Privacy Policy - Selfstorage Edgware

This Privacy Policy applies to all Selfstorage Edgware customers in the Edgware area and explains how personal data is collected, used, stored, shared, and protected in accordance with the UK GDPR and the Data Protection Act 2018. We are committed to handling personal information fairly, lawfully, and transparently. By using our storage services, making an enquiry, entering into a storage agreement, or otherwise interacting with Selfstorage Edgware, you acknowledge the practices described in this policy.

1. Who We Are

Selfstorage Edgware provides self-storage services to individuals, families, and businesses in the local area. In delivering these services, we act as a data controller for the personal data we collect and use for our own purposes. This means we determine why and how your personal information is processed. We take data protection seriously and work to ensure that all personal data is processed in a secure, proportionate, and transparent way.

2. Personal Data We Collect

We may collect and process the following categories of personal data, depending on your relationship with us:

Identity details: name, date of birth, and identification information used to verify who you are.
Contact details: postal address, email address, and telephone number.
Account and contract details: storage unit number, contract dates, payment history, and service preferences.
Financial details: billing information, payment records, and limited transaction data required to manage payments.
Security information: CCTV footage, access logs, entry records, and incident reports.
Communications: records of emails, messages, telephone calls, complaints, and other correspondence.
Website or digital data: IP address, device information, cookies, and usage data if you interact with our digital services.
Special categories of data: we do not normally seek to collect special category data. If such data is provided to us, we will only process it where a lawful basis exists and additional safeguards apply.

3. How We Use Personal Data

We use your personal data for the following purposes:

to set up and manage your storage account;
to verify identity and prevent fraud;
to take payments, issue invoices, and handle account administration;
to maintain the security of our premises, staff, customers, and stored goods;
to respond to enquiries, complaints, and requests;
to comply with legal and regulatory obligations;
to enforce our terms, recover debts, and manage disputes;
to improve our operations, services, and customer experience;
to send administrative notices relevant to your storage agreement.

We only process personal data where we have a valid lawful basis to do so.

4. Lawful Basis for Processing

Under the UK GDPR, we must identify a lawful basis before processing personal data. Depending on the activity, we rely on one or more of the following:

Contract

We process personal data where it is necessary to enter into or perform a storage contract with you. This includes setting up your account, managing access, processing payments, and fulfilling our obligations under the agreement.

Legal Obligation

We may process personal data where required to comply with applicable laws, such as tax, accounting, fraud prevention, health and safety, and record-keeping requirements.

Legitimate Interests

We may process data where it is necessary for our legitimate interests, provided your interests and fundamental rights do not override those interests. Examples include protecting the site from theft, maintaining security, preventing misuse of our services, and improving service quality.

Consent

In limited circumstances, we may rely on your consent, for example where you choose to receive optional marketing communications or when certain non-essential cookies are used. Where consent is used, you may withdraw it at any time.

Vital Interests

In rare cases, we may process personal data to protect someone’s life or physical safety.

5. Sharing Your Information and Processors

We may share personal data with trusted third parties where necessary for the purposes described in this policy. These third parties may act as data processors or independent controllers, depending on the service provided.

Processors we may use include:

Payment service providers that process card or bank payments securely;
IT and software providers that host, maintain, or support our systems;
Security service providers that assist with alarms, CCTV, or site monitoring;
Accountancy and auditing providers that support financial administration and compliance;
Professional advisers such as lawyers, insurers, or consultants;
Delivery or logistics providers if services require coordinated access or handling;
Public authorities where disclosure is required by law or necessary for legal proceedings.

All processors are required to protect personal data, act only on our instructions where applicable, and use appropriate technical and organisational safeguards. We do not sell your personal data.

6. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, and reporting requirements. Retention periods may vary depending on the type of data and the reason for processing.

In general:

Contract and account records are kept for the duration of the storage relationship and for a period afterward where needed for claims, disputes, or compliance.
Financial records are retained in line with tax and accounting obligations.
Security records, including CCTV, are kept only for a limited period unless needed in relation to an incident, investigation, or legal claim.
Enquiry and correspondence records are kept for as long as reasonably necessary to handle the matter and maintain accurate business records.

When personal data is no longer required, we will securely delete, anonymise, or otherwise dispose of it in accordance with our retention procedures.

7. Security of Your Data

We implement appropriate technical and organisational measures to safeguard personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff training, and physical security safeguards. While no system is completely secure, we regularly review our controls and update them where necessary to reduce risk.

8. Your Rights Under Data Protection Law

As a data subject, you have a number of rights under the UK GDPR. These rights may apply depending on the circumstances and applicable exemptions.

Right of access: you may request a copy of the personal data we hold about you.
Right to rectification: you may ask us to correct inaccurate or incomplete data.
Right to erasure: you may request deletion of your data in certain situations.
Right to restriction: you may ask us to limit how we use your data in certain circumstances.
Right to object: you may object to processing based on legitimate interests or direct marketing.
Right to data portability: you may request your data in a structured, commonly used format where processing is based on consent or contract and carried out by automated means.
Right to withdraw consent: where we rely on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we will respond within the timescales required by law. We may need to verify your identity before acting on your request.

9. Cookies and Similar Technologies

If you use our digital services, we may use cookies or similar technologies to support functionality, improve performance, and understand usage patterns. Non-essential cookies will only be used where permitted by law and, if required, with your consent. You can manage cookie preferences through your browser or device settings.

10. International Transfers

Where personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place to protect your information. Such safeguards may include adequacy regulations, standard contractual clauses, or other legally recognised transfer mechanisms.

11. Children’s Data

Our services are not intended for children under 16 without the involvement of a parent or guardian. We do not knowingly collect personal data from children except where reasonably necessary in connection with a storage service and with appropriate authority or consent.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal obligations, business practices, or service developments. Any updates will take effect when published or otherwise communicated as required. We encourage customers in the Edgware area to review this policy periodically so they remain informed about how their data is handled.

13. Complaints and Further Information

If you have concerns about how your personal data is used, you may raise them with us so we can review the matter. You also have the right to lodge a complaint with the UK Information Commissioner’s Office if you believe your data protection rights have been infringed.

By using Selfstorage Edgware services, you acknowledge that you have read and understood this Privacy Policy and that your personal data will be processed in accordance with the principles set out above.