Privacy Policy - Haroldpark Storage

This Privacy Policy explains how Haroldpark Storage collects, uses, shares, stores, and protects personal data relating to its customers in the area. It applies to all Haroldpark Storage customers in the area, including individuals who inquire about services, sign up for storage, use storage facilities, communicate with us, or otherwise interact with our business. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with applicable data protection law, including the General Data Protection Regulation (GDPR).

1. Who We Are

Haroldpark Storage provides storage services to customers in the area. For the purposes of data protection law, Haroldpark Storage is the data controller for the personal data described in this Privacy Policy. This means we decide how and why personal data is processed. We take our obligations seriously and aim to ensure that all personal data is handled with care, security, and respect.

2. Personal Data We Collect

We may collect and process different categories of personal data depending on how you interact with us. The types of information we may collect include:

Identity data such as your name and title;
Contact data such as address, email address, and telephone number;
Account and transaction data such as customer reference numbers, service details, payment records, invoices, and billing information;
Facility use data such as entry records, access logs, booking times, and storage unit allocation details;
Communication data such as messages, complaints, feedback, and correspondence;
Security data such as CCTV images or access control records where used for safety, loss prevention, or incident management;
Technical data such as device and browser information if you interact with electronic systems or online services we use;
Special category data only where strictly necessary and legally permitted, for example if you voluntarily provide information relevant to an accessibility or safety matter.

We generally do not seek to collect unnecessary information. Where possible, we limit data collection to what is relevant and proportionate. We also encourage customers not to provide information unless it is required or useful for a specific service or request.

3. How We Collect Personal Data

We may collect personal data directly from you when you:

make an enquiry;
sign an agreement for storage services;
make payments or request invoices;
visit or use our facilities;
report a problem or make a complaint;
communicate with our staff;
participate in a survey or provide feedback.

We may also receive information from third parties such as payment providers, identity verification services, security contractors, or legal and regulatory bodies where permitted by law. If data is collected from another source, we will only use it for legitimate business and compliance purposes.

4. Lawful Basis for Processing

We only process personal data when we have a lawful basis under GDPR. Depending on the situation, our lawful bases may include:

Contract: processing is necessary to enter into or perform a storage agreement, including managing bookings, payments, access, and account administration;
Legal obligation: processing is necessary to comply with laws and regulations, such as accounting, tax, security, or fraud prevention requirements;
Legitimate interests: processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include maintaining security, preventing misuse, improving services, and protecting property;
Consent: where required, we rely on your consent, for example for certain optional communications or specific processing activities;
Vital interests: in rare cases, processing may be necessary to protect someone’s life or physical safety.

Where we rely on legitimate interests, we carefully consider the impact on your privacy and implement safeguards to reduce any risk. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. How We Use Personal Data

We use personal data for the following purposes:

providing and managing storage services;
administering customer accounts and agreements;
processing payments and issuing records;
verifying identity where appropriate;
maintaining security, safety, and site integrity;
preventing fraud, misuse, theft, or unauthorized access;
handling enquiries, complaints, and support requests;
meeting legal, accounting, insurance, and regulatory obligations;
improving services, operations, and customer experience;
protecting the rights, property, and safety of Haroldpark Storage, customers, staff, and visitors.

We will not use personal data for purposes that are incompatible with the reasons it was originally collected unless we have a lawful basis to do so and, where necessary, notify you.

6. Sharing Your Personal Data

We may share personal data with carefully selected third parties, referred to as processors or, in some cases, independent controllers. We only share data where necessary and under appropriate safeguards. Processors are service providers who process data on our instructions and are required to protect it.

Processors and Service Providers

Examples of processors may include:

payment processing providers;
IT hosting, cloud storage, and system support providers;
security and monitoring contractors;
accounting, invoicing, or administrative service providers;
data backup and recovery providers;
professional advisers acting under confidentiality obligations.

Where a third party acts as an independent controller, such as a regulator, law enforcement authority, or insurer, that party will determine its own purposes and lawful basis for processing.

We do not sell personal data. Any sharing is limited to what is needed for the operation, protection, or lawful administration of Haroldpark Storage services.

7. International Transfers

If personal data is transferred outside the United Kingdom or European Economic Area, we will ensure appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms. We take steps to ensure that any such transfer respects the principles of security, transparency, and data minimization.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, tax, insurance, and contractual requirements. Retention periods may vary depending on the type of data and the reason it was collected.

In general, we consider the following retention principles:

customer account and contract records are retained for the duration of the relationship and for a reasonable period afterward;
financial and tax records are retained for the period required by law;
security records such as access logs or CCTV images are kept only as long as necessary for safety, incident investigation, or legal claims;
enquiry and correspondence records are retained for a limited period unless they need to be kept longer for legal or operational reasons.

When data is no longer required, we will delete it securely or anonymize it so that it can no longer identify you. We do not keep personal data indefinitely without a valid reason.

9. Security of Personal Data

We use appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or disclosure. These measures may include access controls, staff confidentiality duties, secure storage, and system protection tools. While no method of transmission or storage is completely risk-free, we work to reduce risks to a reasonable and lawful level.

Only authorized personnel and approved processors may access personal data where needed for legitimate business purposes.

10. Your Rights Under GDPR

You have rights in relation to your personal data. These rights may apply depending on the circumstances and the lawful basis for processing. They include:

Right of access: you may request a copy of the personal data we hold about you;
Right to rectification: you may ask us to correct inaccurate or incomplete information;
Right to erasure: in certain cases, you may ask us to delete your personal data;
Right to restriction: you may request that we limit how we use your data in certain situations;
Right to object: you may object to processing based on legitimate interests or direct marketing;
Right to data portability: in some cases, you may request a copy of your data in a structured, commonly used format;
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time;
Right to complain: you may raise concerns with a supervisory authority if you believe your rights have been infringed.

To exercise these rights, you may make a request using the details provided through our usual customer communication channels. We may need to verify your identity before responding. We will respond within the time limits required by law unless an extension is permitted.

11. Children’s Data

Our services are intended for adult customers and business users. We do not knowingly collect personal data from children except where required in limited circumstances and only in compliance with applicable law. If we become aware that we have collected data unlawfully or without proper authorization, we will take appropriate steps to delete or protect it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, business practices, or service arrangements. Any updated version will apply from the effective date stated in the revised policy. We encourage customers to review the policy periodically so they remain informed about how we process personal data.

13. Summary of Our Commitment

Haroldpark Storage is committed to processing personal data fairly, lawfully, and securely. We collect only the information we need, use it for clear purposes, retain it for no longer than necessary, and protect it through appropriate safeguards. We also respect your rights and aim to make our data handling practices transparent and accountable. This policy applies to all Haroldpark Storage customers in the area and forms part of our commitment to responsible privacy practices.