute-resolution requirements. Retention periods may vary depending on the type of information and the legal basis for processing.

Customer account and contract records: retained for the duration of the rental relationship and for a reasonable period afterwards.
Financial and tax records: retained for the period required by applicable accounting and tax laws.
Security records and CCTV footage: retained for a limited period unless required longer for an investigation, claim, or legal obligation.
Enquiry and communication records: retained as needed to manage the relationship and resolve issues.

When personal data is no longer required, we securely delete, anonymise, or archive it in accordance with our retention procedures.

7. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, password protection, staff training, CCTV where lawful and proportionate, secure storage, data minimisation, and restricted access to sensitive records. While no system can be guaranteed to be completely secure, we work continuously to protect the confidentiality and integrity of personal data.

8. Your Rights Under GDPR

As a data subject, you have rights over your personal data, subject to certain legal limits and exceptions. These rights include:

Right of access: to request confirmation of whether we process your personal data and obtain a copy of it;
Right to rectification: to ask us to correct inaccurate or incomplete data;
Right to erasure: to request deletion of your data in certain circumstances;
Right to restriction: to ask us to limit processing in certain situations;
Right to data portability: to receive certain data in a structured, commonly used, machine-readable format where applicable;
Right to object: to object to processing based on legitimate interests, and to direct marketing where applicable;
Right to withdraw consent: where processing is based on consent;
Right not to be subject to solely automated decision-making: unless permitted by law and with required safeguards.

To protect privacy, we may need to verify your identity before responding to a rights request. We will respond within the timeframe required by GDPR, unless an extension is lawfully permitted.

9. Children’s Data

Our storage services are generally intended for adults and business customers. We do not knowingly collect personal data from children except where it is necessary in connection with a lawful business relationship or where a parent or guardian has provided the information for a legitimate purpose.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or operational practices. Any revised policy will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to stay informed about how we protect personal data.

11. Summary of Our Commitment

Debeauvoirtown Storage is committed to handling personal data responsibly, securely, and transparently. We collect only what we need, use it for clear and lawful purposes, keep it only as long as necessary, share it only with trusted processors or where legally required, and respect your rights under data protection law. Our approach is designed to support safe, reliable storage services while protecting the privacy of all customers in area.