Privacy Policy - Selfstorage Roehampton

Last updated: This Privacy Policy explains how Selfstorage Roehampton collects, uses, stores, shares, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to all Selfstorage Roehampton customers in the Roehampton area, including individuals, households, and business users who enquire about, reserve, access, or use our self-storage services. We are committed to handling personal information lawfully, fairly, and transparently, and to respecting the rights of every data subject.

1. Who We Are

For the purposes of data protection law, Selfstorage Roehampton is the controller of the personal data described in this policy. This means we determine why and how your personal data is processed. We only collect data that is necessary for operating our storage services, meeting legal obligations, improving service quality, and protecting our business, customers, and premises.

We take privacy seriously and use appropriate technical and organisational measures to keep your information secure. Access to personal data is restricted to authorised personnel and trusted service providers only where needed.

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

Identity data such as your name, title, date of birth, and identification details.
Contact data such as your address, email address, and telephone number.
Account and booking data such as reservation details, unit size, access dates, move-in and move-out information, and service preferences.
Payment data such as billing records, payment status, transaction references, and limited financial details needed to process payments.
Verification data such as proof of identity or address where required for security, fraud prevention, or legal compliance.
Security and access data such as CCTV images, access logs, gate entries, and incident reports.
Communication data such as emails, call notes, complaints, enquiries, and feedback.
Business data where you are a business customer, including company name, trading address, authorised contact details, and invoicing information.

We generally do not collect special category data unless you choose to provide it voluntarily or it is required by law or for the establishment, exercise, or defence of legal claims. If special category data is ever processed, we will do so only where permitted by law and with appropriate safeguards.

3. How We Collect Your Data

We collect personal data directly from you when you:

make an enquiry or request a quotation,
reserve or rent a storage unit,
complete forms or provide documents,
make payments or update your account,
communicate with us by phone, email, or in person, or
use our premises, access systems, or security-controlled areas.

We may also receive data from third parties, such as payment providers, identity verification providers, fraud prevention services, insurers, debt recovery services, or public authorities where lawful and necessary.

4. Lawful Basis for Processing

We only process personal data where we have a valid lawful basis under UK GDPR. Depending on the purpose, our lawful bases include:

Contract – to enter into and perform our storage agreement, manage bookings, provide access, issue invoices, and deliver customer support.
Legal obligation – to comply with tax, accounting, health and safety, fraud prevention, and other legal requirements.
Legitimate interests – to operate and protect our business, monitor security, prevent misuse, improve services, manage risk, and handle disputes, provided our interests are not overridden by your rights and freedoms.
Consent – where we rely on your consent for specific optional processing, such as certain types of marketing. You may withdraw consent at any time.
Vital interests – in the rare event that processing is necessary to protect someone’s life.

Where we rely on legitimate interests, we assess and balance our interests against your privacy rights. Where consent is used, we will make it clear and specific so you can make an informed choice.

5. How We Use Your Data

We may use your personal data to:

set up and manage your storage account,
verify identity and prevent unauthorised access,
process payments and refunds,
send service notices and account updates,
maintain security and investigate incidents,
respond to enquiries, complaints, and disputes,
meet legal, regulatory, and insurance obligations,
analyse service performance and improve operations, and
protect our staff, customers, and property.

We will not use your personal data for purposes that are incompatible with those described in this policy unless we have a lawful basis to do so and, where required, your consent.

6. Data Sharing and Processors

We may share personal data with trusted third parties who act as data processors or independent controllers, only when necessary and subject to appropriate safeguards. These may include:

Payment processors who handle card or online transactions securely.
IT and cloud service providers who store or support our business systems, data backups, and communications tools.
Identity verification and fraud prevention providers who help us confirm identity and reduce misuse.
Security providers who support CCTV, alarm monitoring, access control, and incident response.
Accountants, auditors, and professional advisers where needed for legal, financial, or compliance purposes.
Debt recovery or legal advisers where necessary to enforce agreements or resolve disputes.
Public authorities, regulators, or law enforcement where disclosure is required by law or is otherwise lawful.

All processors are required to protect personal data, act only on our instructions, and implement appropriate security measures. We do not sell your personal data.

7. International Transfers

If any personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or equivalent lawful transfer mechanisms. We will only transfer data where necessary and where adequate protection is ensured.

8. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, insurance, and reporting obligations. Retention periods depend on the type of information and the reason it is held.

In general:

customer account and contract records are retained for the duration of the relationship and for a reasonable period afterwards;
payment and invoicing records are retained for statutory accounting and tax purposes;
security records, such as access logs and CCTV, are retained for limited periods unless required longer for investigation or legal reasons;
complaints, incident records, and dispute-related files are retained until the matter is resolved and for any applicable limitation period.

When personal data is no longer required, it is securely deleted, anonymised, or destroyed. We apply the principle of data minimisation so that we do not keep information longer than necessary.

9. Your Rights

Under data protection law, you have a number of rights in relation to your personal data. These include:

The right of access – to request a copy of the personal data we hold about you.
The right to rectification – to ask us to correct inaccurate or incomplete information.
The right to erasure – to request deletion of your data in certain circumstances.
The right to restriction – to ask us to limit how we use your data in certain situations.
The right to object – to object to processing based on legitimate interests or direct marketing.
The right to data portability – to receive certain data in a structured, commonly used format where applicable.
The right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

You also have the right to raise concerns with the UK Information Commissioner’s Office (ICO) if you believe your data has not been handled lawfully. We encourage you to contact us first so we can try to resolve the issue promptly and fairly.

10. Security of Your Data

We use reasonable and appropriate safeguards to protect personal data from loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, password protection, staff training, secure storage, encryption where appropriate, and regular review of our security practices.

However, no system is completely secure. If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will take the steps required by law, which may include notifying affected individuals and the relevant regulator.

11. Children’s Data

Our services are intended for adults. We do not knowingly collect personal data from children unless it is necessary in connection with a lawful customer arrangement and with appropriate authorisation from an adult responsible party. If we learn that we have collected data unlawfully from a child, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulatory guidance, our services, or operational practices. Any updates will take effect when published. We recommend reviewing this policy periodically so that you remain informed about how we use personal data.

Summary of Our Commitment

Selfstorage Roehampton is committed to treating customer information with care, security, and fairness. We only collect data that is needed, use it for clear and lawful purposes, keep it only for as long as necessary, and respect your privacy rights at every stage of the relationship.

By using our services, you acknowledge that your personal data may be processed in line with this policy and applicable data protection laws. We aim to keep our practices transparent, responsible, and compliant for every customer in the Roehampton area.