Privacy Policy - Selfstorage Finsburypark

This Privacy Policy explains how Selfstorage Finsburypark collects, uses, stores, shares, and protects personal data relating to its customers and prospective customers. It applies to all Selfstorage Finsburypark customers in the area, including individuals and business users who enquire about, reserve, access, or use storage services. We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who this policy applies to

This policy applies to:

current and former customers;
people who request quotations or make enquiries;
account holders, authorised users, and nominated contacts;
visitors to our storage facilities where personal data is collected through access systems, CCTV, or security logs;
individuals whose information is provided to us by a customer, such as emergency contacts or business representatives.

By using our services, you acknowledge that your personal data may be processed as described in this policy.

2. Personal data we collect

We only collect personal data that is necessary for operating our services, meeting legal obligations, and protecting our legitimate interests. The categories of data we may collect include:

Identity and contact details

full name;
date of birth where needed for verification;
postal address;
email address;
telephone number;
business name and position, where applicable.

Account and service information

storage unit details;
reservation and booking records;
payment status and account history;
communication records;
access logs and security records;
details of goods stored, where necessary for administration or safety.

Technical and security information

CCTV footage;
entry system data;
vehicle registration details where recorded for site security;
device or browser information if you interact with digital services;
incident reports and audit trails.

Special category data

We do not seek to collect special category data such as health, racial or ethnic origin, religious beliefs, or biometric data. If such information is voluntarily provided to us, we will only process it where there is a valid legal basis and appropriate safeguards.

3. How we collect personal data

We may collect personal data directly from you when you:

make an enquiry or request a quote;
sign a storage agreement;
make a payment or manage your account;
contact us by email, phone, or in writing;
use our premises, facilities, or access systems;
participate in identity or security checks.

We may also collect data from third parties, for example:

payment providers;
identity verification providers;
debt recovery or fraud prevention services;
publicly available sources where necessary and lawful;
people acting on your behalf or authorised by you.

4. How we use personal data

We use personal data for the following purposes:

to provide storage services and manage contracts;
to verify identity and prevent fraud;
to process payments, refunds, and account balances;
to communicate with customers about bookings, renewals, access, or service changes;
to maintain security and protect customers, staff, and property;
to investigate incidents, disputes, or claims;
to comply with legal and regulatory obligations;
to improve our services, systems, and customer experience;
to pursue or defend legal claims.

We will only use your personal data for the purposes for which it was collected, unless we reasonably determine that we need to use it for a compatible purpose or a lawful new purpose.

5. Lawful basis for processing

Under UK GDPR, we must have a lawful basis for every processing activity. Depending on the circumstances, we rely on the following bases:

Performance of a contract

We process personal data where it is necessary to enter into or perform our storage agreement with you, such as setting up an account, managing access, taking payment, and delivering storage services.

Legal obligation

We may process data where needed to comply with applicable laws, including accounting, tax, health and safety, and lawful requests from public authorities.

Legitimate interests

We may process personal data for our legitimate interests, provided those interests are not overridden by your rights and freedoms. This includes security monitoring, fraud prevention, service improvement, internal administration, and legal protection.

Consent

In limited cases, we may rely on your consent, for example where consent is required for optional communications or certain processing activities. Where we rely on consent, you may withdraw it at any time.

Vital interests and public task

These bases are unlikely to apply in normal circumstances, but may be used if necessary in exceptional situations to protect someone’s life or where required by law.

6. Sharing your personal data and processors

We may share personal data with trusted third parties where necessary to operate our services, protect our business, or comply with the law. These third parties may act as processors or independent controllers.

Processors

A processor is a third party that processes personal data on our behalf and under our instructions. We use processors only where there is a proper contract in place and they provide appropriate security measures. Processors may include:

IT and cloud service providers;
accounting and bookkeeping providers;
payment processing services;
identity verification and fraud prevention providers;
security monitoring and CCTV system providers;
customer relationship and communications platforms;
document storage and archiving services.

Other disclosures

We may also share personal data with:

professional advisers, such as lawyers or insurers;
debt recovery or enforcement agencies where necessary;
law enforcement, regulators, or public authorities;
courts or tribunals;
successors in title, where the business is transferred.

We do not sell your personal data. Where data is shared, we take steps to ensure it is only used for legitimate and lawful purposes.

7. International transfers

Some processors may store or access data outside the United Kingdom. Where this happens, we ensure suitable safeguards are in place, such as adequacy regulations, standard contractual clauses, or equivalent lawful transfer mechanisms. We assess each transfer to make sure your data remains protected to an appropriate standard.

8. Data retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, tax, insurance, and dispute-resolution requirements. Retention periods depend on the type of information and the reason for holding it.

Contract and account records are generally kept for the duration of the storage relationship and for a reasonable period afterward.
Payment and invoicing records are kept for the period required under tax and accounting law.
Security logs and CCTV are retained for a limited period unless needed for an investigation, incident, or legal claim.
Correspondence and complaints may be retained while matters are active and for a further period if required for evidence or compliance.

When personal data is no longer needed, it is securely deleted, anonymised, or destroyed.

9. Data security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption, staff training, secure storage, monitoring, and regular review of internal procedures. While no system can be guaranteed completely secure, we aim to use robust safeguards that are appropriate to the nature of the data we hold.

10. Your rights

Under data protection law, you have a number of rights in relation to your personal data. These rights are not absolute and may be subject to legal conditions or exemptions.

Your rights include:

Right of access – you may request a copy of the personal data we hold about you;
Right to rectification – you may ask us to correct inaccurate or incomplete data;
Right to erasure – you may ask us to delete your data in certain circumstances;
Right to restrict processing – you may ask us to limit how we use your data in certain cases;
Right to data portability – you may request certain data in a structured, commonly used format;
Right to object – you may object to processing based on legitimate interests or direct marketing;
Right to withdraw consent – where processing is based on consent, you can withdraw it at any time;
Right to complain – you may complain to the relevant data protection authority if you believe your rights have been infringed.

We may need to verify your identity before responding to a rights request. We will respond within the time limits required by law, usually within one month, unless the request is complex or numerous.

11. Cookies and similar technologies

If we use websites or digital tools in connection with our services, we may use cookies or similar technologies for essential functionality, security, and service improvement. Where consent is required, we will request it in accordance with applicable law. Any such use will be limited to what is necessary and proportionate.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically so they remain informed about how personal data is handled.

13. Our commitment

Selfstorage Finsburypark is committed to processing personal data fairly, lawfully, and transparently. We only collect what we need, we keep it only as long as necessary, and we protect it with appropriate safeguards. If you are a customer in the area, this policy forms part of our ongoing commitment to responsible data handling and respect for your privacy.

By continuing to use our storage services, you acknowledge that you have read and understood this Privacy Policy.