Storage Whetstone Privacy Policy
This Privacy Policy explains how Storage Whetstone collects, uses, shares, and protects your personal data. It applies to all Storage Whetstone customers in our service area, including prospective, current, and former customers, and to individuals who contact us or use our services on behalf of a business or organisation.
Who We Are and Scope of This Policy
Storage Whetstone is a provider of storage services. In relation to the personal data described in this Privacy Policy, Storage Whetstone acts as the data controller. This means we decide how and why your personal data is used and are responsible for ensuring that such use complies with applicable data protection law, including the General Data Protection Regulation.
This Privacy Policy covers all personal data we process about individuals who are Storage Whetstone customers in our area, visitors to our premises, users of our services, and individuals who communicate with us for enquiries, support, or complaints.
Types of Personal Data We Collect
We collect and process different categories of personal data, depending on your relationship with us and how you use our services. These categories may include:
Identification details, such as your full name, title, date of birth, and a form of identification provided for verification purposes, such as a passport or driving licence details, where required by law or for fraud prevention.
Contact details, such as your home or business address, billing address, and any other address you provide, as well as information related to your preferred communication methods.
Account and contract data, including customer account numbers, contract details, storage unit numbers or references, move-in and move-out dates, and related correspondence about your account.
Payment and billing information, such as payment history, partial payment card details where required for processing through our payment providers, bank account details for transfers or refunds, and invoicing records.
Usage and service information, including records of services you have requested or used, access logs for our storage facilities where applicable, and information about your interactions with our customer service team.
Technical data, such as device type, browser type and version, and general usage data about how you access any online tools or portals we provide, to the extent required for security and functionality.
Security and CCTV data, including video recordings and access control logs where we use surveillance and access systems at our facilities, in order to help protect customers, staff, and property.
Communications data, such as records of enquiries, complaints, feedback, and any correspondence we receive from you or send to you in relation to your account or our services.
How and Why We Use Your Personal Data
We use your personal data for the following purposes, relying on one or more lawful bases under the GDPR for each type of processing.
To enter into and perform a contract with you. This includes processing your data to set up and manage your Storage Whetstone account, verify your identity, provide storage and related services, process payments, manage access to our facilities, and handle enquiries or issues relating to your contract. The lawful basis is that processing is necessary for the performance of a contract or to take steps at your request prior to entering into a contract.
To comply with legal obligations. We may need to process and retain certain personal data to meet tax, accounting, anti money laundering, security, and other regulatory requirements. The lawful basis for such processing is compliance with a legal obligation to which we are subject.
For our legitimate interests. We use personal data to manage and improve our services and operations, to maintain the security of our facilities and systems, to prevent and detect fraud and abuse, to manage business records, and to pursue or defend legal claims. Where we rely on legitimate interests, we carefully balance these interests with your rights and freedoms and only process personal data in ways that you would reasonably expect.
With your consent. Where required by law, we may rely on your consent to send certain forms of marketing communication or to use optional cookies and similar technologies. You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Data Retention
We retain personal data only for as long as is necessary for the purposes described in this Privacy Policy, or as required by law. The relevant retention periods will depend on factors such as the type of data, the nature of our relationship with you, and any legal or regulatory obligations.
Customer account and contract data are generally kept for the duration of your relationship with Storage Whetstone and for a reasonable period thereafter, to handle queries, disputes, or legal claims and to comply with tax and accounting requirements.
Payment and billing records are retained in line with statutory financial record keeping obligations. Security and CCTV data are stored for a limited period, usually only long enough to investigate incidents, ensure safety, and comply with security processes, unless a longer retention period is required in connection with a specific incident or legal claim.
At the end of the applicable retention period, we will securely delete or anonymise your personal data, so that it can no longer be linked to you.
Data Processors and Third Party Access
In some cases, we engage carefully selected third party service providers to process personal data on our behalf in order to support our business operations and deliver our services. These third parties act as data processors and may provide services such as payment processing, customer relationship management systems, data storage and hosting, facility management tools, security and CCTV system maintenance, and professional advisory services.
Where we use data processors, we ensure that appropriate contractual and organisational safeguards are in place. These require processors to act only on our documented instructions, to implement suitable technical and organisational security measures, to maintain confidentiality, and to assist us in fulfilling our data protection obligations.
We may also share personal data with third parties acting as independent data controllers, such as regulators, law enforcement authorities, or professional advisers, when required by law or where it is necessary to protect our rights or the rights of our customers or staff.
International Transfers
Where personal data is transferred outside the United Kingdom or the European Economic Area, we take steps to ensure that an adequate level of protection is in place. This may include relying on an adequacy decision, implementing standard contractual clauses approved by relevant authorities, or using other lawful transfer mechanisms. Further information about international transfers and the safeguards used can be provided on request.
Your Data Protection Rights
Under the GDPR, you have a number of rights in relation to the personal data we hold about you. These rights apply to all Storage Whetstone customers in our area, subject to certain limitations and exemptions set out in data protection law.
Right of access. You have the right to request confirmation as to whether we process your personal data and, if so, to receive a copy of that data and certain related information.
Right to rectification. You have the right to ask us to correct inaccurate personal data or to complete incomplete data that we hold about you.
Right to erasure. In some circumstances, you may have the right to request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected and there is no legal reason for us to retain it.
Right to restriction of processing. You may request that we restrict the processing of your personal data in certain cases, such as while we are verifying its accuracy or assessing an objection you have raised.
Right to data portability. Where processing is based on your consent or on a contract and is carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, and machine readable format and to transmit it to another controller.
Right to object. You have the right to object to certain types of processing, including processing based on our legitimate interests and processing for direct marketing. Where you object on legitimate interest grounds, we will stop processing your data unless we can demonstrate compelling legitimate grounds which override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.
Right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. Withdrawal will not affect the lawfulness of processing based on consent before it was withdrawn.
You also have the right to lodge a complaint with a data protection supervisory authority if you believe that your data protection rights have been infringed. We encourage you to contact us first so that we can address any concerns directly.
Security of Your Personal Data
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are designed to ensure a level of security appropriate to the risks posed by our processing activities and the nature of the data involved, and they are reviewed regularly.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. Any updates will be effective when we publish the revised version. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
