This is StoreBay’s own privacy notice, describing how StoreBay acts as a data controller for the personal data it decides the purposes and means of processing: Operator staff user accounts, Operator billing/administrative contacts, StoreBay’s own prospects and leads, and marketing-site visitors. When an Operator uses StoreBay to serve its own end customers (occupiers / licensees) and the visitors to its website, StoreBay is a processor, not a controller — that relationship is governed by our Data Processing Agreement, not this notice. Governing framework: UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), and PECR for cookies and electronic marketing.
1. Who we are
StoreBay is the controller for the personal data described in this notice. StoreBay is Sellframe Ltd, a company registered in Scotland (company number SC472357; registered office 14 Avonside Grove, Hamilton, ML3 7DL). We are registered with the ICO (the Information Commission, formerly the Information Commissioner’s Office) as a data controller, number ZA781833. Contact for privacy matters: privacy@storebay.co.uk.
2. Who this notice is about (and who it is not)
Operator staff, billing contacts, and our own prospects and site visitors are covered by this notice. An Operator’s own end customers (occupiers/licensees) are not — if you occupy a storage unit under an agreement/licence with one of our Operators and want to know how your data is handled, contact that storage business directly; they are your controller. The same goes for the visitors to an Operator’s own website that we host: we count those visits for the Operator, on its instructions, and its own cookie policy and privacy notice say how.
3. Personal data we collect
Account data (name, work email, role, credentials, session records); billing data (billing contact, address, VAT number, subscription and invoices); usage and telemetry (log-ins, feature usage, device/browser metadata, aggregate metering); cookies (strictly necessary, and our cookieless analytics — see §9); support and communications; and prospect/marketing data. We do not seek special-category data in these relationships.
4. Purposes and lawful bases
We rely on contract (creating and administering accounts, billing), legitimate interests (securing and improving the service, fraud prevention, and telling storage businesses about StoreBay by post, by phone and, to limited companies, by email: you can object at any time and we stop), legal obligation (tax/accounting records), and consent (for anything optional we might add, such as a non-essential cookie: we set none today). We do not use consent as the basis for contacting storage businesses; the notice for them is at storebay.co.uk/legal/prospects.
5. Recipients and sub-processors
We share personal data only as needed to run the service: providers that act for us (hosting, network delivery and security, payments, email and SMS delivery, analytics, meeting bookings, printing and posting our letters, address checks, and an AI service that helps us read and sort replies), the sub-processors listed in our Data Processing Agreement, professional advisers under confidentiality duties, and authorities where legally required. For the storage businesses we contact, the providers are named in the notice at storebay.co.uk/legal/prospects. We do not sell personal data.
6. International transfers
Our primary application data is hosted on a dedicated DigitalOcean droplet in London (LON1), with in-region backups. Requests to our website and API pass through Cloudflare’s network, which carries them to London, so Cloudflare handles that traffic in transit. Some named sub-processors process data outside the UK under appropriate safeguards (UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement).
7. Retention
We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. Account and billing records are retained for the life of the relationship plus the statutory limitation/tax period. Records of the storage businesses we contact are kept for up to 24 months after our last contact; if you ask us to stop, we keep only a scrambled code made from your business, not your details, so that we never contact you again. Our analytics holds no personal data.
8. Your rights
Under the UK GDPR you have the right to access, rectify, erase, restrict, port and object to our processing of your data. To exercise any right, contact privacy@storebay.co.uk. We respond within one month (extendable by two further months for complex requests).
9. Cookies and analytics
Our marketing site uses strictly necessary cookies (session, security, load-balancing) — set without consent, as they are essential. For analytics, we use Fathom Analytics, a cookieless service that sets no cookies and stores no personal data. Because there is nothing non-essential to consent to, we do not show a cookie-consent banner. If we ever add a non-essential cookie or identifier (for example a different analytics tool, session replay, or a remarketing pixel), we will ask first — a compliant consent banner and cookie table will ship in the same change, and the new tag will not load before consent. See our Cookie Policy for the full, current cookie table.
10. Complaints to the ICO
If you have a concern about how we handle your data, please contact us first so we can try to resolve it; we will acknowledge a complaint within 30 days. You also have the right to complain to the ICO (the Information Commission, formerly the Information Commissioner’s Office): Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, 0303 123 1113, ico.org.uk.
11. Changes to this notice
We may update this notice to reflect changes to our processing, the law, or our sub-processors. Material changes will be notified to Operators in advance.