Privacy Policy - Boundsgreen Storage

Boundsgreen Storage is committed to protecting the privacy and personal data of all customers. This Privacy Policy explains how we collect, use, store, share, and protect personal information in connection with our storage services. It applies to all Boundsgreen Storage customers in the area, including prospective customers, account holders, authorised users, and individuals who interact with us in relation to our services.

We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy sets out the key information you need to understand how your data is processed and what rights you have.

1. Information We Collect

We may collect and process personal data directly from you, from your use of our services, and from third parties where necessary. The categories of information may include:

Identity information such as your name, date of birth, and proof of identity when required for security or verification purposes.
Contact details such as postal address, email address, and telephone number.
Account and contract details including booking information, service preferences, payment status, and communications relating to your storage agreement.
Financial information such as billing records and payment-related information.
Security information such as access logs, CCTV recordings, and records of entry or exit from our premises.
Correspondence including emails, letters, complaint records, and notes of conversations.
Technical and usage data where you interact with our systems, such as IP address or device information, if applicable.

We do not intentionally collect special category data unless it is necessary and lawful to do so, for example where you choose to provide information relevant to an accessibility request or complaint. Any such information will be handled with additional care and only where a lawful basis exists.

2. How We Use Personal Data

We process personal data for the following purposes:

To manage enquiries, quotations, and bookings.
To provide storage services and administer customer accounts.
To verify identity, prevent fraud, and protect the security of our premises and customers.
To take payment, issue invoices, and manage arrears.
To communicate with customers about services, notices, and contractual matters.
To maintain records, resolve disputes, and handle complaints.
To comply with legal obligations, including tax, accounting, and regulatory requirements.
To improve our operations, security, and customer service.

We only use personal data where it is appropriate and necessary for a legitimate business purpose or another lawful basis under data protection law.

3. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for each processing activity. Depending on the context, Boundsgreen Storage may rely on one or more of the following bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes managing your storage agreement, taking payment, providing access to your unit, and communicating essential service information.

Legal Obligation

We process certain information to meet legal obligations, such as keeping accounting records, responding to lawful requests, or complying with health and safety requirements.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided that these interests do not override your rights and freedoms. Examples include protecting property, monitoring security, improving services, preventing misuse, and maintaining business records.

Consent

Where required by law, we may ask for your consent, for example for specific optional communications or certain types of processing. If we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Vital Interests and Public Task

These bases are unlikely to apply in normal storage operations, but may be used in exceptional circumstances where necessary to protect someone’s life or to comply with a public authority requirement.

4. Data Sharing and Processors

We may share personal data with trusted third parties where necessary for the purposes described in this policy. These third parties may act as processors or, in some cases, independent controllers.

Examples of processors may include:

IT and system providers who support our email, data storage, and security systems.
Payment service providers who process card or online payments.
Accounting and bookkeeping providers who help maintain financial records.
Security and monitoring providers who assist with CCTV, alarm, or access control systems.
Professional advisers such as lawyers, insurers, or auditors where needed.

We require processors to act only on our instructions, to keep your data secure, and to use it only for the agreed purposes. Where data is shared with independent controllers, they will be responsible for their own handling of the information in accordance with applicable law.

We may also disclose personal data if required by law, by a court order, or to protect the rights, property, or safety of Boundsgreen Storage, our customers, staff, or others.

5. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including for legal, accounting, and reporting requirements. Retention periods depend on the type of data and the purpose of processing.

Contract and account records are generally retained for the duration of the customer relationship and for a reasonable period afterwards to manage claims, disputes, or audits.
Financial records are retained for the period required by tax and accounting law.
Security records, including CCTV and access logs, are retained only for as long as necessary for security, incident review, or legal purposes.
Correspondence and complaint records are retained for as long as needed to resolve the issue and demonstrate compliance.

When personal data is no longer needed, it is securely deleted, anonymised, or otherwise disposed of in a safe and lawful manner.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or misuse. These measures may include access controls, staff training, secure storage, encryption where appropriate, and regular review of our procedures.

Although we take reasonable steps to protect your information, no system can be guaranteed to be completely secure. We therefore encourage customers to take care when sharing personal information and to notify us promptly if they believe their data may have been compromised.

7. Your Rights

Under data protection law, you have a number of rights in relation to your personal data. These rights may be subject to limitations depending on the circumstances and the legal basis for processing.

Right of access – you can request a copy of the personal data we hold about you.
Right to rectification – you can ask us to correct inaccurate or incomplete information.
Right to erasure – in some cases, you can ask us to delete your data.
Right to restriction – you can ask us to limit how we use your data in certain situations.
Right to object – you can object to processing based on legitimate interests or direct marketing.
Right to data portability – you can request transfer of certain data to you or another organisation, where applicable.
Right to withdraw consent – where we rely on consent, you may withdraw it at any time.

You also have the right to complain to the relevant data protection authority if you are unhappy with how your data is handled. We encourage you to raise any concerns with us first so we can try to resolve them promptly.

8. Children’s Data

Our services are not directed at children, and we do not knowingly collect personal data from children unless it is necessary in connection with a lawful customer request or authorised access arrangement. Where we become aware that we have collected data inappropriately, we will take appropriate steps to delete or protect it.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, or our business practices. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically so they remain informed about how their information is used.

By using Boundsgreen Storage services, you acknowledge that you have read and understood this Privacy Policy and that it applies to all Boundsgreen Storage customers in the area.

This policy is intended to provide clear and transparent information about our data protection practices while respecting your rights under applicable law.