Privacy Policy - Selfstorage Shepherdsbush

This Privacy Policy explains how Selfstorage Shepherdsbush collects, uses, stores, shares, and protects personal data relating to its customers in the Shepherdsbush area. It applies to all Selfstorage Shepherdsbush customers in area, including prospective customers, current customers, former customers, and individuals who interact with us in connection with storage services, account management, billing, security, and customer support.

We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy should be read carefully so you understand how your information is processed and what rights you have.

1. Data We Collect

We may collect and process the following categories of personal data:

Identity information such as your name, title, date of birth, and proof of identity where required.
Contact details such as billing address, correspondence address, telephone number, and email address.
Account information such as customer reference numbers, storage unit details, booking history, contract details, and payment status.
Financial information such as payment card details, bank account details, transaction records, invoices, and receipts.
Security information such as access logs, CCTV footage, alarm records, vehicle registration details, and site entry records where applicable.
Communications data such as records of emails, letters, calls, complaints, queries, and support requests.
Technical data such as IP address, device information, browser type, and usage data if you interact with digital systems used for administration or customer service.
Special category data only where strictly necessary and where the law allows it, for example if you voluntarily provide information needed to support a disability-related request or other legitimate accommodation.

We generally collect personal data directly from you when you enquire about storage, sign a contract, make payments, enter our premises, or communicate with us. In some cases, we may also receive data from third parties such as payment providers, fraud prevention services, insurers, legal advisers, or persons acting on your behalf.

2. How We Use Your Data

We use your personal data for the following purposes:

to provide and manage storage services;
to open, administer, and close accounts;
to process payments, deposits, refunds, and billing;
to verify identity and prevent fraud;
to communicate with you about your account, site rules, or service changes;
to manage access to premises and protect the safety and security of customers, staff, and property;
to handle complaints, claims, disputes, and legal matters;
to comply with legal and regulatory obligations;
to improve service quality, operational efficiency, and record keeping;
to defend our rights and interests where necessary.

We only use your personal data for specified and lawful purposes. We do not sell your personal data.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis to process your personal data. Depending on the context, we rely on one or more of the following lawful bases:

Contract

We process your data where it is necessary to enter into or perform a contract with you, such as setting up a storage agreement, managing your unit, taking payment, and providing related services.

Legal obligation

We process data where required to comply with legal obligations, including accounting, tax, fraud prevention, safeguarding, and responding to lawful requests from public authorities.

Legitimate interests

We may process data where it is necessary for our legitimate interests, provided your interests and rights do not override those interests. This includes maintaining security, monitoring site access, preventing misuse, improving our services, and managing business records. Where we rely on legitimate interests, we assess the impact on your privacy and take appropriate safeguards.

Consent

In limited cases, we may rely on your consent, for example for optional communications or specific uses of certain data. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital interests and public interest

These bases are used only in rare circumstances, such as an emergency or where processing is necessary for reasons of substantial public interest as permitted by law.

4. Data Sharing and Processors

We may share personal data with trusted third parties who act as processors or independent controllers, depending on the purpose of the disclosure. Where a third party acts as a processor, they only process data on our instructions and must protect it appropriately.

Our processors and recipients may include:

Payment service providers who process card and bank payments securely;
IT and cloud service providers who support data storage, email, systems administration, and cybersecurity;
Accounting and bookkeeping providers who assist with invoices, records, and tax obligations;
Security providers who support CCTV, alarms, access controls, and site monitoring;
Customer service and communications providers who help us manage enquiries and service updates;
Professional advisers such as lawyers, insurers, auditors, and consultants;
Debt recovery and credit control partners where necessary to recover unpaid sums;
Regulators, courts, law enforcement, or other authorities where disclosure is required or permitted by law.

We require processors to implement appropriate technical and organisational security measures and to process personal data only for the agreed purpose. If personal data is transferred outside the UK, we ensure suitable safeguards are in place in accordance with applicable law.

5. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, reporting, and security requirements. Retention periods vary depending on the type of data and the context of the relationship.

Contract and account records are generally kept for the duration of the customer relationship and for a reasonable period afterwards to handle queries or disputes.
Financial and tax records are typically retained for the period required by law.
Security records such as access logs or CCTV footage are retained only for as long as necessary for security and incident management.
Correspondence and complaint records may be retained to evidence communications and resolution outcomes.

When data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access restrictions, encryption, secure storage, staff training, monitoring, and regular review of our processes. While no system can be guaranteed completely secure, we take data protection seriously and continually work to reduce risk.

7. Your Rights

Under data protection law, you have a number of rights regarding your personal data. These rights may be subject to exceptions or limitations under the law.

Right of access – you can request a copy of the personal data we hold about you.
Right to rectification – you can ask us to correct inaccurate or incomplete data.
Right to erasure – in certain circumstances, you can ask us to delete your data.
Right to restrict processing – you can ask us to limit how we use your data in certain situations.
Right to data portability – you can request that certain information be provided in a structured, commonly used format.
Right to object – you can object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where we rely on consent, you can withdraw it at any time.
Right to complain – you can raise a concern with the relevant data protection authority if you believe your rights have been infringed.

If you wish to exercise any of these rights, we may need to verify your identity before responding. We will respond within the time limits required by law and may extend the period where requests are complex or numerous.

8. Children’s Data

Our services are not intended for children, and we do not knowingly collect personal data from children except where necessary in connection with a lawful customer relationship or where a parent or guardian provides information on their behalf.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or security standards. Any updated version will apply from the date it is made available. We encourage customers to review this policy periodically so they remain informed about how their data is handled.

10. Summary of Key Points

This policy applies to all Selfstorage Shepherdsbush customers in area.
We collect only the data needed to provide storage services, manage security, process payments, and meet legal obligations.
Our main lawful bases are contract, legal obligation, legitimate interests, and, in limited cases, consent.
We share data only with trusted processors and other parties where necessary and lawful.
We retain data only as long as needed and then securely delete or anonymise it.
You have rights over your personal data, including access, correction, deletion, objection, and complaint.

By using our services, you acknowledge that you have read and understood this Privacy Policy.

We aim to process all personal data responsibly, securely, and in a manner that respects your privacy.