Our privacy notice says only people with "a genuine business need to know it" can see your personal information, and they are "subject to a duty of confidentiality". Its examples of technical measures are a password and user name on your customer account, secure servers, and payment details encrypted on the secure server. The notice doesn't cover the online ID check: when you book online, you show a passport or driving licence and take a selfie, and Stripe Identity matches the two. It doesn't say how long those images are kept, whether our staff see them, or whether we or Stripe hold your card details afterwards. If that matters to you, call us on 0800 2545585 before you book and ask.
Jump to: booking online, a message asking for payment details, businesses, acting for someone else, or copies and deletion for current and former customers.
Booking online: your passport, selfie and card details
Our booking guidance asks for "two forms of ID, a photo one and a copy of a recent utility bill". Online, you give photo ID (a driving licence or passport) and a selfie, and Stripe Identity "will match your document to your identity". The privacy notice gives the reason: "we will take copies of documents that identify you so that we can comply with anti-money laundering and counter-terrorist financing requirements."
The notice doesn't name Stripe, which also takes online payments. So before you book, ask us on 0800 2545585 how long the ID photos and selfie are kept, whether our staff can see them, and whether we or Stripe hold your card details after you pay. If you'd rather not verify online, the booking form lets you choose "Reserve a Unit", and "a member of our team will contact you during our office hours".
Stripe's documentation says a business using Stripe Identity can "redact a session to make sure Stripe deletes personal information". That is Stripe's system, not a promise from us, so ask whether we'll do it for yours.
The notice also lists "do a credit check" among the uses of your information; see do you run a credit check? and the ID and documents you need.
What we collect, and how we protect it
When you book, the notice says we collect "your name, postal address, email address, phone numbers, date of birth and payment details." We "may monitor and record communications with you (such as telephone conversations and emails)", and CCTV and door entry systems at a site may collect data; see who can see when you visit your unit.
The notice says "we are responsible as 'controller'" of your personal information. Clause 36 of our terms says: "We process Data in accordance with the UK retained version of the EU General Data Protection Regulation, the Data Protection Act 2018 and all associated laws." We're registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, as Wigwam Storage Management Limited, reference ZB710675.
The notice's measures (it gives the technical ones "for example", so the list isn't complete):
| What | What the notice says |
|---|---|
| Who can see it | "We limit access to your personal information to those who have a genuine business need to know it." |
| Technical measures (for example) | "access to your customer account is controlled by a password and user name"; "we store your personal data on secure servers"; "payment details are encrypted on the secure server" |
| Firms that work for us | we "require them to comply with our instructions in connection with the services they provide for us and not for their own business purposes" |
| If something goes wrong | "We will notify you and any applicable supervisory body of a suspected data breach where we are legally required to do so." |
Its section on transfers abroad says we will not transfer your personal data outside "the [United Kingdom OR European Economic Area]", with the choice left unfilled. Ask us where your data, including your ID images, is held.
Those we may share it with include "service providers under contract with us", credit reference agencies, our insurers if you take cover through us, and law enforcement; the full list is in our privacy notice. To stop marketing, the notice asks you to email info@wigwamstorage.co.uk; you can also call us.
An email or text asking for your payment details
Clause 38 of our terms says we can send you notifications about day-to-day matters by email, and by SMS if you've agreed to it, and we "may also send you a direct message on Your social media accounts", so a genuine message from us is possible. Neither the terms nor our privacy notice say whether we ever send payment links or ask for card details in a message, so if any message, whether email, text or social media, asks you to update payment details through a link, don't click it. Call 0800 2545585, using the number on our website rather than one in the message, and ask whether it came from us.
The National Cyber Security Centre asks you to forward suspicious emails to report@phishing.gov.uk and texts to 7726. If you've given your banking details: "Contact your bank and let them know." If you've lost money, it says to tell your bank and report it to Report Fraud (reportfraud.police.uk).
For businesses: client files in your unit
If your unit will hold client files, two clauses matter. Clause 17 lets us enter the unit and "break any lock if reasonably necessary" in listed cases, including on notice for repairs, in an emergency, or when obliged by law, the police or a court order (full list: can Wigwam staff open my unit?). In the part of our terms on selling or disposing of goods, clause 10 says "We may dispose of the Goods at Our discretion in the event that" (among other things) "(b) Goods may contain personal data belonging to You or others." The clause doesn't say whether this reaches goods in a unit you're still paying for; if that matters, ask us on 0800 2545585.
Our guide for solicitors says Wigwam is "your landlord, not your data processor" and that "no data-processing addendum is required". Clause 10(b) still lets us dispose of goods that "may contain personal data", so have your data protection officer review the terms before you store client records. For keeping records safe, see document storage for business.
Acting for someone else, or naming a contact
Our privacy notice says we may deal with a contact you name "in relation to your account as if that person was you". Under clause 36 of our terms, you confirm that person has "consented to You supplying Data to Us on these terms", and clause 28 lets us "discuss any default by You with" them. So ask them first. To remove them, the notice says you can "email or write to us".
Attorneys, legal guardians and people administering a will are among those we may share information with; call us with your paperwork. Parents: "We do not knowingly collect personal data relating to children under the age of 16." If we hold your child's information, once you've proved your relationship you may "(subject to applicable law) request access to and deletion of" it.
Your rights: copies, corrections, deletion and complaints
Your rights include to "request a copy of your information which we hold (subject access request)", "require us to correct any mistakes", "require the erasure of personal information concerning you in certain situations" and "require us to stop contacting you for direct marketing purposes". The ICO says organisations "usually have one month to respond to a SAR" (a subject access request).
The notice asks for "proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill)"; it doesn't say whether stopping marketing needs this, so ask. "We will not charge any fee for any of these services in most cases." Email info@wigwamstorage.co.uk, the address in our privacy notice, write to "Wigwam Storage, Bloxham Mill (Suite 33), Barford Road, Bloxham, OX15 4FF", or call us on 0800 2545585.
We usually keep customer information for the period UK law requires, "currently 6 years from the end of our contract", "unless you have told us you want us to delete the information earlier". The notice doesn't say which situations erasure covers or what we'd keep, so ask when you write, and if you booked online, ask about your ID photos and selfie too.
If you're unhappy with how we've handled your information, the ICO recommends raising it with us first. You can then complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.
Booking with us
Find your nearest site on our locations page, then get a price online, or call us on 0800 2545585 with your questions first.
Related questions