Privacy Policy - Thehyde Storage

This Privacy Policy explains how Thehyde Storage collects, uses, shares, stores, and protects personal data in connection with the storage services it provides. It applies to all Thehyde Storage customers in the area, including prospective customers, account holders, and individuals who interact with us in relation to storage services, payments, access arrangements, and support. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with applicable data protection law, including the UK GDPR and the Data Protection Act 2018.

This policy is designed to help you understand what information we collect, why we use it, who we share it with, how long we keep it, and what rights you have over your personal data. Please read this policy carefully.

1. Data We Collect

We only collect personal data that is necessary for the provision and management of our storage services, our legal obligations, and our legitimate business operations. The information we collect may include the following:

Identity information: name, date of birth, and, where required, identification details used to verify identity.
Contact information: address, email address, telephone number, and alternative contact details.
Account information: customer reference number, rental agreement details, unit allocation, access records, and correspondence relating to your account.
Payment information: payment card details, billing information, transaction records, payment status, and refund-related information. We do not store full card details unless necessary and permitted by secure payment arrangements.
Access and security data: records of site entry, gate logs, CCTV footage where applicable, and incident reports.
Communication data: emails, call records, complaint details, service requests, and other communications.
Technical data: device, browser, or session information if you interact with digital services used to manage your account or bookings.

In limited circumstances, we may also process sensitive personal data or special category data if it is necessary for legal claims, safeguarding, or compliance with legal obligations. We will only do so where a lawful basis exists and where additional safeguards are in place.

2. How We Use Your Data

We use personal data for the following purposes:

to enter into and perform storage agreements;
to verify identity and prevent fraud;
to manage bookings, access, billing, and renewals;
to provide customer support and respond to enquiries or complaints;
to monitor site security and protect property, staff, customers, and third parties;
to recover unpaid fees and manage debt-related matters;
to comply with legal, regulatory, accounting, and insurance obligations;
to keep internal records and maintain accurate business operations;
to defend or establish legal claims;
to improve services, systems, and operational efficiency.

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another compatible purpose. If we need to use it for an unrelated purpose, we will notify you and explain the lawful basis that permits this.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for processing your personal data. The main lawful bases we rely on are set out below:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes setting up your storage account, managing access, processing payments, and providing services you have requested.

Legal obligation

We process personal data where required to comply with legal duties, such as tax and accounting obligations, fraud prevention, regulatory requirements, and lawful requests from authorities.

Legitimate interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests. These interests include security, business administration, service improvement, prevention of misuse, and debt recovery.

Consent

In limited cases, we may rely on your consent, for example where it is required for specific optional communications or certain non-essential processing. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital interests and legal claims

Where necessary, we may process data to protect someone’s vital interests or to establish, exercise, or defend legal claims. This may include use of security records or incident information.

4. Data Sharing and Processors

We may share personal data with trusted third parties who act as processors or independent controllers, but only where necessary and appropriate. We require these parties to protect personal data and process it in accordance with data protection law.

Processors and service providers may include:

Payment processors who handle card or electronic payments securely;
IT and cloud service providers who host systems, email services, and business software;
Security providers who support alarm systems, access control, or CCTV storage;
Accountancy and audit providers who assist with financial records and compliance;
Legal, insurance, or debt recovery professionals where necessary to protect our rights or meet legal obligations;
Maintenance and operations contractors where access to limited customer information is needed to perform services;
Regulatory, law enforcement, or public authorities where disclosure is required by law or necessary to protect rights, safety, or property.

We do not sell personal data. If personal data is transferred outside the UK or the European Economic Area, we will ensure appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or equivalent protections required by law.

5. Retention of Personal Data

We keep personal data only for as long as necessary to fulfil the purposes described in this policy, including for legal, accounting, insurance, and dispute resolution purposes. The exact retention period depends on the type of information and the reason it was collected.

In general:

customer account and contract records are kept for the duration of the relationship and for a further period afterwards where required for legal or operational purposes;
financial and transaction records are retained for the period required by tax and accounting law;
security records, including access logs and CCTV footage, are retained only for as long as necessary for monitoring, investigation, or safety purposes;
correspondence and complaint records are kept as long as needed to resolve matters and for audit or legal defence purposes.

When personal data is no longer required, we will securely delete, anonymise, or destroy it. We review retention periods regularly to ensure data is not kept longer than necessary.

6. Security of Personal Data

We take appropriate technical and organisational measures to safeguard personal data against unauthorised access, accidental loss, misuse, alteration, or disclosure. These measures may include access controls, encryption where appropriate, staff confidentiality obligations, secure storage, and monitoring of systems and premises.

Although we use reasonable safeguards, no system can be guaranteed to be completely secure. If we become aware of a personal data breach affecting your information, we will assess the incident and take steps required by law, which may include notifying affected individuals and regulators where appropriate.

7. Your Rights

Under data protection law, you have rights in relation to your personal data. These rights may apply depending on the circumstances and the legal basis for processing.

Right of access: you can request a copy of the personal data we hold about you.
Right to rectification: you can ask us to correct inaccurate or incomplete data.
Right to erasure: in certain circumstances, you can request deletion of your data.
Right to restriction: you can ask us to restrict how we use your data in certain situations.
Right to object: you can object to processing based on legitimate interests, including direct marketing where applicable.
Right to data portability: where processing is based on consent or contract and carried out by automated means, you may request that your data be provided in a structured, commonly used format.
Right to withdraw consent: where we rely on consent, you can withdraw it at any time.
Right to complain: you have the right to raise concerns with the relevant data protection authority if you believe your data has been handled unlawfully.

We may need to verify your identity before responding to a rights request. We aim to respond within the time limits required by law.

8. Children’s Data

Our services are not intended for children acting on their own behalf. We do not knowingly collect personal data from children except where it is necessary in connection with a lawful customer relationship, emergency contact arrangement, or legal requirement. Where children’s data is processed, we apply appropriate safeguards.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our processing practices. Any updated version will take effect when made available. We encourage customers to review this policy periodically to stay informed about how we protect personal data.

Thehyde Storage is committed to protecting the privacy of every customer in the area and to processing personal data responsibly, lawfully, and transparently. If you have any concerns about how your data is handled, your rights remain fully protected under applicable law.