Privacy Policy - Selfstorage Earlscourt

This Privacy Policy explains how Selfstorage Earlscourt collects, uses, stores, shares, and protects personal data relating to its customers in the Earlscourt area. It applies to all Selfstorage Earlscourt customers in the area, including prospective customers, active account holders, former customers, and individuals whose details are provided in connection with storage services, payments, access, or security. We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable privacy laws.

By using our services, you acknowledge that your personal data may be processed as described in this policy.

1. Personal Data We Collect

We only collect personal data that is necessary for legitimate storage, administrative, security, and legal purposes. Depending on your interaction with us, we may collect the following categories of information:

Identity data: name, date of birth, and identification details used to verify identity.
Contact data: address, email address, telephone number, and emergency contact details where relevant.
Account and contract data: storage unit number, rental dates, payment status, booking details, service preferences, and correspondence related to your account.
Financial data: billing information, payment records, and transaction details. Card details may be processed by secure third-party payment providers rather than stored by us.
Access and security data: CCTV footage, entry logs, access records, alarm or incident reports, and security-related information.
Technical data: limited device or usage information if you interact with our digital systems, such as IP address or browser data, where applicable.
Communications data: emails, messages, call notes, complaints, claims, and any information you choose to provide in correspondence.

Special category and sensitive data

We do not seek to collect special category data unless it is necessary and lawfully permitted, for example where it is provided in an incident report or required for reasonable adjustments. If such information is provided, we will handle it with extra care and only for a specific, lawful purpose.

2. How We Use Personal Data

We use personal data for the following purposes:

to open, manage, and administer storage accounts;
to verify identity and prevent fraud;
to process bookings, payments, refunds, and debt recovery where necessary;
to provide and maintain access to storage facilities;
to communicate about account matters, service changes, and operational notices;
to protect the safety and security of customers, staff, property, and the facility;
to investigate incidents, claims, complaints, or disputes;
to comply with legal, regulatory, tax, accounting, and insurance obligations;
to improve our services, processes, and site security;
to establish, exercise, or defend legal claims.

We do not use personal data for unrelated purposes without a lawful basis.

3. Lawful Basis for Processing

Selfstorage Earlscourt processes personal data only where a lawful basis under UK GDPR applies. Depending on the activity, we rely on one or more of the following bases:

Contract: processing is necessary to enter into or perform our storage agreement with you, including account creation, access management, billing, and service delivery.
Legal obligation: processing is necessary to comply with laws and regulations, such as tax, accounting, insurance, crime prevention, or lawful requests from authorities.
Legitimate interests: processing is necessary for our legitimate business interests, including facility security, fraud prevention, service improvement, and internal administration, provided these interests are not overridden by your rights and freedoms.
Consent: in limited situations, such as certain marketing activities or optional uses of data, we may rely on your consent. Where consent is used, you may withdraw it at any time.
Vital interests: in rare cases, processing may be necessary to protect someone’s life or physical safety.

When we rely on legitimate interests, we assess whether our interests are proportionate and whether your privacy rights require additional protection.

4. Sharing Personal Data and Processors

We may share personal data with trusted third parties where necessary for the purposes described in this policy. These parties act either as processors or, in some cases, as independent controllers. We only share data when it is necessary and appropriate safeguards are in place.

Examples of processors and service providers may include:

Payment processors: to handle secure card or electronic payments.
IT and hosting providers: to store data, maintain systems, and support secure digital operations.
Security providers: to manage CCTV systems, alarm services, and facility protection.
Accountancy and administrative providers: to support billing, records management, and compliance.
Legal, insurance, and professional advisers: where advice or claim handling is required.
Debt recovery or credit control providers: where accounts remain unpaid and lawful action is needed.

All processors are required to process personal data only on our instructions, keep it secure, and comply with data protection law. We do not sell personal data. We may disclose information where required by law, court order, law enforcement request, or to protect our rights, customers, or property.

5. International Transfers

Where a processor or service provider stores or accesses personal data outside the United Kingdom, we ensure appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or equivalent lawful mechanisms. We take steps to ensure that your data remains protected to a standard consistent with UK data protection requirements.

6. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including any legal, accounting, reporting, or claims-handling requirements. Retention periods vary depending on the type of data and the reason for processing.

Customer and contract records: retained for the duration of the relationship and for a reasonable period afterwards.
Financial and tax records: retained for the period required by law and for audit purposes.
Security records and CCTV: retained for a limited period unless needed for an investigation, claim, or legal matter.
Correspondence and complaints: retained as long as necessary to resolve the issue and maintain appropriate records.
Legal claim records: retained until the claim is settled and any limitation period has expired.

When personal data is no longer needed, we securely delete, anonymise, or archive it in accordance with our retention procedures.

7. Your Rights

Under data protection law, you may have the following rights in relation to your personal data:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete information.
Right to erasure: to request deletion of data in certain circumstances.
Right to restrict processing: to ask us to limit how we use your data in certain situations.
Right to object: to object to processing based on legitimate interests, including direct marketing where applicable.
Right to data portability: to request transfer of data you provided to us, where technically feasible and legally applicable.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

These rights are not absolute and may be subject to legal exceptions. We may need to verify your identity before responding to a request.

Additional rights and complaints

If you believe your personal data has been handled unlawfully or unfairly, you have the right to raise a concern with the relevant data protection authority in the UK. We encourage you to contact us first so we can review and address your concerns promptly and fairly.

8. Security of Personal Data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, secure storage, staff training, CCTV protection, confidentiality obligations, and supplier due diligence. However, no system can be guaranteed completely secure, and you should also take care to protect any personal information you share with us.

9. Children’s Data

Our services are intended for adults. We do not knowingly collect personal data from children except where necessary and lawful in connection with an adult customer, emergency contact, or incident handling. If we become aware that we have inadvertently collected child-related data without a lawful basis, we will take steps to remove it or restrict its use.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our processing activities. Any updated version will apply from the date it is published or otherwise communicated. We recommend that customers review this policy periodically so they remain informed about how their data is handled.

Summary statement: Selfstorage Earlscourt processes personal data lawfully, fairly, and transparently, using it only for storage services, security, compliance, and legitimate business purposes, while respecting your rights and protecting your information.