Privacy Policy - Selfstorage Richmond

This Privacy Policy explains how Selfstorage Richmond collects, uses, stores, shares, and protects personal data relating to customers, prospective customers, visitors, and other individuals whose information we process in connection with our storage services. It applies to all Selfstorage Richmond customers in the area and to anyone interacting with our services, whether in person, by phone, by email, or through other business channels. We are committed to processing personal data in a lawful, fair, and transparent manner in accordance with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018.

1. Information We Collect

We collect only the personal data that is necessary for the provision, administration, and security of our storage services. The categories of information we may collect include:

Identity information such as full name, date of birth, and identification details used for verification purposes.
Contact information such as postal address, email address, and telephone number.
Account and contract information such as storage unit number, rental dates, payment status, service preferences, and agreement details.
Payment and billing information such as invoice records, transaction references, and limited payment details required for processing payments and maintaining records.
Security information such as CCTV footage, access logs, entry records, and incident reports where relevant to site security and protection of property.
Communication records including correspondence, complaints, service requests, and notes of interactions relevant to account management.
Technical data where applicable, such as device or browser information if you interact with digital systems we use to manage customer services.

We do not intentionally collect special category data unless it is provided by you voluntarily and is necessary for a specific legal or operational purpose. If such data is ever processed, it will be handled with enhanced care and only where a lawful basis exists.

2. How We Use Personal Data

We process personal data for clear and legitimate purposes connected to our storage business. These purposes include:

setting up and managing customer accounts;
verifying identity and preventing fraud;
providing access to storage units and related services;
processing payments, invoices, deposits, and refunds;
communicating about bookings, renewals, notices, and service updates;
maintaining site safety, protecting customers, staff, and property;
investigating complaints, disputes, breaches, or incidents;
fulfilling legal, regulatory, tax, and accounting obligations;
improving the quality, efficiency, and security of our operations.

We only use personal data for the purpose for which it was collected unless we reasonably determine that another compatible purpose applies or a new lawful basis exists.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis before processing personal data. Selfstorage Richmond relies on the following lawful bases where appropriate:

Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes managing storage agreements, taking payment, delivering services, and handling account administration.

Legal Obligation

We process certain data to comply with legal requirements, such as tax laws, accounting rules, fraud prevention obligations, and lawful requests from public authorities where applicable.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests and where those interests are not overridden by your rights and freedoms. This may include improving service delivery, protecting our premises, monitoring security, preventing misuse, and resolving operational issues. We ensure that any reliance on legitimate interests is balanced and proportionate.

Consent

In limited situations, we may rely on consent, for example where it is appropriate to send optional marketing communications or to process certain information that is not otherwise necessary for a contract or legal obligation. Where consent is used, you have the right to withdraw it at any time.

Vital Interests and Public Task

These bases are unlikely to apply in ordinary storage operations, but if they ever become relevant in an exceptional situation, we will only rely on them where permitted by law.

4. Sharing Personal Data and Processors

We do not sell personal data. However, we may share information with trusted third parties where necessary for business operations, legal compliance, or service delivery. These third parties act either as independent controllers or as processors acting on our instructions.

Processors may include:

IT and cloud service providers that host or maintain our systems and data storage platforms;
payment service providers that assist with card or electronic payment processing;
accounting and bookkeeping providers that support financial administration;
security and monitoring providers that help maintain site safety and surveillance systems;
customer management or communications providers that help us manage operational correspondence;
professional advisers such as lawyers, insurers, or auditors where necessary.

Where processors are used, we require them to follow our instructions, keep data secure, and process information only for authorised purposes. They are also expected to apply appropriate technical and organisational measures to protect personal data. If data is transferred outside the UK, we will ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent lawful mechanisms.

5. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, reporting, and dispute-resolution requirements. Retention periods vary depending on the type of information and the reasons for processing.

As a general approach:

Customer account and contract records are retained for the duration of the relationship and for a reasonable period afterwards in case of disputes or legal claims.
Financial records are retained for the periods required by tax and accounting law.
Security records such as access logs or CCTV may be retained for shorter periods unless needed for an investigation, claim, or legal matter.
Communications and complaint records are kept as long as needed to resolve issues and maintain accurate business records.

When data is no longer needed, it is securely deleted, anonymised, or otherwise disposed of in accordance with our retention procedures.

6. Your Rights Under Data Protection Law

If your personal data is processed by Selfstorage Richmond, you may have the following rights, subject to legal limits and exemptions:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain circumstances.
Right to restriction – to ask us to limit how we use your data in certain situations.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to data portability – to receive certain data in a structured, commonly used format or have it transmitted where technically feasible.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

You also have the right to raise concerns about our data practices. If you believe your data protection rights have not been respected, you may seek guidance from the relevant supervisory authority in the UK. We encourage you to first contact us so that we can address any issue promptly and fairly.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, password protection, staff confidentiality obligations, secure storage, and regular review of internal processes. While no system can be guaranteed completely secure, we work continuously to maintain a high level of protection.

8. Accuracy and Responsibility

We take reasonable steps to keep personal data accurate and up to date. You should inform us of changes to your contact details or other relevant information so that our records remain correct. Where inaccurate data is identified, we will correct it or take appropriate steps to ensure accuracy.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or security developments. Any updated version will apply from the date it takes effect. We recommend reviewing this policy periodically so that you remain informed about how we process personal data.

In summary, Selfstorage Richmond processes personal data fairly and securely, only for legitimate business and legal purposes, and only for as long as necessary. We are committed to respecting privacy rights and maintaining trust in the services we provide to customers throughout the Richmond area.