Privacy Policy - Selfstorage Westkensington

This Privacy Policy explains how Selfstorage Westkensington collects, uses, stores, shares, and protects personal data. It applies to all Selfstorage Westkensington customers in the area, including prospective customers, current customers, former customers, and individuals who interact with us in connection with storage services, account management, billing, access control, security, or customer support.

We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We aim to keep your information secure, use it fairly and lawfully, and respect your rights.

1. Data We Collect

We collect only the personal data that is necessary for our storage services and related operations. The categories of data we may collect include:

Identity information, such as your name, date of birth, and proof of identity when required.
Contact details, such as postal address, email address, and telephone number.
Account and contract details, including storage unit information, booking history, payment status, invoices, and service preferences.
Payment information, such as bank details or payment card information, where needed to process payments or refunds.
Access and security information, such as entry records, key or access code usage, CCTV footage, and incident reports.
Communications, including enquiries, complaints, feedback, and correspondence with our team.
Technical information, such as device identifiers, log data, and online usage information if you interact with digital systems connected to our services.

We may also collect limited special category data only where strictly necessary and permitted by law, for example if you provide health-related information in connection with an accessibility request or a safety issue. Such data is handled with additional care and only where there is a lawful basis to do so.

2. How We Use Your Data

We use personal data for the following purposes:

to set up and manage customer accounts;
to provide storage services and maintain access to storage units;
to verify identity and prevent fraud;
to process payments, refunds, and account administration;
to maintain site safety, security, and operational integrity;
to respond to enquiries, complaints, and service requests;
to comply with legal obligations, including accounting, tax, and regulatory requirements;
to defend, establish, or exercise legal claims;
to improve our services, systems, and customer experience;
to send service-related notices and administrative updates.

We do not use your personal data for unrelated purposes without informing you, unless required or permitted by law.

3. Lawful Basis for Processing

We process personal data only when we have a valid lawful basis. Depending on the context, the lawful bases we rely on are:

Performance of a Contract

We process data where it is necessary to enter into or perform our storage agreement with you. This includes managing bookings, providing access to units, handling billing, and delivering customer support connected to the service.

Legal Obligation

We may process data to meet legal requirements, such as record keeping, tax compliance, fraud prevention, health and safety obligations, or responding to lawful requests from authorities.

Legitimate Interests

We may process data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include protecting our premises, improving service quality, managing disputes, and preventing misuse of our facilities.

Consent

In limited circumstances, we may rely on your consent, for example where required for certain optional communications or specific uses of data. If we rely on consent, you may withdraw it at any time. Withdrawal will not affect processing carried out before consent was withdrawn.

Vital Interests and Legal Claims

In rare situations, processing may be necessary to protect someone’s vital interests or to establish, exercise, or defend legal claims.

4. Sharing and Processors

We may share personal data with trusted third parties who act as processors on our behalf or, in some cases, as independent controllers. We require all third parties to handle data lawfully, securely, and only for specified purposes.

Examples of processors may include:

Payment service providers who handle transaction processing;
IT and cloud service providers who support our systems, storage, and data security;
Security providers who assist with site monitoring, alarm systems, or incident management;
Accounting or administrative service providers who help with invoicing, record keeping, and internal operations;
Customer communication providers who help deliver service notices or operational messages;
Professional advisers, such as legal, audit, or insurance advisers, where necessary.

We may also disclose personal data to public authorities, courts, law enforcement, or regulators when required by law or when necessary to protect our rights, customers, staff, or property.

Where processors act on our instructions, they are only permitted to use personal data in accordance with our contract and applicable data protection law. We do not sell your personal data.

5. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, and for any additional period required by law or to establish, exercise, or defend legal claims.

The retention period depends on the type of data and the reason it is held. For example:

Contract and account records are generally kept for the duration of the relationship and for a reasonable period afterwards.
Financial and tax records are retained for the period required by accounting and tax laws.
Security records, such as CCTV footage or access logs, are usually retained for a shorter period unless needed for incident investigation, fraud prevention, or legal proceedings.
Correspondence and complaint records may be retained for a period necessary to manage disputes and service improvement.

When data is no longer required, it is securely deleted, anonymised, or otherwise disposed of in accordance with our retention procedures.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures may include access controls, secure storage, staff training, monitoring, and procedural safeguards. While no system can be guaranteed to be perfectly secure, we take reasonable steps to reduce risk and respond appropriately to incidents.

7. Your Rights

Under data protection law, you have several rights in relation to your personal data. Subject to legal conditions and exemptions, these include:

Right of access – to request confirmation of whether we process your personal data and obtain a copy of it;
Right to rectification – to request correction of inaccurate or incomplete data;
Right to erasure – to request deletion of your data in certain circumstances;
Right to restriction – to request that processing be limited in certain situations;
Right to data portability – to receive certain data in a structured, commonly used format;
Right to object – to object to processing based on legitimate interests or direct marketing;
Right to withdraw consent – where processing is based on consent;
Right to complain – to raise concerns with the relevant supervisory authority if you believe your data has been handled unlawfully.

We may need to verify your identity before responding to a request. We will aim to respond within the time periods required by law.

8. Children’s Data

Our storage services are not directed at children. We do not knowingly collect personal data from children unless it is necessary in connection with a lawful business or legal purpose and appropriate safeguards are in place.

9. International Transfers

If personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place, such as an adequacy decision, standard contractual clauses, or another lawful transfer mechanism approved under data protection law.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or service changes. Any updated version will apply from the date it is made available. We encourage you to review this policy periodically to stay informed about how we handle personal data.

11. Summary of Our Commitment

At Selfstorage Westkensington, we handle personal data responsibly, transparently, and only as needed to deliver secure storage services and related support. We process information fairly, keep it for no longer than necessary, and respect your rights under data protection law. Your privacy matters to us, and we are committed to maintaining trust through careful data handling and lawful processing practices.