Privacy Policy - Barnescray Storage

This Privacy Policy explains how Barnescray Storage collects, uses, stores, and protects personal data. It applies to all Barnescray Storage customers in the area, including prospective customers, current customers, former customers, and individuals who contact us on behalf of a business or household storage account. We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

For the purposes of data protection law, Barnescray Storage acts as the data controller for personal data processed in connection with our storage services, customer management, security, billing, and related administrative activities. This means we decide why and how your personal data is used. We take privacy seriously and aim to collect only the information that is necessary for legitimate business purposes, service delivery, legal compliance, and security.

2. Personal data we collect

We may collect the following categories of personal data:

Identity information such as your name, title, date of birth, and identification details where needed for verification.
Contact information such as address, email address, and telephone number.
Account and service information including storage unit details, booking records, access arrangements, payment status, and communication history.
Financial information such as billing details, payment records, and transaction references.
Security information such as CCTV footage, access logs, key or passcode records, and incident reports where applicable.
Correspondence including emails, forms, telephone notes, and any information you provide when asking about our services or raising a concern.

We generally do not intentionally collect special category data unless you voluntarily provide it and it is necessary for a specific legal or operational purpose. If such data is provided, it will be handled with additional care and only where a lawful basis exists.

3. How we collect personal data

We may collect personal data directly from you when you:

request information about our services;
make a booking or sign a storage agreement;
use our facilities or security systems;
make a payment or set up billing arrangements;
communicate with us by phone, email, or in writing;
report a problem, incident, or complaint.

We may also receive personal data from third parties where this is necessary for our services, for example from payment processors, identity verification providers, insurers, contractors, or legal and regulatory bodies.

4. Lawful basis for processing

Under data protection law, we must have a lawful basis before we process personal data. Barnescray Storage relies on the following lawful bases:

Contract: to provide storage services, manage bookings, process payments, and fulfil our obligations under your storage agreement.
Legal obligation: to comply with tax rules, accounting requirements, health and safety duties, fraud prevention, and other legal requirements.
Legitimate interests: to operate and improve our business, protect property, maintain security, prevent misuse, and handle routine administration, provided these interests do not override your rights and freedoms.
Consent: where required, for example for certain optional communications or specific processing activities. You may withdraw consent at any time where consent is the basis used.

Where we process special category data, we will only do so where an additional condition under data protection law is met, such as explicit consent or another lawful ground permitted by law.

5. Why we use your data

We use personal data for the following purposes:

to create and manage customer accounts;
to provide access to storage facilities and associated services;
to verify identity and protect against fraud or unauthorised use;
to process payments and issue receipts or invoices;
to monitor security, investigate incidents, and protect people and property;
to comply with legal and regulatory requirements;
to handle enquiries, complaints, and customer support matters;
to maintain records and improve operational efficiency;
to defend or establish legal claims where necessary.

We will not use your data for purposes that are incompatible with the reasons it was collected unless we have a lawful basis to do so.

6. Data retention

We keep personal data only for as long as necessary to meet the purposes for which it was collected, including legal, accounting, insurance, and reporting requirements. Retention periods depend on the type of data and the reason it is held.

Typical retention approach

Customer account and contract records: retained for the duration of the relationship and for a reasonable period afterwards.
Payment and accounting records: retained in line with legal and tax obligations.
Security records such as CCTV or access logs: retained only as long as necessary for security, investigation, or incident management.
Enquiry and complaint records: retained for as long as needed to resolve the matter and support our records.

When data is no longer needed, it will be securely deleted, anonymised, or otherwise disposed of safely.

7. Processors and sharing of data

We may share personal data with trusted third-party processors who act on our behalf and process data only under our instructions. These may include:

IT and hosting providers who support systems, backups, and data storage;
payment service providers who handle transactions securely;
security providers such as CCTV, alarm, or access-control service providers;
professional advisers including accountants, auditors, insurers, and legal advisers;
maintenance and operational contractors where access to limited data is necessary to perform services;
regulators, law enforcement, or public authorities where disclosure is required by law.

We require processors to protect personal data, keep it confidential, and process it only for agreed purposes. If data is transferred outside the UK, we will ensure appropriate safeguards are in place in accordance with applicable law.

8. Data security

Barnescray Storage uses appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. These measures may include access controls, secure systems, staff training, monitoring, and restricted handling of sensitive information. While no system can guarantee complete security, we work continuously to reduce risk and respond promptly to any suspected data incident.

9. Your rights

Under data protection law, you have several rights in relation to your personal data. These rights may apply depending on the circumstances and the legal basis for processing.

Right of access: you may request a copy of the personal data we hold about you.
Right to rectification: you may ask us to correct inaccurate or incomplete data.
Right to erasure: you may ask us to delete your data in certain situations.
Right to restriction: you may request limited processing in some cases.
Right to object: you may object to processing based on legitimate interests.
Right to data portability: you may request certain data in a structured, commonly used format where applicable.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

We may need to verify your identity before responding to a request. In some cases, legal obligations or legitimate grounds may mean we cannot fully comply, but we will always explain our decision where appropriate.

10. How to exercise your rights

If you wish to exercise any of your rights, please submit a request in writing to us through the appropriate internal customer service route. We will respond within the time limits required by law and may request further information to confirm your identity or understand your request. We will not normally charge a fee unless the request is manifestly unfounded, excessive, or repetitive.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. The most recent version will apply to personal data processed by Barnescray Storage. We encourage customers to review this policy periodically so they remain informed about how their information is handled.

12. Summary of our privacy commitment

Barnescray Storage is committed to keeping personal data accurate, secure, and used fairly. We only collect what we need, use it for clear and lawful purposes, retain it for limited periods, and share it only where necessary with trusted processors or legal authorities. This policy applies to all Barnescray Storage customers in area, and we aim to respect your privacy at every stage of our service relationship.