Privacy Policy - Denmarkhill Storage

This Privacy Policy explains how Denmarkhill Storage collects, uses, shares, stores, and protects personal data when providing storage and related services. It applies to all Denmarkhill Storage customers in the area, including prospective customers, current customers, former customers, and individuals who interact with us on behalf of a business customer. By using our services, entering into a storage agreement, or otherwise providing personal data to us, you acknowledge that your information will be handled in accordance with this policy and applicable data protection laws, including the GDPR.

1. Who We Are

Denmarkhill Storage provides storage facilities and associated services to individuals and businesses in the local area. For the purposes of data protection law, Denmarkhill Storage is the data controller for the personal data described in this policy. This means we decide why and how personal data is processed in connection with our services.

2. Personal Data We Collect

We may collect personal data directly from you, from your use of our services, and from third parties where permitted by law. The types of data we may collect include:

Identity data such as your name, date of birth, and identity verification information.
Contact data such as your postal address, email address, and telephone number.
Account and contract data such as storage unit details, start and end dates, payment status, and service preferences.
Payment data such as billing information, transaction records, and payment confirmations. We do not intentionally store full card details unless required for a specific payment process.
Access and security data such as gate access logs, CCTV footage, entry records, alarm activity, and incident reports.
Communications data such as emails, calls, messages, complaints, feedback, and support requests.
Technical data such as device information, IP address, browser type, and basic usage information if you interact with any online systems connected to our services.
Verification data where needed for fraud prevention, identity checks, or compliance with legal obligations.

We aim to collect only the information that is necessary for lawful and legitimate business purposes. Where possible, we keep data collection to a minimum and avoid collecting special category data unless required by law or where you choose to provide it and it is relevant to our services.

3. How We Use Personal Data

We process personal data for several purposes connected to the operation of our storage business. These may include:

setting up and managing customer accounts;
providing storage services and administering storage agreements;
processing payments, refunds, and account balances;
verifying identity and preventing misuse, theft, fraud, or unauthorized access;
maintaining facility security, including CCTV monitoring and access control;
responding to enquiries, complaints, and service requests;
meeting legal, tax, accounting, insurance, and regulatory obligations;
recovering debts, enforcing agreements, and managing disputes;
improving our services, processes, and security measures;
sending administrative notices relating to your account or the services we provide.

We do not use personal data for unrelated purposes and will not process it in a way that is incompatible with the original purpose unless permitted by law or with your consent where required.

4. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for processing personal data. Denmarkhill Storage relies on one or more of the following bases:

Contract: processing is necessary to enter into or perform a storage agreement, manage your account, and provide the services you have requested.
Legal obligation: processing is necessary to comply with applicable legal and regulatory requirements, such as tax, accounting, fraud prevention, and record-keeping duties.
Legitimate interests: processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include site security, CCTV monitoring, service improvement, debt recovery, and prevention of misuse or crime.
Consent: where required, we may rely on your consent, for example for certain optional communications or specific processing activities. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Where we rely on legitimate interests, we assess the impact on your privacy and take steps to protect your personal data. We do not use personal data in ways that are unfair, excessive, or incompatible with these bases.

5. Retention of Personal Data

We keep personal data only for as long as necessary for the purposes for which it was collected, including for legal, accounting, security, and operational reasons. Retention periods depend on the nature of the data and the reason for processing.

Customer and contract records are retained for the duration of the agreement and for a reasonable period afterwards to manage queries, disputes, and legal claims.
Financial and tax records are kept for the period required by applicable law.
Security records, including CCTV and access logs, are kept only for as long as necessary for security, incident investigation, and crime prevention.
Communications are retained for as long as needed to respond to your request and maintain accurate service records.

When data is no longer required, we will delete it, anonymize it, or securely archive it where appropriate. Retention is never indefinite; it is linked to a valid business or legal purpose.

6. Data Sharing and Processors

We may share personal data with trusted third parties where necessary to operate our business, comply with the law, or protect our rights and property. These recipients may act as independent data controllers or as processors acting on our instructions.

Examples of processors and service providers may include:

payment service providers;
accounting and bookkeeping providers;
IT, hosting, and software providers;
security and CCTV service providers;
customer support tools and communication providers;
professional advisers such as lawyers, auditors, and insurers.

Where a processor handles personal data on our behalf, we require appropriate contractual safeguards, including instructions on how the data may be used, confidentiality obligations, security measures, and restrictions on sub-processing. We do not permit processors to use your data for their own purposes.

We may also disclose information to public authorities, courts, law enforcement, or other third parties where required by law or where necessary to protect the safety, rights, or property of Denmarkhill Storage, our customers, or others.

7. International Transfers

If personal data is transferred outside the United Kingdom or European Economic Area, we will ensure that appropriate safeguards are in place to protect it, such as standard contractual clauses or other lawful transfer mechanisms. Any transfer will be carried out only where legally permitted and where adequate protection is maintained.

8. Security of Personal Data

We take reasonable technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration, or disclosure. These measures may include access controls, encryption where appropriate, staff confidentiality obligations, secure storage, and monitoring of facility access. While no system is completely secure, we work to maintain a level of protection appropriate to the risks associated with the data we process.

9. Your Rights

Under GDPR, you have several rights in relation to your personal data. Subject to legal limits and exceptions, these rights may include:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of your data in certain circumstances.
Right to restriction: to request limits on how we use your data in certain cases.
Right to object: to object to processing based on legitimate interests or direct marketing, where applicable.
Right to data portability: to receive certain data in a structured, commonly used format and have it transmitted where technically feasible.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

You also have the right to lodge a complaint with the relevant data protection authority if you believe your rights have been infringed. We encourage customers to raise concerns with us first so we can try to resolve them promptly and fairly.

10. Automated Decision-Making

We do not normally carry out automated decision-making that produces legal or similarly significant effects on customers. If this changes, we will provide appropriate information about the logic involved and the consequences for you, as required by law.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or operational practices. Any updated version will apply from the date it is made available. We recommend reviewing this policy periodically to stay informed about how we protect your personal data.

12. Summary of Our Commitment

Denmarkhill Storage is committed to handling personal data lawfully, fairly, and transparently. We collect only what we need, use it for clear and legitimate purposes, retain it for no longer than necessary, share it only where appropriate, and respect your rights under GDPR. This policy applies to all Denmarkhill Storage customers in the area and is intended to provide a clear explanation of how we manage privacy in connection with our services.