Privacy Policy - Selfstorage Wimbledon

This Privacy Policy explains how Selfstorage Wimbledon collects, uses, stores, shares, and protects personal data. It applies to all Selfstorage Wimbledon customers in the Wimbledon area, including individuals, households, and business customers who use our self-storage services, make enquiries, sign agreements, or otherwise interact with us. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who this policy applies to

This policy applies to current and former customers, prospective customers, authorised users, emergency contacts provided by customers, and any other individuals whose information we process in connection with our storage services. It also applies to people visiting our facilities, making reservations, paying for storage, or communicating with us in relation to an account.

2. Personal data we collect

We only collect personal data that is relevant and necessary for operating our storage services, managing accounts, protecting our site, and meeting legal obligations. Depending on your relationship with us, the data we may collect includes:

Identity information such as your name, date of birth, and, where required, proof of identity.
Contact information such as your address, email address, telephone number, and billing address.
Account and contract information such as storage unit reference, agreement details, move-in and move-out dates, payment status, and service preferences.
Financial information such as payment card details or bank account information, where needed to process payments, refunds, or collections.
Security information such as access logs, CCTV recordings, vehicle registration details, and records of site entry or exit.
Communications including emails, letters, call notes, complaints, and service requests.
Special circumstances information only where required, for example when you voluntarily provide details needed to accommodate access, safety, or legal requirements.

We do not intentionally collect more information than is necessary. If you provide information about another person, you should ensure that you have the right to do so and that they understand how their information will be used.

3. How we collect data

We collect personal data directly from you when you complete forms, sign an agreement, make a booking, contact us, pay for services, or use our facilities. We may also receive information from third parties such as payment providers, identity verification services, insurance providers, debt recovery agents, and law enforcement where appropriate and lawful. In addition, our premises may use security measures such as CCTV and access controls that record limited data to protect customers, staff, and property.

4. Lawful basis for processing

Under UK GDPR, we must identify a lawful basis for processing your personal data. We rely on the following lawful bases:

Contract

We process your data when it is necessary to enter into or perform our storage agreement, provide access to your unit, manage billing, and deliver customer support. Without this information, we may not be able to provide the service.

Legal obligation

We process data where we must comply with legal or regulatory requirements, including accounting rules, tax obligations, fraud prevention, and responding to lawful requests from public authorities.

Legitimate interests

We may process data where it is necessary for our legitimate interests and where those interests do not override your rights and freedoms. These interests include protecting our premises, preventing misuse, managing disputes, improving our services, and ensuring operational security.

Consent

In limited circumstances, we rely on your consent, for example where you choose to receive certain marketing communications or where a specific optional service requires consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Where required, we may also process information to protect vital interests or to establish, exercise, or defend legal claims.

5. How we use personal data

We use personal data for the following purposes:

To register and manage your storage account.
To verify identity and prevent fraud.
To process payments, issue invoices, and manage arrears.
To communicate with you about your account, access, or service changes.
To maintain safety, security, and site access controls.
To comply with legal, tax, and regulatory obligations.
To investigate complaints, disputes, or incidents.
To improve our operations, administration, and customer experience.

We will not use your personal data for purposes that are incompatible with those listed above unless we have a lawful basis to do so and, where required, we have informed you.

6. Data sharing and processors

We may share personal data with trusted third parties who act as data processors or, in some cases, independent controllers. We ensure that any processor handles data only on our instructions, keeps it secure, and complies with applicable data protection law. Typical processors and recipients include:

Payment processors that handle card or bank transactions securely.
IT and cloud service providers that host systems, email, and databases.
Identity verification or fraud prevention providers where checks are required for security or legal compliance.
CCTV and security system providers that help operate and maintain monitoring systems.
Accountants, auditors, and professional advisers for financial, legal, or compliance purposes.
Debt recovery or legal services providers if necessary to enforce agreements or resolve disputes.
Public authorities, regulators, or law enforcement when disclosure is required by law or is otherwise lawful.

Where processors are used, they are bound by written contracts requiring appropriate technical and organisational security measures. We do not sell your personal data.

7. International transfers

If any personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place, such as adequacy regulations, the UK Addendum to Standard Contractual Clauses, or other legally approved transfer mechanisms. We only permit such transfers where adequate protection is ensured.

8. Data retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including meeting legal, accounting, and reporting obligations. Retention periods may vary depending on the type of record and our obligations under law. In general:

Contract and account records are retained for the duration of the agreement and for a reasonable period afterwards.
Payment and invoicing records are retained to comply with tax and accounting requirements.
Security records, including access logs and CCTV footage, are retained for a limited period unless required longer for an incident, investigation, or legal claim.
Complaint, dispute, and claims records may be retained until the matter is resolved and for an additional period where necessary to defend legal rights.

When personal data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you.

9. Your rights

Under data protection law, you have a number of rights regarding your personal data. These rights may be subject to legal conditions and exceptions. They include:

Right of access - you can request a copy of the personal data we hold about you.
Right to rectification - you can ask us to correct inaccurate or incomplete information.
Right to erasure - you can ask us to delete your data where there is no lawful reason for us to keep it.
Right to restrict processing - you can request a temporary restriction on processing in certain circumstances.
Right to data portability - you can request certain data in a structured, commonly used format where applicable.
Right to object - you can object to processing based on legitimate interests or direct marketing.
Right to withdraw consent - where processing is based on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we will assess your request in line with legal requirements and respond within the required timeframe. We may need to verify your identity before acting on a request.

10. Security of your data

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include secure storage, access restrictions, staff training, system controls, monitoring, and physical security arrangements. While no system is completely secure, we take data protection seriously and regularly review our controls.

11. Cookies and similar technologies

Where our digital systems use cookies or similar technologies, they are used only for necessary functionality, security, or basic service improvement, unless additional consent is obtained where required. Any such use will be managed in accordance with applicable law.

12. Complaints

If you have concerns about how your personal data is handled, you should contact us through the normal service channels so that we can investigate and respond. You also have the right to raise a complaint with the UK Information Commissioner’s Office if you believe your data protection rights have been breached.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practice. The latest version will always describe how we process personal data at the time it is collected or used.

By using Selfstorage Wimbledon services in the Wimbledon area, you acknowledge that you have read and understood this Privacy Policy.