Privacy Policy - Kennington Storage

Kennington Storage is committed to protecting the privacy and personal data of our customers, visitors, and prospective customers. This Privacy Policy explains how we collect, use, disclose, store, and protect personal data in connection with our storage services and related operations. It applies to all Kennington Storage customers in the area, including individuals and businesses using our facilities or contacting us about our services.

1. Who We Are

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Kennington Storage acts as the data controller in relation to the personal data we collect and use for the provision and management of our services. This means we determine why and how your personal data is processed.

2. Personal Data We Collect

We collect only the personal data necessary to provide our services, manage our business, and comply with legal obligations. Depending on how you interact with us, we may collect the following categories of data:

Identity information: name, title, date of birth, and similar identifying details.
Contact information: postal address, email address, telephone number, and billing address.
Account and service information: storage unit details, booking records, correspondence, payment status, access permissions, and service preferences.
Financial information: payment card details, bank details, invoices, payment history, and related transaction records. Where possible, payment processing is handled securely by third parties.
Security information: CCTV footage, access logs, alarm records, incident reports, and information relating to site safety and security.
Communication records: emails, telephone notes, online enquiry forms, complaints, and other communications you send to us.
Technical information: IP address, browser type, device information, and usage data where collected through our digital systems.
Verification information: copies of identification documents or proof of address where required for fraud prevention, security, or legal compliance.

We do not intentionally collect special category data unless it is relevant and lawful to do so, for example where you voluntarily provide information that is necessary for a specific service issue or legal claim. Where such data is processed, we do so only in accordance with data protection law.

3. How We Use Personal Data

We use personal data for the following purposes:

to set up and manage customer accounts;
to provide and maintain storage services;
to process payments, deposits, invoices, and refunds;
to verify identity and prevent fraud;
to maintain site security, monitor access, and protect property;
to respond to enquiries, complaints, and customer support requests;
to send service-related notices, including contractual updates and policy changes;
to comply with legal, regulatory, tax, and accounting obligations;
to establish, exercise, or defend legal claims;
to improve our operations, customer service, and service quality;
to manage business records and internal administration.

4. Lawful Basis for Processing

We process personal data only where we have a valid lawful basis under the UK GDPR. The lawful bases we rely on are:

4.1 Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes managing bookings, providing storage services, taking payments, and maintaining your customer account.

4.2 Legal Obligation

We may process personal data where required to comply with legal obligations, such as tax rules, accounting requirements, anti-fraud requirements, and obligations relating to health, safety, or lawful record-keeping.

4.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include protecting our premises, preventing theft and fraud, improving services, managing disputes, maintaining business records, and ensuring the secure operation of our services. Where we rely on legitimate interests, we consider the impact on your privacy and apply appropriate safeguards.

4.4 Consent

In limited circumstances, we may rely on your consent, for example for certain optional communications or specific uses not covered by another lawful basis. Where we rely on consent, you may withdraw it at any time, and we will stop the relevant processing unless another lawful basis applies.

5. Sharing Personal Data and Processors

We may share personal data with trusted third parties where necessary to operate our services, meet legal requirements, and protect our business. These third parties may act as processors or, in some cases, as independent controllers.

Processors are service providers that process personal data on our behalf and under our instructions. Examples may include:

payment processing providers;
cloud storage and IT service providers;
customer relationship management and booking system providers;
security and CCTV monitoring service providers;
accountants, auditors, and professional advisers acting under confidentiality obligations;
maintenance, repair, and facilities management contractors where access to personal data is necessary;
legal advisers and debt recovery providers where needed for claims or debt management.

We require our processors to handle personal data securely, to process it only on our instructions, and to implement appropriate technical and organisational measures to protect it. We do not sell personal data.

We may also disclose personal data to public authorities, law enforcement agencies, courts, or regulators where required by law or where necessary to protect our rights, customers, staff, or property.

6. International Transfers

Where personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms approved under data protection law. We take reasonable steps to ensure that such transfers remain secure and compliant.

7. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, reporting, or security requirements. Retention periods vary depending on the type of data and the reason for processing.

Customer and contract records: retained for the duration of the relationship and for a reasonable period afterwards to deal with queries, disputes, or legal claims.
Financial and tax records: retained for the period required by applicable accounting and tax laws.
Security records and CCTV: retained for a limited period unless needed for an investigation, insurance claim, or legal matter.
Correspondence and complaints: retained as long as necessary to manage the issue and maintain business records.
Marketing preferences: retained until you opt out or your consent is withdrawn, where applicable.

When personal data is no longer needed, we will securely delete, anonymise, or destroy it in accordance with our retention procedures.

8. Data Security

We take the security of personal data seriously and use appropriate measures to protect it from loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff training, monitoring, and regular review of our procedures. While no system can be guaranteed to be completely secure, we work to maintain a level of protection appropriate to the risk.

9. Your Rights

Under data protection law, you have a number of rights in relation to your personal data. Subject to certain conditions and exemptions, these rights include:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete data.
Right to erasure: to ask us to delete your data in certain circumstances.
Right to restriction: to request limited processing in certain cases.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to data portability: to receive certain data in a structured, commonly used, machine-readable format and to have it transferred where feasible.
Right to withdraw consent: where we rely on consent, you may withdraw it at any time.

You also have the right to raise concerns about how we handle your personal data. If you believe your data protection rights have been infringed, you may complain to the UK Information Commissioner's Office (ICO). We encourage you to contact us first so that we can try to resolve the issue promptly.

10. Automated Decision-Making

We do not use personal data for decisions based solely on automated processing that produce legal or similarly significant effects unless we inform you and ensure such processing is lawful and appropriately safeguarded. If this changes, we will update this policy and provide clear information about the process involved.

11. Children

Our services are intended for adults and business users. We do not knowingly collect personal data from children in connection with storage services. If we become aware that we have collected data from a child without appropriate consent or legal basis, we will take reasonable steps to delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our data practices. Any revised version will apply from the date it is made available. We encourage you to review this policy periodically to stay informed about how we protect your personal data.

13. Summary of Our Commitment

Kennington Storage is dedicated to handling personal data lawfully, fairly, and transparently. We only collect data that is relevant and necessary, we use it for clear and legitimate purposes, and we keep it only for as long as needed. We also ensure that our processors are carefully selected and contractually required to protect your information. Our aim is to support a secure, reliable, and privacy-conscious storage service for all customers in the area.