Privacy Policy - Selfstorage Hackney

This Privacy Policy explains how Selfstorage Hackney collects, uses, stores, shares, and protects personal data. It applies to all Selfstorage Hackney customers in the area, including prospective customers, current customers, former customers, and any individual whose information is provided in connection with a storage service, payment arrangement, access arrangement, or account administration. We are committed to handling personal information in a lawful, fair, and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

For the purposes of data protection law, Selfstorage Hackney acts as the data controller for personal data collected and processed in connection with our storage services. This means we determine why and how your personal data is used. We take privacy seriously and aim to collect only the information needed to manage our services effectively, securely, and responsibly.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

Identity data: your name, date of birth, and identification details where needed for verification.
Contact data: your address, email address, and telephone number.
Account data: customer reference numbers, storage unit details, access records, and service preferences.
Financial data: payment information, transaction history, billing records, and refund details.
Verification data: copies or details of identification documents, proof of address, and anti-fraud checks where required.
Technical data: IP address, device information, and system logs when you interact with digital systems or online forms.
Security data: CCTV footage, access logs, gate entry records, incident reports, and related security information.
Communication data: correspondence, complaints, queries, and any feedback you provide.

We generally collect data directly from you when you enquire about our services, enter into a storage agreement, make payments, request support, or use our premises. We may also receive data from third parties, such as payment providers, identity verification services, insurers, emergency services, legal advisers, or fraud prevention services, where appropriate and lawful.

3. How We Use Your Data

We use personal data for a range of operational, legal, and security purposes, including:

setting up and managing your storage account;
verifying identity and preventing fraud;
processing payments, deposits, and refunds;
providing access to storage facilities and managing site security;
communicating with you about your account, bookings, or service updates;
handling complaints, disputes, and customer support requests;
meeting legal, accounting, insurance, and regulatory obligations;
protecting the rights, property, and safety of customers, staff, and visitors;
improving our services, systems, and operational efficiency;
defending or pursuing legal claims where necessary.

We do not use your personal data for purposes that are incompatible with the reasons it was originally collected unless we have a lawful basis to do so and have informed you where required.

4. Lawful Basis for Processing

We process personal data only where we have a valid lawful basis under UK GDPR. Depending on the context, our lawful bases may include:

Contract

We process data when it is necessary to enter into or perform our storage contract with you. This includes managing your account, providing access, handling payments, and delivering the services you have requested.

Legal obligation

We process data where required to comply with legal duties, such as tax records, accounting obligations, fraud prevention requirements, court orders, or other applicable laws and regulations.

Legitimate interests

We may process personal data where it is necessary for our legitimate interests, provided these interests are not overridden by your rights and freedoms. Legitimate interests may include security monitoring, CCTV operation, business administration, service improvement, customer support, and protection against misuse or unlawful activity.

Consent

In limited situations, we may rely on your consent, for example where it is required for certain optional communications or specific processing activities. Where we rely on consent, you have the right to withdraw it at any time.

Vital interests

In rare cases, we may process personal data where necessary to protect someone’s vital interests, such as in an emergency or serious safety incident.

5. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including for legal, accounting, insurance, dispute resolution, and security requirements. Retention periods depend on the type of data and the reason it is held.

For example, account and transaction records may be retained for several years after the end of the customer relationship to satisfy tax and financial obligations. Security records, such as CCTV and access logs, may be kept for a shorter period unless they are needed for investigation, enforcement, or legal proceedings. Communication records may also be kept for a reasonable period so we can manage queries, complaints, and contractual matters.

When data is no longer required, it is securely deleted, anonymised, or destroyed. We regularly review retention periods to ensure that we do not keep information longer than necessary.

6. Processors and Sharing of Data

We may share personal data with trusted third parties who act as data processors on our behalf. These processors are only permitted to use your data according to our instructions and must implement appropriate security and confidentiality measures.

Examples of processors may include:

payment service providers and card processing services;
IT hosting, software, and cloud storage providers;
identity verification and fraud prevention service providers;
security and CCTV monitoring service providers;
accounting, bookkeeping, and administration service providers;
customer communication and document management services;
professional advisers such as insurers, auditors, lawyers, and consultants.

We may also share data with independent third parties where necessary and lawful, including law enforcement, regulatory authorities, emergency services, courts, debt recovery agencies, insurers, or other parties involved in a legal or contractual matter.

We do not sell your personal data. Any sharing is done only when necessary, proportionate, and supported by an appropriate lawful basis.

7. Data Security

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, secure storage, encryption where appropriate, staff confidentiality obligations, and physical security arrangements. While no system is completely risk-free, we work to maintain robust safeguards appropriate to the nature of the data we process.

8. Your Rights

Under data protection law, you have a number of rights in relation to your personal data. These rights may be subject to legal exceptions and limitations, but we will always consider and respond to requests appropriately.

Right of access: you may request a copy of the personal data we hold about you.
Right to rectification: you may ask us to correct inaccurate or incomplete information.
Right to erasure: in certain circumstances, you may request deletion of your data.
Right to restriction: you may ask us to limit how we use your data in certain situations.
Right to data portability: you may request certain data in a structured, commonly used format where the right applies.
Right to object: you may object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

We will not subject you to decisions based solely on automated processing that produce legal or similarly significant effects unless permitted by law and appropriately safeguarded.

9. Children’s Data

Our services are intended for adults. We do not knowingly collect personal data from children unless it is provided lawfully by a parent, guardian, or authorised representative in connection with a storage agreement or related service requirement. If we become aware that we have collected children’s data without appropriate authority, we will take steps to delete it where required.

10. International Transfers

If any personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms. We take steps to ensure that any international transfer respects the same level of protection required under UK data protection law.

11. Complaints and Further Information

If you have concerns about how we handle your personal data, you may raise them with us so that we can review and address the matter. You also have the right to lodge a complaint with the UK Information Commissioner’s Office if you believe your data protection rights have been infringed.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. Any updates will take effect when published or otherwise communicated where necessary. We encourage customers to review this policy periodically to remain informed about how their personal data is handled.

By using Selfstorage Hackney services, you acknowledge that you have read and understood this Privacy Policy. This policy applies to all Selfstorage Hackney customers in area and is intended to provide clear, lawful, and transparent information about our data practices.