Privacy Policy - Selfstorage Hollandpark

This Privacy Policy explains how Selfstorage Hollandpark collects, uses, shares, stores, and protects personal data. It applies to all Selfstorage Hollandpark customers in the area, including prospective customers, current customers, former customers, visitors, and anyone who otherwise interacts with our storage services, administration, or related operations. We are committed to handling personal data in accordance with the General Data Protection Regulation (GDPR) and applicable local privacy laws.

1. Scope of this Privacy Policy

This policy covers personal data processed in connection with our storage services, access management, billing, customer support, security, and legal compliance. It applies whether data is collected directly from you, through your use of our services, or from third parties acting on your behalf.

Selfstorage Hollandpark respects the privacy of every customer and only processes personal data when there is a valid and lawful reason to do so. We aim to collect only the data necessary for specific and legitimate purposes.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

Identity data: name, date of birth, and identification details where necessary.
Contact data: postal address, email address, and telephone number.
Contract and account data: customer reference details, storage unit information, contract terms, rental dates, and payment records.
Payment data: invoice information, bank account details, payment status, and transaction history.
Access and security data: entry logs, key or code usage, CCTV footage, and incident reports where applicable.
Communication data: correspondence, support requests, complaints, and service-related messages.
Technical data: basic information about devices or systems used to access digital services, if relevant.

We do not intentionally collect more information than is needed for the operation of our services. If you choose not to provide certain data, we may be unable to enter into or perform a storage agreement with you.

3. How We Collect Personal Data

Personal data may be collected in several ways, including:

When you request information or enter into a storage agreement.
When you use our facilities or services.
When you communicate with us about your account, access, or billing.
When payments are made or invoices are issued.
When security systems record access or incidents.
When third parties provide information on your behalf, such as payment service providers or authorized representatives.

4. Purposes of Processing

We process personal data for the following purposes:

To establish and manage customer contracts.
To provide access to storage units and related services.
To process payments, issue invoices, and manage accounts.
To maintain security, prevent fraud, and protect property.
To communicate with customers regarding service matters.
To comply with legal and regulatory obligations.
To handle disputes, claims, and enforcement of contractual rights.

Where appropriate, data may also be used to improve our internal processes, provided that such use remains consistent with GDPR principles of purpose limitation, minimisation, and accountability.

5. Lawful Basis for Processing

Under GDPR, every processing activity must rely on a lawful basis. Selfstorage Hollandpark processes personal data on one or more of the following bases:

Contract: when processing is necessary to enter into or perform a storage agreement, such as account creation, billing, and access management.
Legal obligation: when we must retain or disclose information to comply with laws, tax rules, accounting obligations, or lawful requests from authorities.
Legitimate interests: when processing is necessary for security, fraud prevention, customer service, operational administration, or the protection of our business and customers, provided these interests do not override your rights and freedoms.
Consent: where required by law, for example for optional communications or specific services. If we rely on consent, you may withdraw it at any time.

Important: we only rely on consent when no other lawful basis is more suitable. If processing is based on legitimate interests, we ensure that a balancing assessment has been carried out.

6. Data Sharing and Processors

We may share personal data with carefully selected third parties that help us operate our services. These third parties act as processors or, in some cases, independent controllers. We require appropriate contractual safeguards and only share data to the extent necessary.

Examples of processors may include:

Payment service providers for processing card or bank payments.
IT and cloud service providers that host systems, communications, or data storage tools.
Security service providers that support access control, alarm monitoring, or CCTV systems.
Accounting and administrative service providers that help manage invoices and bookkeeping.
Maintenance and facility support providers where access to personal data is required for service delivery.

We may also disclose personal data where necessary to lawyers, insurers, public authorities, or courts if required for legal claims, compliance, or the protection of rights and safety. Any transfer is carried out in a manner consistent with GDPR and applicable data protection standards.

7. International Transfers

If personal data is transferred outside the European Economic Area, we will take steps to ensure an adequate level of protection. This may include standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms permitted under GDPR. We do not transfer data internationally unless appropriate safeguards are in place.

8. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, and reporting obligations. Retention periods depend on the type of data and the reason for processing.

Contract and account data are generally retained for the duration of the customer relationship and for a reasonable period thereafter.
Billing and tax-related records are retained for the period required by law.
Security records, such as access logs or CCTV footage, are retained only as long as necessary for security, incident review, or legal purposes.
Communication records are retained for the time needed to handle enquiries, disputes, or ongoing service matters.

When data is no longer needed, we will delete, anonymise, or securely archive it in accordance with our retention procedures. Retention is never longer than necessary.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against accidental loss, unlawful access, misuse, alteration, or disclosure. These measures may include access restrictions, authentication controls, secure storage, staff confidentiality obligations, and regular review of security practices.

While no system can be guaranteed to be completely secure, we work to maintain a high standard of protection and to reduce risks to personal data. Any confirmed data breach will be handled in line with GDPR requirements, including notification where legally required.

10. Your Rights Under GDPR

As a data subject, you have the following rights, subject to legal limitations and exceptions:

Right of access: you may request confirmation of whether we process your data and receive a copy of it.
Right to rectification: you may request correction of inaccurate or incomplete data.
Right to erasure: you may request deletion of data in certain circumstances.
Right to restriction: you may request that we limit processing in certain situations.
Right to data portability: you may request data you have provided to us in a structured, commonly used format, where applicable.
Right to object: you may object to processing based on legitimate interests, including profiling where relevant.
Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time.

If you wish to exercise any of these rights, we may need to verify your identity before responding. We will respond within the time limits required by law. If we are unable to fulfil a request, we will explain the reason, unless we are legally prevented from doing so.

11. Automated Decision-Making

We do not generally use automated decision-making that produces legal or similarly significant effects for customers. If this changes in the future, we will provide appropriate information about the logic involved and your rights.

12. Children’s Data

Our services are intended for adults and business or personal storage customers. We do not knowingly collect personal data from children unless it is incidentally provided as part of a lawful customer relationship and only where necessary. If we become aware that we have collected data improperly, we will take steps to delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. The most current version will apply to all Selfstorage Hollandpark customers in the area. Significant changes will be communicated where appropriate. We encourage customers to review this policy periodically.

14. Complaints and Supervisory Authority

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the relevant data protection authority. You may also raise concerns with us directly so we can review and address the matter promptly. We take privacy concerns seriously and aim to resolve them fairly and transparently.

Summary of our approach: we collect only necessary personal data, process it on a lawful basis, retain it for limited periods, use trusted processors under contract, and respect your GDPR rights. This Privacy Policy applies to all Selfstorage Hollandpark customers in the area.