Privacy Policy - Selfstorage Finchley

This Privacy Policy explains how Selfstorage Finchley collects, uses, stores, shares, and protects personal data relating to its customers and prospective customers. It applies to all Selfstorage Finchley customers in the Finchley area, including individuals, households, and businesses that use or enquire about our storage services. We are committed to handling personal data in a lawful, fair, transparent, and secure manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We want customers to understand what information we collect, why we collect it, how long we keep it, who may process it on our behalf, and what rights you have over your personal data. This Privacy Policy should be read alongside any relevant terms and conditions or service agreements that apply to your storage arrangement.

1. Personal Data We Collect

We may collect and process various types of personal data depending on how you interact with us. The information we collect is limited to what is necessary for the purposes described in this policy.

Information you provide directly

Identity data such as your name, title, date of birth, and proof of identity where required.
Contact data such as postal address, email address, and telephone number.
Account and service data including details related to your storage unit, booking, move-in date, payment status, and service preferences.
Verification data where we need to confirm your identity, address, or authority to act on behalf of a business or another person.
Correspondence data including emails, messages, notes of calls, and other communications with our staff.

Information collected automatically

Technical data such as IP address, browser type, device information, and basic usage data if you interact with our digital services.
Security and access data such as entry logs, access timestamps, CCTV footage, and alarm or incident records where applicable.

Information from third parties

We may receive information from third parties when needed to deliver our services, verify information, support payment processing, or comply with legal obligations. This may include identity verification providers, payment service providers, debt recovery services, or legal and regulatory bodies.

2. How We Use Personal Data

We process personal data only for legitimate storage and business purposes. These include:

Providing storage services and managing your account or booking.
Verifying identity and preventing fraud, misuse, or unauthorised access.
Processing payments, refunds, deposits, and billing matters.
Communicating with you about your storage arrangement, account status, and service changes.
Maintaining site security, protecting property, and investigating incidents.
Complying with legal, tax, insurance, and regulatory obligations.
Managing disputes, enforcing agreements, and establishing or defending legal claims.
Improving our operations, services, and internal record-keeping.

We do not use personal data for purposes that are incompatible with the original reason for collection unless we have a lawful basis to do so and have informed you where required.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis to process personal data. Depending on the activity, we rely on one or more of the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you, such as providing storage services, administering your account, and managing payments.

Legal obligation

We may process data to comply with legal requirements, including accounting, tax, anti-fraud, security, and record-keeping obligations.

Legitimate interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided your interests and rights do not override those interests. This may include site security, prevention of misuse, service improvement, and limited internal administration. We consider and balance these interests carefully.

Consent

In limited situations, we may rely on your consent, for example where you choose to receive certain optional communications. Where consent is used, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital interests and public task

These bases are unlikely to apply in normal circumstances but may be used if necessary to protect someone’s life or where required by law in exceptional situations.

4. Sharing and Processors

We may share personal data with trusted third parties only when necessary and only for the purposes described in this policy. When a third party processes personal data on our behalf, they act as a processor and are contractually required to protect the information and use it only according to our instructions.

Typical processors and service providers

Payment processors that handle card payments, direct debits, and refunds.
IT and cloud service providers that support secure storage, backup, and system administration.
Security providers that assist with monitoring, alarm systems, or CCTV management.
Identity verification and fraud prevention providers where checks are needed.
Professional advisers such as accountants, insurers, lawyers, and auditors.
Debt recovery or collection providers where account enforcement is necessary and lawful.
Maintenance and property service providers where access is required for essential site operations.

We may also disclose personal data where required by law, court order, regulatory request, or to protect our rights, the rights of others, or the security of our premises and users.

We do not sell your personal data. If personal data is transferred outside the UK, appropriate safeguards will be used to ensure that it remains protected to a standard consistent with UK data protection law.

5. Retention of Personal Data

We keep personal data only for as long as necessary for the purposes for which it was collected, including any legal, accounting, insurance, or reporting requirements. Retention periods depend on the type of data and the reason for processing.

Retention principles

Data connected to your storage contract is retained for the life of the contract and for a reasonable period afterwards.
Financial and invoicing records are kept for the period required by tax and accounting law.
Security records, incident logs, and access records are retained only as long as needed for security, investigation, and compliance purposes.
Correspondence and complaint records are kept for as long as necessary to manage the matter and defend legal claims if required.

When personal data is no longer needed, we will delete it securely or anonymise it so that it can no longer identify you.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unlawful use, unauthorised access, alteration, or disclosure. These measures may include access controls, secure storage systems, staff confidentiality obligations, encryption where appropriate, and regular review of security procedures.

While we work hard to safeguard information, no system can be guaranteed to be completely secure. In the event of a personal data breach, we will assess the situation and notify affected individuals and regulators where required by law.

7. Your Rights

As a data subject, you have rights under data protection law. These rights may apply in full or in part depending on the circumstances and legal exemptions.

Rights available to you

Right of access – you can request a copy of the personal data we hold about you.
Right to rectification – you can ask us to correct inaccurate or incomplete data.
Right to erasure – in some cases, you can ask us to delete your data.
Right to restriction – you can request that we limit how we use your data in certain situations.
Right to data portability – you may request certain data in a structured, commonly used format.
Right to object – you may object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing relies on consent, you may withdraw it at any time.
Right to complain – you may raise concerns with the UK Information Commissioner’s Office if you believe your rights have been infringed.

To protect privacy, we may need to verify your identity before responding to a rights request. We will respond within the time limits required by law, unless an extension is permitted for complex requests.

8. Children’s Data

Our storage services are generally intended for adults and business users. We do not knowingly collect personal data from children except where it is necessary in connection with a customer’s lawful use of the service and appropriate consent or authority exists. If we become aware that we have collected information from a child without proper permission, we will take reasonable steps to delete it.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, service operations, or data handling practices. Any updated version will apply from the date it is issued. We encourage customers to review this policy periodically so they remain informed about how their personal data is handled.

10. Summary of Our Commitment

Selfstorage Finchley is committed to treating personal data with care, transparency, and respect. We collect only the information needed to provide secure and reliable storage services, use it for clear and lawful purposes, keep it only as long as necessary, and protect it through appropriate safeguards. We also recognise and uphold your rights under data protection law.

This Privacy Policy applies to all Selfstorage Finchley customers in the Finchley area.