Privacy Policy - Selfstorage Fulham

This Privacy Policy explains how Selfstorage Fulham collects, uses, stores, shares, and protects personal data relating to its customers and prospective customers in the Fulham area. It applies to all Selfstorage Fulham customers in area, including individuals, households, business users, and anyone who makes an enquiry, enters into a storage agreement, or otherwise interacts with our services.

We are committed to handling personal data in accordance with the UK GDPR and the Data Protection Act 2018. This policy is intended to be clear, transparent, and easy to understand. It explains what information we collect, why we collect it, the legal basis we rely on, how long we keep it, who may process it on our behalf, and what rights you have over your personal information.

1. Who We Are

For the purposes of data protection law, Selfstorage Fulham is the data controller for the personal data described in this policy. This means we decide how and why your personal data is used. We may use trusted third parties to process data on our behalf, but we remain responsible for ensuring that your information is handled lawfully and securely.

2. Information We Collect

We collect different categories of personal data depending on how you interact with us. The information we collect may include:

Identity information such as your name, title, and date of birth where needed for identification.
Contact information such as your address, email address, telephone number, and correspondence details.
Account and contract information such as storage unit details, agreement records, access permissions, booking history, invoices, and payment status.
Payment information such as bank account details, card payment references, billing records, and transaction confirmations. We do not necessarily store full payment card details if these are processed by a payment provider.
Security and access information such as key fob records, entry logs, CCTV images, or other site access records where applicable.
Communication data including emails, telephone notes, complaint records, and customer service messages.
Technical data such as IP address, browser type, and device information if you use any online forms or digital services connected to us.
Special category data only in exceptional cases where it is necessary, lawful, and limited, for example if you voluntarily disclose health-related information needed to support an access arrangement or vulnerability.

We do not intentionally collect more information than is necessary. We ask customers to provide only the information required to manage storage services, maintain security, meet our legal duties, and support customer administration.

3. How We Collect Your Data

We may collect personal data directly from you when you:

make an enquiry or request a quotation;
sign up for storage services or complete a storage agreement;
make payments or set up billing arrangements;
contact us by phone, email, or in writing;
provide identification or documentation;
use our premises or access-controlled facilities;
submit a complaint, query, or claim.

We may also receive data from third parties where necessary and lawful, such as payment service providers, identity verification services, insurers, legal advisers, debt recovery agents, or public authorities. In some cases, we may receive details from someone acting on your behalf, such as a family member, employee, or authorised representative.

4. Why We Use Your Data

We use personal data for the following purposes:

to assess enquiries and provide storage services;
to create and manage customer accounts and agreements;
to verify identity and prevent fraud;
to administer billing, payments, and refunds;
to manage access, safety, and site security;
to respond to questions, complaints, and requests;
to meet legal, regulatory, tax, and insurance obligations;
to maintain internal records and business operations;
to exercise or defend legal claims;
to improve our services and customer experience.

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another compatible purpose and the law allows us to do so.

5. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for processing your personal data. Depending on the circumstances, we rely on one or more of the following lawful bases:

Contract – when processing is necessary to enter into or perform our storage agreement with you.
Legal obligation – when we must process data to comply with tax, accounting, safety, fraud prevention, or other legal requirements.
Legitimate interests – when processing is needed for our legitimate business interests, such as protecting our premises, managing customer relations, improving operations, and pursuing or defending legal claims, provided these interests do not override your rights and freedoms.
Consent – in limited situations where we ask for your clear permission, for example certain optional communications or specific processing that requires consent.
Vital interests – in rare situations where processing is necessary to protect someone’s life.

If we rely on consent, you can withdraw it at any time. This will not affect the lawfulness of any processing already carried out before your consent was withdrawn.

6. Sharing Your Data and Processors

We may share your personal data with third parties where necessary and lawful. These parties may act as processors or, in some cases, independent controllers. Processors only handle your data on our instructions and must keep it secure.

Examples of processors and third parties may include:

IT and cloud service providers that store email, account, or administrative records;
payment processors that handle card or bank transactions;
security providers supporting CCTV, access control, alarms, or site monitoring;
customer management and communication systems used to manage bookings and enquiries;
professional advisers such as accountants, auditors, insurers, lawyers, or surveyors;
debt recovery or credit-related service providers where lawful and necessary;
regulators, law enforcement, or public authorities where required by law or where disclosure is necessary to protect rights, property, or safety.

Where we use processors, we put in place appropriate contractual and security measures to ensure your data is protected. We do not sell your personal data.

7. Retention of Personal Data

We keep personal data only for as long as necessary for the purposes described in this policy, including to meet legal, accounting, tax, insurance, and operational requirements. The length of retention depends on the type of data and the reason we hold it.

Typical retention periods may include:

Customer account and contract records retained for the duration of the agreement and for a period afterward to deal with disputes, claims, and legal obligations;
Payment and accounting records kept for the period required by tax and financial laws;
Security logs and access records retained only as long as reasonably necessary for safety, site management, and incident handling;
CCTV footage kept for a limited time unless needed longer for investigation, legal proceedings, or safeguarding;
General enquiries and correspondence retained for a reasonable period to manage follow-up, customer service, and record keeping.

When data is no longer needed, we will delete, destroy, or anonymise it securely. We may retain some information longer where required by law or where it is needed to establish, exercise, or defend legal claims.

8. Your Rights

You have a number of rights under data protection law in relation to your personal data. These rights may be subject to conditions, exemptions, or limitations. They include:

The right of access – to request a copy of the personal data we hold about you.
The right to rectification – to ask us to correct inaccurate or incomplete data.
The right to erasure – in some cases, to ask us to delete your data.
The right to restrict processing – to ask us to limit how we use your data in certain circumstances.
The right to object – to object to processing based on legitimate interests or direct marketing.
The right to data portability – to request that certain data be provided to you or another organisation in a structured, commonly used format.
The right to withdraw consent – where processing is based on consent.

You also have the right to raise concerns about how your data is handled and to complain to the relevant supervisory authority if you believe your data protection rights have been infringed.

9. Security of Your Information

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, password protection, secure storage, staff training, limited access permissions, and regular review of processing practices.

While we take security seriously, no method of transmission or storage is completely risk-free. We therefore cannot guarantee absolute security, but we work to reduce risks to an appropriate level.

10. International Transfers

If personal data is transferred outside the UK, we will only do so where appropriate safeguards are in place and the transfer is permitted by law. These safeguards may include adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms designed to protect your data.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our services, or our data handling practices. When we make significant changes, we will take reasonable steps to ensure the updated policy is made available. Please review this policy periodically to stay informed about how we protect your personal data.

12. Summary of Key Points

Data collection

We collect only the information needed to provide storage services, manage accounts, ensure security, and meet legal duties.

Lawful basis

We rely on contract, legal obligation, legitimate interests, consent, or vital interests depending on the context.

Retention

We keep data only as long as necessary and securely delete or anonymise it when it is no longer needed.

Processors

We use trusted service providers such as IT, payment, security, and professional advisers under strict data protection controls.

User rights

You have rights including access, correction, deletion, restriction, objection, portability, and withdrawal of consent.

By using Selfstorage Fulham services, you acknowledge that your personal data may be processed as described in this Privacy Policy. This policy is designed to support lawful, fair, and transparent processing for all Selfstorage Fulham customers in area.