Privacy Policy - Selfstorage Acton

This Privacy Policy explains how Selfstorage Acton collects, uses, stores, shares, and protects personal data. It applies to all Selfstorage Acton customers in the area, including prospective customers, current customers, former customers, visitors who make enquiries, and individuals who interact with our services in any way. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who this policy applies to

This policy applies to all Selfstorage Acton customers in the area, whether they use a storage unit, make a reservation, request a quote, sign a storage agreement, access our premises, or communicate with us by any means. It also applies to any person whose information we may need to process in connection with a storage account, such as an authorised contact, business representative, emergency contact, or person making a payment on behalf of a customer.

2. Personal data we collect

We may collect and process different types of personal data depending on how you use our services. This may include:

Identity data, such as your name, date of birth, and identification details where required for verification.
Contact data, such as address, email address, telephone number, and billing details.
Account and contract data, such as storage unit reference, booking details, agreement information, payment status, and service history.
Financial data, such as payment card information, bank details, transaction records, and invoice information.
Security and access data, such as access logs, CCTV images, entry records, and incident reports.
Correspondence data, such as messages, complaints, enquiries, and notes relating to support or customer service.
Technical data, such as device information, IP address, and limited usage data when you interact with our digital systems.

We do not seek to collect unnecessary personal information. We only collect data that is relevant for operating our storage services, maintaining security, managing customer accounts, and meeting legal obligations.

3. How we use your personal data

We use personal data for the following purposes:

to register and manage customer accounts;
to provide storage services and administer contracts;
to process payments, refunds, and invoices;
to verify identity and prevent fraud;
to control access to premises and protect stored property;
to communicate about bookings, renewals, amendments, and service updates;
to handle complaints, disputes, and insurance-related matters;
to comply with legal and regulatory obligations;
to improve operational efficiency, safety, and customer experience;
to establish, exercise, or defend legal claims.

We only use personal data for the purposes for which it was collected, unless we reasonably need to use it for a compatible purpose or we are required or permitted to do so by law.

4. Lawful basis for processing

We process personal data only where we have a lawful basis under UK GDPR. Depending on the context, our lawful bases may include:

Performance of a contract

We process data when it is necessary to enter into or perform a storage agreement, manage your account, provide access to your unit, or deliver services you have requested.

Legal obligation

We may process data when required to comply with legal or regulatory obligations, including tax, accounting, security, fraud prevention, and lawful requests from authorities.

Legitimate interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. This may include maintaining security, preventing misuse of premises, managing business operations, improving services, and defending legal claims.

Consent

Where required, we will rely on your consent, for example for optional marketing communications or certain uses of non-essential data. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital interests

In rare situations, we may process data to protect someone’s vital interests, such as in an emergency affecting health or safety.

5. Data sharing and processors

We may share personal data with trusted third parties who act as processors or independent controllers, depending on the service provided. We ensure that appropriate contractual and organisational safeguards are in place before sharing data.

Typical processors and recipients may include:

Payment processors that handle card or electronic payments;
IT and cloud service providers that support storage of records, communications, and administrative systems;
Security providers that support CCTV, alarm monitoring, access control, or site protection;
Maintenance and facilities contractors who may access areas of the premises where data is incidentally processed;
Professional advisers, such as accountants, auditors, insurers, or legal advisers;
Debt recovery or collection services, where necessary for unpaid balances;
Public authorities, courts, or regulators, where disclosure is required by law or necessary for legal proceedings.

We require processors to act only on our instructions, to protect personal data, and to use appropriate security measures. We do not sell personal data.

6. Retention of personal data

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, and reporting requirements. Retention periods depend on the nature of the information and the purpose for which it is processed.

In general:

customer account and contract records are retained for the duration of the relationship and for a reasonable period afterwards;
financial and transaction records are retained for the period required by law and accounting rules;
security records, such as CCTV footage or access logs, are retained for a limited period unless needed for an investigation or legal claim;
correspondence and complaint records are kept long enough to manage the matter and address any follow-up issues;
where data is no longer required, it is securely deleted, anonymised, or archived in accordance with our retention procedures.

We review retention regularly to ensure that personal data is not kept longer than necessary. If we must retain information due to a legal hold, dispute, or regulatory requirement, we will do so only for as long as needed.

7. Security of personal data

We take the security of personal data seriously and use appropriate technical and organisational measures to protect it from unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, secure storage, staff training, logging, restricted permissions, and contractual safeguards with third-party providers.

While no system can be guaranteed to be completely secure, we work to maintain a level of protection appropriate to the nature of the data and the risks involved.

8. Your rights under data protection law

You have rights in relation to your personal data, subject to certain legal limits and exceptions. These rights include:

Right of access – you may request a copy of the personal data we hold about you.
Right to rectification – you may ask us to correct inaccurate or incomplete data.
Right to erasure – in certain circumstances, you may request deletion of your data.
Right to restriction – you may ask us to limit how we use your data in specific situations.
Right to object – you may object to processing based on legitimate interests or direct marketing.
Right to data portability – you may request certain data in a structured, commonly used format where applicable.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office if you believe your data protection rights have been infringed. We encourage you to raise concerns with us first so we can try to resolve the issue promptly.

9. Marketing communications

We may send marketing communications where permitted by law and, if required, where you have given consent. You can opt out of marketing at any time. If you opt out, we may still send non-marketing messages that are necessary for the administration of your account or contract.

10. International transfers

If any of our service providers process personal data outside the UK, we will ensure that appropriate safeguards are in place, such as an adequacy decision, standard contractual clauses, or another lawful transfer mechanism recognised under UK GDPR.

11. Children’s data

Our services are directed to adults. We do not knowingly collect personal data from children except where it is necessary in connection with a lawful customer arrangement or where a parent, guardian, or authorised adult provides information on their behalf. If we learn that we have collected data unlawfully, we will take appropriate steps to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, services, or operational practices. Any revised version will apply from the date it is made available. We encourage customers to review this policy periodically to stay informed about how we process personal data.

13. Summary of key points

This Privacy Policy explains how Selfstorage Acton handles personal data for all customers in the area. We collect only what is needed, use it for clear and lawful purposes, retain it for appropriate periods, share it only with relevant processors and authorised recipients, and respect your rights under data protection law. Our aim is to process data in a lawful, transparent, and secure way while providing reliable storage services.