Privacy Policy - Selfstorage Lambeth

This Privacy Policy explains how Selfstorage Lambeth collects, uses, stores, shares, and protects personal data relating to its customers and prospective customers in the Lambeth area. It applies to all Selfstorage Lambeth customers in the area, including individuals and businesses using storage units, related services, or making enquiries about storage solutions. We are committed to processing personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Selfstorage Lambeth provides self-storage services to customers in Lambeth and surrounding areas. For the purposes of data protection law, Selfstorage Lambeth acts as the data controller for the personal information it collects and processes in connection with its business activities. This means we decide why and how your personal data is used.

2. Personal data we collect

We only collect personal data that is necessary for the operation of our services, for legal compliance, and for legitimate business purposes. The categories of data we may collect include:

Identity information such as your name, title, date of birth, and, where relevant, business name or company registration details.
Contact information such as your address, email address, and telephone number.
Account and contract details including rental agreement information, storage unit details, move-in and move-out dates, and payment status.
Financial information such as billing details, transaction records, and payment confirmations. We do not store full payment card details where these are handled by secure payment providers.
Security information such as CCTV images, access logs, ID verification details, and records of site entry or exit where applicable.
Communication records such as emails, letters, call notes, complaints, and service requests.
Technical data where relevant, including device or browser information if you interact with digital services, enquiry forms, or online booking tools.

In some situations, we may receive personal data from third parties, for example from payment processors, identity verification providers, debt recovery services, legal advisers, or public authorities where required by law.

3. How we use your personal data

We use personal data for the following purposes:

to register and manage your storage account;
to provide storage space and related services;
to verify identity and prevent fraud;
to process payments and maintain accurate financial records;
to communicate with you about your account, contract, or service requests;
to manage access to our premises and protect site security;
to resolve disputes, handle complaints, and enforce agreements;
to comply with legal obligations, including tax, accounting, and regulatory requirements;
to maintain business records and improve service quality;
to support lawful claims, insurance matters, or debt recovery where necessary.

We will only use your personal data for purposes that are compatible with the reasons it was originally collected, unless we have a valid legal basis to use it for a new purpose.

4. Lawful basis for processing

Under UK GDPR, we must have a lawful basis to process your personal data. Depending on the activity, we may rely on one or more of the following:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes setting up your storage account, administering your rental agreement, collecting payments, and providing the services you have requested.

Legal obligation

We may process data where we are required to do so by law, such as for accounting, tax compliance, fraud prevention, or responding to lawful requests from regulators or public authorities.

Legitimate interests

We may process data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include site security, CCTV monitoring, service improvement, fraud prevention, debt management, and record keeping. When relying on legitimate interests, we consider whether the processing is necessary and whether your privacy rights are protected.

Consent

In limited situations, we may rely on your consent, for example for certain optional communications or where required by law. Where consent is used, you have the right to withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

5. Sharing your personal data

We may share personal data with trusted third parties when necessary for the operation of our services, to meet legal obligations, or to protect our legitimate interests. These recipients may include:

Payment processors who securely handle billing transactions;
IT and system providers who support our record management, communications, and security systems;
Professional advisers such as accountants, insurers, auditors, or legal advisers;
Debt recovery or credit control providers where accounts become overdue and recovery action is required;
Security service providers where access control, monitoring, or incident response is needed;
Public authorities, regulators, or law enforcement where disclosure is required or permitted by law.

Where we use third-party processors, they act only on our instructions and must protect your personal data in accordance with applicable data protection laws. We do not sell your personal data.

6. Retention of personal data

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, insurance, and dispute-resolution requirements. Retention periods vary depending on the type of information and the reason for processing.

Examples of retention practices include:

Customer account and contract records are typically retained for the duration of the relationship and for a reasonable period afterwards to deal with claims, disputes, or legal obligations;
Financial and transaction records are retained in line with statutory accounting and tax requirements;
CCTV and access records are retained only as long as needed for security, incident investigation, or legal purposes;
Enquiry records may be kept for a limited period if no contract is entered into;
Legal correspondence and dispute files may be retained longer where necessary to establish, exercise, or defend legal rights.

When personal data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you.

7. International transfers

If any of our service providers store or access data outside the United Kingdom, we will ensure appropriate safeguards are in place. These may include adequacy regulations, standard contractual clauses, or equivalent protections required by law. We only permit transfers where your personal data will remain protected to a high standard.

8. Data security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, misuse, alteration, or disclosure. These measures may include access controls, secure storage, staff confidentiality obligations, password protection, and monitoring of systems. While no system can be guaranteed to be completely secure, we take data security seriously and regularly review our safeguards.

9. Your rights

Under UK GDPR, you have a number of rights regarding your personal data. Subject to certain conditions and exemptions, you may have the right to:

Access the personal data we hold about you;
Rectification of inaccurate or incomplete data;
Erasure of your data in certain circumstances;
Restriction of processing in certain situations;
Object to processing based on legitimate interests or direct marketing;
Data portability for information you provided to us, where processing is based on consent or contract and carried out by automated means;
Withdraw consent where processing is based on consent;
Complain to the Information Commissioner’s Office if you believe your data protection rights have been infringed.

We may need to verify your identity before responding to a rights request, especially where the request involves account, security, or contractual information. We aim to respond within the time limits required by law.

10. Children’s data

Selfstorage Lambeth services are generally intended for adults and business users. We do not knowingly collect personal data from children except where it is necessary in the context of a lawful service arrangement and only with appropriate safeguards.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. The latest version will apply to the processing of personal data from the date it is published or otherwise communicated. We encourage customers to review the policy periodically to stay informed about how their information is handled.

12. Summary of key commitments

Selfstorage Lambeth is committed to handling personal data responsibly and in line with data protection law. We collect only the information needed to provide storage services, maintain security, fulfil legal duties, and manage our business. We use your data only where we have a valid lawful basis, retain it for no longer than necessary, and share it only with trusted processors or authorities where appropriate. We also respect your legal rights and will respond to requests in accordance with applicable rules.

This Privacy Policy applies to all Selfstorage Lambeth customers in the Lambeth area. By using our services, you acknowledge that your personal data may be processed as described in this policy.