Privacy Policy - Selfstorage Belsizepark

This Privacy Policy explains how Selfstorage Belsizepark collects, uses, stores, shares, and protects personal data. It applies to all Selfstorage Belsizepark customers in area, including individuals and businesses that use our storage services, make enquiries, or otherwise interact with us in connection with our services. We are committed to handling personal data in a lawful, fair, transparent, and secure manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our services, you acknowledge that your personal data may be processed in line with this Privacy Policy. We encourage you to read it carefully so you understand what information we collect, why we collect it, how long we keep it, and what rights you have over your data.

1. Personal Data We Collect

We may collect different categories of personal data depending on how you interact with us and which services you use. The data we collect may include:

Identity details such as your name, title, and date of birth where required for verification purposes.
Contact details such as postal address, email address, and telephone number.
Account and contract information including storage unit details, service preferences, booking records, and rental agreements.
Payment information such as billing details, partial card information, bank details, and transaction history, processed securely through payment providers.
Verification information such as identification documents and proof of address, where required for fraud prevention, security checks, or legal compliance.
Communication records including enquiries, complaints, feedback, and correspondence.
Security and access information such as access logs, CCTV images, and records of entry or exit where applicable.
Technical data such as device information, IP address, and usage data if you interact with our digital systems.

We generally collect personal data directly from you. In some cases, we may also receive information from third parties such as payment processors, identity verification providers, insurers, or public authorities where lawful and necessary.

2. How We Use Personal Data

We use personal data only where we have a lawful basis to do so. Our purposes for processing include:

Setting up and managing customer accounts and storage agreements.
Providing storage services and related customer support.
Processing payments, refunds, and account administration.
Verifying identity and preventing fraud, misuse, or unauthorised access.
Maintaining the safety, security, and integrity of our premises and systems.
Responding to enquiries, complaints, and legal claims.
Meeting legal and regulatory obligations, including accounting, tax, and record-keeping duties.
Improving our services, operational efficiency, and customer experience.
Sending important service communications about your account, contractual changes, or policy updates.

We will not use your personal data for purposes that are incompatible with the reasons it was collected unless we have a valid legal basis to do so and you have been informed where required.

3. Lawful Basis for Processing

Under data protection law, we must identify a lawful basis before processing your personal data. Depending on the circumstances, we may rely on one or more of the following bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes managing your storage agreement, processing payments, providing access to your unit, and delivering customer support.

Legal Obligation

We may process personal data to comply with legal requirements, such as tax obligations, financial record-keeping, anti-fraud measures, or responding to lawful requests from authorities.

Legitimate Interests

We may process data where it is necessary for our legitimate interests, provided these do not override your rights and freedoms. This may include protecting our premises, preventing crime, improving services, managing risk, and handling internal administration.

Consent

In limited cases, we may rely on your consent, for example for certain optional communications or specific processing activities. Where consent is used, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. Retention of Personal Data

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including meeting legal, accounting, and reporting requirements. Retention periods depend on the type of information and the reason it was collected.

In general:

Contract and account records may be retained for the duration of the customer relationship and for a reasonable period afterwards for legal defence, administration, and audit purposes.
Financial and tax records are kept for the period required by law.
Security records such as access logs or CCTV footage are retained only for as long as necessary for security and incident management, unless required for an investigation.
Enquiry records may be retained for a limited period after your last interaction with us unless they become part of an active customer record or legal matter.

When personal data is no longer needed, it is securely deleted, anonymised, or archived in line with our retention procedures.

5. Processors and Data Sharing

We may share personal data with carefully selected third-party processors who act on our behalf and only process data according to our instructions. These processors may include:

Payment service providers that handle secure payment processing.
IT and cloud service providers that support storage, hosting, maintenance, and communication systems.
Identity verification providers that assist with anti-fraud and compliance checks.
Security providers that support site protection, monitoring, or access control.
Professional advisers such as accountants, lawyers, and insurers where necessary.
Regulatory, law enforcement, or public authorities where disclosure is required by law or necessary to protect legal rights.

We require all processors to apply appropriate technical and organisational measures to protect personal data and to process it only for agreed purposes. We do not sell your personal data.

Where personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or equivalent lawful mechanisms designed to protect your information.

6. Data Security

We take the security of personal data seriously and use reasonable technical and organisational measures to protect it from loss, unauthorised access, misuse, alteration, or disclosure. These measures may include access controls, encryption, staff confidentiality obligations, secure storage, and regular review of our security practices.

While we work to protect personal data, no system can be guaranteed to be completely secure. If a personal data breach occurs and we are legally required to do so, we will notify the relevant supervisory authority and affected individuals.

7. Your Rights

As a data subject, you have rights under data protection law in relation to your personal data. Subject to legal limits and verification of identity, you may have the right to:

Access your personal data and receive a copy of the information we hold about you.
Rectification of inaccurate or incomplete personal data.
Erasure of your personal data in certain circumstances.
Restriction of processing in certain cases.
Object to processing based on legitimate interests or for direct marketing.
Data portability where processing is based on consent or contract and carried out by automated means.
Withdraw consent at any time where we rely on consent.
Complain to the relevant data protection authority if you believe your rights have been infringed.

We may need to request information to confirm your identity before responding to a rights request. We aim to respond within the timeframes required by law.

8. Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, unless we have informed you and the law permits it. If automated tools are used in limited operational processes, we will ensure appropriate safeguards are in place.

9. Children’s Data

Our services are generally intended for adults. We do not knowingly collect personal data from children except where it is necessary in connection with a lawful customer arrangement or required by law. If we become aware that we have collected data from a child without appropriate authority, we will take steps to delete it or seek proper consent where permitted.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, operational practices, or service offerings. Any updated version will take effect when published or when otherwise communicated to you. We encourage you to review this policy periodically so you remain informed about how we protect your personal data.

Last updated: This policy is intended to apply to all Selfstorage Belsizepark customers in area and governs the processing of personal data connected with our storage services.

We are committed to respecting your privacy and to handling your personal data responsibly, transparently, and securely. This Privacy Policy is designed to reflect GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.