Privacy Policy - Tufnellpark Storage

This Privacy Policy explains how Tufnellpark Storage collects, uses, stores, shares, and protects personal data. It applies to all Tufnellpark Storage customers in the area, including individuals and business customers who use our storage services, related facilities, or administrative services. We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Tufnellpark Storage provides storage-related services and associated customer support. In providing these services, we act as a data controller for the personal data we determine the purpose and means of processing. This means we decide why and how certain personal information is used, subject to applicable data protection law.

2. Personal data we collect

We only collect data that is relevant and necessary for legitimate business and legal purposes. Depending on how you interact with us, we may collect the following categories of personal data:

Identity data such as your name, date of birth, and identification details where required for verification.
Contact data such as address, email address, and telephone number.
Account and contract data such as customer reference numbers, storage unit details, service preferences, and agreement records.
Financial data such as billing details, payment status, and limited payment transaction information.
Access and security data such as entry logs, CCTV footage, alarm-related records, and authorised access information.
Correspondence data such as enquiries, complaints, and any communications between you and us.
Technical data where applicable, including device or system information collected when you use digital systems associated with our services.

We do not seek to collect special category data unless there is a clear lawful reason and it is strictly necessary. If such data is provided to us inadvertently, we will handle it with extra care and only retain it where permitted by law.

3. How we use personal data

We use personal data for the following purposes:

to manage customer accounts and provide storage services;
to verify identity where necessary;
to process payments, invoices, refunds, and account administration;
to maintain the security of our premises, property, and customers;
to communicate about service updates, notices, or contractual matters;
to handle customer enquiries, disputes, and complaints;
to meet legal, regulatory, tax, and insurance obligations;
to improve our operations, systems, and service quality;
to defend or establish legal claims where required.

We will always ensure that any use of personal data is fair, necessary, and proportionate.

4. Lawful basis for processing

Under UK GDPR, we must have a lawful basis for each processing activity. Depending on the context, we rely on one or more of the following:

4.1 Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes managing your storage agreement, verifying account details, and handling billing or service administration.

4.2 Legal obligation

We may process data where required to comply with legal obligations, such as tax record keeping, health and safety requirements, fraud prevention, or lawful requests from authorities.

4.3 Legitimate interests

We may process data where it is necessary for our legitimate business interests, provided these interests are not overridden by your rights and freedoms. Examples include protecting property, preventing misuse, maintaining security, and improving our service operations. When relying on this basis, we carry out a balancing assessment to ensure your privacy is protected.

4.4 Consent

In limited cases, we may rely on your consent, for example for optional communications or certain non-essential processing. Where consent is used, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Sharing and processors

We may share personal data with trusted third parties where necessary and lawful. These third parties act as processors or, in some cases, independent controllers. We only share the minimum data required for the relevant purpose.

Processors may include:

payment service providers that assist with billing and transaction processing;
IT and system support providers that maintain our operational software and data infrastructure;
security providers that support access control, alarm monitoring, and CCTV systems;
accounting, audit, and professional advisers who assist with compliance and financial management;
legal or insurance advisers where necessary for claims, defence, or risk management;
debt recovery or credit-related service providers, only where lawful and appropriate.

All processors are required to act under written contracts and to process data only on our instructions, using appropriate technical and organisational safeguards. They must not use your data for their own unrelated purposes.

We may also disclose personal data if required by law, by a court order, or to protect the rights, property, or safety of Tufnellpark Storage, our customers, staff, or others.

6. Retention of personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Retention periods depend on the type of data, the nature of the service, and applicable legal obligations.

In general:

contract and account records are retained for the duration of the agreement and for a reasonable period afterwards;
financial and tax records are kept for the periods required by law;
security records, such as access logs or CCTV, are retained for limited periods unless needed for incident investigation or legal claims;
complaints and correspondence may be retained while matters remain active and for a further period for evidential purposes.

When personal data is no longer required, we will securely delete, anonymise, or archive it in line with our retention procedures.

7. Security of your data

We take reasonable and appropriate steps to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. Measures may include restricted access, staff confidentiality duties, secure storage, access controls, and appropriate monitoring of systems and premises. While no system can be guaranteed completely secure, we regularly review our safeguards to maintain a high standard of protection.

8. Your rights

As a data subject under UK GDPR, you have important rights in relation to your personal data. Subject to legal limits and exemptions, these rights include:

Right of access - to obtain confirmation of whether we process your data and a copy of that data.
Right to rectification - to ask us to correct inaccurate or incomplete data.
Right to erasure - to request deletion of data in certain circumstances.
Right to restriction - to request limited processing in specific situations.
Right to object - to object to processing based on legitimate interests or direct marketing.
Right to data portability - to receive certain data in a structured, commonly used format where applicable.
Right to withdraw consent - where processing is based on consent.

You also have the right to raise concerns about how your data is handled. If you believe your rights have been infringed, you may complain to the relevant data protection supervisory authority.

9. Automated decision-making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals, unless we have informed you and such processing is permitted by law. If this changes, we will provide appropriate notice and safeguards.

10. Children

Our storage services are generally intended for adults and business customers. We do not knowingly collect personal data from children except where necessary and lawful in connection with a contract, family arrangement, or legal obligation.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or service changes. The most current version will apply from the date it is published or otherwise communicated. We encourage customers to review it periodically so they remain informed about how their personal data is handled.

12. Summary

In summary, Tufnellpark Storage processes personal data responsibly, lawfully, and transparently. We collect only what we need, use it for clear purposes, rely on valid legal grounds, retain it only for as long as necessary, and require processors to protect it. We also respect your rights and aim to support them promptly and fairly. This policy applies to all Tufnellpark Storage customers in area.