We use personal data to answer enquiries, provide secure self-storage and run our business. Our AI telephone assistant can answer routine questions, provide quotations and collect contact and enquiry details. Calls are recorded and transcribed, chat interactions are retained as written records, and relevant information can be accessed from or transferred into our SpaceManager customer management system. Customer interaction data and feedback from our team may be used to train and improve the AI service used by Loc-Box. If you consent to advertising cookies, we may also share Google click identifiers, conversion information and securely hashed contact details with Google to measure which adverts lead to enquiries and customers. You can change your cookie choices at any time.
1. Who we are
Loc-Box Self Storage Limited (“Loc-Box”, “we”, “us” or “our”) operates www.loc-box.co.uk and provides self-storage services. We are the controller of the personal data described in this policy.
Company number: 05001136. Registered office: The Office, Grooms Lane, Creaton, Northamptonshire, England, NN6 8NN.
Our privacy contact is George Matts. You can contact us at george@loc-box.co.uk, by telephone on 01604 505050, or at the registered office above.
2. What this policy covers
This policy explains how we collect, use, disclose, retain and protect personal data when you use our website, telephone service, AI telephone assistant or chat services, request a quote, make an enquiry, reserve or rent a storage unit, visit one of our sites, communicate with us, apply for a job, or otherwise deal with us.
It also explains our use of cookies, Google Ads conversion tracking, Google click identifiers (including GCLID), enhanced conversions for leads and similar advertising measurement technologies.
3. Personal data we collect
Information you give us
- your name, title, postal address, email address and telephone number;
- enquiry, quote, reservation, move-in and account information, including your chosen site, unit, dates and communications with us;
- payment and billing information (payment card processing is normally handled by our payment provider);
- identity and verification documents, such as a driving licence or passport, where required;
- details of authorised contacts, alternate contacts or representatives;
- information you give us in feedback, reviews, complaints or correspondence; and
- recruitment and employment information if you apply to work for us.
Information collected through our website and communications
- IP address, device, browser, operating system, approximate location and technical log information;
- pages viewed, links clicked, dates and times, referring website and interactions with our website;
- cookie identifiers, advertising identifiers and consent choices;
- Google click identifiers and related campaign information, including GCLID, GBRAID and WBRAID where available; and
- telephone and AI-chat information, including caller number, call audio, recordings, transcripts, written chat records, AI-generated summaries, structured enquiry records and related communication metadata.
Information collected at our sites
We may collect CCTV images, vehicle registration details, access-control records and other security information when you visit or use a Loc-Box site.
Information from other sources
We may receive information from advertising and analytics providers, payment providers, credit-reference or fraud-prevention organisations, insurers, referees, public sources and other service providers where lawful.
Providing your personal data
Some personal data is required for us to take steps at your request or to enter into and administer a storage agreement, including contact, identity, payment and account information. Where information is required, we will make this clear when we collect it.
If you do not provide information that is required, we may be unable to provide a quotation, verify your identity, reserve or rent a unit, take payment or administer your account. Unless we tell you otherwise, you are not under a statutory obligation to provide personal data to us.
4. How we use personal data and our lawful bases
We use personal data only where we have a lawful basis. Depending on the circumstances, the relevant basis is one or more of the following:
- Contract or steps before a contract: to respond to enquiries, provide quotes, take reservations, enter into and administer storage agreements, take payment, manage accounts and provide customer support, including through our AI telephone assistant.
- Legal obligation: to meet tax, accounting, identity, health and safety, regulatory and law-enforcement requirements.
- Legitimate interests: to operate and improve our business, provide an efficient telephone and customer-support service, maintain accurate enquiry records, record and transcribe service calls, retain AI-chat records, and train, test and improve the AI assistant used by Loc-Box using customer interaction data and feedback where this is necessary and proportionate. We also rely on legitimate interests to secure our sites and systems, prevent fraud, manage debts and disputes, understand business performance and protect legal rights. We balance these interests against your rights and document the assessment where required.
- Consent: for non-essential cookies and similar technologies, online advertising measurement or personalisation where consent is required, and electronic direct marketing where consent is the appropriate basis. You may withdraw consent at any time.
- Special-category data: we do not request this routinely. Where health or disability information is genuinely required to consider an adjustment or support a vulnerable customer, we process only the minimum needed and identify both an Article 6 lawful basis and the specific additional condition required by law. We do not routinely process criminal-offence data and will identify and document the specific legal condition before doing so.
We may also use aggregated or anonymised information that no longer identifies you for statistical, operational and planning purposes.
5. AI telephone assistant
We use an AI-powered assistant, supplied and supported by a specialist third-party technology provider, to answer incoming telephone calls and handle supported chat interactions. It can respond to routine questions, provide storage quotations and collect enquiry details for our team. Telephone calls handled by the assistant are recorded and transcribed, and chat interactions are retained as written records. A caller may ask to speak to a member of the Loc-Box team. If a team member is not available, the caller may request a call back.
How the information is used
We use this information where necessary to take steps at your request before entering into a storage agreement and for our legitimate interests in answering calls and chats efficiently, extending the availability of routine support, maintaining accurate records, monitoring service quality, training the AI assistant used by Loc-Box and improving our services.
