Privacy Policy - Selfstorage Knightsbridge

This Privacy Policy explains how Selfstorage Knightsbridge collects, uses, stores, shares, and protects personal data relating to its customers and prospective customers. It applies to all Selfstorage Knightsbridge customers in the area, including individuals and businesses that enquire about, reserve, access, or use storage services. We are committed to handling personal data in a lawful, fair, transparent, and secure manner in accordance with the UK GDPR and the Data Protection Act 2018.

1. Who this policy applies to

This policy applies to anyone who interacts with Selfstorage Knightsbridge in connection with storage services. This includes customers, account holders, authorised users, visitors to storage facilities, individuals making enquiries, and anyone whose data is provided to us in the course of arranging or managing a storage agreement. It also applies where we process data relating to representatives of business customers.

2. Information we collect

We may collect and process different types of personal data depending on how you use our services. The data we collect may include:

Identity data such as name, date of birth, and identification details.
Contact data such as address, email address, and telephone number.
Account and booking data such as storage unit details, reservation records, payment status, and account history.
Financial data such as payment card information, billing details, and transaction records.
Verification data such as proof of identity or proof of address where required for security, fraud prevention, or legal compliance.
Usage data such as access logs, entry times, and facility usage information.
Communications data such as correspondence with our team, complaint records, and service-related requests.
Technical data such as device, browser, and IP-related information where collected through digital systems.

We generally do not seek to collect special category data. If such data is inadvertently disclosed to us, it will only be processed where a lawful basis exists and appropriate safeguards are in place.

3. How we use your personal data

We use personal data to operate our storage services effectively and responsibly. Typical uses include:

setting up and managing customer accounts and storage agreements;
verifying identity and preventing fraud;
processing payments and managing invoices;
providing access to storage units and maintaining facility security;
responding to enquiries, complaints, and service requests;
meeting legal and regulatory obligations;
monitoring for misuse, unauthorised access, or unsafe activity;
protecting our legal rights and defending claims;
improving operational performance, service quality, and customer experience.

We only use data for the purposes for which it was collected, unless we reasonably consider that we need to use it for a compatible purpose and that such use is permitted by law.

4. Lawful basis for processing

We process personal data only where we have a valid lawful basis under the UK GDPR. Depending on the context, our lawful bases may include the following:

Contract

We process data where it is necessary to enter into or perform a contract with you. This includes managing reservations, providing access to storage space, collecting payments, and delivering customer support related to the service.

Legal obligation

We may process data where required to comply with legal obligations, including tax, accounting, fraud prevention, identity verification, and lawful requests from competent authorities.

Legitimate interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided that these interests are not overridden by your rights and freedoms. This can include maintaining security, preventing crime, managing business operations, improving services, and enforcing our terms. When relying on this basis, we assess whether the processing is necessary and proportionate.

Consent

In limited situations, we may rely on your consent, particularly for optional communications or certain types of processing where consent is the most appropriate basis. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. Sharing personal data and processors

We may share personal data with trusted third parties where necessary for service delivery, legal compliance, or business operations. These third parties may act as processors on our behalf or as independent controllers in their own right.

Examples of processors may include:

payment service providers that handle card or electronic payment processing;
IT and cloud service providers that host systems, store records, or support communications;
security and monitoring providers that help maintain site safety and access control;
accounting and administrative providers that assist with invoicing, bookkeeping, and reporting;
customer relationship and communication tools used to manage service messages and support requests;
professional advisers such as lawyers, auditors, insurers, and consultants where necessary.

Where processors handle personal data on our behalf, they are required to act only on our instructions, keep the information secure, and use appropriate technical and organisational measures. We do not allow processors to use your data for their own unrelated purposes.

We may also disclose personal data where required by law, court order, regulatory request, or where it is necessary to protect our rights, customers, staff, property, or the public.

6. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including meeting legal, accounting, reporting, and security requirements. Retention periods vary depending on the type of data and the relationship involved.

As a general approach:

customer and contract records are retained for the duration of the service relationship and for a reasonable period afterwards;
financial and tax records are retained for the period required by applicable law;
access logs and security records are retained for as long as needed for facility protection, incident review, and fraud prevention;
enquiry records may be retained for a shorter period where no contract is formed;
legal claims and dispute records may be kept for longer if necessary to establish, exercise, or defend legal rights.

When personal data is no longer needed, we will securely delete, anonymise, or archive it in accordance with our retention procedures.

7. Data security

We take appropriate measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction. These measures may include access controls, secure systems, staff confidentiality obligations, and regular review of our internal procedures. While no system can be guaranteed completely secure, we work to maintain a level of protection appropriate to the risks involved.

8. International transfers

Where personal data is transferred outside the United Kingdom, we will ensure that suitable safeguards are in place. These may include adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms approved under applicable data protection law.

9. Your rights

You have a number of rights in relation to your personal data, subject to certain legal conditions and exemptions. These rights include:

Right of access – to request confirmation of whether we process your data and obtain a copy of it.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of data in certain circumstances.
Right to restriction – to request limited processing in certain situations.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to data portability – to receive certain data in a structured, commonly used format where applicable.
Right to withdraw consent – where processing is based on consent.

You also have the right to raise concerns about how your data is handled. If you believe your rights have been infringed, you may seek advice or lodge a complaint with the relevant data protection authority. We encourage customers to contact us first so that we can try to resolve the matter promptly and fairly.

10. Children’s data

Our services are intended for adults and business users. We do not knowingly collect personal data from children unless it is provided lawfully and is necessary in connection with a service arrangement. Where we become aware that we have collected data inappropriately, we will take steps to address it.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service arrangements. Any updated version will apply from the date it is made effective. We encourage customers to review this policy periodically so they remain informed about how their personal data is handled.

12. Summary of our commitments

Selfstorage Knightsbridge is committed to handling personal data responsibly, lawfully, and transparently. We collect only the data needed to deliver storage services, rely on appropriate lawful bases, retain information only for as long as necessary, use trusted processors under strict safeguards, and respect the rights of all individuals whose data we process. Our approach is designed to protect privacy while supporting the secure and efficient operation of our storage services across the area.