Privacy Policy - Finsburypark Storage

This Privacy Policy explains how Finsburypark Storage collects, uses, stores, shares, and protects personal data. It applies to all Finsburypark Storage customers in the area, including prospective customers, current customers, former customers, and any individual who interacts with our services on behalf of a business or household. We are committed to handling personal data fairly, lawfully, transparently, and in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Finsburypark Storage provides storage services to individuals and businesses in the local area. In the course of providing these services, we act as a data controller for the personal data described in this policy. This means we decide why and how your personal data is processed. We take our responsibilities seriously and aim to collect only the information needed to operate our services, protect our premises, meet our legal obligations, and support our customers.

2. What personal data we collect

We may collect and process the following categories of personal data:

Identity data such as your name, title, date of birth, and identification details where required.
Contact data such as your address, email address, and telephone number.
Account and contract data including booking details, storage unit information, billing records, payment status, and correspondence about your account.
Financial data such as limited payment-related information necessary to process invoices, refunds, and charges.
Security data including CCTV footage, access logs, entry records, alarm records, and incident reports.
Usage data such as visits to the site, access times, service preferences, and records relating to the use of facilities.
Communication data including messages, complaints, queries, and notes of calls or interactions.
Technical data if you use any online systems connected with our services, such as IP address, browser information, and device details.

In some cases, we may also collect special category data or more sensitive information if it is necessary to protect rights, investigate incidents, or comply with legal obligations. Where this occurs, we will process such data only where a valid legal condition applies and with appropriate safeguards.

3. How we collect your data

We collect personal data directly from you when you complete forms, sign agreements, make enquiries, pay for services, or communicate with us. We may also collect data from:

third parties involved in payment processing;
security systems such as CCTV and access control systems;
fraud prevention and identity verification sources where necessary;
public authorities, insurers, legal advisers, or other organisations where required by law or to protect legitimate interests.

We only collect personal data that is relevant and proportionate to the purpose for which it is needed.

4. Why we use your data

We use personal data for the following purposes:

to provide storage services and manage customer accounts;
to verify identity and prevent fraud;
to process payments, issue invoices, and manage arrears;
to maintain site safety, security, and operational integrity;
to monitor access to the premises and investigate incidents;
to respond to enquiries, complaints, and support requests;
to comply with legal, regulatory, tax, and accounting obligations;
to establish, exercise, or defend legal claims;
to improve our services and maintain accurate records.

We use your information only when we have a valid reason to do so and we keep our processing limited to what is necessary for each purpose.

5. Lawful basis for processing

Under GDPR, we must have a lawful basis to process personal data. Depending on the situation, Finsburypark Storage may rely on one or more of the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform our storage agreement with you. This includes setting up your account, delivering services, and managing billing.

Legal obligation

We process personal data where required to comply with legal duties, including tax, accounting, health and safety, fraud prevention, and lawful requests from public authorities.

Legitimate interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided that these interests are not overridden by your rights and freedoms. This may include protecting property, managing site security, preventing misuse, and improving service operations.

Consent

In limited situations, we may rely on your consent, for example where consent is required for a specific optional activity. If we rely on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

Vital interests and public task

These bases are unlikely to apply in most cases, but we may process data where necessary to protect someone’s vital interests or where required in connection with a public task or official request.

6. Sharing your data and processors

We may share personal data with trusted third parties who act as processors on our behalf. Processors only act under our instructions and are required to protect your data and process it lawfully. These may include:

payment service providers;
IT and cloud storage providers;
security service providers and CCTV system providers;
maintenance and facilities management providers;
professional advisers such as accountants, insurers, and legal advisers;
identity verification or fraud prevention services;
regulatory bodies, law enforcement, or public authorities where legally required.

Where data is shared, we ensure suitable contractual and technical safeguards are in place. We do not sell personal data.

7. International transfers

If any processor or service provider stores or accesses personal data outside the UK, we will take steps to ensure that appropriate safeguards are in place. These may include adequacy regulations, standard contractual clauses, or equivalent protections recognised under applicable data protection law.

8. Data retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, security, and reporting requirements. Retention periods vary depending on the type of data and the reason it is held.

Contract and account records are generally retained for the duration of the customer relationship and for a reasonable period afterwards.
Payment and accounting records are kept in line with statutory accounting and tax retention requirements.
Security records such as CCTV footage are retained for a limited period unless needed for an investigation, claim, or legal process.
Correspondence and complaints may be retained for as long as needed to resolve the matter and for record-keeping purposes.

When data is no longer required, it is securely deleted, anonymised, or otherwise disposed of in a safe and lawful manner.

9. Security of your data

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, staff training, secure storage, CCTV monitoring, password protection, and limited access to sensitive information. While no system can be guaranteed to be completely secure, we work to maintain a high standard of data protection.

10. Your rights under GDPR

You have important rights in relation to your personal data. Subject to legal limits, these include the right to:

access the personal data we hold about you;
rectify inaccurate or incomplete information;
erase your personal data in certain circumstances;
restrict processing in certain situations;
object to processing based on legitimate interests or direct marketing;
data portability for information you provided to us where processing is based on consent or contract and carried out by automated means;
withdraw consent where we rely on consent for processing;
not be subject to automated decision-making that produces legal or similarly significant effects, where applicable.

You also have the right to lodge a complaint with the Information Commissioner’s Office if you believe your data protection rights have been infringed. We encourage you to contact us first so we can try to resolve any concern promptly and fairly.

11. How we handle children’s data

Our services are generally intended for adults. We do not knowingly collect personal data from children except where necessary and lawful, such as when a parent, guardian, or authorised representative provides information in connection with a storage arrangement. If we become aware that we have collected data unlawfully, we will take steps to delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data protection practices. Any updated version will apply from the date it is made available. We encourage customers to review this policy periodically so they remain informed about how their information is handled.

13. Summary of our approach

Finsburypark Storage is committed to privacy, transparency, and accountability. We collect only the data we need, use it for clear and lawful purposes, retain it for no longer than necessary, and require our processors to protect it. We respect the rights of all customers in the area and will always aim to treat personal information with care and integrity. If you continue to use our services, you acknowledge that this policy applies to your personal data in connection with those services.