Privacy Policy - Goodmayes Storage

This Privacy Policy explains how Goodmayes Storage collects, uses, stores, shares, and protects personal data relating to customers, prospective customers, website visitors, and other individuals whose information we process in connection with our storage services. This policy applies to all Goodmayes Storage customers in the area and to anyone who interacts with us in relation to our services.

1. Who We Are

Goodmayes Storage provides storage-related services to individuals and businesses. In the course of operating our services, we act as a data controller for the personal data we determine the purposes and means of processing. This means we are responsible for ensuring that personal data is handled in accordance with the UK GDPR and the Data Protection Act 2018.

2. Personal Data We Collect

We collect and process personal data that is necessary to provide our services, manage our relationship with customers, maintain security, and meet legal obligations. The categories of information we may collect include:

Identity information such as name, title, and date of birth where needed for verification.
Contact details such as postal address, email address, and telephone number.
Account and contract information such as booking details, customer reference numbers, service preferences, and communication records.
Payment information such as billing details and transaction records. Payment card details are typically handled by secure payment processors rather than stored by us in full.
Security and access information such as CCTV images, entry logs, key or access records, and incident reports where applicable.
Correspondence and complaints including emails, call notes, and records of enquiries, disputes, or claims.
Technical information such as IP address, device information, and usage data if you interact with our digital systems.

We generally collect personal data directly from you when you make an enquiry, sign a contract, make a payment, or contact us. We may also receive information from third parties such as payment providers, identity verification providers, insurers, or legal and regulatory bodies where this is permitted by law.

3. How We Use Your Data

We only use personal data where we have a lawful basis to do so. The main purposes for which we process personal data are:

to provide and manage storage services;
to set up and administer customer accounts and bookings;
to verify identity and prevent fraud;
to process payments, refunds, and invoices;
to communicate with customers about their accounts, service updates, and operational matters;
to maintain the safety and security of our premises, property, staff, and customers;
to handle complaints, disputes, and claims;
to comply with legal, tax, accounting, and regulatory obligations;
to defend or establish legal rights; and
to improve our services, systems, and customer experience.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis before processing personal data. Depending on the circumstances, Goodmayes Storage may rely on one or more of the following lawful bases:

Performance of a Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes taking steps at your request before entering into a contract, managing your storage arrangement, collecting payments, and providing customer support linked to the service.

Legal Obligation

We may process personal data to comply with legal obligations, such as tax, accounting, record-keeping, fraud prevention, and responses to lawful requests from authorities.

Legitimate Interests

We may process data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Examples include protecting our premises, preventing misuse of services, improving our operations, managing disputes, and maintaining business records. Where we rely on legitimate interests, we assess the impact on individuals and take steps to limit any unnecessary privacy intrusion.

Consent

In limited cases, we may rely on your consent, for example for certain optional marketing communications or specific types of processing where consent is the appropriate legal basis. Where we rely on consent, you may withdraw it at any time.

5. Sharing and Processors

We do not sell personal data. However, we may share personal data with trusted third parties who help us operate our business. These third parties act as processors or independent controllers depending on the service they provide.

Examples of processors and service providers may include:

payment service providers;
IT and cloud hosting providers;
security monitoring and CCTV service providers;
customer communication platforms;
accounting and invoicing providers;
legal, insurance, or claims handling advisers acting on our behalf;
identity verification and fraud prevention services.

Where we use processors, we require them to process personal data only on our instructions, to keep it secure, and to comply with applicable data protection law. We may also share data with law enforcement, regulators, courts, or other public authorities when required or permitted by law.

6. International Transfers

Some processors may store or access data outside the UK. Where this happens, we ensure appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms designed to protect personal data.

7. Retention of Personal Data

We keep personal data only for as long as necessary for the purposes for which it was collected, including satisfying legal, accounting, reporting, and insurance requirements. Retention periods may vary depending on the type of data and the reason it is held.

In general, we consider the following principles:

Contract records are retained for the duration of the customer relationship and for a reasonable period afterwards in case of disputes or legal claims.
Financial and tax records are usually retained for the period required by applicable law.
Security records such as CCTV footage are retained for a limited period unless needed for investigation, safety, or legal proceedings.
Enquiry records may be retained for a shorter period if no service is taken up.

When personal data is no longer required, we will securely delete, anonymise, or archive it in accordance with our internal retention procedures.

8. Security of Personal Data

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, misuse, alteration, or disclosure. These measures may include access controls, staff training, secure storage, data minimisation, and restricted access to sensitive records. While no system can be guaranteed completely secure, we work to apply safeguards appropriate to the nature of the information we process.

9. Your Rights

Depending on the legal basis for processing and your location, you may have the following rights under data protection law:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete information.
Right to erasure – to ask us to delete your personal data in certain circumstances.
Right to restriction – to ask us to limit how we use your data in certain circumstances.
Right to data portability – to request transfer of certain data to you or another organisation in a structured format.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

These rights are not absolute and may be subject to conditions or exemptions under the law. If we cannot comply fully with a request, we will explain the reasons where appropriate.

10. Automated Decision-Making

We do not normally use automated decision-making that produces legal or similarly significant effects on individuals. If this position changes, we will update this policy and provide appropriate information about the logic involved, the significance of the processing, and your available rights.

11. Marketing

We may send service-related communications that are necessary for the administration of your account or storage arrangement. If we send optional marketing communications, we will do so only where permitted by law and, where required, with your consent. You can opt out of marketing communications at any time using the method described in the communication or by contacting us through the channels we provide elsewhere.

12. Children

Our services are not intended for children acting on their own behalf. We do not knowingly collect personal data from children except where a parent, guardian, or authorised adult provides it in connection with a storage arrangement or related service.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or operational practices. Any revised version will apply from the date it is made available. We encourage customers to review this policy periodically so they remain aware of how their data is handled.

14. Summary of Our Commitments

Goodmayes Storage is committed to processing personal data fairly, lawfully, and transparently. We collect only the information needed to deliver our storage services, keep data for no longer than necessary, use trusted processors under proper safeguards, and respect the rights of individuals whose data we handle. Your privacy matters to us, and we aim to process personal data in a way that is secure, proportionate, and consistent with data protection law.