Privacy Policy - Selfstorage Brent

This Privacy Policy explains how Selfstorage Brent collects, uses, stores, shares, and protects personal data in connection with our self-storage services. It applies to all Selfstorage Brent customers in the area, including prospective customers, account holders, authorised users, and any person whose information is provided to us in relation to a storage agreement, enquiry, or service request. We are committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all other applicable privacy laws.

1. Information We Collect

We collect only the personal data that is necessary for specific, explicit, and legitimate purposes. The type of information we may collect depends on how you interact with us and the services you use.

Information provided directly by you

We may collect information that you provide when you make an enquiry, register for services, sign a storage agreement, pay fees, request access, or communicate with us. This may include:

Identity details such as your name, date of birth, and title;
Contact details such as address, email address, and telephone number;
Account and contract details such as storage unit number, agreement dates, billing details, and payment status;
Verification details such as identification documents, proof of address, or other information needed to confirm identity or eligibility;
Communication records including emails, letters, notes of calls, complaints, and service requests;
Vehicle or access information where relevant to site access, security, or authorised entry;
Insurance-related information if required to support the storage arrangement.

Information collected automatically

When you visit or use our facilities, we may collect limited technical and security-related information, including access logs, CCTV recordings, electronic entry records, time and date of entry, and incident reports. This information is used to protect customers, staff, property, and premises. Where CCTV is used, it is operated in line with security and data protection requirements.

Information from third parties

We may receive personal data from third parties where necessary for the operation of our services. This may include payment providers, identity verification services, insurance providers, debt recovery professionals, or authorised representatives acting on your behalf. Where information is received from a third party, we will ensure it is used only for lawful and appropriate purposes.

2. How We Use Personal Data

We use personal data only when we have a lawful reason to do so. Our main purposes include:

setting up and managing storage accounts;
verifying identity and preventing fraud;
processing payments, refunds, and account administration;
providing access to storage units and managing site security;
communicating with customers about agreements, changes, incidents, and service matters;
responding to complaints, disputes, and legal claims;
meeting legal, tax, accounting, and regulatory obligations;
protecting the rights, safety, and property of customers, staff, and visitors;
improving our services and maintaining accurate business records.

We do not use personal data for purposes that are incompatible with the original reason for collection unless we have a lawful basis to do so and, where required, we notify you.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis before processing personal data. Depending on the situation, Selfstorage Brent may rely on one or more of the following lawful bases:

Performance of a contract

We process personal data when it is necessary to enter into or perform a storage agreement. This includes creating accounts, managing access, collecting payments, and delivering services you have requested.

Legal obligation

We may process personal data to comply with legal obligations, such as tax, accounting, anti-fraud, health and safety, and lawful disclosure requirements.

Legitimate interests

We may process personal data where it is necessary for our legitimate interests and where those interests are not overridden by your rights and freedoms. Examples include site security, CCTV monitoring, fraud prevention, service improvement, and record keeping. When we rely on legitimate interests, we ensure the processing is proportionate and appropriate.

Consent

In limited situations, we may rely on your consent, for example for certain optional communications or specific uses where consent is required by law. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, and reporting requirements. Retention periods vary depending on the type of information and the reason it is held.

Contract and account records are generally retained for the duration of the agreement and for a reasonable period afterwards for administration, dispute resolution, and legal compliance;
Payment and invoicing records are retained in line with tax and financial recordkeeping obligations;
Identity verification records are kept only as long as needed for verification, fraud prevention, and legal compliance;
CCTV and access records are retained for a limited period unless needed longer for an investigation, insurance claim, or legal matter;
Correspondence and complaint records are retained for the time required to manage the matter and evidence decisions taken.

When personal data is no longer required, we will securely delete, anonymise, or destroy it. Retention periods are reviewed regularly to ensure they remain proportionate and lawful.

5. Processors and Sharing of Data

We may share personal data with trusted third-party processors who act on our behalf and only under our instructions. These processors are required to protect your information and may not use it for their own purposes.

Typical categories of processors

Payment processors that handle card or electronic payments;
IT and cloud service providers that support our systems, data storage, and communications;
Security providers that support CCTV, alarms, access systems, or incident management;
Identity verification providers where checks are required;
Professional advisers including accountants, auditors, legal advisers, and insurers;
Debt recovery or credit control services where necessary to recover amounts owed;
Maintenance or service contractors where access to limited personal data is required to complete operational work.

We may also disclose personal data where required by law, regulation, court order, or lawful request from public authorities. If a business restructuring, sale, or transfer occurs, personal data may be disclosed to relevant parties subject to appropriate confidentiality and data protection safeguards.

6. International Transfers

Where a processor or service provider stores or accesses data outside the UK, we will ensure that appropriate safeguards are in place. These safeguards may include adequacy regulations, standard contractual clauses, or equivalent protections required under applicable law. We only permit international transfers where suitable protection is available.

7. Data Security

We take the security of personal data seriously and use technical and organisational measures to reduce the risk of unauthorised access, loss, alteration, or disclosure. Measures may include access controls, password protection, staff training, CCTV, secure premises, encryption, and regular review of our systems. No method of transmission or storage is completely secure, but we aim to maintain a level of security appropriate to the risk.

8. Your Rights

Depending on the circumstances and the legal basis for processing, you may have the following rights under data protection law:

Right of access – to request a copy of the personal data we hold about you;
Right to rectification – to ask us to correct inaccurate or incomplete data;
Right to erasure – to request deletion of your data in certain situations;
Right to restrict processing – to ask us to limit how we use your data in certain circumstances;
Right to object – to object to processing based on legitimate interests or direct marketing;
Right to data portability – to receive certain data in a structured, commonly used format where applicable;
Right to withdraw consent – where processing is based on consent;
Right to lodge a complaint – with the relevant data protection authority if you believe your rights have been infringed.

Some rights may not apply in all cases, for example where we need to retain information to comply with legal obligations or establish, exercise, or defend legal claims.

9. Children’s Data

Our services are intended for adults and business users. We do not knowingly collect personal data from children unless it is necessary and lawful in a specific circumstance, such as where a parent or legal guardian provides information on their behalf. If we become aware that we have collected data inappropriately, we will take reasonable steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational needs. Any revised version will apply from the date it is published or otherwise communicated. We encourage customers to review the policy periodically to stay informed about how personal data is handled.

By using Selfstorage Brent services, you acknowledge that personal data may be processed in accordance with this Privacy Policy and applicable data protection laws.