Privacy Policy - Selfstorage Islington

This Privacy Policy explains how Selfstorage Islington collects, uses, stores, shares, and protects personal data relating to customers, prospective customers, website visitors, and other individuals whose information we may process in the course of providing self-storage services. It applies to all Selfstorage Islington customers in the area and is intended to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are committed to handling personal data fairly, lawfully, and transparently. We respect privacy rights and aim to process only the information necessary for the purposes described in this policy. By using our services or engaging with us, you acknowledge that your personal data may be processed in accordance with this Privacy Policy.

1. Information We Collect

We may collect and process different types of personal data depending on how you interact with us. This may include:

Identity information: name, title, date of birth, and identification documents where required for verification.
Contact information: address, email address, telephone number, and emergency contact details if provided.
Account and contract information: customer reference numbers, booking details, storage unit details, payment history, and contract preferences.
Financial information: payment card details, bank details, billing records, and transaction confirmations.
Security and access information: CCTV images, access logs, gate entry records, and other security-related records.
Communication information: enquiries, complaints, service requests, and correspondence with us.
Technical information: IP address, browser type, device identifiers, and usage data if you interact with our digital systems.

We do not intentionally collect special category data unless it is necessary and lawful to do so, for example where required to meet legal obligations or for the establishment, exercise, or defence of legal claims. We ask that you do not provide unnecessary sensitive data unless specifically requested.

2. How We Use Personal Data

We use personal data for the following purposes:

to register and manage customer accounts;
to provide storage services and maintain your rental agreement;
to process payments, refunds, invoices, and account administration;
to verify identity and prevent fraud;
to manage access to storage facilities and protect property;
to communicate with customers about bookings, service updates, and account matters;
to handle complaints, queries, and disputes;
to comply with legal, regulatory, and tax requirements;
to maintain business records, security systems, and service quality;
to establish, exercise, or defend legal claims.

Where necessary, we may also use personal data for internal administration, audit, and risk management. We will only use your data for purposes that are compatible with the reasons it was collected, unless we have a lawful basis to use it otherwise.

3. Lawful Basis for Processing

We process personal data only where we have a lawful basis under data protection law. Depending on the circumstance, the lawful basis may include:

Contract: processing is necessary to enter into or perform a storage agreement, including managing bookings, payments, access, and account services.
Legal obligation: processing is required to meet our obligations under applicable law, including tax, accounting, fraud prevention, and regulatory requirements.
Legitimate interests: processing is necessary for our legitimate business interests, such as maintaining security, preventing misuse, improving services, and protecting our rights and property, provided these interests are not overridden by your rights and freedoms.
Consent: in limited situations, we may rely on your consent, for example where it is required for specific optional communications or non-essential processing. You may withdraw consent at any time where processing is based on consent.
Vital interests: in rare cases, we may process information to protect someone’s life or physical safety.

Where we rely on legitimate interests, we assess the impact on your privacy and ensure that the processing is proportionate and necessary. We will not use personal data in a way that is incompatible with the lawful basis on which it was collected.

4. Data Sharing and Processors

We may share personal data with trusted third parties who act as processors or, in some cases, independent controllers. These parties are only permitted to process personal data in accordance with our instructions or their own legal obligations. The categories of processors may include:

Payment service providers for card and banking transactions;
IT and system support providers for data storage, software, cybersecurity, and maintenance;
Security providers for monitoring, access control, alarm response, and CCTV-related services;
Professional advisers such as accountants, auditors, insurers, or legal advisers;
Debt recovery or credit control providers where payment issues arise and such sharing is lawful;
Public authorities or law enforcement where required by law or where disclosure is necessary to protect legal rights.

We require processors to implement appropriate technical and organisational measures to safeguard personal data. Where personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place in accordance with data protection law.

We do not sell personal data. Any sharing is limited to what is necessary for the provision of services, legal compliance, protection of rights, or legitimate business operations.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, insurance, and reporting requirements. Retention periods may vary depending on the type of data and the reason for processing.

In general:

contract and account records are retained for the duration of the customer relationship and for a reasonable period afterwards;
financial records are kept for the period required by tax and accounting laws;
security records, including access logs and CCTV footage, are retained only for as long as necessary for security, investigation, or legal purposes;
complaint and dispute records may be retained for the period needed to resolve the issue and defend legal claims;
inactive or unnecessary data is securely deleted, anonymised, or archived where appropriate.

When determining retention periods, we consider the nature of the data, the potential risk of harm from unauthorised use or disclosure, and the legal obligations that apply. Once personal data is no longer required, we will take reasonable steps to dispose of it securely.

6. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures may include access controls, password protection, secure storage, staff training, and regular review of security procedures.

Although we strive to protect personal data, no system can be guaranteed to be completely secure. Where a personal data breach occurs and we are legally required to do so, we will notify the relevant authority and affected individuals in accordance with applicable law.

7. Your Rights

Under data protection law, you have a number of rights in relation to your personal data. These rights may apply depending on the circumstances and the legal basis for processing:

Right of access: you may request confirmation of whether we process your personal data and obtain a copy of that data.
Right to rectification: you may ask us to correct inaccurate or incomplete information.
Right to erasure: you may request deletion of personal data in certain situations, such as where it is no longer needed or where consent is withdrawn.
Right to restriction: you may ask us to limit processing in certain circumstances.
Right to object: you may object to processing based on legitimate interests or direct marketing.
Right to data portability: where applicable, you may request that certain data be provided in a structured, commonly used, machine-readable format.
Right to withdraw consent: where processing is based on consent, you can withdraw consent at any time.

You also have the right to raise concerns with the UK Information Commissioner’s Office if you believe your data protection rights have been infringed. We encourage you to contact us first so that we may try to resolve any concern promptly and fairly.

8. Children’s Data

Our services are intended for adults. We do not knowingly collect personal data from children except where it is necessary in connection with a lawful service arrangement and appropriate safeguards are in place. If we become aware that personal data has been collected inappropriately, we will take steps to delete it where required.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our data handling practices. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to stay informed about how we protect personal data.

10. Summary of Our Commitment

We process personal data for clear and limited purposes, rely on appropriate lawful bases, retain data only for as long as needed, and use vetted processors under appropriate safeguards. We aim to be transparent and accountable in all data handling activities.

Selfstorage Islington is committed to respecting privacy and protecting the information entrusted to us by customers in the area. If you use our services, your data will be handled in line with this policy, with fairness, security, and compliance at the centre of our approach.