Privacy Policy - Stora London

Effective Date: This Privacy Policy applies to all Stora London customers in area and explains how we collect, use, share, store, and protect personal data in accordance with the UK GDPR and the Data Protection Act 2018.

1. Introduction

Stora London is committed to handling personal data lawfully, fairly, and transparently. We respect the privacy of our customers, visitors, and other individuals whose data we process in connection with our services. This Privacy Policy sets out what information we collect, why we collect it, the lawful bases on which we rely, how long we keep it, the types of third parties that may process it on our behalf, and the rights available to you under data protection law.

This policy applies to all Stora London customers in area and to any person whose data is processed by us in the course of providing our services. By using our services or providing us with personal data, you acknowledge that your information will be handled as described in this Privacy Policy.

2. Data We Collect

We may collect and process different categories of personal data depending on your relationship with us and how you interact with our services. The information we collect may include:

Identity data: name, title, date of birth, and similar identifying information.
Contact data: email address, billing address, service address, telephone number, and other communication details.
Account data: account credentials, customer reference numbers, service preferences, and communication settings.
Transaction data: records of payments, invoices, receipts, service history, and related financial details.
Technical data: IP address, device type, browser type, operating system, log information, and usage data.
Communication data: messages, enquiries, complaints, feedback, and any correspondence you send to us.
Verification data: information required to confirm identity, prevent fraud, and comply with legal obligations.

We normally collect personal data directly from you when you register, make an enquiry, enter into a contract, make a payment, or communicate with us. We may also receive data from third parties where necessary to deliver our services, comply with the law, or protect our legitimate interests.

3. How We Use Your Personal Data

We use personal data only for specified, explicit, and legitimate purposes. These include:

providing and managing our services;
processing payments, billing, and account administration;
responding to enquiries, complaints, and requests;
maintaining security, preventing fraud, and detecting misuse;
meeting legal, regulatory, accounting, and tax obligations;
improving service quality, systems, and customer experience;
sending operational communications related to your account or service;
establishing, exercising, or defending legal claims.

We do not use personal data for purposes that are incompatible with the original reason for collection unless we have a lawful basis to do so.

4. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for each processing activity. Depending on the circumstances, Stora London may rely on one or more of the following bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes setting up your account, providing services, handling payments, and communicating about contractual matters.

Legal Obligation

We process data where required to comply with legal or regulatory obligations, such as tax, accounting, anti-fraud, record-keeping, and compliance requirements.

Legitimate Interests

We may process data where it is necessary for our legitimate interests and where those interests are not overridden by your rights and freedoms. These interests include service improvement, business administration, fraud prevention, network and information security, and legal protection. Where we rely on legitimate interests, we balance our interests against your privacy rights.

Consent

In limited cases, we may process data based on your consent. Where consent is relied upon, it will be freely given, informed, specific, and unambiguous. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

5. Retention of Personal Data

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including for satisfying legal, accounting, reporting, or dispute-resolution requirements. The retention period will depend on the type of data, the purpose for which it is used, and applicable legal obligations.

Examples of retention practice include retaining customer and transaction records for the period required by tax and accounting law, keeping service records for the duration of the contractual relationship plus any limitation period for legal claims, and retaining complaint or correspondence records for as long as necessary to resolve the issue and maintain evidence of our handling.

When personal data is no longer required, it will be securely deleted, anonymised, or otherwise disposed of in a safe and appropriate manner.

6. Processors and Third Parties

We may share personal data with third-party service providers that act as processors on our behalf. These processors are only permitted to process data in accordance with our instructions and for the purposes agreed with us. They are required to implement appropriate technical and organisational measures to protect personal data.

Categories of processors may include:

IT and hosting providers: to store data, maintain systems, and support infrastructure;
payment service providers: to process transactions and related financial operations;
customer support tools: to manage communications and service requests;
professional advisers: including legal, accounting, and compliance advisers;
security and fraud-prevention providers: to help detect and prevent misuse;
analytics and system monitoring providers: to improve reliability and performance.

In some circumstances, we may also disclose data to independent controllers such as regulators, public authorities, courts, or law enforcement agencies where legally required or permitted. We do not sell your personal data.

7. International Transfers

If personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place. These may include adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms required under applicable data protection law.

8. Your Rights

Depending on the legal basis for processing and the circumstances of the request, you may have the following rights:

Right of access: to obtain confirmation of whether we process your personal data and to receive a copy of it;
Right to rectification: to correct inaccurate or incomplete data;
Right to erasure: to request deletion of data in certain situations;
Right to restriction: to ask us to limit processing in certain cases;
Right to data portability: to receive data you provided to us in a structured, commonly used, machine-readable format, where applicable;
Right to object: to object to processing based on legitimate interests or for direct marketing purposes;
Right to withdraw consent: where processing is based on consent;
Right not to be subject to automated decision-making: where applicable, to object to decisions made solely by automated means that produce legal or similarly significant effects.

To exercise your rights, you may submit a request through the appropriate channels provided by Stora London. We may need to verify your identity before responding. We will respond within the timeframe required by law, usually within one month, unless the request is complex or numerous.

Important: Some rights may not apply in every situation, and there may be legal reasons why we cannot fully comply with a request. If so, we will explain our decision.

9. Security of Personal Data

We take the security of personal data seriously and use appropriate safeguards to protect information against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff training, and regular review of security practices. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children except where it is necessary and lawful to do so. If we become aware that we have collected data from a child inappropriately, we will take steps to delete it or process it in accordance with legal requirements.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we do so, we will revise the policy accordingly. We encourage you to review it periodically to stay informed about how we protect personal data.

12. Complaints and Further Information

If you have concerns about how your personal data is handled, you have the right to raise a complaint with the relevant data protection supervisory authority. We also encourage you to raise concerns directly with us so that we can address them promptly and fairly.

This Privacy Policy is intended to provide clear information about our data protection practices and to support transparency in all dealings with Stora London customers in area. We are committed to processing personal data responsibly, lawfully, and with respect for your privacy.