Privacy Policy - Selfstorage Brixton

This Privacy Policy explains how Selfstorage Brixton collects, uses, stores, shares, and protects personal data. It applies to all Selfstorage Brixton customers in the area, including prospective customers, account holders, authorised users, visitors, and anyone who interacts with our storage services.

We are committed to handling personal information in a lawful, fair, and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We also aim to ensure that your privacy rights are respected and that your data is only used for legitimate and necessary purposes.

1. Information We Collect

We collect personal data that is necessary to provide our storage services, manage customer accounts, meet legal obligations, and improve our operations. The categories of information we may collect include:

Identity data such as your name, date of birth, and identification details where required for verification.
Contact data such as address, email address, and telephone number.
Account and contract data such as booking details, unit allocation, payment status, invoices, and service history.
Payment data such as card or bank details, billing records, and transaction references. Payment information may be processed by secure third-party payment providers.
Security and access data such as CCTV images, key fob logs, gate access records, alarm records, and entry/exit information.
Communications data such as emails, phone calls, complaints, service requests, and correspondence with us.
Technical data such as IP addresses, device information, and website usage data if you interact with any online systems we use.

We generally collect personal data directly from you when you enquire about our services, enter into a storage agreement, make payments, visit the premises, or contact us with a query. In some cases, we may collect data from third parties where this is necessary and lawful, for example from payment providers, identity verification services, insurers, or legal and regulatory bodies.

2. How We Use Your Data

We use personal data only where we have a lawful reason to do so. The main purposes for which we process data are:

To create and manage your customer account.
To provide storage services and administer access to storage units.
To process payments, issue invoices, and recover amounts owed.
To verify identity where required for fraud prevention, security, or compliance purposes.
To communicate with you about your account, contract, or service updates.
To maintain security, prevent unauthorised access, and protect property.
To comply with legal, regulatory, tax, accounting, and insurance obligations.
To investigate disputes, incidents, complaints, or claims.
To improve the quality, efficiency, and safety of our services.

We will not use your personal data for purposes that are incompatible with those described in this policy unless we have informed you and, where required, obtained your consent.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for each type of processing. Selfstorage Brixton relies on the following lawful bases:

Contract

We process personal data when it is necessary to enter into or perform our contract with you. This includes setting up your account, providing storage space, taking payment, and managing your access to services.

Legal Obligation

We process data where necessary to comply with legal duties, such as accounting requirements, tax obligations, anti-fraud checks, regulatory requests, or obligations relating to safety and security.

Legitimate Interests

We may process data where it is necessary for our legitimate business interests, provided these interests are not overridden by your rights and freedoms. Examples include protecting our premises, preventing misuse of services, enforcing our terms, maintaining records, and improving service delivery. We ensure that any such processing is proportionate and privacy-minded.

Consent

In limited situations, we may rely on your consent, for example where optional marketing communications or non-essential cookies are used. If we rely on consent, you can withdraw it at any time. Withdrawal will not affect processing carried out before the consent was withdrawn.

4. Data Sharing and Processors

We may share personal data with trusted third parties where necessary for the purposes described above. When we use third parties to process personal data on our behalf, they act as processors and are only permitted to use the data in accordance with our instructions and applicable law.

Examples of processors and service providers may include:

IT and cloud service providers that host or maintain our systems.
Payment processors that handle card payments, direct debits, or bank transfers.
Identity verification providers used to confirm customer identity where necessary.
Security and surveillance providers supporting access control, CCTV, and alarm systems.
Accounting and administrative service providers assisting with financial records and reporting.
Professional advisers such as lawyers, insurers, auditors, and accountants.

We may also disclose personal data to public authorities, law enforcement agencies, courts, or regulators where required by law or where disclosure is reasonably necessary to protect our rights, the rights of others, or the security of our premises and customers.

Where data is shared with processors, we take steps to ensure appropriate contractual safeguards are in place. These include confidentiality duties, security requirements, limits on sub-processing, and restrictions on international transfers unless adequate protection is provided.

5. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, insurance, and reporting requirements. The length of retention depends on the type of data and the reason for processing.

In general:

Account and contract records are kept for the duration of the customer relationship and for a reasonable period after it ends.
Financial and tax records are retained for the period required by law.
Security records such as access logs and CCTV footage are kept only for as long as necessary for security, monitoring, or investigation purposes.
Communications and complaint records are kept as needed to resolve issues and evidence our dealings with you.

When data is no longer needed, we will securely delete, anonymise, or destroy it. We do not keep data indefinitely, and we review retention practices periodically to ensure they remain appropriate and lawful.

6. Security of Your Data

We use appropriate technical and organisational measures to protect personal data from loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, secure storage, staff training, confidentiality obligations, and monitoring of systems and premises.

Although no system can be guaranteed to be completely secure, we work to maintain a level of protection that is suitable for the nature of the data we process and the risks involved.

7. Your Rights

As a data subject, you have a number of rights under data protection law. Subject to certain conditions and exemptions, these may include:

Right of access – you can request a copy of the personal data we hold about you.
Right to rectification – you can ask us to correct inaccurate or incomplete information.
Right to erasure – you can request deletion of your data in certain circumstances.
Right to restriction – you can ask us to limit how we use your data in certain situations.
Right to data portability – you may request that we provide certain data in a structured, commonly used format.
Right to object – you can object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where we rely on consent, you may withdraw it at any time.

You also have the right to raise concerns about how we handle your personal data. If you believe your data protection rights have been infringed, you may lodge a complaint with the Information Commissioner's Office (ICO) or the relevant supervisory authority.

8. International Transfers

Where personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place. This may include use of adequacy regulations, standard contractual clauses, or other lawful mechanisms designed to protect personal information to a standard consistent with UK data protection law.

9. Children

Our storage services are intended for adults and businesses. We do not knowingly collect personal data from children except where required in limited circumstances and with appropriate legal basis.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. Any updates will take effect when published in the revised version. We encourage customers to review this policy periodically so they remain informed about how their personal data is handled.

11. Final Statement

Selfstorage Brixton is committed to protecting your privacy and handling personal information responsibly. We only collect the data we need, use it for clear and lawful purposes, keep it no longer than necessary, and put safeguards in place when working with processors or other third parties. This policy applies to all Selfstorage Brixton customers in the area and is designed to ensure transparency, accountability, and respect for your rights.