Privacy Policy - Hornsey Storage

Effective date: This Privacy Policy applies to all Hornsey Storage customers in the area.

This Privacy Policy explains how Hornsey Storage collects, uses, stores, shares, and protects personal data when providing storage services. It is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are committed to handling personal information fairly, lawfully, and transparently. By using our storage services, making an enquiry, entering into an agreement, or otherwise interacting with us, you acknowledge the practices described in this policy.

1. Personal Data We Collect

We may collect and process several categories of personal data depending on how you interact with us and which services you use. The data collected is limited to what is necessary for the purpose for which it is obtained.

Information you provide directly

Identity details such as your name, title, and date of birth where required for verification.
Contact details including postal address, email address, and telephone number.
Account and booking information such as storage unit details, rental dates, payment preferences, and service instructions.
Correspondence including any communications with our staff, complaint records, or feedback you provide.
Verification information where needed to confirm identity, prevent fraud, or comply with legal obligations.

Information collected automatically

Technical data such as device type, browser type, and basic usage data if you access digital systems linked to our services.
Security and access records including entry logs, CCTV footage, and site access information where applicable.
Payment-related records such as transaction confirmation and billing history, though full card details are generally handled by secure payment processors rather than stored by us.

Information from third parties

In some cases, we may receive information from third parties such as identity verification providers, payment services, insurance providers, lawful authorities, or referral partners. We only use such data where permitted by law and where it is relevant to the provision and management of our services.

2. How We Use Personal Data

Hornsey Storage uses personal data for specific and legitimate purposes connected with our business operations and customer relationship. These purposes include:

setting up and managing customer accounts and storage agreements;
verifying identity and preventing unauthorised use of storage services;
processing payments, invoices, deposits, refunds, and account adjustments;
providing customer support and responding to enquiries or complaints;
maintaining the safety and security of our premises, staff, customers, and property;
fulfilling legal and regulatory obligations, including tax, accounting, and record-keeping duties;
detecting, investigating, and preventing fraud, theft, vandalism, or misuse of our services;
improving our services, internal processes, and customer experience;
defending or pursuing legal claims where necessary.

We will only use personal data in ways that are compatible with the purposes set out in this policy, unless we are required or permitted by law to use it for another related purpose.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for each type of processing. Depending on the circumstances, Hornsey Storage relies on one or more of the following lawful bases:

Contract — where processing is necessary to enter into or perform a storage agreement, provide services, take payment, manage access, or respond to service requests.
Legal obligation — where we must process personal data to comply with statutory duties such as accounting, tax, fraud prevention, health and safety, or record-keeping requirements.
Legitimate interests — where processing is necessary for our legitimate business interests, provided these interests are not overridden by your rights and freedoms. Examples include site security, CCTV monitoring, service improvement, and protecting against misuse.
Consent — where we rely on your permission for certain optional activities, such as marketing communications where consent is required by law. You may withdraw consent at any time, where applicable.
Vital interests — in rare circumstances where processing is needed to protect someone’s life.

We assess each processing activity to ensure that the chosen legal basis is appropriate and proportionate.

4. How We Share Personal Data

We do not sell personal data. However, we may share it with trusted third parties where necessary and lawful for the operation of our services.

Categories of processors and recipients

Payment processors who handle secure payment transactions and related financial processing;
IT and cloud service providers that support record storage, system administration, and communications;
Security providers involved in monitoring, alarm systems, access control, and CCTV management;
Professional advisers such as legal, accounting, or audit services;
Insurance providers and claims handlers where a claim, incident, or policy matter requires disclosure;
Regulatory bodies, courts, law enforcement, or government authorities where disclosure is required by law or necessary to protect rights, property, or safety.

Where third parties process personal data on our behalf, they act as processors and are required to follow our instructions, protect the data, and process it only for the agreed purpose.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting obligations. Retention periods vary depending on the nature of the data and the reason it is held.

Customer account and contract records are generally kept for the duration of the customer relationship and for a reasonable period afterwards to manage claims, disputes, or contractual obligations.
Financial and tax records are retained in line with legal requirements, which may require keeping records for several years after the end of the financial year.
Security records such as access logs or CCTV footage are kept only for as long as needed for security, investigation, or incident handling purposes.
Communications and complaints are retained for a period that allows us to address issues, improve services, and evidence how matters were resolved.

When personal data is no longer required, we will securely delete, anonymise, or destroy it in a manner appropriate to its sensitivity.

6. Security of Personal Data

We use reasonable technical and organisational measures to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. These measures may include restricted access controls, secure storage, staff training, system protections, and monitoring of critical systems.

Although we take steps to safeguard personal data, no system can be guaranteed to be completely secure. If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will take appropriate action in line with legal requirements.

7. Your Rights

As a data subject under UK GDPR, you have a number of rights in relation to your personal data. These rights may be subject to limitations in some situations, but we will always consider your request carefully.

Right of access — you can request a copy of the personal data we hold about you.
Right to rectification — you can ask us to correct inaccurate or incomplete personal data.
Right to erasure — you can request deletion of your personal data in certain circumstances.
Right to restriction — you can ask us to restrict the processing of your data in certain cases.
Right to object — you can object to processing based on legitimate interests or direct marketing.
Right to data portability — you may request transfer of data you provided to us in a structured, commonly used format, where applicable.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your data protection rights have been infringed.

8. Automated Decision-Making

Hornsey Storage does not use personal data for decisions that produce legal or similarly significant effects based solely on automated processing, unless we have informed you and the law allows it. If we introduce such processing in the future, we will provide appropriate safeguards and explain your rights.

9. International Transfers

Where personal data is transferred outside the UK, we will ensure appropriate safeguards are in place to protect it, such as adequacy regulations, standard contractual clauses, or equivalent lawful transfer mechanisms. Any such transfer will be assessed to ensure a level of protection consistent with UK data protection standards.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our business practices. Any revised version will apply from the date of publication or as otherwise stated. We encourage customers to review this policy periodically to stay informed about how we handle personal data.

11. Contact and Further Information

If you have questions about this Privacy Policy or wish to exercise your rights, you can raise the matter through the normal customer service channels used for Hornsey Storage accounts. We will respond in accordance with applicable data protection law.

Summary of key principles:

We collect only the data needed to provide storage services and meet legal obligations.
We process data on lawful bases including contract, legal obligation, legitimate interests, and consent where relevant.
We share data only with necessary processors and recipients under appropriate safeguards.
We retain data for no longer than necessary.
You have rights over your personal data and can ask us to exercise them where applicable.

This Privacy Policy applies to all Hornsey Storage customers in the area and is intended to ensure transparent, fair, and lawful handling of personal data.