Privacy Policy - Selfstorage Dulwich

Selfstorage Dulwich is committed to protecting the privacy and personal data of all customers in the Dulwich area and surrounding locations. This Privacy Policy explains how we collect, use, store, share, and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all Selfstorage Dulwich customers in the area, including prospective customers, existing customers, former customers, authorised contacts, and visitors who interact with our services.

1. Introduction

We understand that personal data must be handled carefully and lawfully. This policy explains what data we collect, why we collect it, the legal grounds we rely on, how long we keep it, which third parties may process it on our behalf, and what rights you have in relation to your personal information. By using our storage services, making enquiries, entering into a storage agreement, or otherwise interacting with Selfstorage Dulwich, you acknowledge that your personal data may be processed as described in this policy.

2. Data We Collect

We collect only the personal data that is relevant and necessary for providing storage services, managing our relationship with customers, meeting legal obligations, and protecting our business. The types of information we may collect include:

Identity data such as your name, title, date of birth, and identification details where required.
Contact data such as address, email address, telephone number, and emergency or alternative contact details.
Account and contract data including storage unit details, agreement terms, payment records, billing history, and customer reference information.
Financial data such as payment card details, bank account information, or transaction records, where relevant to payment processing.
Access and security data such as entry logs, CCTV footage, alarm records, and site access history.
Communication data including enquiries, complaints, service requests, and records of correspondence.
Technical data such as device information, IP address, and basic browsing data if you interact with our digital systems, where applicable.

We may also receive data from third parties where necessary, for example from payment processors, identity verification providers, or legal representatives acting on your behalf.

3. How We Use Your Data

We use your personal data for the following purposes:

to provide storage services and manage your storage agreement;
to verify your identity and assess eligibility for services;
to process payments, issue invoices, and manage account administration;
to communicate with you about your account, service changes, and operational matters;
to maintain security, prevent fraud, and protect property and staff;
to comply with legal and regulatory obligations;
to handle disputes, claims, or complaints;
to improve our services and ensure effective business operations.

We do not use personal data for purposes that are incompatible with the reasons it was collected unless permitted by law or we have obtained your consent where required.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis to process your personal data. Depending on the context, we rely on one or more of the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes creating accounts, managing storage units, taking payment, and providing access to our services.

Legal Obligation

We may process personal data where we are required to do so by law, including compliance with accounting, tax, fraud prevention, and regulatory requirements.

Legitimate Interests

We may process data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. This may include maintaining site security, protecting against misuse, improving services, and defending legal claims.

Consent

In limited situations, we may rely on your consent, for example where it is needed for certain optional communications or specific uses of information. Where consent is used, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

5. Sharing Your Data and Processors

We may share personal data with trusted third-party processors and service providers who act on our instructions and help us operate efficiently. These processors are bound by contractual obligations to keep personal data secure, use it only for authorised purposes, and comply with data protection requirements.

Examples of processors may include:

Payment processors who handle card or bank transactions securely;
IT and cloud service providers who support storage, backups, email systems, and data management;
Security providers who operate CCTV, alarm, or access control systems;
Accountancy and audit providers who assist with financial records and compliance;
Professional advisers such as legal advisers, insurers, or consultants where necessary;
Identity verification or fraud prevention services where checks are required.

We may also disclose personal data to public authorities, regulators, law enforcement, or courts where required by law or necessary to establish, exercise, or defend legal rights. We do not sell your personal data.

6. Retention of Personal Data

We keep personal data only for as long as necessary for the purposes for which it was collected, or for as long as required by law. Retention periods vary depending on the type of information and the reason we hold it.

Customer and contract records are typically retained for the duration of the storage relationship and for a reasonable period afterwards to manage claims, disputes, and legal requirements.
Financial and accounting records are kept for the period required by tax and accounting laws.
Security records such as CCTV or access logs are retained for a limited period unless needed for an investigation or legal matter.
Correspondence and support records may be retained for as long as needed to resolve issues and maintain business records.

When data is no longer required, we will securely delete, anonymise, or archive it in line with our retention procedures.

7. Data Security

We use appropriate technical and organisational measures to protect personal data from unauthorised access, loss, destruction, alteration, or disclosure. These measures may include access controls, secure storage systems, encryption where appropriate, staff confidentiality obligations, and regular review of security practices.

However, no method of transmission or storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

8. Your Rights

As a data subject under UK GDPR, you have a number of rights in relation to your personal data. These rights may be subject to legal conditions and exceptions.

Right of access – you may request a copy of the personal data we hold about you.
Right to rectification – you may ask us to correct inaccurate or incomplete information.
Right to erasure – you may request deletion of your data in certain circumstances.
Right to restriction – you may ask us to limit how we use your data in certain situations.
Right to object – you may object to processing based on legitimate interests or direct marketing.
Right to data portability – you may request transfer of certain data in a structured, commonly used format, where applicable.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we will review your request and respond in accordance with applicable law. We may need to verify your identity before responding to protect your privacy.

9. Children’s Data

Our services are generally intended for adults. We do not knowingly collect personal data from children unless it is necessary in connection with a customer relationship and is provided by a parent, guardian, or authorised representative. Where such information is processed, we take appropriate safeguards and only use it for legitimate service-related purposes.

10. International Transfers

Where personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place to protect it, such as adequacy regulations, standard contractual clauses, or equivalent legal mechanisms. Any such transfer will be handled in accordance with data protection law.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data handling practices. Any updated version will apply from the date it is made effective. We encourage customers to review this policy periodically to remain informed about how we protect personal data.

12. Summary of Our Commitment

Selfstorage Dulwich is committed to processing personal data lawfully, fairly, and transparently. We collect only what we need, use it for clear and legitimate purposes, retain it for appropriate periods, and share it only with trusted processors or where legally required. We also respect and support your rights under data protection law.

This Privacy Policy applies to all Selfstorage Dulwich customers in the area.