Storage Bulls Cross Privacy Policy
This Privacy Policy explains how Storage Bulls Cross collects, uses, stores and protects personal data relating to our customers and prospective customers in the Storage Bulls Cross service area. It also describes the lawful bases we rely on under the UK General Data Protection Regulation and the EU General Data Protection Regulation, our retention practices, the role of our processors, and the rights you have in relation to your personal data.
This Privacy Policy applies to all Storage Bulls Cross customers and anyone who contacts us, makes an enquiry, or otherwise interacts with our services in the Storage Bulls Cross area, whether in person, by post, by electronic communication or by any other means.
Data Controller
Storage Bulls Cross is the data controller responsible for determining how and why your personal data is processed in connection with our storage and related services. Where we use third parties to process data on our behalf, those third parties act as data processors and are subject to contractual obligations to handle your data securely and only in accordance with our written instructions.
Personal Data We Collect
We may collect and process the following categories of personal data, depending on how you interact with us and which services you use:
Identification and contact details, such as name, postal address, billing address, contact address, and other basic contact information required to open and manage your account.
Communication records, such as enquiries, correspondence, complaint details and any other information you choose to provide when you contact us or respond to our communications.
Contract and account details, such as details of your storage unit, rental agreements, service history, payment history, contract status and any related documentation that is necessary to provide and administer our services.
Payment and transaction information, such as payment dates, amounts, methods and transaction references. We do not store full card details where payment is processed through a secure payment processor.
Security and access data, such as access logs, unit entry and exit times, and, where used at our facilities, surveillance footage that may incidentally contain your image or vehicle registration when you enter or move around our premises.
Technical information, where you interact with our online content, such as basic device and usage data and preferences to enable us to provide and maintain our online services and to improve their functionality. We do not seek to identify you through this information unless it is strictly necessary, for example in connection with security or fraud prevention.
How We Use Your Personal Data
We use your personal data only when we have a lawful basis to do so. The main purposes for which we process personal data are as follows:
To provide and manage storage services, including handling enquiries, setting up customer accounts, preparing and administering contracts, managing access to storage units, processing payments and providing customer support.
To comply with legal and regulatory obligations, including obligations under tax, accounting, health and safety, crime prevention, anti money laundering and other applicable legislation and regulatory requirements.
To maintain security and protect our legitimate interests, including monitoring access to our premises and systems, preventing unauthorised access, reducing the risk of theft or damage, and managing disputes or legal claims.
To communicate with you about your account, contracts, payments, service updates, operational notices and any changes to this Privacy Policy or our terms and conditions.
To improve our services, facilities and customer experience by reviewing feedback, monitoring service usage and analysing trends in how our storage services and related facilities are used.
Lawful Basis for Processing
We rely on one or more of the following lawful bases for processing your personal data:
Contract. Processing is necessary for the performance of a contract with you or in order to take steps at your request before entering into a contract. This includes creating and managing your storage agreement, processing payments and responding to your pre contract enquiries.
Legal obligation. Processing is necessary for compliance with legal obligations that apply to us, such as keeping certain records for tax, accounting, regulatory, safety or crime prevention purposes.
Legitimate interests. Processing is necessary for our legitimate interests or those of a third party, provided that your interests and fundamental rights do not override those interests. Our legitimate interests include operating secure and efficient storage facilities, managing our business, preventing fraud and misuse, and improving our services.
Consent. In limited cases, we may rely on your consent, for example where we send certain types of optional marketing communications. Where we rely on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before your withdrawal.
Data Retention
We retain personal data only for as long as is reasonably necessary for the purposes described in this Privacy Policy or as required to meet legal, regulatory, tax or accounting requirements. The retention period depends on the nature of the data and the purpose for which it was collected.
Customer account and contract data is generally retained for the duration of your contract and for a period after the end of the contract to enable us to respond to queries, handle disputes and meet our legal obligations. Financial records and transaction data are generally retained for the periods required by applicable tax and accounting laws.
Security data, such as access logs and surveillance footage, is retained for shorter periods, unless we need to keep it longer in connection with an incident, dispute or legal proceedings.
When we no longer need to retain personal data, we take steps to delete it securely or to anonymise it so that it can no longer be associated with an identifiable individual.
Data Processors and Third Parties
We may share your personal data with carefully selected third parties who act as data processors and provide services to us, such as payment processing, secure data storage, information technology support, accounting and professional advice. These processors are only permitted to use your data in accordance with our written instructions and for the specific purposes we specify. They are required to implement appropriate technical and organisational measures to protect your personal data.
We may also share limited personal data with third parties acting as independent data controllers where this is necessary to comply with legal obligations, enforce our rights, protect the security of our premises, or cooperate with regulators or law enforcement authorities. When we do so, each party is individually responsible for complying with data protection laws in respect of the personal data it holds.
We do not sell your personal data. We do not share your personal data with unrelated third parties for their own independent marketing purposes.
International Transfers
Where personal data is transferred outside the United Kingdom or European Economic Area, and the destination country has not been recognised as providing an adequate level of data protection, we will ensure that appropriate safeguards are in place. These may include entering into contracts using standard data protection clauses approved by relevant authorities, or relying on other lawful transfer mechanisms permitted under applicable data protection laws.
Your Data Protection Rights
You have a number of rights in relation to your personal data, subject to certain conditions and exemptions set out in data protection laws.
Right of access. You have the right to obtain confirmation as to whether we process your personal data and to request a copy of the personal data we hold about you, together with information about how we use it.
Right to rectification. You have the right to request that any inaccurate or incomplete personal data we hold about you is corrected or updated.
Right to erasure. In certain circumstances, you have the right to request that we delete your personal data, for example where the data is no longer needed for the purposes for which it was collected or where you withdraw consent and there is no other lawful basis for processing.
Right to restriction. You have the right to request that we restrict the processing of your personal data in certain situations, such as while we are verifying the accuracy of the data or considering an objection you have raised.
Right to object. You have the right to object to processing based on our legitimate interests, including profiling based on those interests. We will stop processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms or where processing is required for legal claims.
Right to data portability. Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive your personal data in a structured, commonly used and machine readable format and to request that we transmit that data to another organisation where technically feasible.
Right to withdraw consent. Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing that took place before you withdrew consent.
You also have the right to raise concerns or lodge a complaint with a data protection supervisory authority if you believe we have not handled your personal data in accordance with applicable law.
Security of Your Personal Data
We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction or damage. Measures may include access controls, physical security measures at our facilities, data minimisation practices and regular review of our information security procedures.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, how we process personal data, or legal and regulatory developments. Where changes are material, we will take reasonable steps to inform you, for example by providing a prominent notice or by contacting you directly where appropriate. The most recent version of this Privacy Policy will apply to our processing of your personal data.
