Storage Kensington Privacy Policy
This Privacy Policy explains how Storage Kensington collects, uses, stores, and protects personal data relating to individuals who use our self-storage services or interact with us in any way. It describes the types of information we process, the purposes for which we process it, the lawful bases we rely on under the UK General Data Protection Regulation and the EU General Data Protection Regulation, and the rights you have in relation to your personal data.
This Privacy Policy applies to all Storage Kensington customers and prospective customers in our service area, as well as visitors to our premises and individuals who contact us regarding our services.
Data Controller
Storage Kensington is the data controller for the personal data described in this Privacy Policy. This means that we determine the purposes and means of processing your personal data and are responsible for ensuring that our processing complies with applicable data protection laws.
Personal Data We Collect
We collect and process different types of personal data in connection with our self-storage services and related activities. The categories of personal data we may collect include:
Identification data such as name, title, date of birth, and a form of identification where required for security and contract purposes.
Contact details such as home or billing address, storage unit address within our facility, and any other addresses you provide to us.
Communication details such as email correspondence, written communications, and records of telephone or in-person enquiries related to your bookings, payments, and any support requests.
Contract and account data such as storage unit numbers, rental agreements, access permissions, contract start and end dates, and records of changes to your services.
Payment and billing data such as payment history, invoices, payment method details as permitted by law, and information required to prevent fraud and non-payment. We do not store full card details where this is not necessary.
Security and access data such as CCTV footage of our premises, access control records including key code logs or entry system data, and incident reports where relevant to the protection of people and property.
Technical data such as IP addresses, device identifiers, and basic usage data where you visit our website or use any online account or customer portal we provide.
Marketing preferences such as your choices regarding receiving service updates and marketing communications from us.
How We Collect Personal Data
We may obtain personal data directly from you, for example when you request a quotation, enter into a storage agreement, sign up to an online portal, communicate with us by email or in person, visit our premises, or complete forms related to our services.
We may also collect personal data from third parties where lawful and necessary, for example from payment processors, identity verification services, or third party platforms used to advertise or manage our services. Additionally, some information is generated automatically, such as access control records and CCTV images when you visit our facilities.
Purposes and Lawful Bases for Processing
Storage Kensington will only process your personal data where we have a lawful basis to do so under the GDPR. Depending on the context, we may rely on one or more of the following lawful bases:
Contract performance: We process personal data to take steps at your request before entering into a contract and to fulfil our contractual obligations. This includes setting up and managing your storage agreement, providing access to your unit, managing payments, and communicating with you about your account.
Legal obligations: We process certain personal data as required by applicable laws and regulations. This may include retaining certain billing and transaction records for tax and accounting purposes, assisting law enforcement where we are legally required to do so, and complying with health and safety requirements.
Legitimate interests: We process personal data where it is necessary for our legitimate interests or those of a third party, provided that your rights and interests do not override those interests. Our legitimate interests include securing our premises and property through CCTV and access control systems, preventing and investigating fraud or misuse of our services, improving our services and facilities, and communicating with you regarding similar services you already use, subject to applicable marketing rules.
Consent: In some circumstances, we may rely on your explicit consent to process personal data, for example where we send certain types of marketing material by electronic means that require consent. Where we rely on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purpose of satisfying any legal, accounting, or reporting requirements. When determining the appropriate retention period, we consider the nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, our contractual obligations, and any statutory retention periods.
In general, we will retain contract and account data for a period after your storage agreement ends to enable us to respond to queries, handle disputes, or provide verification of past services. Payment and billing records are typically retained for a minimum period required by tax and accounting laws. CCTV footage and access control records are retained for shorter periods, unless an incident requires us to keep them for longer for investigation or legal reasons.
When personal data is no longer needed for the purposes for which it was collected, we securely delete or anonymise it.
Data Processors and Sharing of Personal Data
We may engage carefully selected third party service providers to act as data processors on our behalf. These processors are only permitted to process personal data in accordance with our documented instructions and are required to implement appropriate technical and organisational measures to protect the data.
Examples of the types of processors we may use include payment processing providers, IT and cloud hosting services, customer management systems, security and CCTV system providers, and professional advisers who assist us with legal, auditing, or accounting matters.
We may also share personal data with third parties where this is necessary for compliance with a legal obligation, for the establishment, exercise, or defence of legal claims, or where you have requested or consented to such sharing. Where we use third parties located outside the United Kingdom or European Economic Area, we will ensure that appropriate safeguards are in place to protect your personal data in accordance with GDPR requirements.
Security of Personal Data
We take the security of your personal data seriously and implement measures designed to protect it from loss, misuse, unauthorised access, disclosure, alteration, and destruction. These measures may include physical security controls at our premises, access control systems, restricted access to customer information, encryption where appropriate, and policies and procedures to guide staff in handling personal data securely.
While we strive to protect your personal data, no system can be guaranteed to be completely secure. We continually review our security procedures and technology to maintain a high level of protection appropriate to the risks involved in our processing activities.
Individual Rights Under GDPR
Under the GDPR, individuals whose data we process have a number of rights in relation to their personal data. These rights apply to all Storage Kensington customers and other individuals within our service area whose data we process, subject to certain legal conditions and exceptions.
Right of access: You have the right to request confirmation as to whether we process your personal data and, if so, to request a copy of that data together with information about how we process it.
Right to rectification: You have the right to request that we correct any inaccurate personal data about you and to complete any incomplete information.
Right to erasure: In certain circumstances, you have the right to request that we delete or remove your personal data, for example where the data is no longer necessary for the purposes for which it was collected or where you withdraw consent and no other lawful basis applies.
Right to restriction of processing: You may request that we restrict the processing of your personal data in certain situations, such as where you contest its accuracy or where you have objected to processing and we are considering whether our legitimate grounds override your interests.
Right to data portability: In some circumstances, you have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format and to have that data transmitted to another data controller, where this is technically feasible.
Right to object: You have the right to object at any time, on grounds relating to your particular situation, to our processing of your personal data that is based on legitimate interests. You also have an absolute right to object to processing for direct marketing purposes.
Rights related to automated decision-making: If we ever use automated decision-making processes that produce legal effects or significantly affect you, you may have the right to request human intervention, to express your point of view, and to contest the decision.
Exercising Your Rights and Complaints
If you wish to exercise any of the rights described in this Privacy Policy, or if you have questions or concerns about how we handle your personal data, you can contact us using the contact details provided on our website or in your storage agreement. We may need to request additional information from you to confirm your identity before responding to your request.
You also have the right to lodge a complaint with your local data protection authority if you believe that our processing of your personal data infringes data protection laws. We would, however, welcome the opportunity to address your concerns directly in the first instance.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. Any significant changes will be communicated by appropriate means, and the latest version will always be available from us. We encourage you to review this Privacy Policy periodically so that you remain informed about how we process and protect your personal data.
