PRIVACY POLICY

Last Updated: 4 June 2026

GXP-Storage Ltd (“GXPS”, “Company”, “us”, “we”, or “our”) is a private limited company registered in Scotland (Company No. SC179028) that operates www.gxp-storage.co.uk and related services (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our Service. GXPS acts as the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy.

Clause 1. What Personal Data We Collect

We collect the following categories of personal data:

  • Contact Information: name, email address, phone number, postal address.
  • Account Information: username, user permissions, password, and system preferences.
  • Communication Data: information you provide when contacting us, including support requests, feedback, and survey responses.
  • Payment Information: billing profile information, such as contact information and billing references.
  • Profile Information: any additional information you choose to provide in your profile.
  • Usage Data: how you interact with our Service, including pages visited, time spent, features used, and click patterns.
  • Device Information: IP address, browser type and version, device type, operating system, and device identifiers.
  • Location Data: general geographic location based on IP address.
  • Cookies and Tracking Data: information collected through cookies, web beacons, and similar technologies as governed by the Privacy and Electronic Communications Regulations 2003 (PECR).

Clause 2. SMS and Communication Consent

When you provide your phone number and consent to receive SMS messages, we collect your phone number and mobile carrier information, your consent preferences for different message types, and message delivery and engagement data.

SMS Messaging Terms:

  • Message types include appointment reminders, order alerts, account notifications, service updates, and promotional messages (with your consent).
  • Messaging frequency may vary.
  • Message and data rates may apply.
  • To opt out at any time, text STOP.
  • For assistance, text HELP or visit www.gxp-storage.co.uk.
  • SMS consent is not shared with third parties or affiliates.

Clause 3. How We Use Your Personal Data

We collect and process only the personal data necessary for the purposes set out below. We regularly review the data we hold to ensure it remains relevant and not excessive. Our Data Privacy Officer conducts annual assessments to ensure compliance with data minimisation principles.

Service Provision

  • Provisioning, maintaining, and improving our Service.
  • Processing transactions and managing your account.
  • Authenticating users and preventing unauthorised access.
  • Providing customer support and responding to enquiries.

Communication

  • Sending service-related notifications and updates.
  • Delivering marketing communications (with your consent for prospects; based on legitimate interest for existing customers, with opt-out rights).
  • Sending SMS messages only with your explicit opt-in consent.
  • Responding to your questions and requests.

Analytics and Improvement

  • Analysing usage patterns to improve our Service.
  • Conducting research and development.
  • Monitoring Service performance and troubleshooting issues.
  • Generating aggregate statistics about Service usage.

Legal and Security

  • Complying with legal obligations and enforcing our terms.
  • Protecting against fraud, abuse, and security threats.
  • Investigating and preventing illegal activities.
  • Defending our rights and interests.

Clause 4. Legal Basis for Processing (UK GDPR)

Under the UK GDPR, we process your personal data on the following lawful grounds:

Consent (Article 6(1)(a))

  • SMS messaging (with your explicit opt-in consent).
  • Marketing communications to prospects (with your consent).
  • Non-essential cookies and tracking technologies.

Contract (Article 6(1)(b))

  • Processing transactions and managing your account.
  • Providing customer support related to our services.
  • Authenticating users and providing Service access.

Legitimate Interests (Article 6(1)(f))

  • Analysing usage patterns to improve our Service.
  • Preventing fraud, abuse, and security threats.
  • Conducting research and development.
  • Website analytics and performance monitoring.

A Legitimate Interests Assessment (LIA) supporting these activities is documented and available upon request by contacting privacy@gxp-storage.com.

Legal Obligation (Article 6(1)(c))

  • Complying with legal requirements and regulations.
  • Retaining records as required by law.
  • Responding to valid legal processes.

Vital Interests (Article 6(1)(d))

  • Protecting against immediate threats to health or safety.

You have the right to object to processing based on legitimate interests. For more information about your rights, see Clause 8 below.

Clause 5. Automated Decision-Making

We do not engage in automated decision-making that produces legal effects or significantly affects you without human intervention, in accordance with Article 22 of the UK GDPR. We use automated systems for basic website functionality (such as login authentication and spam filtering), and our marketing automation platform may send automated email sequences based on your interactions. These do not constitute significant automated decision-making for the purposes of Article 22.

Clause 6. Who We Share Your Personal Data With

Service Providers

We work with trusted third-party service providers who act as data processors under our instructions. These include cloud hosting and infrastructure providers; analytics and monitoring services; marketing automation platforms; our CRM platform (Salesforce, Inc.); and business communication and telephony services. A list of our current sub-processors is available upon request at privacy@gxp-storage.com. All data processors are bound by data processing agreements (DPAs) that comply with Article 28 of the UK GDPR.

No Joint Controllers

We do not currently have joint controller arrangements. If this changes, we will update this Privacy Policy accordingly.

Legal Requirements

We may disclose personal data in response to valid legal processes (court orders, warrants, or regulatory requests), or when required by applicable law or regulation.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections.

With Your Consent

We may share your information with third parties when you provide explicit consent. SMS consent is not shared with third parties or affiliates under any circumstances.

