This is StoreBay’s own privacy notice, describing how StoreBay acts as a data controller for the personal data it decides the purposes and means of processing: Operator staff user accounts, Operator billing/administrative contacts, StoreBay’s own prospects and leads, and marketing-site visitors. When an Operator uses StoreBay to serve its own end customers (occupiers / licensees), StoreBay is a processor, not a controller — that relationship is governed by our Data Processing Agreement, not this notice. Governing framework: UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), and PECR for cookies and electronic marketing.
1. Who we are
StoreBay is the controller for the personal data described in this notice. We are registered with the Information Commissioner’s Office as a data controller. Contact for privacy matters: privacy@storebay.co.uk.
2. Who this notice is about (and who it is not)
Operator staff, billing contacts, and our own prospects and site visitors are covered by this notice. An Operator’s own end customers (occupiers/licensees) are not — if you occupy a storage unit under an agreement/licence with one of our Operators and want to know how your data is handled, contact that storage business directly; they are your controller.
3. Personal data we collect
Account data (name, work email, role, credentials, session records); billing data (billing contact, address, VAT number, subscription and invoices); usage and telemetry (log-ins, feature usage, device/browser metadata, aggregate metering); cookies (strictly necessary, and our cookieless analytics — see §9); support and communications; and prospect/marketing data. We do not seek special-category data in these relationships.
4. Purposes and lawful bases
We rely on contract (creating and administering accounts, billing), legitimate interests (securing and improving the service, fraud prevention), legal obligation (tax/accounting records), and consent (non-essential cookies, prospect marketing — with an easy opt-out in every message).
5. Recipients and sub-processors
We share personal data only as needed to run the service: our sub-processors (hosting, payments, email, SMS, identity, analytics — listed in our sub-processor register), professional advisers under confidentiality duties, and authorities where legally required. We do not sell personal data.
6. International transfers
Our primary application data is hosted on a dedicated DigitalOcean droplet in London (LON1), with in-region backups. Some named sub-processors process data outside the UK under appropriate safeguards (UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement).
7. Retention
We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. Account and billing records are retained for the life of the relationship plus the statutory limitation/tax period; marketing data is kept until you opt out or it goes stale.
8. Your rights
Under the UK GDPR you have the right to access, rectify, erase, restrict, port and object to our processing of your data. To exercise any right, contact privacy@storebay.co.uk. We respond within one month (extendable by two further months for complex requests).
9. Cookies and analytics
Our marketing site uses strictly necessary cookies (session, security, load-balancing) — set without consent, as they are essential. For analytics, we use Fathom Analytics, a cookieless service that sets no cookies and stores no personal data. Because there is nothing non-essential to consent to, we do not show a cookie-consent banner. If we ever add a non-essential cookie or identifier (for example a different analytics tool, session replay, or a remarketing pixel), we will ask first — a compliant consent banner and cookie table will ship in the same change, and the new tag will not load before consent. See our Cookie Policy for the full, current cookie table.
10. Complaints to the ICO
If you have a concern about how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).
11. Changes to this notice
We may update this notice to reflect changes to our processing, the law, or our sub-processors. Material changes will be notified to Operators in advance.