Storage Millbank Privacy Policy
This Privacy Policy explains how Storage Millbank collects, uses, stores and protects personal data relating to our customers and prospective customers within our service area. It describes the types of personal data we process, the purposes and lawful bases for processing, how long we keep your information, the use of third party processors, and your rights under the UK General Data Protection Regulation and related data protection laws.
Scope of this Privacy Policy
This Privacy Policy applies to all Storage Millbank customers, including individuals renting storage units, authorised users of those units, and any person who contacts us or uses our services in our operating area. By using our services, entering into a contract with us, or otherwise providing your personal data, you acknowledge that you have read and understood this Privacy Policy.
Personal Data We Collect
Storage Millbank collects and processes different categories of personal data depending on how you interact with us. The main categories include:
Identification and contact details such as full name, postal address, billing address, proof of identity, proof of address, and other information necessary to verify your identity and set up your account.
Contact and account information such as email address, communication preferences, and details relating to your customer account, including unit number, contract details and correspondence history.
Payment and transaction data such as payment method details, billing history, invoice amounts, payment status and records of refunds or arrears. We do not store full payment card details where a third party payment processor is used.
Access and security information such as access codes, key or fob references, time and date logs of entry to and exit from the facility where access control systems are in place, and any records required for site security and safety.
Technical data such as IP address, device information and basic usage data when you visit our website or use online customer tools, to help us operate and secure our online services.
Communication records including email communications, letters, notes of telephone calls and any complaints or enquiries you submit to us.
Purposes and Lawful Bases for Processing
We process your personal data only where we have a lawful basis under data protection law. The main purposes and lawful bases are:
To provide storage services and manage your contract. This includes setting up your account, providing access to your storage unit, managing payments, handling renewals and terminations, and communicating with you about your contract. The lawful basis is performance of a contract or taking steps at your request prior to entering into a contract.
To meet legal and regulatory obligations. We may process and retain certain data to comply with tax, accounting, security, health and safety and other legal obligations. The lawful basis is compliance with a legal obligation.
To protect our legitimate interests. We may use your data to maintain the security of our premises, prevent and detect fraud, protect our property and business interests, manage disputes, and improve our services. The lawful basis is our legitimate interests, balanced against your rights and freedoms.
To communicate with you about our services. We may send you service updates, operational notices and important information about your use of our facility, which are necessary for the performance of the contract. For certain types of marketing communications, where required by law, we will rely on your consent or, where appropriate, on our legitimate interests with an easy opportunity for you to opt out.
To respond to your enquiries. When you contact us with questions, requests or complaints, we use your personal data to respond and keep appropriate records. The lawful basis is performance of a contract, taking steps at your request, or our legitimate interests in ensuring good customer service.
Data Retention
Storage Millbank will keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting or reporting requirements. We apply the following general retention principles:
Customer contract records, key identification data and billing information are typically retained for a period necessary to administer the contract and for a number of years after the relationship ends, in line with legal limitation periods and tax and accounting rules.
Access logs and security related data are retained for a period required to ensure facility security, investigate incidents and comply with any applicable regulations, after which they are securely deleted or anonymised.
Enquiry and complaint records are usually retained for a period necessary to resolve the matter and for internal reporting and audit purposes.
Where personal data is no longer required for the original purpose and there is no legal requirement to keep it longer, we will either delete it securely or anonymise it so that it can no longer be linked to an identifiable individual.
Data Processors and Sharing of Personal Data
We may share your personal data with carefully selected third parties who act as data processors on our behalf. These processors are engaged only to the extent necessary to provide our services and must act in accordance with our written instructions and applicable data protection law.
Typical categories of processors and recipients include:
Payment service providers who process payments, handle direct debits or card transactions and manage payment security.
IT and system support providers who host or support our customer management systems, access control systems, website and email services.
Security and maintenance providers who support our facility access systems, CCTV, alarm systems and related security infrastructure, where used.
Professional advisers such as accountants, auditors or legal advisers, where sharing is necessary for the services they provide to us.
We may also disclose personal data where required by law, for example to law enforcement agencies, regulatory bodies or courts, or where such disclosure is necessary to protect our rights, property or the safety of our customers or the public.
We do not sell your personal data. Where personal data is transferred outside the United Kingdom or European Economic Area by our processors, we take steps to ensure that appropriate safeguards are in place, such as standard contractual clauses or equivalent protections, in line with data protection law.
Your Data Protection Rights
Under data protection law, you have a number of rights in relation to the personal data that we hold about you. These rights are subject to certain conditions and legal exceptions.
Right of access. You have the right to request confirmation of whether we process your personal data and to receive a copy of that data, together with certain information about how we use it.
Right to rectification. You have the right to request that inaccurate or incomplete personal data about you be corrected or updated without undue delay.
Right to erasure. In certain circumstances, you may request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected or where you withdraw consent and there is no other lawful basis for processing.
Right to restriction of processing. You may request that we restrict the processing of your personal data in certain situations, for example while we verify accuracy or consider an objection.
Right to object. You have the right to object, on grounds relating to your particular situation, to our processing of your personal data where we rely on legitimate interests. You also have the right to object at any time to the processing of your personal data for direct marketing.
Right to data portability. Where we process your personal data based on your consent or on a contract and by automated means, you may have the right to receive that data in a structured, commonly used and machine readable format and to request that it be transmitted to another controller where technically feasible.
You also have the right to lodge a complaint with a supervisory authority if you consider that our processing of your personal data infringes data protection law. We encourage you to contact us first so that we can address your concerns directly.
Security of Your Personal Data
Storage Millbank takes appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include access controls, secure storage, regular reviews of our procedures and restricting personal data access to those employees, contractors and processors who need it for legitimate business purposes and are bound by confidentiality obligations.
Updates to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or services. Any changes will be posted in the latest version of this Privacy Policy, which will apply from the date of publication. We encourage you to review this Privacy Policy regularly to stay informed about how we handle your personal data.
