Storage Maryland Privacy Policy
This Privacy Policy explains how Storage Maryland collects, uses, stores, and protects personal data relating to customers and prospective customers in our service area. It also explains the legal bases we rely on under the General Data Protection Regulation and applicable data protection laws, how long we keep information, which third parties may process data on our behalf, and the rights you have in relation to your personal data.
This Privacy Policy applies to all Storage Maryland customers and individuals who inquire about, use, or are affected by our storage and related services in our service area, whether they interact with us online, by telephone, or in person.
Data Controller
Storage Maryland determines the purposes and means of the processing of your personal data and acts as the data controller for the personal data described in this Privacy Policy. Where we use third parties to process your personal data on our behalf, they act as data processors and are bound by contractual obligations to protect your information.
Personal Data We Collect
We collect and process different categories of personal data depending on how you interact with us and which services you use. This may include:
Identification and contact details, such as your name, postal address, billing address, and other contact details you choose to provide to us when you inquire about or use our services.
Account and contract information, such as customer numbers, contract details for storage units or related services, rental dates, payment status, and communications relating to your account.
Payment and billing information, such as payment method details and billing history processed through secure payment providers. We do not store full payment card details where this is not necessary for the purpose of providing our services.
Communication data, including records of your communications with us such as inquiries, complaints, feedback, and any correspondence relating to our services.
Usage and technical data, such as information relating to your interactions with our websites or online services, including access times, device information, and other technical data necessary to ensure security and functionality.
Security and access data, such as facility access logs, unit access information, and where in operation, CCTV footage for security and safety purposes at our locations.
Purposes and Lawful Bases for Processing
We process your personal data only when we have a lawful basis to do so under applicable data protection laws. Depending on the circumstances, we may rely on the following lawful bases:
Contract performance: We process personal data to take steps at your request before entering into a contract and to perform our contractual obligations to you. This includes managing reservations, setting up and administering your storage unit or related services, processing payments, handling customer service requests, and communicating with you about your account.
Legal obligations: We may process personal data to comply with legal and regulatory obligations, such as tax and accounting requirements, responding to lawful requests from public authorities, and maintaining records that we are legally required to keep.
Legitimate interests: We may process personal data where necessary for our legitimate interests, provided that your interests and fundamental rights do not override those interests. Our legitimate interests include ensuring the security of our facilities and systems, preventing and investigating fraud or misuse, improving our services and customer experience, managing and planning our business operations, and maintaining secure access to storage units and premises.
Consent: In limited cases, we may rely on your consent, for example for certain optional communications or marketing, where required by applicable law. Where processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
How We Use Your Personal Data
Subject to the lawful bases described above, we use your personal data for the following purposes:
To manage customer relationships, including processing inquiries, providing quotations, administering contracts, and maintaining records of our interactions.
To provide and support our services, including managing facility access, ensuring the safety and security of stored items, maintaining our systems and premises, and providing customer support.
To handle payments and billing, including issuing invoices, taking payments through our payment providers, and managing any payment disputes.
To maintain security and prevent misuse, including monitoring access to our facilities, using CCTV where applicable, defending our rights and property, and supporting investigations into suspected illegal or unauthorised activity.
To comply with legal and regulatory requirements, including retention of records, responding to lawful requests for information, and meeting obligations under applicable laws.
To communicate with you, including providing information about your current services, changes to our terms or policies, and other information that is necessary or helpful in connection with your use of our services.
Data Retention
We retain personal data for no longer than is necessary for the purposes for which it was collected and to meet legal, accounting, or reporting requirements. The specific retention period can vary depending on the type of data and the context of our relationship with you, but we generally apply the following principles:
Customer and contract data is retained for the duration of your contract with us and for a reasonable period afterwards to deal with any queries, disputes, or legal claims, and to comply with legal retention obligations.
Payment and billing records are retained for the period required under applicable financial and tax laws and for any additional period necessary to resolve payment related issues.
Security and access data, including access logs and CCTV footage where used, is retained for a limited period that enables us to investigate security incidents and protect our facilities and customers, unless longer retention is required for legal or investigative reasons.
Where data is no longer required for the purposes described above, we will securely delete or anonymise it in accordance with our data retention procedures.
Data Processors and Third Parties
We may engage third party service providers to process personal data on our behalf and in accordance with our instructions. These third parties act as data processors and are only permitted to process your personal data as necessary to provide their services to us. We require all processors to implement appropriate technical and organisational measures to protect your personal data.
Categories of processors and third parties we may use include:
Payment processing providers that facilitate secure handling of payments and billing.
IT and cloud service providers that host our systems, data, and communication platforms.
Security service providers that support facility access systems, CCTV operations, and incident response where applicable.
Professional advisers, such as accountants or legal advisers, who may require limited access to certain data to provide their services in accordance with legal and professional duties.
In some cases, we may also need to share data with public authorities or law enforcement where we are legally required to do so or where this is necessary to protect rights, property, or safety.
International Data Transfers
Where we transfer personal data outside of your local jurisdiction, we do so only where appropriate safeguards are in place to protect your information in accordance with applicable data protection laws. These safeguards may include the use of standard data protection clauses or other lawful transfer mechanisms recognized under the General Data Protection Regulation.
Your Data Protection Rights
You have a number of rights in relation to your personal data under applicable data protection laws. Subject to certain conditions and exemptions, these rights may include:
Right of access: You can request confirmation as to whether we process your personal data and obtain a copy of the personal data we hold about you, along with certain information about how we process it.
Right to rectification: You can request that we correct or complete any inaccurate or incomplete personal data relating to you.
Right to erasure: In certain circumstances, you can request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected or where you withdraw consent and there is no other legal basis for processing.
Right to restriction of processing: You can request that we restrict the processing of your personal data in certain situations, for example while we consider a request to rectify data or where you object to processing.
Right to data portability: Where processing is based on your consent or on a contract and is carried out by automated means, you may have the right to receive the personal data you have provided to us in a structured, commonly used, and machine readable format and to transmit that data to another controller where technically feasible.
Right to object: You can object to the processing of your personal data where we rely on legitimate interests as our lawful basis. We will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or where processing is necessary for the establishment, exercise, or defence of legal claims.
Right to withdraw consent: Where we rely on consent as a legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority if you believe that our processing of your personal data infringes data protection laws.
Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make changes, we will revise the date of the latest update and make the updated version available through our usual communication channels. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.
