Privacy Policy - Selfstorage Camden

This Privacy Policy explains how Selfstorage Camden collects, uses, stores, shares, and protects personal data relating to our customers, prospective customers, visitors, and other individuals whose information we process in connection with our storage services. This policy applies to all Selfstorage Camden customers in the Camden area and to anyone who interacts with us in relation to our services.

We are committed to handling personal data in a lawful, fair, transparent, and secure manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy sets out the categories of data we process, the lawful bases we rely on, how long we retain information, the processors we use, and the rights available to individuals.

1. Information We Collect

We may collect and process personal data that you provide directly to us, information generated through our services, and limited technical data when you use our systems. The information we collect may include:

Identity information such as your name, date of birth, and identification details where needed for account setup or verification.
Contact information such as postal address, email address, and telephone number.
Account and service information including storage unit details, booking records, payment status, move-in and move-out dates, and correspondence.
Payment information such as billing details and transaction records. Payment card details are typically handled by secure payment providers rather than stored by us in full.
Security information such as CCTV footage, access logs, visitor records, incident reports, and key or access credential records where applicable.
Communications including emails, messages, complaints, queries, and any records of phone or written communications.
Technical information such as IP address, device details, browser type, and usage data if you interact with our digital systems.

We may also receive information from third parties where necessary, such as payment providers, identity verification services, insurers, or law enforcement authorities. Where this happens, we will only use the information in ways that are consistent with this policy and applicable law.

2. How We Use Personal Data

We use personal data for the following purposes:

to provide storage services, manage bookings, and maintain customer accounts;
to verify identity and prevent fraud, misuse, or unauthorised access;
to process payments, invoices, refunds, and account administration;
to communicate about service updates, reminders, contractual matters, or operational issues;
to manage site security, protect property, and investigate incidents;
to comply with legal and regulatory obligations;
to resolve disputes, enforce agreements, and establish, exercise, or defend legal claims;
to improve our services, processes, and security measures;
to maintain business records and internal reporting.

We will not use personal data for purposes that are incompatible with the reason it was collected, unless we have a lawful basis to do so and it is permitted by law.

3. Lawful Basis for Processing

Under data protection law, we must identify a lawful basis before processing personal data. The lawful bases we may rely on are:

Performance of a Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes managing your storage agreement, issuing invoices, providing access, and delivering related services.

Legal Obligation

We may process personal data where necessary to comply with legal requirements, including accounting, tax, security, fraud prevention, and responding to lawful requests from authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests or those of a third party, provided your rights and interests do not override those interests. Examples include protecting our premises, preventing crime, maintaining records, improving services, and managing disputes. When we rely on legitimate interests, we assess whether the processing is necessary and proportionate.

Consent

In limited circumstances, we may rely on your consent, for example for specific optional communications or processing where consent is the most appropriate basis. Where we rely on consent, you may withdraw it at any time.

Vital Interests

In rare cases, we may process personal data to protect someone’s vital interests, such as in an emergency involving health or safety.

4. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, reporting, and operational requirements. Retention periods may vary depending on the type of data and the reason for processing.

Customer account and contract records are normally retained for the duration of the service relationship and for a period afterwards to deal with queries, claims, and legal obligations.
Payment and accounting records are retained for the period required by tax and financial regulations.
Security records such as CCTV footage and access logs are retained only as long as needed for security, investigation, or incident management, unless a longer period is required for legal reasons.
Correspondence and complaints may be retained while a matter is active and for a reasonable time afterwards for audit and defence purposes.

When personal data is no longer required, we will delete it securely or anonymise it so it can no longer identify you.

5. Processors and Sharing of Data

We may share personal data with trusted third parties who act as processors or independent controllers, but only where necessary and appropriate. These parties are required to handle data securely and in accordance with data protection law.

Processors may include:

IT and cloud service providers that support our systems, storage, and security;
payment processors that handle billing and transaction processing;
identity verification or fraud prevention providers used to confirm details and reduce risk;
security service providers such as CCTV or access control system suppliers;
accounting and administrative service providers supporting finance and record keeping;
professional advisers such as legal, insurance, or audit advisers where needed;
public authorities or law enforcement where disclosure is required by law.

We require processors to process data only on our instructions where they are acting for us, to use appropriate security measures, and not to use personal data for their own purposes unless they are acting as an independent controller under their own legal obligations.

6. Data Security

We implement appropriate technical and organisational measures to protect personal data from unauthorised access, loss, alteration, or disclosure. These measures may include access controls, secure storage, staff training, confidentiality obligations, and regular review of our systems and procedures. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights

Under data protection law, you may have the following rights in relation to your personal data:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain circumstances.
Right to restriction – to ask us to limit processing in certain situations.
Right to data portability – to receive certain data in a structured, commonly used format where applicable.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.
Right to lodge a complaint – to complain to the UK Information Commissioner’s Office if you believe your data rights have been infringed.

Some rights may be limited where the law permits or requires us to retain or process information. We will respond to requests in accordance with applicable data protection rules and may need to verify your identity before acting on a request.

8. International Transfers

If personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place so that your information remains protected to a standard consistent with UK data protection law. These safeguards may include adequacy regulations or approved contractual protections.

9. Children’s Data

Our services are intended for adults. We do not knowingly collect personal data from children except where it is necessary for a lawful purpose connected to our services and where appropriate consent or authority is in place.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or how we process personal data. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to stay informed.

11. Summary of Our Commitment

Selfstorage Camden is committed to processing personal data lawfully, transparently, and securely. We only collect information that is relevant to providing storage services, running our business, and meeting our legal responsibilities. We retain data only for as long as necessary, use trusted processors under appropriate safeguards, and respect the rights of the individuals whose data we hold. This policy applies to all Selfstorage Camden customers in the Camden area and is intended to give a clear and fair explanation of our privacy practices.