Privacy Policy - Eelpieisland Storage
This Privacy Policy explains how Eelpieisland Storage collects, uses, stores, shares, and protects personal data when providing storage services. It applies to all Eelpieisland Storage customers in the area, including individuals and businesses that use our facilities, make enquiries, sign agreements, access units, or otherwise interact with our services. We are committed to handling personal data in accordance with applicable data protection law, including the UK GDPR and the Data Protection Act 2018.
1. Who We Are
Eelpieisland Storage is the data controller for the personal data described in this Policy. This means we decide how and why your personal data is processed in connection with our storage services, site operations, security measures, account administration, and legal compliance obligations.
2. Personal Data We Collect
We collect only the personal data necessary to operate our storage services, manage our relationship with customers, and meet legal and security requirements. The types of data we may collect include:
- Identity details: name, date of birth, and, where relevant, company or business name.
- Contact details: address, email address, phone number, and billing address.
- Account and contract information: storage unit number, agreement details, payment status, and service preferences.
- Financial information: payment card details or bank account details where needed to process payments. We do not intentionally store full card security codes.
- Access and security data: entry logs, key or access code records, CCTV images, alarm records, and incident reports.
- Communications: correspondence with us by email, telephone, text message, or written note.
- Usage and operational data: details relating to unit use, site visits, damage claims, complaints, or service requests.
We generally do not seek to collect special category data. If you choose to provide such information to us, for example in a complaint or support request, we will only process it where we have a lawful basis and appropriate safeguards.
3. How We Collect Your Data
We collect personal data directly from you when you complete forms, enter into a storage agreement, make a payment, contact us, or use our facilities. We may also receive data from third parties where necessary, such as payment providers, insurers, debt recovery agents, delivery partners, or public authorities. In addition, our security systems may automatically collect data such as access records and CCTV footage for safety and site protection purposes.
4. Purposes of Processing and Lawful Basis
We only process personal data when we have a lawful basis under data protection law. The main purposes and lawful bases are set out below.
Contract
We process personal data where it is necessary to enter into or perform a storage agreement with you. This includes setting up your account, managing access to your unit, taking payments, issuing invoices, and providing customer support. Without this data, we may be unable to provide our services.
Legal obligation
We process personal data where needed to comply with legal duties, including accounting and tax requirements, fraud prevention, safety obligations, and lawful requests from regulators or law enforcement. We may also retain records to comply with statutory limitation periods and other legal requirements.
Legitimate interests
We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include protecting property, preventing unauthorised access, maintaining site security, investigating incidents, recovering unpaid amounts, improving services, and managing business operations. We carry out assessments to ensure these interests are balanced fairly against your privacy rights.
Consent
In limited situations, we may rely on your consent, for example for certain optional communications or non-essential uses of data. Where we do so, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
5. How We Use Personal Data
We use personal data to:
- create and administer storage accounts;
- verify identity where required;
- process payments and refunds;
- issue notices, reminders, and service communications;
- manage access control and site security;
- investigate incidents, disputes, or suspected misuse;
- meet legal, regulatory, accounting, and insurance obligations;
- maintain records, improve service quality, and support business continuity.
We do not use personal data for automated decision-making that produces legal or similarly significant effects without appropriate safeguards. If this position changes, we will update this Policy and provide the information required by law.
6. Sharing Personal Data and Processors
We may share personal data with trusted third parties who process data on our behalf, known as processors. These processors only act on our instructions and are contractually required to protect personal data. Typical processors may include:
- payment service providers;
- accounting and bookkeeping providers;
- IT hosting, cloud storage, and software providers;
- security monitoring and CCTV service providers;
- maintenance and facility management contractors;
- debt collection or credit management providers;
- legal, insurance, and professional advisers where necessary.
We may also disclose personal data where required by law, court order, or official request, or where necessary to protect our rights, customers, staff, property, or the public. Where processors or other third parties act outside the UK, we will ensure appropriate data transfer safeguards are in place.
7. Data Retention
We keep personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law. The retention period depends on the type of data and the reason for processing.
- Contract and account records: retained for the duration of the agreement and for a further period to address disputes, tax, accounting, and legal obligations.
- Payment and financial records: retained in line with accounting and tax requirements.
- Access logs and security records: retained for a period appropriate to security needs, incident investigation, and operational review.
- CCTV footage: retained for a limited period unless needed for investigation, insurance, or law enforcement purposes.
- Correspondence and complaints: retained as long as necessary to resolve the matter and keep proper records.
When data is no longer needed, we will delete it securely or anonymise it so that it can no longer identify you. Retention schedules are reviewed regularly to ensure data is not kept longer than necessary.
8. Data Security
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include restricted access, staff training, encryption, secure storage, backup controls, access logging, and physical security measures at our sites. While no system can be guaranteed completely secure, we work to reduce risk and respond promptly to any suspected breach.
9. Your Rights
Under data protection law, you have a number of rights in relation to your personal data. These rights may be subject to conditions or exemptions, but we will always consider them carefully. Your rights include:
- Right of access: you may request a copy of the personal data we hold about you.
- Right to rectification: you may ask us to correct inaccurate or incomplete data.
- Right to erasure: you may ask us to delete your data where there is a lawful basis to do so.
- Right to restriction: you may ask us to limit how we use your data in certain circumstances.
- Right to object: you may object to processing based on legitimate interests or direct marketing.
- Right to data portability: you may request certain data in a structured, commonly used format where applicable.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
If you wish to exercise any of these rights, we will respond in accordance with legal requirements. We may need to verify your identity before acting on your request.
10. Marketing Communications
We may send service-related messages that are necessary for the operation of your storage account, such as payment reminders, notice periods, or security updates. Where we send optional marketing communications, we will do so only where permitted by law and you may opt out at any time. We will not sell your personal data to third parties.
11. Cookies and Similar Technologies
If we use digital services that employ cookies or similar technologies, these may be used for security, functionality, and performance purposes. Any such use will be limited to what is necessary or otherwise consented to in line with applicable law. This Policy does not provide website-specific details, and any additional notices will be provided separately where required.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in law, technology, or our services. Any updated version will apply from the date it is published or otherwise communicated to customers. We encourage customers to review it periodically.
13. Complaints and Further Information
If you have concerns about how your personal data is handled, you may raise them with us so that we can review and address the issue. You also have the right to lodge a complaint with the relevant data protection authority if you believe your rights have been infringed. We encourage customers to contact us first so we can try to resolve concerns promptly and fairly.
This Privacy Policy is intended to provide clear, lawful, and transparent information about how Eelpieisland Storage handles personal data. By using our services, customers in the area acknowledge that their data may be processed in line with this Policy and applicable law.