Privacy Policy - Kingstonvale Storage

Kingstonvale Storage is committed to protecting the privacy and personal data of all customers in area. This Privacy Policy explains how we collect, use, store, share, and protect personal data in accordance with the UK GDPR and the Data Protection Act 2018. It applies to all Kingstonvale Storage customers in area, including prospective customers, current customers, visitors, and any other individuals whose personal data we process in connection with our services.

1. Personal Data We Collect

We collect only the personal data that is necessary for the operation of our storage services, contract management, security, and legal compliance. Depending on your relationship with us, we may collect the following categories of personal data:

Identity data: name, date of birth, and proof of identity where required.
Contact data: postal address, email address, telephone number, and billing address.
Account data: customer reference number, storage unit details, rental dates, payment status, and service preferences.
Financial data: payment card details, bank account details, payment confirmations, and transaction history, where needed for billing and refunds.
Security data: CCTV images, access logs, gate entry records, alarm records, and incident reports.
Communication data: correspondence, complaints, enquiries, and service-related messages.
Technical data: device information, internet protocol address, browser type, and log data when you interact with our digital systems.

We do not intentionally collect special category data unless it is strictly necessary and you have provided it, or unless we are required to process it for a lawful reason. We ask that you do not provide unnecessary sensitive information.

2. How We Use Personal Data

We use personal data for the following purposes:

to provide storage services and administer your customer account;
to verify identity and prevent fraud, theft, and misuse;
to process payments, refunds, and account adjustments;
to maintain site safety and manage access control;
to communicate about service changes, reminders, and account matters;
to handle complaints, disputes, and claims;
to comply with legal, regulatory, tax, and insurance obligations;
to improve our operations, systems, and customer experience;
to exercise, defend, or establish legal rights.

We process data only for clear and legitimate purposes. We do not use your personal data for unrelated purposes without first ensuring that we have a valid legal basis and, where required, informing you appropriately.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis before processing personal data. Kingstonvale Storage relies on the following lawful bases:

Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes setting up storage agreements, managing access, taking payments, and providing agreed services.

Legal Obligation

We may process personal data where required to comply with legal obligations, including accounting rules, tax requirements, health and safety duties, and lawful requests from authorities.

Legitimate Interests

We process personal data where it is necessary for our legitimate interests and those interests are not overridden by your rights and freedoms. Examples include security monitoring, fraud prevention, service improvement, and the protection of property.

Consent

In limited situations, we rely on consent. Where we do so, you may withdraw consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

Vital Interests

In rare cases, we may process personal data to protect someone’s vital interests, such as in an emergency involving serious harm.

4. Data Sharing and Processors

We may share personal data with trusted third parties that help us operate our business. These third parties act as data processors or independent controllers, depending on the circumstances. We only share the minimum data necessary and require appropriate safeguards.

Examples of processors and service providers may include:

payment processing providers;
accounting and bookkeeping services;
IT hosting, cloud storage, and software providers;
security and CCTV system providers;
maintenance and facilities management contractors;
professional advisers such as lawyers, insurers, and auditors;
debt recovery or collections providers, where lawful and necessary.

All processors are required to handle personal data securely, follow our instructions, and comply with data protection law. We do not sell personal data.

We may also disclose personal data where necessary to comply with legal requirements, court orders, law enforcement requests, or to protect the rights, property, or safety of Kingstonvale Storage, our customers, or others.

5. Retention of Personal Data

We keep personal data only for as long as necessary for the purposes described in this policy, unless a longer retention period is required by law. Retention periods vary depending on the type of data and the reason for its collection.

Customer account records: retained for the duration of the contract and for a reasonable period afterwards.
Financial and tax records: retained for the period required by applicable accounting and tax laws.
Security records and CCTV footage: retained only for as long as needed for security, incident review, or legal purposes.
Complaints and dispute records: retained until the matter is resolved and for a further period where needed to defend legal claims.
Marketing consent records: retained until you withdraw consent or we no longer use the data for that purpose.

When personal data is no longer required, we will securely delete, anonymise, or archive it in accordance with our retention practices.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss, disclosure, or destruction. These measures may include access controls, secure storage, encryption where appropriate, staff confidentiality obligations, and regular review of our systems and processes.

While we take data security seriously, no system can be guaranteed completely secure. We therefore encourage customers to keep their own personal information safe and to notify us promptly if they become aware of any suspected misuse of their data.

7. Your Rights

Under data protection law, you have a number of rights in relation to your personal data. These rights may be limited in some situations, but we will always consider your request carefully.

Right of access: you can request a copy of the personal data we hold about you.
Right to rectification: you can ask us to correct inaccurate or incomplete data.
Right to erasure: you may ask us to delete your data in certain circumstances.
Right to restriction: you may ask us to limit how we use your data.
Right to object: you may object to processing based on legitimate interests or direct marketing.
Right to data portability: you may request certain data in a structured, commonly used format.
Right to withdraw consent: where we rely on consent, you can withdraw it at any time.

If you wish to exercise any of these rights, we may need to verify your identity before responding. We aim to respond within one month, unless the request is complex or numerous, in which case the law permits additional time.

8. Marketing Preferences

We will only send marketing communications where permitted by law. If you have agreed to receive marketing, you may opt out at any time. Transactional or service-related messages are not marketing and may still be sent when necessary for account management or service delivery.

9. Children’s Data

Our services are intended for adults and business or residential customers who are able to enter into storage agreements. We do not knowingly collect children’s personal data unless it is incidentally provided and necessary for a lawful purpose. If we become aware that we have collected data unlawfully, we will take appropriate steps to delete it.

10. International Transfers

If personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place, such as approved contractual protections or an adequacy decision, so that your data remains protected to a standard consistent with UK data protection law.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or security changes. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to stay informed about how we handle personal data.

12. Summary

This Privacy Policy explains how Kingstonvale Storage collects and uses personal data, the lawful bases for processing, how long data is retained, which processors may receive it, and the rights available to customers. It applies to all Kingstonvale Storage customers in area. We are committed to processing personal data fairly, lawfully, and transparently, while respecting your privacy and protecting your information.

By using Kingstonvale Storage services, you acknowledge that your personal data will be handled in accordance with this Privacy Policy and applicable data protection law.