Privacy Policy - Selfstorage Kensington

This Privacy Policy explains how Selfstorage Kensington collects, uses, shares, stores, and protects personal data in connection with the storage services we provide. It applies to all Selfstorage Kensington customers in the area, including individuals, household customers, business customers, authorised representatives, and anyone who communicates with us about our services. We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Selfstorage Kensington acts as a data controller in relation to the personal information we collect and use for the provision and administration of our self-storage services. This means we determine the purposes and means of processing your personal data when you use our services, make enquiries, enter into a storage agreement, access a unit, or otherwise interact with us.

2. Personal data we collect

We collect only the personal data that is necessary for lawful, specific, and legitimate purposes. The categories of information we may collect include:

Identity information: name, title, date of birth, and identification details where required for verification.
Contact information: address, email address, telephone number, and other communication details.
Contract and account information: storage unit details, agreement records, payment status, invoices, billing history, and service preferences.
Financial information: payment card details, bank details, and transaction records, where needed for payment processing and refunds.
Security and access information: entry logs, key or access credentials, CCTV footage, incident reports, and records of visits to our premises.
Correspondence and support information: messages, complaints, claims, and records of communications with our staff.
Technical information: limited device or usage data generated when you use online booking or account systems, where applicable.

We may also collect information from third parties where necessary, such as identity verification providers, payment processors, insurance providers, law enforcement agencies, or persons acting on your behalf.

3. How we use your data

We use personal data to operate and improve our self-storage services and to meet legal and contractual obligations. Typical uses include:

setting up and managing customer accounts;
verifying identity and preventing fraud;
processing bookings, payments, and refunds;
providing access to storage units and managing site security;
communicating service updates, notices, and account information;
responding to enquiries, complaints, and claims;
meeting health, safety, insurance, taxation, and record-keeping requirements;
protecting our rights, property, staff, customers, and premises;
improving our services, systems, and customer experience;
complying with legal obligations and requests from authorities.

4. Lawful basis for processing

We only process personal data where we have a lawful basis under data protection law. Depending on the context, we rely on one or more of the following bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes creating your account, managing your storage agreement, delivering the service, and handling payments.

Legal obligation

We may process data where needed to comply with a legal requirement. This can include accounting rules, tax obligations, fraud prevention duties, safeguarding obligations, and lawful disclosures to authorities.

Legitimate interests

We may process data where it is necessary for our legitimate interests and where those interests are not overridden by your rights and freedoms. Examples include site security, CCTV monitoring, managing risk, preventing misuse of services, improving our operations, and defending legal claims.

Consent

In limited cases, we may rely on your consent, for example for certain marketing activities or optional services. Where consent is used, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Vital interests

In rare situations, we may process information to protect someone’s vital interests, such as in an emergency involving health or safety.

5. Data sharing and processors

We do not sell your personal data. However, we may share it with trusted third parties where necessary for the purposes described in this policy. These third parties may act as processors or independent controllers, depending on the service they provide.

Processors are organisations that process personal data on our behalf and only in accordance with our instructions. The processors we may use include:

payment service providers;
IT and cloud hosting providers;
customer management and booking system providers;
security and CCTV service providers;
identity verification and fraud prevention services;
maintenance, cleaning, and facility management contractors;
professional advisers such as lawyers, accountants, and auditors;
insurance or claims handling providers where applicable.

We require processors to implement appropriate technical and organisational security measures and to process personal data only for the agreed purpose. Where data is shared with independent controllers, such as banks, insurers, or public authorities, their own privacy notices may also apply.

6. International transfers

If any of our service providers or systems are located outside the UK, we ensure that appropriate safeguards are in place before personal data is transferred. These safeguards may include adequacy regulations, standard contractual clauses, or equivalent protective measures required by law.

7. Data retention

We keep personal data only for as long as necessary for the purposes for which it was collected, and to satisfy any legal, regulatory, accounting, or reporting obligations. Retention periods may vary depending on the type of information and the reason for processing.

Contract records: kept for the duration of the customer relationship and for a reasonable period afterwards.
Payment and accounting records: retained for the period required by tax and accounting laws.
Security and access records: retained for a limited time unless needed for investigations, claims, or legal proceedings.
CCTV footage: retained for a short period unless required for incident review or law enforcement.
Enquiry and complaint records: retained for as long as necessary to resolve the matter and for record-keeping purposes.

When data is no longer needed, we will securely delete, anonymise, or archive it in accordance with our retention practices.

8. Data security

We take appropriate measures to protect personal data from unauthorised access, loss, alteration, disclosure, or destruction. These measures may include access controls, staff training, encryption where appropriate, secure storage, and regular review of our procedures. While no system can be guaranteed to be completely secure, we strive to maintain a level of protection appropriate to the risks involved.

9. Your rights

Under data protection law, you have rights regarding your personal data. These rights may be subject to conditions or exemptions in certain circumstances. They include:

Right of access: to obtain confirmation of whether we process your data and receive a copy of it.
Right to rectification: to request correction of inaccurate or incomplete information.
Right to erasure: to request deletion of your data in certain situations.
Right to restriction: to ask us to limit processing in specific cases.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to data portability: to receive certain data in a structured, commonly used format, where applicable.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we may need to verify your identity before responding. We aim to handle requests within the time limits required by law.

10. CCTV and site security

Our premises may use CCTV and other security measures to protect customers, staff, property, and the site. CCTV images and related records are used for security, incident investigation, and crime prevention. Access to security footage is limited to authorised personnel and, where appropriate, to lawful requests from third parties such as insurers or authorities.

11. Marketing communications

Where permitted by law, we may send you information about our services, updates, or offers. You can object to direct marketing at any time. If we rely on consent for any marketing activity, you can withdraw that consent whenever you choose.

12. Children

Our services are generally intended for adults and business users. We do not knowingly collect personal data from children unless it is necessary in connection with a customer’s account, legal obligation, or an emergency. If we learn that we have collected information from a child without a valid basis, we will take appropriate steps to delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or operational practices. The latest version will apply from the date it is issued or made available. We encourage customers to review this policy periodically.

14. Complaints and further information

If you have concerns about how we handle your personal data, you have the right to raise a complaint with the relevant data protection authority. You may also contact us through our normal service channels to discuss any privacy issue or to exercise your rights. We will take your concerns seriously and aim to respond appropriately.

By using Selfstorage Kensington services, you acknowledge that you have read and understood this Privacy Policy.