Clause 7. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this Privacy Policy, unless a longer period is required or permitted by law:

  • Account Data: retained while your account is active and for a reasonable period thereafter to comply with legal and regulatory obligations.
  • SMS Consent Records: retained for at least 5 years to comply with telecommunications regulations.
  • Analytics Data: retained in accordance with the analytics provider’s retention policies (typically 26 months for user-level data).
  • CRM Data: retained for no longer than 7 years after the last commercial interaction, or as required by applicable law.
  • Communication Records: call logs retained for up to 12 months; call recordings typically retained for 90 days unless extended for training or compliance purposes.

Clause 8. Your Data Subject Rights

Under the UK GDPR, you have the following rights:

  • Right of Access: to request confirmation of whether we process your personal data and to obtain a copy.
  • Right of Rectification: to request correction of inaccurate or incomplete personal data.
  • Right of Erasure (“Right to be Forgotten”): to request deletion of your personal data in certain circumstances.
  • Right to Restrict Processing: to request that we limit how we use your personal data in certain circumstances.
  • Right to Data Portability: to receive your personal data in a structured, commonly used, machine-readable format.
  • Right to Object: to object to processing based on legitimate interests or for direct marketing purposes.
  • Rights Related to Automated Decision-Making: the right not to be subject to a decision based solely on automated processing that produces significant effects.
  • Right to Withdraw Consent: where processing is based on consent, to withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@gxp-storage.com. We will respond within one month of receiving your request.

Specific Withdrawal Methods

  • SMS Messages: text STOP to opt out, or contact us directly.
  • Marketing Emails: use the unsubscribe link in emails or email unsubscribe@gxp-storage.com.
  • Analytics Cookies: adjust your browser settings or use our cookie preference centre.

Complaints

You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your personal data has been processed unlawfully:

  • ICO Website: ico.org.uk
  • ICO Helpline: 0303 123 1113
  • ICO Email: casework@ico.org.uk
  • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Clause 9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

  • Encryption of data in transit and at rest.
  • Regular security assessments and vulnerability testing.
  • Access controls and authentication systems.
  • Employee training on data protection practices.
  • Incident response procedures.

No method of transmission over the Internet is 100% secure.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will: notify the ICO within 72 hours of becoming aware of the breach, where feasible; and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Clause 10. Accountability Measures

We implement the following accountability measures to demonstrate UK GDPR compliance:

  • Data Protection Impact Assessments (DPIAs): conducted for high-risk processing activities.
  • Privacy by Design: privacy considerations integrated into all new systems and processes.
  • Regular Audits: internal reviews of our data processing activities.
  • Staff Training: all personnel receive regular training on data protection principles.
  • Records of Processing: we maintain detailed records of all processing activities as required by Article 30 of the UK GDPR.
  • Data Processing Agreements: all data processors are bound by comprehensive DPAs compliant with Article 28.

Clause 11. Children’s Privacy

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal data from children under 18. If you believe your child has provided us with personal data, please contact us immediately. If we discover we have collected personal data from a child under 18 without appropriate consent, we will take steps to delete that data.

Clause 12. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our Service. The types of cookies we use include:

  • Essential Cookies: strictly necessary for the Service to function.
  • Analytics Cookies: help us understand how the Service is used.
  • Functionality Cookies: remember your preferences and settings.
  • Marketing Cookies: used to deliver relevant content and track marketing campaign effectiveness.

For UK users, our use of non-essential cookies is subject to the Privacy and Electronic Communications Regulations 2003 (PECR), which requires your prior consent before we set any non-essential cookie. When you first visit our website, you will be presented with a cookie consent banner allowing you to accept, reject, or customise your cookie preferences. You can update your preferences at any time through your browser settings.

Third-Party Cookies

Our Service may set cookies from third-party analytics services, our marketing automation platform, and our CRM platform. Full details of cookies used are set out in our Cookie Notice, available at www.gxp-storage.co.uk/cookie-policy.

Clause 13. International Data Transfers

Your personal data may be transferred to and processed in countries outside the United Kingdom, including the United States, where our servers and third-party service providers are located. We only transfer personal data internationally when we have a lawful basis to do so.

For transfers outside the UK, we ensure appropriate safeguards are in place as required by UK GDPR, including:

  • The UK International Data Transfer Addendum (UK IDTA), being the standard contractual clauses approved by the UK Information Commissioner’s Office supplementing the EU Standard Contractual Clauses.
  • Adequacy regulations made under the UK GDPR.
  • Binding corporate rules approved by the ICO.

For transfers subject to EU SCCs that also involve EU/EEA personal data, our designated lead supervisory authority for EU data transfers is the Irish Data Protection Commission (www.dataprotection.ie).

Clause 14. Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party services you visit.

Clause 15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on our website, send email notifications to registered users, and update the “Last Updated” date. Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

Clause 16. Contact Us

Privacy Contact: privacy@gxp-storage.com

General Contact: contact@gxp-storage.com

Marketing Opt-Out: unsubscribe@gxp-storage.com

Registered Office:

GXP-Storage Ltd
c/o Clyde Offices, Suite 2/3, 2nd Floor
48 West George Street
Glasgow, G2 1BP
United Kingdom
Attn: Data Privacy Officer

If you have concerns about our privacy practices that we have been unable to resolve, you may contact the ICO at ico.org.uk or 0303 123 1113.