Privacy Policy - Selfstorage Swisscottage

This Privacy Policy explains how Selfstorage Swisscottage collects, uses, stores, shares, and protects personal data in connection with its storage services. It applies to all Selfstorage Swisscottage customers in the area, including prospective customers, current customers, former customers, visitors, and anyone who interacts with us in relation to our services. We are committed to handling personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our services or providing personal data to us, you acknowledge that your information will be processed as described in this Privacy Policy.

1. Information We Collect

We collect only the personal data necessary to provide and manage our storage services, comply with legal obligations, and protect our legitimate business interests. The categories of data we may collect include:

Identity data such as your name, date of birth, and identification details;
Contact data such as postal address, email address, and telephone number;
Contract data such as tenancy or storage agreement details, account reference numbers, payment terms, and service history;
Financial data such as billing information and records of payments received or due;
Access and security data such as CCTV footage, entry logs, key or access-code records, and incident reports;
Communication data such as records of emails, written correspondence, complaints, and service requests;
Technical data if you visit any digital systems we operate, including basic device, browser, and usage information;
Special category data only where strictly necessary and lawful, for example if you voluntarily provide information relating to disability or access requirements so we can make reasonable adjustments.

We generally collect personal data directly from you when you enquire about, register for, or use our services. In some cases, we may also receive data from third parties, such as payment providers, identity verification services, insurers, debt recovery providers, or legal and regulatory authorities where permitted by law.

2. How We Use Your Data

We use personal data for the following purposes:

to register and manage your storage account;
to verify your identity and prevent fraud;
to administer contracts and provide access to storage facilities;
to process payments, refunds, and account statements;
to communicate with you about your account, service changes, or security matters;
to maintain site safety and security, including monitoring access and investigating incidents;
to comply with legal, tax, accounting, and regulatory obligations;
to establish, exercise, or defend legal claims;
to improve our services, operations, and customer experience;
to send service-related notices and, where permitted, limited marketing communications.

We do not sell your personal data. Any marketing communication will be handled in line with applicable electronic marketing laws, and you may opt out where required.

3. Lawful Basis for Processing

We process personal data only where we have a lawful basis under the UK GDPR. Depending on the context, the lawful basis may include:

Contract – processing is necessary to enter into or perform our storage agreement with you;
Legal obligation – processing is necessary to comply with laws relating to tax, accounting, anti-fraud, health and safety, or law enforcement requests;
Legitimate interests – processing is necessary for our legitimate business interests, such as maintaining secure premises, preventing misuse, managing operations, and resolving disputes, provided your interests and rights do not override those interests;
Consent – where required, such as for certain optional communications or the use of particular categories of data;
Vital interests – in rare situations where processing is necessary to protect someone’s life;
Public task – where applicable, if processing is required in connection with a public authority request or official function.

Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

4. Data Sharing and Processors

We may share personal data with trusted third parties where necessary and proportionate for the purposes described in this Policy. These third parties act either as processors on our behalf or as independent controllers in their own right.

Processors

Processors may include:

IT and hosting providers that support our systems, storage, and security;
payment processing and billing service providers;
customer relationship and communications service providers;
security and CCTV monitoring service providers;
document management and archiving providers;
professional advisers acting under confidentiality obligations, such as accountants, auditors, insurers, and lawyers;
identity verification and fraud prevention services;
debt recovery or collections providers, where lawful and necessary.

All processors are required to process personal data only on our instructions, to keep it secure, and to comply with appropriate contractual and legal safeguards. We do not permit processors to use your data for their own unrelated purposes.

We may also disclose personal data to courts, regulators, police, government bodies, or other third parties where required or permitted by law, or where necessary to protect our rights, customers, staff, or property.

5. International Transfers

If any of our processors or service providers store or access data outside the UK, we will ensure that appropriate safeguards are in place before any transfer occurs. These safeguards may include adequacy regulations, standard contractual clauses, or equivalent legal mechanisms approved under applicable data protection law. We assess transfer risks and aim to maintain a level of protection that is equivalent to UK standards.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, insurance, security, and dispute resolution requirements. Retention periods depend on the type of data and the purpose of processing.

Account and contract records are normally kept for the duration of the relationship and for a reasonable period afterward;
Payment and tax-related records are retained for the period required by law;
Security records, including CCTV and access logs, are retained for limited periods unless needed for an investigation, legal claim, or regulatory requirement;
Correspondence and complaint records are retained as long as needed to manage the issue and defend any potential claims;
Where data is no longer required, it is securely deleted, anonymised, or archived in a controlled manner.

We review retention practices regularly to ensure that data is not kept longer than necessary.

7. Data Security

We apply appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. These measures may include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, and monitoring of security incidents. Although we take care to protect your data, no system can be guaranteed to be completely secure.

8. Your Rights

Under data protection law, you may have the following rights in relation to your personal data:

Right of access – to request a copy of the personal data we hold about you;
Right to rectification – to request correction of inaccurate or incomplete data;
Right to erasure – to request deletion of your data in certain circumstances;
Right to restriction – to request that we limit how we use your data in certain cases;
Right to data portability – to receive certain data in a structured, commonly used format and have it transferred where technically feasible;
Right to object – to object to processing based on legitimate interests or direct marketing;
Right to withdraw consent – where processing is based on consent;
Rights relating to automated decision-making – to not be subject to decisions based solely on automated processing where such decisions produce legal or similarly significant effects, unless permitted by law.

To exercise any of these rights, you should provide sufficient information to help us identify you and locate your records. We may need to verify your identity before responding. We will respond within the time limits required by law unless an extension is permitted due to complexity or multiple requests.

These rights are not absolute. In some situations, legal obligations or legitimate grounds may allow us to refuse part or all of a request.

9. Children’s Data

Our services are not intended for children under the age at which they may lawfully enter contracts. We do not knowingly collect personal data from children except where necessary in connection with a lawful service arrangement or where provided by a parent, guardian, or authorised representative.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or security changes. Any revised version will apply from the date it is issued. We encourage customers to review this Policy periodically so they remain informed about how personal data is used and protected.

11. Complaints and Supervisory Authority

If you are concerned about how your personal data has been handled, we encourage you to raise the issue so it can be reviewed and addressed. You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe your rights have been infringed.

Privacy is important to us. We are committed to processing personal data responsibly, securely, and in a manner that respects the rights and freedoms of the individuals whose data we hold.