Privacy Policy - Wimbledon Storage

Wimbledon Storage is committed to protecting the privacy and personal data of all customers in the area. This Privacy Policy explains how we collect, use, store, share, and protect personal information in a manner that is fair, lawful, and transparent. It applies to all Wimbledon Storage customers in area, including prospective customers, current customers, former customers, and individuals who interact with us in relation to storage services, billing, access arrangements, and account administration.

This Privacy Policy has been prepared in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It sets out the types of data we collect, the lawful bases on which we process it, how long we keep it, which categories of processors may handle it, and what rights individuals have in relation to their personal information.

1. Personal Data We Collect

We collect only the personal data necessary to provide our services, manage our business, and meet our legal and regulatory obligations. The categories of personal data we may collect include:

Identity details: name, title, date of birth, and identification information where required for security or verification purposes.
Contact details: postal address, email address, telephone number, and other communication details provided by you.
Account and service details: storage unit reference, booking information, rental dates, access permissions, payment status, and service preferences.
Payment information: billing details, bank account information, transaction records, and payment history. We do not normally store full card details where a secure payment provider is used.
Access and security information: entry logs, CCTV images where applicable, incident records, and key or code management information.
Communications: emails, messages, complaint records, call notes, and any other correspondence relating to your account or our services.
Technical and usage data: device information, IP address, and website interaction data if you interact with our digital systems.

We may also collect information from third parties, such as payment processors, identity verification providers, insurers, debt recovery providers, legal advisers, or public authorities where permitted by law. Where we receive information from third parties, we will use it only for the purposes explained in this policy.

2. How We Use Your Data

We use personal data for the following purposes:

to provide storage services and manage customer accounts;
to verify identity and prevent fraud;
to process bookings, payments, renewals, and cancellations;
to manage access to premises and storage units;
to communicate with you about your account, service updates, and notices;
to handle complaints, disputes, and insurance or incident matters;
to maintain security, including monitoring misuse or unauthorised access;
to comply with legal and regulatory obligations;
to manage business administration, including auditing, reporting, and record-keeping;
to establish, exercise, or defend legal claims.

We will not use your personal data in a way that is incompatible with the purposes described in this Privacy Policy unless required or permitted by law.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for each processing activity. Depending on the context, Wimbledon Storage relies on the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes managing bookings, payments, access rights, and customer support related to your storage agreement.

Legal Obligation

We process certain data where required to comply with legal obligations, including tax, accounting, fraud prevention, and record-keeping duties, as well as lawful requests from authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Examples include security monitoring, business administration, service improvement, debt recovery, and protection against unlawful activity.

Consent

In limited situations, we may rely on your consent, for example for certain optional communications or specific uses not covered by another lawful basis. Where we rely on consent, you have the right to withdraw it at any time.

Vital Interests

In rare cases, we may process personal data where necessary to protect someone’s vital interests, such as in an emergency affecting health or safety.

4. Data Sharing and Processors

We may share personal data with trusted third parties who act as processors or, in some cases, separate controllers. These parties may process your data only for specified purposes and under appropriate contractual safeguards. Categories of processors may include:

IT and cloud service providers: for hosting, data storage, security, and system maintenance.
Payment service providers: for handling payment transactions and billing processes.
Identity verification and fraud prevention providers: where verification or risk checks are necessary.
Customer service and communication platforms: for sending notices, reminders, and service-related messages.
Accountants, auditors, and professional advisers: where needed for financial, legal, or compliance support.
Insurance providers and claims handlers: where incident reporting or claims management is involved.
Debt recovery or legal service providers: where unpaid balances or disputes require action.
Security and monitoring providers: including CCTV maintenance or access control support, where applicable.

We may also disclose personal data to public authorities, regulators, courts, law enforcement agencies, or other parties where disclosure is required or permitted by law.

Where processors act on our behalf, they are required to protect personal data, use it only under our instructions, and implement appropriate technical and organisational measures to safeguard it.

5. Retention of Personal Data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, reporting, and security requirements. Retention periods vary depending on the type of information and the reason for processing.

In general:

customer account records are retained for the duration of the service relationship and for a reasonable period afterwards;
payment and accounting records are retained for the period required by tax and financial law;
security logs, access records, and incident information are retained for operational and safety purposes, then securely deleted or anonymised;
communications and complaint records are kept as long as needed to resolve the issue and for evidential or audit purposes;
where legal claims are possible, records may be retained for the limitation period applicable to such claims.

When personal data is no longer required, we will securely delete, anonymise, or archive it in accordance with our retention procedures.

6. Data Security

We take appropriate technical and organisational measures to protect personal data from unauthorised access, alteration, disclosure, loss, or destruction. These measures may include access controls, encryption, secure storage, staff training, audit logs, and restricted permissions. While no system can be guaranteed as completely secure, we continuously review and improve our safeguards to maintain a high standard of protection.

7. International Transfers

If any personal data is transferred outside the United Kingdom or European Economic Area, we will ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms. Such transfers will only occur where necessary and with suitable protection for your rights.

8. Your Rights

As a data subject, you have several rights under data protection law. These rights may be subject to certain conditions and exemptions.

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete data.
Right to erasure: to request deletion of your data in certain circumstances.
Right to restriction: to ask us to limit the processing of your data in certain situations.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to data portability: to receive certain data in a structured, commonly used format and, where technically feasible, have it transmitted to another controller.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
Right to complain: to raise concerns with the UK Information Commissioner’s Office if you believe your data rights have been infringed.

We will respond to valid requests within the time limits required by law and may ask for information to verify your identity before acting on your request.

9. Children’s Data

Our services are not directed at children, and we do not knowingly collect personal data from children except where necessary in connection with a customer relationship and in compliance with the law. If we become aware that we have collected such data without a lawful basis, we will take appropriate steps to delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our business operations. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically so they remain informed about how their personal data is handled.

11. Scope of This Policy

This Privacy Policy applies to all Wimbledon Storage customers in area and to all personal data processed by Wimbledon Storage in connection with our storage services. By using our services, you acknowledge that you have read and understood this policy and the ways in which we process personal data in accordance with applicable law.

Wimbledon Storage values privacy, accountability, and trust. We process personal data carefully and responsibly, with respect for the rights of every customer.