Privacy Policy - Shacklewell Storage

This Privacy Policy explains how Shacklewell Storage collects, uses, shares, retains, and protects personal data. It applies to all Shacklewell Storage customers in the area, including prospective customers, current customers, visitors, and any individuals who interact with our services on behalf of a customer. We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Shacklewell Storage provides storage services to individuals and businesses. In the course of providing these services, we may process personal data relating to customers, account holders, authorised users, delivery contacts, contractors, and other individuals connected with a storage agreement or enquiry.

Important: This policy applies to all Shacklewell Storage customers in the area and to anyone whose personal data we process in connection with our services.

2. Information We Collect

We collect only the personal data that is necessary for the operation of our services, the administration of accounts, compliance with legal obligations, and the protection of our business and customers. The categories of data we may collect include:

Identity details such as name, date of birth, and title.
Contact details such as postal address, email address, and telephone number.
Account and contract information such as customer reference numbers, storage unit details, payment status, and service history.
Payment information such as billing records and transaction details. We do not intentionally store full card details unless required for a specific secure payment process.
Access and security data such as entry logs, CCTV footage, gate access records, and incident reports where relevant to security and safety.
Communications such as emails, notes of telephone calls, complaint records, and service requests.
Verification data such as proof of identity or address when required to prevent fraud or meet regulatory requirements.

In limited circumstances, we may also process information relating to vehicles, delivery arrangements, business representatives, or emergency contacts where necessary to support the service. We do not intentionally collect special category data unless it is provided by you and required for a lawful reason, such as to accommodate a request or comply with a legal obligation.

3. How We Use Personal Data

We use personal data for the following purposes:

to create and manage customer accounts;
to provide storage services and administer agreements;
to process payments and maintain financial records;
to verify identity and prevent fraud;
to maintain security, protect property, and investigate incidents;
to communicate about bookings, access, renewals, service changes, and account matters;
to handle complaints, disputes, and claims;
to meet legal, regulatory, tax, and insurance obligations;
to improve our operational efficiency and customer service;
to establish, exercise, or defend legal claims.

We will only use personal data in ways that are compatible with the purposes explained in this policy or where we have a valid legal reason to do so.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for each processing activity. Shacklewell Storage relies on the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes setting up storage services, taking payments, providing access, and managing your account.

Legal Obligation

We process certain information where required to comply with legal or regulatory obligations, including tax rules, accounting requirements, fraud prevention, and lawful requests from public authorities.

Legitimate Interests

We may process personal data for our legitimate interests where those interests are not overridden by your rights and freedoms. These interests include protecting our premises, monitoring access, preventing misuse of services, improving our operations, and defending legal claims. When we rely on legitimate interests, we assess the impact on individuals and apply appropriate safeguards.

Consent

In limited situations, we may rely on consent. Where we do, you have the right to withdraw consent at any time. Withdrawal of consent will not affect processing carried out before it was withdrawn.

Vital Interests

In rare cases, we may process personal data to protect someone’s vital interests, such as in an emergency or urgent safety situation.

5. Sharing and Processors

We do not sell personal data. We may share information only where necessary and lawful. This may include sharing with:

Payment processors that help us take and reconcile payments;
IT and hosting providers that support our systems, data storage, and communication tools;
Security service providers such as CCTV, access control, alarm monitoring, and maintenance contractors;
Professional advisers including accountants, insurers, auditors, and legal advisers;
Debt recovery or collections providers where necessary to recover unpaid amounts;
Public authorities or law enforcement where required by law or to protect rights, property, or safety.

Where we use third-party processors, they act only on our instructions and are required to protect personal data, use it only for the agreed purpose, and implement appropriate technical and organisational security measures. We take reasonable steps to ensure that processors are reliable and compliant with data protection law.

6. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including the need to satisfy legal, accounting, insurance, and reporting requirements. Retention periods vary depending on the type of data and the reason for processing.

As a general principle:

customer account records are kept for the duration of the relationship and for a reasonable period afterwards;
financial and tax records are retained for the periods required by law;
security logs and CCTV footage are kept for limited periods unless needed for an investigation, claim, or legal process;
complaints, dispute records, and correspondence may be retained for as long as needed to resolve issues and protect legal rights.

When personal data is no longer needed, we will securely delete, anonymise, or archive it in accordance with our retention practices.

7. Security of Personal Data

We use appropriate technical and organisational measures to protect personal data from loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, password protection, staff training, secure storage, encryption where appropriate, and regular review of security practices. While no system can be completely secure, we work to reduce risks and respond promptly to any suspected data breach.

8. International Transfers

If any of our service providers process personal data outside the United Kingdom, we will ensure that appropriate safeguards are in place. These may include UK-approved standard contractual clauses, adequacy regulations, or other lawful transfer mechanisms designed to protect your information.

9. Your Rights

Under data protection law, you have a number of rights regarding your personal data. Subject to legal conditions and exceptions, you may have the right to:

Access your personal data and request a copy of the information we hold about you;
Rectification of inaccurate or incomplete data;
Erasure of your data in certain circumstances;
Restriction of processing in certain circumstances;
Object to processing based on legitimate interests or direct marketing;
Data portability where processing is based on consent or contract and carried out by automated means;
Withdraw consent where processing relies on consent;
Lodge a complaint with the Information Commissioner’s Office if you believe your rights have been infringed.

We may need to verify your identity before responding to a rights request. Some rights may not apply in every situation, particularly where we must keep information to comply with legal obligations, protect security, or establish legal claims.

10. Automated Decision-Making

Shacklewell Storage does not normally use automated decision-making that produces legal or similarly significant effects on individuals. If this changes, we will provide appropriate information about the logic involved and the consequences for you, together with the available rights and safeguards.

11. Children

Our services are not intended for children acting on their own behalf. We do not knowingly collect personal data from children unless it is necessary in a family or emergency context and processed lawfully. If we become aware that we have collected data from a child without an appropriate basis, we will take steps to delete it where required.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our data handling practices. The latest version will apply from the date it is issued. We encourage customers to review the policy periodically so they remain informed about how their information is handled.

13. Summary of Our Commitment

We are committed to processing personal data lawfully, fairly, and transparently. We collect only what we need, use it for clear and legitimate purposes, retain it for appropriate periods, and share it only with trusted processors or where required by law. We also respect your rights and seek to ensure that your personal information is handled with care and in line with GDPR principles.

By using Shacklewell Storage services, you acknowledge that your personal data may be processed as described in this Privacy Policy.