Storage Botanybay Privacy Policy
This Privacy Policy explains how Storage Botanybay collects, uses, stores, and protects personal data relating to our storage services. It applies to all Storage Botanybay customers in our service area, as well as prospective customers and visitors to our premises. We are committed to complying with the General Data Protection Regulation and all applicable data protection laws.
Data Controller and Scope
Storage Botanybay acts as the data controller for the personal data described in this Privacy Policy. This means that we determine the purposes and means of processing your personal data. This Privacy Policy applies to all personal data we process in connection with enquiries, quotes, contracts, payments, and the day-to-day operation of our storage services for customers in our area.
Types of Personal Data We Collect
We collect and process the following categories of personal data, depending on your relationship with us and the services you use:
Identification and contact information: name, postal address, billing address, contact address, and similar identifying details.
Account and contract information: customer reference number, contract details, unit number, contract start and end dates, services selected, correspondence relating to your contract, and any preferences you communicate to us.
Payment and billing information: payment method, payment history, amounts paid, due dates, invoices, and records of transactions. We do not store full payment card details if payment is made by card through a secure provider.
Usage and operational information: dates and times of access to the facility where relevant, logs related to unit entry systems, and records of communication and support requests.
Security and CCTV data: images and recordings captured by CCTV systems installed for the safety and security of our customers, staff, property, and premises.
Technical information: where applicable, limited technical data such as IP address and basic device information in connection with digital services or communications tools we operate.
Purposes of Processing and Lawful Bases
Storage Botanybay processes your personal data only where we have a lawful basis under the GDPR. Depending on the context, we rely on the following bases:
Performance of a contract: We process your identification, contact, account, contract, and payment data to provide storage services, manage reservations, set up and maintain your account, issue invoices, and respond to your requests relating to your contract.
Compliance with legal obligations: We process certain data to comply with legal and regulatory requirements, for example, record keeping obligations, tax and accounting requirements, and obligations to assist law enforcement authorities when legally required to do so.
Legitimate interests: We process data for our legitimate business interests, provided that those interests are not overridden by your rights and freedoms. This includes ensuring the security of our premises through CCTV, preventing fraud or misuse of our services, maintaining and improving our operations, and managing customer relationships and service quality.
Consent: In specific cases, we may rely on your consent, for example, where we choose to send certain types of optional marketing communications by electronic means. Where processing is based on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal.
Data Retention
We retain personal data only for as long as necessary to achieve the purposes for which it was collected, or as required by law. The retention period depends on the type of data and the context in which it is processed:
Customer and contract records: We generally retain records relating to contracts, including identification, contact, and billing data, for a period required by applicable limitation and tax laws after the end of the contractual relationship. This is to handle any queries, disputes, or legal claims.
Payment and financial records: Invoices, transaction records, and related financial information are retained for the duration required under tax and accounting regulations.
CCTV recordings: CCTV footage is retained for a limited period, focused on what is necessary to investigate incidents, ensure security, and comply with legal obligations. Once this period has passed and footage is no longer required, it is securely deleted or overwritten.
Enquiries and correspondence: Enquiry records and routine correspondence may be retained for a reasonable period to respond to follow-up questions and maintain accurate records of interactions.
When data is no longer needed, we securely delete, anonymise, or destroy it in accordance with our data retention and disposal policies.
Data Processors and Third Parties
We use carefully selected third-party service providers to support our operations. These providers act as data processors on our behalf and may process your personal data only in accordance with our documented instructions and applicable data protection law. They are required to implement appropriate technical and organisational measures to protect your data.
Examples of such processors may include providers of payment processing services, cloud storage and data hosting, IT support, access control systems, CCTV maintenance, and customer management tools. We only disclose to processors the data that is necessary for them to perform their services for us.
In addition, we may share personal data with professional advisors such as accountants or legal advisors where necessary, and with public authorities or law enforcement where we are legally obliged to do so or where disclosure is necessary to protect our rights, property, or safety or that of others.
We do not sell your personal data. We do not disclose personal data to third parties for their independent marketing purposes.
International Data Transfers
Where any of our service providers are located outside the European Economic Area or where data is processed in a country that does not have an adequacy decision from the relevant data protection authorities, we take appropriate safeguards to protect your personal data. These may include using standard data protection clauses approved by regulators or ensuring that the recipient is subject to binding and enforceable obligations to protect data.
Security of Your Personal Data
We take the security of your personal data seriously. We implement appropriate technical and organisational measures designed to protect your data from unauthorised access, accidental loss, alteration, or disclosure. These measures include access controls, physical security for our premises, security protocols for our systems, staff training, and regular review and improvement of our security arrangements.
Your Data Protection Rights
Under the GDPR and applicable data protection laws, you have a number of rights in relation to your personal data that we process. Subject to certain conditions and exceptions, these include:
Right of access: You can request confirmation as to whether we process your personal data and obtain a copy of that data, along with information about how we use it.
Right to rectification: You can request that we correct or complete any inaccurate or incomplete personal data we hold about you.
Right to erasure: You can request that we delete your personal data in certain circumstances, for example where it is no longer necessary for the purposes for which it was collected or where processing is based on your consent and you withdraw that consent.
Right to restriction of processing: You can request that we restrict the processing of your personal data in certain situations, such as while we verify the accuracy of data or assess an objection you have raised.
Right to data portability: Where processing is based on your consent or on a contract and is carried out by automated means, you can request a copy of your data in a structured, commonly used, and machine-readable format and ask us to transmit that data to another controller where technically feasible.
Right to object: You can object to processing based on our legitimate interests, including profiling, on grounds relating to your particular situation. You also have an absolute right to object to direct marketing at any time.
Right to withdraw consent: Where we rely on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.
You also have the right to lodge a complaint with a data protection supervisory authority if you believe that your personal data has been processed in a way that does not comply with data protection laws.
Children
Our services are not directed at children. We do not knowingly collect personal data relating to children without appropriate authorisation. If we become aware that we have collected such data in error, we will take steps to delete it as soon as reasonably possible.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, our processing activities, or applicable law. The updated version will be made available at our premises or through our usual communication channels, and the date of the latest revision will be indicated. We encourage you to review this Privacy Policy periodically to stay informed about how we process your personal data.
