Privacy Policy - Selfstorage Chelsea

This Privacy Policy explains how Selfstorage Chelsea collects, uses, stores, shares, and protects personal data. It applies to all Selfstorage Chelsea customers in the area, including individuals and businesses who enquire about, reserve, access, or use our self-storage services. We are committed to handling personal data in a lawful, fair, and transparent way in accordance with the UK GDPR and the Data Protection Act 2018.

1. Who This Policy Applies To

This policy applies to:

current and former customers;
potential customers who make enquiries or request a quotation;
individuals named on accounts, authorisation forms, or access arrangements;
visitors to our storage facilities where personal data is collected through security systems or site records; and
any other person whose data we process in connection with our storage services.

By using our services, you acknowledge that your personal data may be processed as described in this policy.

2. Personal Data We Collect

We only collect personal data that is relevant and necessary for operating our storage services, managing our contractual relationship, and meeting legal obligations. The categories of data we may collect include:

Identity and contact information

name;
postal address;
email address;
telephone number;
date of birth where needed for identity verification;
company name and role, if you are acting on behalf of a business.

Account and service information

reservation and rental details;
unit size and access arrangements;
billing and payment records;
communications about your account, enquiries, complaints, or service updates;
identity verification documents where required by law or for fraud prevention;
vehicle registration details if required for site access or security.

Security and access data

site entry and exit logs;
key, access code, or fob records;
CCTV images and related security records;
incident reports involving safety, damage, or suspected misuse.

Technical and website-related data

device and browser information;
IP address;
cookie data and similar tracking information where applicable;
usage data related to online forms or digital interactions.

We do not intentionally collect special category data unless you choose to provide it or it becomes necessary in connection with an incident, legal claim, or safeguarding issue. If that occurs, we will only process it where the law allows.

3. How We Use Personal Data

We use personal data only for clear and limited purposes, including:

setting up and managing storage accounts;
processing payments and issuing invoices;
verifying identity and preventing fraud;
providing access to storage units and facility services;
communicating about bookings, account changes, reminders, and service matters;
handling complaints, claims, disputes, and enforcement actions;
monitoring site safety and security;
meeting legal, regulatory, tax, and accounting obligations;
improving our services, systems, and customer experience;
defending legal claims or establishing, exercising, or defending rights.

We will not use your personal data for purposes that are incompatible with the original reason it was collected unless we have a lawful basis to do so.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for each processing activity. Depending on the context, we rely on one or more of the following:

Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes managing your storage account, providing access to a unit, billing you, and delivering the services you request.

Legal obligation

We process personal data where we must comply with legal obligations, such as accounting, tax recordkeeping, fraud prevention, safety requirements, or responding to lawful requests from authorities.

Legitimate interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests. This may include site security, CCTV monitoring, protecting property, preventing abuse, improving services, and managing business operations.

Consent

In limited cases, we rely on your consent, for example for certain optional communications or non-essential cookies where applicable. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal will not affect processing carried out before consent was withdrawn.

Vital interests

In rare circumstances, we may process personal data to protect someone’s vital interests, such as in an emergency involving health or safety.

5. Data Sharing and Processors

We may share personal data with trusted third parties who process data on our behalf or as independent controllers. Where a third party processes data for us, it acts as a processor and only handles the data according to our instructions and applicable law. We use appropriate contracts and safeguards to protect your information.

Typical processors and recipients may include:

payment service providers that handle card or bank transactions;
accounting and bookkeeping providers;
IT, hosting, and software providers that support our operational systems;
security providers, including CCTV and access-control system operators;
email, document management, and customer communications providers;
professional advisers such as lawyers, insurers, auditors, or consultants;
regulators, law enforcement, courts, or public authorities where required by law.

We do not sell personal data. If personal data is transferred outside the UK, we will ensure appropriate safeguards are in place, such as an adequacy decision or approved contractual protections.

6. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, reporting, and dispute-resolution requirements. Retention periods vary depending on the type of data and the reason for processing.

Customer account records are normally kept for the duration of the contract and for a period after it ends to deal with follow-up queries, claims, or legal obligations.
Billing and transaction records are kept for the periods required by tax and accounting law.
Security logs and access records are retained for a limited period unless needed for an incident investigation, insurance matter, or legal claim.
CCTV footage is usually retained only for a short period unless an incident requires longer retention.
Enquiry records may be kept for a reasonable period to manage business records and respond to future questions.

When data is no longer needed, we will delete it securely or anonymise it so that it can no longer identify you. Retention is based on necessity, not convenience.

7. Your Rights

As a data subject, you have rights under data protection law. These rights may be subject to conditions or exemptions, but we will always assess requests carefully and respond in line with the law.

Your rights include:

Right of access – you can request a copy of the personal data we hold about you.
Right to rectification – you can ask us to correct inaccurate or incomplete data.
Right to erasure – you may ask us to delete your data where there is no lawful reason to keep it.
Right to restriction – you can ask us to limit processing in certain situations.
Right to data portability – you may request certain data in a structured, commonly used format where applicable.
Right to object – you can object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where we rely on consent, you can withdraw it at any time.
Rights relating to automated decision-making – if we ever use automated decisions that produce legal or similarly significant effects, you may have rights to challenge them and seek human review.

If you wish to exercise any of these rights, we may need to verify your identity before responding. We will usually respond within one month, unless the request is complex or we receive multiple requests.

8. Security of Personal Data

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, encryption where appropriate, staff confidentiality obligations, secure storage, and monitoring of systems and facilities. No system can be guaranteed completely secure, but we work to maintain a level of security appropriate to the risks involved.

9. Children’s Data

Our services are not directed at children, and we do not knowingly collect personal data from children except where it is necessary in connection with a customer relationship, legal requirement, or incident handling. If we become aware that we have collected data improperly, we will take appropriate steps to delete or protect it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our operations, or the way we process personal data. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically so they remain informed about how their data is handled.

11. Key Principles We Follow

Our approach to privacy is based on the core data protection principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality. We strive to process only the data we need, keep it only as long as necessary, and use it responsibly.

Selfstorage Chelsea treats privacy as part of responsible service. By collecting only relevant information, using clear lawful bases, applying secure retention practices, and working with trusted processors, we aim to protect your data while delivering reliable storage services. This policy is intended to ensure that all customers in the area understand how their information is handled and what rights they can exercise.