We may use customer data from interactions with the AI assistant, together with corrections and feedback provided by our team, to train, test and improve the AI service used by Loc-Box. This may include call transcripts, written chat records, AI-generated summaries, structured enquiry information and staff feedback. This training and improvement activity is for the AI service used by Loc-Box.
We use only the customer information that is reasonably required for this training and improvement activity. Information used for this purpose remains subject to the retention rules and customer rights described in this policy, including the rights to object, request correction and request deletion where those rights apply.
Human assistance and accuracy
During its initial use, the AI assistant can provide quotations and answer basic questions. Quotations are subject to availability, current prices, offers and our terms. The assistant does not take payment, complete a storage agreement, change a customer account, verify identity or make a significant decision based solely on automated processing. AI-generated information can be incomplete or inaccurate. You may ask for human assistance, and our team can review, correct or supplement information before it is relied upon.
Supplier safeguards and retention
Our AI, telephony, transcription, cloud-service and customer-management providers may process personal data to provide and support the service. This includes SpaceManager and external companies involved in operating, hosting or supporting the AI service. Where a provider acts on our behalf, we require it to follow our instructions, protect the information and use it only for the agreed service. Call recordings, transcripts, chat records, summaries and associated AI records are retained in accordance with this policy and our usual retention schedule. They are deleted or anonymised when they are no longer reasonably required, subject to legal, accounting, security, complaint and dispute-resolution requirements.
6. Google Ads, GCLID and enhanced conversions for leads
Where Google Ads measurement is enabled and you have consented to the relevant advertising cookies or similar technologies, we use Google Ads tools to understand whether our advertising leads to enquiries, reservations and customers, and to improve campaign reporting and bidding.
Click identifiers
When you arrive after clicking a Google advert, Google may add an identifier to the website address, such as a Google Click Identifier (GCLID) or the related GBRAID or WBRAID identifiers. Subject to your consent choices and our technical configuration, we may collect and store that identifier with your enquiry or customer record. If you later reserve or become a customer, we may send the identifier and limited conversion information (for example, the conversion type, date/time, value and currency) to Google so the outcome can be attributed to the relevant advert.
Enhanced conversions for leads
Where enabled, we use Google’s enhanced conversions for leads feature. This allows us to send limited first-party contact data that you gave directly to us, such as your email address and/or telephone number and, where configured, your name and address, together with conversion information. Contact data is normalised and securely hashed before transmission where Google’s implementation requires hashing. Hashing turns the data into a coded value for matching, but it remains personal data and we treat it accordingly.
Google compares the hashed data and/or click identifiers with data associated with signed-in Google users and advertising interactions. This helps Google report whether an advert resulted in a lead or customer, including across devices. Google provides us with aggregated campaign reporting; we do not receive details of the Google account to which a match relates.
For this advertising measurement activity, the data may include: email address, telephone number, name and postal address where configured; GCLID, GBRAID or WBRAID; enquiry or customer reference; site or unit category; conversion type and status; conversion date/time; and transaction value and currency. We do not upload payment-card details, identity documents, storage contents, special-category data or information that we know relates to a child.
Our lawful basis for placing or reading advertising cookies and for associated online advertising measurement is consent. You can refuse or withdraw consent through the cookie settings on our website. Withdrawing consent does not affect processing that was lawful before withdrawal. It may not remove data already lawfully sent to Google, but it will prevent future consent-dependent collection or sharing from your browser once your choice has been applied.
Where we rely on consent for enhanced conversions or offline conversion uploads, we only include records for which the relevant consent has been recorded. Refusing advertising consent will not affect your quotation, reservation, rental or access to storage services.
Google processes uploaded customer data under its applicable Google Ads customer-data and data-processing terms. More information is available in Google’s Privacy Policy and its explanation of how Google uses information from sites or apps that use its services.
7. Cookies and similar technologies
Cookies are small files placed on, or information accessed from, your device. We also use tags, pixels, local storage and similar technologies. They may be operated by us or by third parties.
- Strictly necessary cookies support security, session management, load balancing, consent records and core website functions. Consent is not normally required for these.
- Analytics cookies help us understand website use and improve performance.
- Advertising cookies and tags help measure campaigns, store advertising click information, support enhanced conversions and, where enabled, personalise advertising.
- Functional cookies remember choices or enable optional features such as embedded media.
We do not set or access non-essential analytics or advertising cookies unless you consent, except where the law permits otherwise. You can accept, reject or change non-essential cookie choices using the website’s cookie settings. You can also control cookies through your browser, although blocking necessary cookies may affect website operation.
Our cookie settings panel gives current details of the specific cookies and similar technologies in use, including their providers, purposes and durations. Where third-party technologies are used, the panel identifies the relevant third parties. That information forms part of this policy and is reviewed whenever website tags, cookies or suppliers change.
8. Direct marketing
We may send service messages about an enquiry, reservation, contract, payment, security or account. These are not marketing messages. We may send marketing by email, text or other electronic means where you have consented or where the soft opt-in applies and the law permits it. We rely on the soft opt-in only where you bought or negotiated to buy a similar service from us and we gave you a clear opportunity to opt out when we collected your details and in every subsequent message. You can opt out at any time using the unsubscribe option in a message or by contacting us. We may retain a suppression record so that we respect your choice.
