Privacy Policy - Poplar Storage

Effective date: This Privacy Policy applies to all Poplar Storage customers in area and explains how we collect, use, share, retain, and protect personal data.

At Poplar Storage, we are committed to handling personal data in a fair, lawful, transparent, and secure manner in accordance with the UK General Data Protection Regulation (UK GDPR) and applicable data protection laws. This policy explains what information we collect, why we collect it, the legal grounds we rely on, how long we keep it, who may process it on our behalf, and the rights available to you.

1. Who this policy applies to

This Privacy Policy applies to all Poplar Storage customers in area, including prospective customers, account holders, authorised users, and any individual whose personal data is provided to us in connection with our storage services. It also applies where we receive data from third parties that are acting on your behalf, such as a business representative, insurer, or payment provider.

2. Personal data we collect

We collect only the personal data that is necessary for operating our storage services, managing accounts, meeting legal obligations, and improving our business. The information we collect may include:

Identity information: name, date of birth, title, and similar identifiers.
Contact details: postal address, email address, and telephone number.
Account information: customer reference number, tenancy details, access permissions, booking history, and correspondence.
Payment information: payment method, billing records, transaction history, and payment status. We do not store full card details where payment processing is handled securely by third-party providers.
Verification information: documents or data used to confirm identity, address, or eligibility where required.
Security and access information: CCTV footage, access logs, alarm records, gate entries, and incident reports where applicable.
Communication records: emails, messages, complaint records, and notes of calls or service interactions.
Technical information: device and usage data if you interact with our online systems, such as IP address, browser type, and basic activity logs.

We may also collect special category data only where strictly necessary and where the law allows it. In most cases, we do not intentionally seek such data. If such information is provided to us, we will process it only with an appropriate legal basis and with additional safeguards.

3. How we use your data

We use personal data for the following purposes:

to create and manage customer accounts;
to provide storage services and related customer support;
to verify identity and prevent fraud;
to process payments, invoices, refunds, and arrears;
to manage site access, safety, and security;
to handle complaints, disputes, and claims;
to comply with legal and regulatory obligations;
to maintain records and internal administration;
to improve our operations, systems, and customer experience;
to enforce our terms and protect our rights, property, and customers.

We will not use your data for purposes that are incompatible with the reasons it was collected unless we have a lawful basis to do so and have informed you where required.

4. Lawful basis for processing

Under data protection law, we must have a lawful basis to process personal data. Depending on the activity, Poplar Storage relies on one or more of the following lawful bases:

Contract: processing is necessary to enter into or perform our storage agreement with you, including setting up your account, providing access, and managing payments.
Legal obligation: processing is necessary to comply with laws such as tax, accounting, safety, fraud prevention, or other regulatory requirements.
Legitimate interests: processing is necessary for our legitimate business interests, such as protecting our premises, preventing misuse, managing risk, improving services, and maintaining records, provided those interests are not overridden by your rights and freedoms.
Consent: where we rely on your consent, we will explain this clearly at the point of collection. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Where we process special category data, we will also rely on a valid condition under data protection law, such as your explicit consent or another condition permitted by law.

5. Sharing your personal data

We do not sell your personal data. We may share it only when necessary and only with appropriate safeguards. Recipients may include:

Service providers and processors who support our operations, such as IT support, hosting, payment processing, storage management software, communications services, and security providers.
Professional advisers such as accountants, auditors, insurers, and legal advisers.
Public authorities, regulators, or law enforcement where disclosure is required by law or necessary to protect rights, safety, or property.
Debt recovery or dispute resolution providers where required to manage unpaid balances or contractual issues.

Where third parties process personal data on our behalf, they act as processors and may only process data according to our instructions. We require them to implement appropriate technical and organisational measures to protect personal data and to keep it confidential.

6. Processors and third-party safeguards

Poplar Storage uses processors to help deliver services efficiently and securely. Typical processing activities may include website and account hosting, cloud storage, payment administration, customer messaging, document handling, security monitoring, and analytics. We enter into data processing agreements with processors to ensure they process data only on our instructions, keep it secure, and assist us with legal compliance where needed.

We take reasonable steps to ensure that any processor or supplier with access to personal data is selected carefully, vetted appropriately, and subject to confidentiality obligations.

If personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place, such as adequacy regulations or approved contractual protections, so that your data remains protected to a standard consistent with UK GDPR requirements.

7. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy, including to meet legal, accounting, and reporting obligations. Retention periods depend on the type of information and the reason we hold it.

Customer account records: kept for the duration of the contract and for a reasonable period afterwards for administration, dispute handling, and recordkeeping.
Payment and invoicing records: retained for the period required by tax and accounting law.
Security records: such as access logs and CCTV footage, kept only for as long as needed for safety, incident investigation, or security purposes.
Correspondence and complaints: retained for as long as required to resolve the issue and for a limited period afterward for evidence and compliance.

When data is no longer needed, we will delete it securely or anonymise it so that it can no longer identify you.

8. Your rights

Under data protection law, you have a number of rights in relation to your personal data. These rights may be subject to conditions or exceptions. They include:

Right of access: you can request a copy of the personal data we hold about you.
Right to rectification: you can ask us to correct inaccurate or incomplete data.
Right to erasure: in some cases, you can ask us to delete your personal data.
Right to restriction: you can ask us to limit how we use your data in certain circumstances.
Right to object: you can object to processing based on legitimate interests or direct marketing.
Right to data portability: where applicable, you can request your data in a structured, commonly used format.
Right to withdraw consent: where we rely on consent, you may withdraw it at any time.

You also have the right to raise concerns with the relevant data protection authority if you believe your rights have been breached. We encourage you to contact us first so we can try to resolve any issue promptly.

9. Security of your information

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, staff training, secure storage, encryption where appropriate, and regular review of our procedures. While no system can be guaranteed completely secure, we work hard to safeguard the information entrusted to us.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or operational practices. Any updated version will apply from the date it takes effect. We encourage you to review this policy periodically to stay informed about how we protect your personal data.

11. Summary of our approach

Poplar Storage only collects the personal data needed to provide storage services, run our business responsibly, and meet legal obligations. We process data on clear lawful bases, keep it secure, limit sharing to trusted processors and necessary recipients, and retain it only for as long as required. You remain in control of your data through the rights described above.

Key commitments

Transparency: we tell you why we collect and use your data.
Necessity: we collect only what is relevant and proportionate.
Protection: we apply safeguards and contractual controls.
Accountability: we remain responsible for how personal data is handled.

This Privacy Policy is intended to provide a clear and practical explanation of our data handling practices for Poplar Storage customers in area. If you use our services, your personal data will be processed in line with this policy and applicable law.