Privacy Policy - Selfstorage Tufnellpark

This Privacy Policy explains how Selfstorage Tufnellpark collects, uses, stores, shares, and protects personal data. It applies to all Selfstorage Tufnellpark customers in the area, including prospective customers, current customers, former customers, visitors, and any individual who interacts with our services, facilities, contracts, or support processes. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Selfstorage Tufnellpark provides self-storage services and related customer account administration, facility access management, billing, and operational support. In the context of data protection law, we act as the data controller for personal data that we collect and process in connection with our services. This means we determine the purposes and means of processing personal data.

2. Personal data we collect

We collect only the information necessary to provide and manage our services, comply with our legal obligations, and protect the security of our facilities and customers. Depending on how you interact with us, we may collect the following categories of personal data:

Identity data such as name, title, and date of birth where needed for verification.
Contact data including postal address, email address, and telephone number.
Account and contract data such as storage unit details, access permissions, agreement terms, payment status, and account history.
Financial data such as billing information, payment card details processed through secure payment providers, invoices, and transaction records.
Verification data including identification documents or proof of address where required for fraud prevention, security, or legal compliance.
Usage and access data such as entry logs, gate access records, and facility attendance information.
Technical data including device, browser, and IP-related information if you interact with any digital systems used in our operations.
Security data such as CCTV footage, incident reports, and investigation records where necessary for safety and property protection.

We generally do not seek to collect special category data unless it is essential for a lawful purpose, such as dealing with a legal claim or an emergency. If such data is processed, we apply additional safeguards.

3. How we use personal data

We use personal data for the following purposes:

to create and administer customer accounts;
to verify identity and prevent fraud;
to manage storage unit bookings, access, and occupancy;
to process payments, refunds, and billing;
to communicate service updates, notices, and account information;
to maintain the safety and security of customers, staff, and property;
to comply with legal, regulatory, tax, and accounting obligations;
to resolve disputes, enforce agreements, and defend legal claims;
to improve operational performance, customer service, and facility management.

We ensure that processing is adequate, relevant, and limited to what is necessary for the stated purpose.

4. Lawful basis for processing

We process personal data only when we have a valid lawful basis under the UK GDPR. Depending on the context, our lawful bases include:

Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes managing your storage agreement, verifying account details, providing access to your unit, and handling payments.

Legal obligation

We may process data to comply with legal duties, such as tax, accounting, fraud prevention, health and safety, and lawful requests from authorities.

Legitimate interests

We may process data where it is necessary for our legitimate business interests, provided your rights and interests do not override those interests. Examples include facility security, loss prevention, customer support, service improvement, and dispute management. Where we rely on legitimate interests, we assess the impact on your privacy and apply appropriate safeguards.

Consent

In limited circumstances, we may rely on your consent, for example for certain optional communications or non-essential processing. Where consent is used, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Data sharing and processors

We may share personal data with trusted third parties where necessary to operate our services, meet legal obligations, or protect our legitimate interests. These third parties act as processors or independent controllers depending on the service provided.

Processors may include:

payment service providers;
accounting and bookkeeping providers;
IT hosting, software, cloud storage, and system maintenance providers;
customer communications and messaging providers;
security and CCTV system providers;
professional advisers such as lawyers, auditors, and insurers;
contractors or maintenance providers where access is required for operational reasons.

All processors are required to handle personal data in accordance with written contracts, confidentiality obligations, and data protection requirements. They may only process personal data on our instructions and must implement suitable technical and organisational safeguards.

We may also disclose personal data to law enforcement, regulators, courts, or public authorities where required by law or necessary to protect rights, property, or safety.

6. International transfers

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as an adequacy decision or approved contractual protections. We take reasonable steps to ensure that any international transfer preserves a level of protection equivalent to UK data protection standards.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, security, and dispute resolution requirements. Retention periods vary depending on the type of data and the reason for processing.

Customer account and contract records are typically retained for the duration of the contract and for a further period afterwards to deal with claims, disputes, or compliance needs.
Financial and transaction records are retained for the period required by tax and accounting laws.
Security records such as access logs or CCTV footage are kept only as long as needed for safety, incident investigation, or legal purposes.
Enquiry records are retained for a limited period if no contract is formed.

When personal data is no longer needed, we will delete, anonymise, or securely destroy it. Retention periods may be extended where necessary to comply with legal obligations or to establish, exercise, or defend legal claims.

8. Data security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures may include access controls, password protection, encryption where appropriate, staff training, secure storage, and review of supplier security standards.

While no system can be guaranteed completely secure, we work to maintain a security standard proportionate to the nature of the data and the risks involved.

9. Your rights

Under data protection law, you may have the following rights in relation to your personal data:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of data in certain circumstances.
Right to restriction – to request limited processing in certain situations.
Right to data portability – to receive certain data in a structured, commonly used format.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent.

These rights are not absolute and may be subject to legal exemptions or limitations. If you exercise a right, we may need to verify your identity before responding. We will respond within the time limits required by law.

10. Children’s data

Our services are intended for adults and businesses. We do not knowingly collect personal data from children unless it is necessary in connection with a lawful customer arrangement or incident management. Where we become aware that we have collected a child’s data without appropriate authority, we will take steps to address it promptly.

11. Automated decision-making

We do not normally use fully automated decision-making that produces legal or similarly significant effects. If this changes, we will provide clear information about the logic involved, the significance of the processing, and your available rights.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational needs. Any revised version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to remain informed about how personal data is handled.

13. Summary of our approach

In summary, Selfstorage Tufnellpark processes personal data responsibly, only where there is a lawful basis, and for clear operational, contractual, security, and legal purposes. We keep data only for as long as necessary, use processors under strict safeguards, and respect the rights of individuals whose information we hold. This policy applies to all Selfstorage Tufnellpark customers in area and is designed to ensure that personal data is handled with fairness, transparency, and care.