9. Who we share personal data with
Where necessary and lawful, we may share personal data with:
- Google and other analytics, advertising and conversion-measurement providers;
- website, CRM and customer-management providers, including SpaceManager, together with telephony, email, messaging, IT, hosting, security and customer-support providers;
- AI-assistant, speech-to-text, transcription, voice-processing, chat and associated cloud-service providers;
- payment processors, banks, fraud-prevention and credit-reference organisations;
- insurers, brokers, debt-recovery providers, professional advisers and trade associations;
- law-enforcement, courts, regulators, government bodies or other parties where required by law or needed to protect rights, safety or property
- an authorised contact or representative you have nominated; and
- a prospective buyer, seller, funder or adviser in connection with a corporate or asset transaction, subject to appropriate safeguards.
We require service providers acting on our instructions to protect personal data and use it only for the contracted purpose. Some recipients may act as independent controllers and will provide their own privacy information.
10. International transfers
Some suppliers, including Google, our AI telephone-assistant provider and other technology providers, may process personal data outside the United Kingdom. Where personal data is transferred internationally, we use an approved safeguard where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism. You may contact us for more information about the safeguards relevant to your data.
11. How long we keep personal data
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements. In general:
- customer, contract, payment and accounting records are normally kept for six years after the end of the relevant contract or financial period;
- unsuccessful recruitment records are normally kept for six months after the recruitment process ends;
- CCTV footage is normally overwritten automatically under the retention cycle configured for the relevant site. The cycle reflects the site’s security needs, camera coverage and system capacity. Footage isolated for an incident, investigation or legal claim is retained until it is no longer needed for that purpose;
- access-control and site-security records are kept while needed to manage access, protect site security and investigate incidents, and are then deleted under our retention schedule;
- call recordings, transcripts, written chat records, AI-generated summaries and associated AI interaction records are retained only while needed to manage the enquiry, maintain appropriate records, monitor quality, handle complaints or legal claims, verify accuracy, or train, test and improve the AI assistant used by Loc-Box. The records are then deleted or anonymised under our retention schedule;
- enquiry and marketing-attribution records are reviewed on a scheduled basis and deleted or anonymised when they are no longer needed for follow-up, conversion reporting, suppression of duplicate records or legal claims; and
- cookie durations are shown in the cookie settings panel.
Where another law, dispute, complaint, safeguarding concern or regulatory request requires a longer or shorter period, we adjust retention accordingly.
12. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure or access. Measures include access controls, secure systems, encryption where appropriate, staff confidentiality and incident-response procedures. No internet transmission or storage system can be guaranteed completely secure.
13. Special-category data and children
We do not routinely request special-category personal data. If you voluntarily provide health or disability information and it is genuinely needed, for example so that we can consider an appropriate adjustment for a vulnerable customer, we will process only the minimum information required and only where an additional lawful condition applies. We do not routinely process criminal-offence data. If such processing becomes necessary, we will identify the applicable legal condition and safeguards.
Because customers can communicate freely, they may volunteer sensitive information during a call or chat. The AI assistant is not designed to request health, disability or other special-category information unless it is genuinely necessary for the enquiry. Where such information is provided, we limit its use, route the matter to our team where appropriate and handle it in accordance with the retention and customer-rights provisions in this policy.
Our services are intended for adults. We do not knowingly collect personal data from children for advertising measurement and do not upload data that we know relates to a child to Google’s enhanced conversions service. Please contact us if you believe we hold a child’s information inappropriately.
Automated decision-making
We do not make significant decisions about customers based solely on automated processing. Our AI telephone assistant may provide quotations and routine information, and Google Ads may use automated systems for advertising measurement and campaign bidding, but neither decides whether Loc-Box will enter into a storage agreement, take payment, change an account or provide access to storage. Customers may request human assistance and correction of inaccurate information.
14. Your rights
Depending on the circumstances, UK data-protection law may give you the right to:
- ask for access to your personal data;
- ask us to correct inaccurate or incomplete data;
- ask us to erase data or restrict its use;
- object to processing based on legitimate interests, including use of personal data to test or improve the AI assistant, or object to direct marketing;
- receive certain data in a portable format;
- withdraw consent at any time; and
- ask for human intervention, express your point of view and challenge a significant decision based solely on automated processing, where these safeguards apply.
These rights are not absolute and exemptions may apply. To exercise a right, contact us using the details in section 1. We may request proportionate information to verify your identity. We normally respond within one month.
15. Complaints
Please contact us first if you have a concern so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.
16. Links and third-party services
Our website may link to third-party websites or include third-party content. Those organisations control their own services and privacy practices. We recommend reading their privacy information before providing personal data.
17. Changes to this policy
We may update this policy when our services, suppliers, technologies or legal obligations change. The latest version will be published on this page with a revised “last updated” date. If a change materially affects how we use personal data, we will take reasonable steps to bring it to your attention and obtain fresh consent where required.
