Privacy Policy - Selfstorage Shoreditch

Selfstorage Shoreditch is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect information relating to customers, prospective customers, visitors, and anyone else who interacts with our services in Shoreditch and the surrounding area. It applies to all Selfstorage Shoreditch customers in the area, including individuals, sole traders, and business users who use our storage facilities or related services.

1. Who we are

For the purposes of the UK GDPR and the Data Protection Act 2018, Selfstorage Shoreditch acts as the data controller for personal data collected in connection with our storage services, account management, billing, security, and customer support activities. This means we decide why and how your personal data is used.

We are committed to handling personal data in a lawful, fair, and transparent manner. We collect only what is necessary and process it in a way that is proportionate to the services we provide.

2. Personal data we collect

We may collect and process the following categories of personal data:

Identity data such as your name, date of birth, and identification details.
Contact data such as your address, email address, and telephone number.
Contract and account data such as storage unit details, rental dates, payment status, and account correspondence.
Financial data such as billing information, payment records, and transaction history.
Security data such as CCTV footage, access logs, entry records, and incident reports.
Communication data such as enquiries, complaints, feedback, and records of interactions with our staff.
Technical data where relevant, such as device information or online activity when you use our digital systems.

We do not intentionally collect special category data unless it is provided to us by you and is necessary for a specific lawful purpose, for example in connection with a complaint, legal claim, or safeguarding matter.

3. How we collect your data

We collect personal data directly from you when you:

enquire about our services;
enter into a storage agreement;
complete forms or provide identification documents;
make payments or update your account;
contact us with a question, complaint, or request;
visit our premises where CCTV or access control systems are in operation.

We may also receive data from third parties where necessary, such as payment providers, identity verification services, insurance providers, debt recovery partners, legal advisers, or public authorities.

4. Why we use your personal data

We use personal data for the following purposes:

to provide and manage storage services;
to open and administer customer accounts;
to take payment and manage invoices;
to verify identity and prevent fraud;
to manage access to storage facilities;
to monitor site safety and security;
to communicate with you about your account or service use;
to handle complaints, disputes, and claims;
to comply with legal, regulatory, and tax obligations;
to maintain business records and improve our services.

We will only use your data where we have a lawful reason to do so.

5. Lawful basis for processing

Under data protection law, we must have a lawful basis for each use of your personal data. Depending on the context, we rely on one or more of the following:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes managing your storage agreement, processing payments, providing access, and responding to service requests.

Legal obligation

We may process your data to comply with legal requirements, such as tax rules, accounting obligations, fraud prevention duties, health and safety requirements, and lawful requests from authorities.

Legitimate interests

We may process personal data where it is necessary for our legitimate interests, provided your rights and freedoms do not override those interests. This may include protecting our premises, preventing theft, managing disputes, improving operations, and securing our records and systems.

Consent

In limited situations, we may rely on your consent, for example for certain optional communications. Where consent is used, you may withdraw it at any time.

Vital interests

In rare circumstances, we may process data where it is necessary to protect someone’s vital interests, such as in an emergency.

6. Data sharing and processors

We do not sell your personal data. However, we may share it with trusted third parties who process data on our behalf or who act as independent controllers in their own right.

Our processors may include:

Payment service providers who handle card and direct payment transactions;
IT and cloud service providers who store, secure, or support our systems;
Identity verification providers who assist with customer checks;
Security providers who support monitoring, alarms, or CCTV systems;
Accountancy and audit services who support financial records and compliance;
Legal and professional advisers who assist with disputes, claims, or regulatory matters;
Debt recovery or enforcement partners where necessary to recover unpaid sums or enforce agreements.

Where we use processors, we ensure appropriate data processing terms are in place and that they only process data on our instructions, unless they are legally required to do otherwise.

We may also disclose personal data if required by law, court order, or regulatory authority, or to protect the rights, property, or safety of Selfstorage Shoreditch, our customers, or others.

7. International transfers

If any of our service providers transfer personal data outside the UK, we will ensure suitable safeguards are in place. These may include adequacy regulations, standard contractual clauses, or equivalent protective measures required under applicable law.

8. Data retention

We keep personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Retention periods vary depending on the type of data and why it is processed.

Customer and contract records are generally retained for the duration of the service relationship and for a reasonable period afterwards.
Financial and tax records are retained for the periods required by law and accounting practice.
CCTV and access records are kept for a limited period unless needed for investigation, legal proceedings, or insurance claims.
Complaint and dispute records are retained for as long as necessary to resolve the matter and defend our legal position.

When data is no longer needed, we will delete, anonymise, or securely destroy it.

9. Data security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. These measures may include access controls, encryption, secure storage, staff training, and restricted administrative access. While no system can be guaranteed completely secure, we take privacy and security seriously and regularly review our safeguards.

10. Your rights

Depending on the circumstances, you have several rights under data protection law:

Right of access - to request a copy of the personal data we hold about you.
Right to rectification - to ask us to correct inaccurate or incomplete data.
Right to erasure - to ask us to delete personal data in certain situations.
Right to restriction - to request limited use of your data in certain cases.
Right to object - to object to processing based on legitimate interests or direct marketing.
Right to data portability - to receive certain data in a structured, commonly used format where applicable.
Right to withdraw consent - where processing is based on consent.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office if you believe your data protection rights have been violated. We encourage you to contact us first so we can try to resolve any concerns.

11. Automated decision-making

We do not generally use fully automated decision-making that produces legal or similarly significant effects. If this changes, we will inform you and explain the logic involved, the significance, and the possible consequences.

12. Children

Our services are intended for adults. We do not knowingly collect personal data from children except where it is necessary and lawful in the context of a customer arrangement, legal obligation, or emergency situation.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will apply from the date it is published or otherwise made available. We encourage customers to review this notice periodically to stay informed about how we protect personal data.

14. Summary of our approach

At Selfstorage Shoreditch, our approach is simple: collect only what we need, use it fairly, keep it secure, and retain it only for as long as necessary. We aim to maintain trust through clear and lawful handling of personal information for every customer in Shoreditch and the surrounding area.

This Privacy Policy is designed to reflect GDPR principles, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.