Privacy Policy - Hollandpark Storage

Effective date: This Privacy Policy applies to all Hollandpark Storage customers in the area and explains how we collect, use, store, share, and protect personal data in connection with our storage services.

Hollandpark Storage is committed to handling personal data in a lawful, fair, and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and any other applicable privacy laws. This policy applies to all individuals who enquire about, purchase, or use our storage services, including current, former, and prospective customers.

1. Personal Data We Collect

We may collect personal data directly from you, from your use of our services, and from third parties where lawful and appropriate. The categories of personal data we collect may include:

Identity data: your name, date of birth, and identification details where required for verification.
Contact data: your address, email address, and telephone number.
Account and service data: account details, storage unit information, booking information, payment status, and service preferences.
Financial data: payment card details, bank account details, billing records, and transaction history.
Verification data: documents or information used to confirm your identity, address, or authority to act on behalf of another person.
Security and access data: CCTV images, access logs, visitor records, and site entry information where applicable.
Communications data: records of correspondence, enquiries, complaints, and customer support interactions.
Technical data: IP address, device information, browser type, and limited usage data if you interact with our digital systems.

We only collect personal data that is necessary for the purposes described in this policy. We do not intentionally collect special category data unless you choose to provide it or it becomes necessary for a specific legal or safeguarding reason.

2. How We Use Your Personal Data

We use personal data to operate our storage business, manage customer relationships, maintain site security, and comply with legal obligations. In particular, we may process your data to:

set up and manage your storage account;
verify your identity and prevent fraud;
process payments, invoices, refunds, and account administration;
allocate and manage storage units;
communicate with you about your account or service use;
respond to enquiries, complaints, and disputes;
monitor access to premises and protect customers, staff, and property;
meet legal, tax, insurance, and regulatory obligations;
enforce our terms and conditions;
improve our services, systems, and customer experience;
establish, exercise, or defend legal claims.

Where required, we will ensure that any additional use of your data is compatible with the original purpose or based on a separate lawful basis.

3. Lawful Basis for Processing

We only process personal data when we have a valid lawful basis under the UK GDPR. Depending on the context, our lawful bases may include:

Contract: processing is necessary to enter into or perform our storage agreement with you, including account management, billing, and service delivery.
Legal obligation: processing is necessary to comply with laws and regulations, including tax, accounting, consumer, and security requirements.
Legitimate interests: processing is necessary for our legitimate business interests, such as maintaining security, preventing fraud, improving services, and managing customer communications, provided these interests do not override your rights and freedoms.
Consent: where we rely on your consent for a specific activity, such as optional marketing or certain types of electronic communication, you may withdraw it at any time.

When we process special category data, criminal offence data, or similar sensitive information, we will only do so where an additional condition under data protection law applies.

4. Sharing Your Data and Processors

We may share your personal data with trusted third parties when necessary for the operation of our business, the delivery of services, or compliance with law. These third parties may act as data processors or independent controllers depending on the relationship and purpose.

Our processors may include:

payment service providers that process transactions securely;
IT hosting, software, and cloud service providers that support our systems;
customer management and communications platforms;
security service providers, including CCTV maintenance and monitoring providers where used;
professional advisers such as accountants, auditors, insurers, and legal advisers;
maintenance, cleaning, and facilities contractors where access to data is necessary for service delivery;
debt recovery, dispute resolution, or enforcement partners, where lawful and proportionate.

We require processors to act only on our instructions, keep personal data secure, and comply with relevant data protection obligations. We do not sell your personal data.

We may also disclose data to public authorities, regulators, courts, or law enforcement bodies where required by law or where disclosure is necessary to protect our rights, our customers, or the public.

5. International Transfers

Where personal data is transferred outside the UK, we will take appropriate safeguards to protect it. This may include using adequacy regulations, standard contractual clauses, or other approved transfer mechanisms. We ensure that any international transfer is made only where appropriate protections are in place.

6. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, tax, and reporting requirements. Retention periods depend on the type of data and the reason for processing.

Customer and contract records: retained for the duration of the relationship and for a period after it ends to manage claims, disputes, and legal obligations.
Payment and accounting records: retained in line with financial and tax requirements.
Security records and access logs: retained only for as long as necessary for site security, incident handling, and operational needs.
Communications and support records: retained for a reasonable period to manage enquiries, complaints, and service history.

When personal data is no longer needed, we will securely delete, destroy, or anonymise it. If retention is required due to legal proceedings, regulatory investigations, or similar reasons, we may keep the relevant data for longer.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, and regular review of our procedures.

While no system can be guaranteed completely secure, we aim to maintain safeguards that are proportionate to the risks associated with the data we process. We also limit access to personal data to those who need it for legitimate business purposes.

8. Your Rights

Under data protection law, you have a number of rights in relation to your personal data. These rights may be subject to conditions, exemptions, or limitations depending on the circumstances.

Right of access: you can request a copy of the personal data we hold about you.
Right to rectification: you can ask us to correct inaccurate or incomplete data.
Right to erasure: you can ask us to delete your data where it is no longer needed or where deletion is otherwise permitted.
Right to restriction: you can ask us to limit how we use your data in certain situations.
Right to data portability: where applicable, you can request that we provide your data in a structured, commonly used format.
Right to object: you can object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where we rely on consent, you may withdraw it at any time.

You also have the right to be informed about how your data is used and to raise concerns with the relevant supervisory authority if you believe your rights have been infringed.

9. Cookies and Similar Technologies

Where digital systems or online tools are used, we may employ limited cookies or similar technologies to support functionality, security, and basic analytics. These technologies may collect technical data such as device and browser details. Where consent is required, we will obtain it before placing non-essential cookies.

10. Children

Our services are intended for adults and business users where applicable. We do not knowingly collect personal data from children except where it is necessary and lawful in connection with our services or legal obligations.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, business practices, or service arrangements. Any updated version will apply from the effective date shown or from the date it is published, as appropriate.

Final Statement

Hollandpark Storage is committed to protecting privacy and treating personal data responsibly. If you are a customer in the area, this Privacy Policy explains the main ways we collect and use your data, the lawful bases we rely on, how long we keep it, the types of processors we use, and the rights available to you under data protection law. We aim to be transparent, secure, and respectful in all our data handling practices.