Privacy Policy - Upton Storage

Last updated: This Privacy Policy explains how Upton Storage collects, uses, stores, shares, and protects personal data. It applies to all Upton Storage customers in the area, including prospective customers, current customers, former customers, visitors to our facilities, and anyone who interacts with us in connection with our storage services.

1. Introduction

Upton Storage is committed to protecting personal data and respecting privacy rights. We process personal information in line with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 where relevant. This policy is designed to explain what data we collect, why we collect it, how long we keep it, who we share it with, and what rights you have.

By using our services, you acknowledge that we may process your personal data as described in this policy. We only collect and use information where we have a lawful basis to do so, and we aim to keep all data accurate, secure, and limited to what is necessary.

2. Data We Collect

We may collect and process the following categories of personal data:

Identity data: name, date of birth, and information used to verify identity.
Contact data: address, email address, and telephone number.
Account and service data: account details, storage unit information, rental dates, payment history, and service preferences.
Financial data: billing details, payment records, and limited transaction information needed to manage payments.
Access and security data: entry logs, CCTV footage, gate access records, and incident reports where required for safety and security.
Communications data: emails, messages, notes from calls, and any information you provide when making an enquiry or complaint.
Technical data: device and usage information collected when you interact with digital systems we use, where applicable.

We generally do not intentionally collect special category data unless you choose to provide it or it is necessary in exceptional circumstances, such as when required for legal claims or health and safety reasons. If such data is processed, we do so only with a valid legal condition under data protection law.

3. How We Collect Data

We collect personal data directly from you when you:

complete forms or rental agreements;
contact us by phone, email, or in person;
make payments or set up account arrangements;
visit our site or use our storage facilities;
report a problem, damage, loss, or security issue.

We may also receive data from third parties where lawful and appropriate, for example identity verification providers, payment processors, law enforcement authorities, or professional advisers. In some cases, data may be collected automatically through security systems, access control systems, or CCTV used to protect our premises, staff, customers, and property.

4. Lawful Basis for Processing

We only process personal data when we have a lawful basis under data protection law. The main lawful bases we rely on are:

4.1 Contract

We process data when it is necessary to enter into or perform a contract with you. This includes setting up your storage account, managing access to your unit, handling billing, and providing customer support related to the services you have requested.

4.2 Legal Obligation

We may process personal data where we must comply with legal or regulatory requirements, including accounting obligations, fraud prevention, record-keeping, and responding to lawful requests from public authorities.

4.3 Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided your rights and freedoms do not override those interests. This may include protecting our facilities, preventing theft or misuse, maintaining business records, improving service quality, and managing disputes or claims.

Where we rely on legitimate interests, we consider the nature of the data, the impact on you, and whether the processing is proportionate. We do not use this basis in a way that would be unfair or unexpected.

4.4 Consent

In limited circumstances, we may rely on your consent, for example for certain optional communications or uses of data not covered by other lawful bases. Where consent is used, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. How We Use Personal Data

We use personal data for the following purposes:

providing and managing storage services;
processing payments and issuing invoices or receipts;
verifying identity and protecting against fraud;
operating security systems and controlling access to the premises;
responding to enquiries, complaints, and service requests;
maintaining internal records and business administration;
meeting legal, accounting, and regulatory obligations;
defending legal claims and handling insurance matters;
improving operations, safety, and customer experience.

We keep our processing limited to what is necessary for these purposes and use data minimisation principles to avoid collecting excessive information.

6. Data Sharing and Processors

We may share personal data with trusted third parties who act as processors or independent controllers, depending on the circumstances. These may include:

Payment service providers that handle secure payment processing;
IT and cloud service providers that store or support business systems;
Security and CCTV service providers that help us maintain site safety;
Identity verification providers where checks are required;
Professional advisers such as accountants, auditors, insurers, and legal advisers;
Authorities and regulators where disclosure is required by law or necessary to protect rights and property.

Where a third party acts as a processor, they are only allowed to process data on our instructions and must implement appropriate security measures. We use written agreements to ensure processors handle personal data securely and lawfully. We do not sell your personal data.

Some service providers may store or process data outside the UK. Where this happens, we take steps to ensure appropriate safeguards are in place, such as approved contractual protections or equivalent transfer mechanisms required by law.

7. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, and in line with legal, accounting, operational, and security requirements. Retention periods vary depending on the type of data and the reason for processing.

Customer account and contract records are generally retained for the period of the contract and for a reasonable period afterwards to manage claims, disputes, and audit requirements.
Financial records are retained for periods required by tax and accounting laws.
Security records, including CCTV and access logs, are retained only as long as needed for safety, incident investigation, or legal purposes.
Enquiry and correspondence records are retained for the time needed to resolve matters and maintain service records.

When data is no longer needed, we will delete it securely or anonymise it so that it can no longer identify you. Retention is reviewed periodically to ensure we do not keep information longer than necessary.

8. Your Rights

Under data protection law, you may have the following rights in relation to your personal data:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of your data in certain circumstances.
Right to restrict processing: to ask us to limit how we use your data in certain cases.
Right to object: to object to processing based on legitimate interests or direct marketing where applicable.
Right to data portability: to receive certain data in a structured, commonly used format where processing is based on consent or contract and carried out by automated means.
Right to withdraw consent: where we rely on consent, you may withdraw it at any time.

These rights are not absolute and may be subject to legal limits. If you make a request, we may ask for information to verify your identity before responding. We aim to respond within the timeframes required by law.

9. Security of Personal Data

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, restricted permissions, secure storage, staff training, and monitoring of security systems. While no system is completely secure, we take reasonable steps to protect the information entrusted to us.

10. Data Accuracy

We take reasonable steps to ensure personal data is accurate and up to date. We encourage you to tell us if your details change so that we can keep our records current. Inaccurate or incomplete data may affect our ability to provide services or meet legal obligations.

11. Complaints and Further Information

If you have concerns about how your personal data is handled, you have the right to raise those concerns with the relevant data protection authority. You may also ask us to review your concern and provide clarification about our data practices. We encourage customers to raise questions early so that we can address them promptly and fairly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, operational practices, or service arrangements. Any updated version will apply from the date it is published or otherwise communicated. We recommend reviewing this policy periodically to stay informed about how we protect personal data.

In summary: Upton Storage processes personal data lawfully, fairly, and transparently; uses it only for legitimate business and legal purposes; keeps it only as long as needed; works with trusted processors under contract; and respects your rights under data protection law.