Privacy Policy - Selfstorage Docklands

This Privacy Policy explains how Selfstorage Docklands collects, uses, stores, shares, and protects personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all Selfstorage Docklands customers in the Docklands area, including prospective customers, account holders, visitors, and any individuals whose personal data is processed in connection with our storage services.

1. Who We Are

Selfstorage Docklands provides self-storage services for individuals and businesses. In doing so, we act as a data controller for the personal information we decide to collect and use for our own operational, legal, and contractual purposes. This means we determine how and why your personal data is processed when you enquire about, use, or interact with our services.

2. Personal Data We Collect

We collect only the personal data necessary to provide storage services, manage customer accounts, meet legal obligations, and protect the security of our facilities. Depending on your relationship with us, we may collect the following categories of data:

Identity data such as your name, date of birth, and identification details.
Contact data such as your postal address, email address, and telephone number.
Account and contract data such as agreement details, unit numbers, access records, payment status, and service history.
Payment data such as billing information, transaction records, and limited financial details needed to process payments.
Security and access data such as CCTV images, entry logs, access card usage, and incident reports.
Communication data such as enquiries, complaints, and correspondence relating to your storage service.
Technical data such as IP address and device-related information when you interact with our online systems, if applicable.

We do not intentionally collect special category personal data unless it is provided to us by you and is necessary for a specific legal or operational reason. Where such data is received, it will be handled with additional safeguards and only processed where permitted by law.

3. How We Collect Your Data

We may collect personal data directly from you when you:

make an enquiry or request a quotation;
enter into a storage agreement;
complete forms or provide identification;
make payments or update account details;
contact us by phone, email, or in person;
use our premises, access systems, or monitored areas.

We may also receive personal data from third parties where lawful and appropriate, such as payment service providers, identity verification providers, legal advisers, insurers, debt recovery partners, or public authorities.

4. Purposes of Processing

We process personal data only for specific, legitimate purposes. These include:

setting up and managing your storage account;
verifying identity and preventing fraud;
processing payments and managing billing;
providing access to storage units and our facilities;
monitoring site security and preventing unlawful activity;
responding to customer queries, complaints, and disputes;
meeting legal, tax, accounting, insurance, and regulatory obligations;
enforcing contractual rights and recovering debts where necessary;
improving service quality and operational efficiency.

We use your data only where there is a valid lawful basis and where our use is fair, necessary, and proportionate.

5. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis before processing personal data. Depending on the activity, we rely on one or more of the following:

Contract

We process data where it is necessary to enter into or perform a storage agreement with you. This includes account administration, billing, access arrangements, and customer support.

Legal Obligation

We may process data to comply with legal requirements, such as tax records, financial compliance, fraud prevention, health and safety obligations, and lawful requests from authorities.

Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided these interests are not overridden by your rights and freedoms. Examples include site security, CCTV monitoring, service improvement, debt recovery, and protecting our property, customers, and staff.

Consent

Where required, we may rely on your consent, for example for certain optional communications or specific uses that are not covered by other lawful bases. You may withdraw consent at any time where processing is based on consent.

Vital Interests

In rare cases, we may process personal data to protect someone’s vital interests, such as in an emergency at our premises.

6. How We Use CCTV and Security Records

For the safety of our customers, staff, and property, Selfstorage Docklands may operate CCTV and maintain security-related access logs. These records may include images, timestamps, and facility entry information. We use this data to detect and investigate incidents, prevent criminal activity, manage safety concerns, and comply with legal obligations. CCTV and access records are retained only as long as necessary for these purposes and are access-restricted.

7. Data Sharing and Processors

We may share personal data with trusted third parties that assist us in delivering services. These third parties act as processors when they handle data on our instructions, or as independent controllers where they determine their own purposes. We ensure appropriate contracts and safeguards are in place before data is shared.

Processors may include:

Payment processors that handle card or electronic payments.
IT and cloud service providers that host systems, back up data, or maintain software.
Security providers that support CCTV, alarm systems, or physical site protection.
Identity verification and fraud prevention providers that help confirm identity and reduce risk.
Customer service and communication providers that support messaging or administrative functions.
Professional advisers such as accountants, auditors, lawyers, and insurers.
Debt recovery or enforcement partners where unpaid balances or contractual breaches need to be addressed.

We may also disclose personal data to public authorities, courts, regulators, or law enforcement where required by law or necessary to establish, exercise, or defend legal claims. We do not sell personal data.

8. International Transfers

If any service provider processes personal data outside the UK, we will take appropriate steps to protect it. These steps may include using standard contractual clauses, assessing local legal risks, and applying other lawful transfer safeguards under data protection law.

9. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, including meeting legal, accounting, insurance, and operational requirements. The exact retention period depends on the category of data and the reason for processing.

Customer account and contract records are generally retained for the duration of the agreement and for a period afterward to manage claims, disputes, and legal obligations.
Payment and accounting records are kept for the period required by tax and financial laws.
CCTV and access records are retained for a limited time unless needed for an investigation, legal claim, or security incident.
Enquiry and correspondence records are retained only as long as necessary to handle the matter and support business records.

When data is no longer required, it is securely deleted, anonymised, or otherwise disposed of in line with our retention procedures.

10. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures may include role-based access controls, encryption, secure storage, staff confidentiality obligations, monitoring, and regular review of our security practices. While we take reasonable steps to protect data, no system can be guaranteed completely secure.

11. Your Rights

As a data subject under UK GDPR, you have the following rights in relation to your personal data, subject to certain legal limitations:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain circumstances.
Right to restriction – to ask us to limit how we use your data in certain situations.
Right to object – to object to processing based on legitimate interests, including direct marketing where applicable.
Right to data portability – to receive certain data in a structured, commonly used format where processing is based on consent or contract and carried out by automated means.
Right to withdraw consent – where processing relies on consent, you may withdraw it at any time.

You also have the right to raise concerns about how your personal data is handled. You may contact the relevant data protection supervisory authority if you believe your rights have been infringed. We encourage you to raise any concerns with us first so we can try to resolve them promptly.

12. Children’s Data

Our services are not directed at children, and we do not knowingly collect personal data from children unless required in connection with a lawful contract or authorised access arrangement. Where we become aware of such data, we will process it only where lawful and necessary.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or security changes. Any updated version will apply from the date it is published or otherwise made available. We encourage customers to review the policy periodically to stay informed about how we handle personal data.

14. Summary of Our Commitment

Selfstorage Docklands is committed to processing personal data lawfully, fairly, and transparently. We collect only the information needed to provide secure and reliable storage services, use it for clearly defined purposes, keep it only as long as necessary, and protect it through appropriate safeguards. We also respect your rights and will respond to requests in accordance with applicable data protection law.