Privacy Policy - Peckham Storage

Peckham Storage is committed to protecting the privacy and personal data of all customers. This Privacy Policy explains how we collect, use, store, share, and protect personal information in connection with our storage services. It applies to all Peckham Storage customers in the area, including individuals and businesses who use our services, enquire about our services, or otherwise interact with us.

1. Who we are

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Peckham Storage is the data controller for the personal data described in this policy. This means we determine the purposes and means of processing your personal information when you use our services or communicate with us.

2. Personal data we collect

We collect only the information that is necessary for us to provide storage services, manage our customer relationships, meet legal obligations, and operate securely. The categories of personal data we may collect include:

Identity information, such as your name, date of birth, and identification details where required for verification.
Contact information, such as address, email address, and telephone number.
Account and service information, such as customer reference numbers, storage unit details, booking records, move-in and move-out dates, and communication preferences.
Payment information, such as billing details and payment records. We do not normally store full card details if payments are processed by secure payment providers.
Security information, such as CCTV footage, access logs, entry records, alarm records, and vehicle registration details where applicable.
Correspondence and support information, including emails, messages, complaints, claims, and notes from conversations with you.
Technical information, such as IP address, device information, and usage data if you interact with our digital services.

We may also collect limited additional information where necessary to assess risk, prevent fraud, comply with safety obligations, or verify identity. We do not intentionally collect special category data unless it is strictly required and permitted by law.

3. How we use personal data

We use personal data for the following purposes:

To register customers and manage storage agreements.
To verify identity and prevent unauthorised access, fraud, or misuse.
To process payments, invoices, refunds, and account administration.
To provide customer support and respond to enquiries or complaints.
To maintain safety and security at our storage sites.
To monitor access, investigate incidents, and protect property.
To meet legal, regulatory, tax, insurance, and record-keeping obligations.
To manage business operations, audits, reporting, and service improvements.

We only use personal data in ways that are compatible with the purposes described above. Where required, we will seek additional permission or rely on another lawful basis before using your data for a new purpose.

4. Lawful basis for processing

Under data protection law, we must have a valid lawful basis to process personal data. Depending on the situation, we rely on one or more of the following lawful bases:

Contract — to enter into and perform our storage agreement with you, including account setup, billing, access management, and service delivery.
Legal obligation — to comply with laws and regulations, including tax, accounting, health and safety, fraud prevention, and lawful requests from authorities.
Legitimate interests — to operate and secure our business, prevent crime, improve services, enforce policies, and protect customers, staff, and property, provided our interests do not override your rights and freedoms.
Consent — in limited circumstances, such as when we need your consent for optional marketing or other non-essential processing. You may withdraw consent at any time where processing is based on consent.

Where we process special category data or information relating to criminal offences, we will do so only where legally permitted and subject to appropriate safeguards.

5. Sharing personal data and processors

We may share personal data with trusted third parties where this is necessary to operate our business and provide services. These third parties act as either independent controllers or processors acting on our instructions. Processors may include:

Payment service providers, for secure payment processing and reconciliation.
IT and cloud service providers, for secure data storage, software hosting, backup, and system maintenance.
Security providers, including CCTV, alarm, and access control system suppliers.
Professional advisers, such as accountants, auditors, insurers, legal advisers, and compliance consultants.
Maintenance and operational contractors, where access to data is needed to support security or facility management.
Debt recovery or credit control providers, where necessary to recover unpaid balances lawfully.

All processors are required to protect personal data, use it only for specified purposes, and implement appropriate technical and organisational security measures. We do not sell personal data. We may disclose information to law enforcement, regulators, courts, or other authorities where required or permitted by law.

6. International transfers

Where service providers process personal data outside the United Kingdom, we will ensure suitable safeguards are in place, such as adequacy regulations, standard contractual clauses, or equivalent approved mechanisms. These safeguards are intended to provide an adequate level of protection for your data.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including the purposes of satisfying legal, accounting, insurance, and reporting requirements. Retention periods depend on the type of information and the reason for holding it. In general:

Customer account and contract records are kept for the duration of the relationship and for a period afterward to handle disputes, claims, or legal obligations.
Payment and accounting records are kept for the periods required by tax and financial law.
Security records, including CCTV and access logs, are kept only as long as necessary for safety, incident management, and crime prevention.
Enquiry and correspondence records are retained for as long as needed to deal with the matter and to maintain business records.

When data is no longer required, we will securely delete, anonymise, or destroy it. If there is a legal reason to keep certain information longer, we will retain it only for that specific purpose.

8. Security of personal data

We use appropriate technical and organisational measures to protect personal data from unauthorised access, loss, alteration, disclosure, or destruction. These measures may include access restrictions, staff confidentiality obligations, system monitoring, encryption, secure storage, and regular review of our processes. While no system can be guaranteed to be completely secure, we take data protection seriously and continuously assess our controls.

9. Your rights

Subject to legal limits and exemptions, you have the following rights regarding your personal data:

Right of access — to obtain confirmation of whether we process your data and to receive a copy of it.
Right to rectification — to correct inaccurate or incomplete information.
Right to erasure — to request deletion of your data in certain circumstances.
Right to restriction — to ask us to limit how we use your data in certain cases.
Right to object — to object to processing based on legitimate interests and to direct marketing.
Right to data portability — to receive certain information in a portable format where processing is based on contract or consent and carried out by automated means.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we may need to verify your identity before acting on your request. We will respond within the timeframes required by data protection law. If we are unable to comply with a request, we will explain the reason where permitted.

10. Marketing preferences

We may send service-related communications that are necessary for the operation of your account, such as notices about your storage unit, billing, or policy updates. Where we send optional marketing communications, we will do so only in accordance with applicable law. You may opt out of marketing at any time, and we will respect your preferences.

11. Children

Our storage services are not directed at children, and we do not knowingly collect personal data from minors except where this is necessary in connection with a lawful customer relationship and appropriate safeguards are in place. If we become aware that we have collected data from a child without proper authorisation, we will take steps to delete it where required.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or operational practices. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to stay informed about how we protect personal data.

13. Summary of our approach

Peckham Storage processes personal data fairly, lawfully, and transparently. We collect only what we need, use it for clear and legitimate purposes, retain it for appropriate periods, and share it only with trusted processors or where required by law. We also respect and support your data protection rights. This policy applies to all Peckham Storage customers in the area and forms part of our commitment to privacy, security, and compliance.