Privacy Policy - Kingston Storage

This Privacy Policy explains how Kingston Storage collects, uses, shares, stores, and protects personal data in connection with its services. It applies to all Kingston Storage customers in the area, including current, former, and prospective customers, as well as individuals who interact with us in relation to storage services, billing, account management, and facility operations. We are committed to handling personal data in a lawful, fair, transparent, and secure manner in accordance with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018 where applicable.

1. Information We Collect

We may collect and process a range of personal data depending on how you interact with Kingston Storage and the services you use. The types of data we collect include:

Identity information such as your name, date of birth, and identification details provided for account verification purposes.
Contact information including address, email address, and telephone number.
Account and contract information such as customer reference numbers, service agreements, rental terms, payment status, and communication preferences.
Payment information including billing details and transaction records. We do not ordinarily store full card details where these are processed by secure payment providers.
Facility and security information such as entry logs, CCTV footage, access records, and incident reports where required for security, safety, and fraud prevention.
Communication data including messages, complaints, queries, and any information you choose to provide when corresponding with us.
Technical information where applicable, such as device, browser, and usage information collected through digital systems used to manage services or secure accounts.

We generally collect personal data directly from you when you apply for services, enter into a storage agreement, make payments, contact us, or use our premises. We may also receive data from third parties such as payment processors, identity verification providers, insurers, debt recovery providers, or legal and regulatory bodies where permitted by law.

2. How We Use Personal Data

Kingston Storage uses personal data only where we have a valid reason to do so. We may use your information for the following purposes:

To set up and manage your storage account and provide storage services.
To verify identity, assess eligibility, and prevent misuse of services.
To process payments, issue invoices, and manage billing and account administration.
To communicate about service changes, notices, access arrangements, or security matters.
To maintain safety and security at our facilities, including monitoring access and investigating incidents.
To deal with enquiries, complaints, disputes, and claims.
To comply with legal and regulatory requirements, including accounting, tax, and record-keeping obligations.
To protect our business, customers, staff, and property against fraud, unauthorised access, and unlawful activity.

We will only use personal data in ways that are compatible with the purposes for which it was collected unless we reasonably believe that another lawful basis applies and such use is permitted by law.

3. Lawful Basis for Processing

Under data protection law, Kingston Storage must have a lawful basis for each processing activity. Depending on the context, we rely on one or more of the following:

Contract

We process personal data because it is necessary to enter into or perform a contract with you. This includes opening your account, providing storage services, managing payments, and administering your agreement.

Legal Obligation

We may process your data where it is required to comply with legal obligations, such as tax rules, financial record retention, health and safety obligations, anti-fraud measures, or lawful requests from authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests. This may include protecting our facilities, preventing fraud, managing operations, improving services, and resolving disputes. Where we rely on legitimate interests, we consider the impact on your privacy and apply safeguards where appropriate.

Consent

In limited situations, we may rely on your consent, for example where specific optional communications or certain types of marketing are involved. Where consent is used, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

4. Sharing and Processors

We do not sell your personal data. However, we may share personal data with trusted third parties who act as processors or independent controllers where necessary for our operations or where required by law.

Processors may include:

Payment service providers who handle transactions and payment verification.
IT and cloud service providers who support data storage, communications, and system maintenance.
Security providers who assist with CCTV, alarm monitoring, access control, and facility protection.
Professional advisers such as accountants, auditors, insurers, legal advisers, and consultants.
Debt recovery or credit control providers where outstanding balances need to be managed lawfully.
Regulators, law enforcement, courts, and public authorities where disclosure is required or permitted by law.

Where a third party acts as a processor, they are only permitted to process personal data on our instructions and must implement appropriate security measures. We seek to ensure that all processors are bound by contractual obligations to protect data and use it only for authorised purposes.

5. International Transfers

If personal data is transferred outside the United Kingdom or the European Economic Area, Kingston Storage will take appropriate steps to ensure that it remains protected to a standard consistent with applicable data protection law. This may include using approved transfer mechanisms and assessing whether additional safeguards are needed.

6. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, and reporting requirements. Retention periods are determined by the nature of the information and the reasons for processing it.

Typical retention considerations include:

Contract and account records are retained for the duration of the customer relationship and for a reasonable period afterwards to handle claims, disputes, and administration.
Financial records are generally retained for periods required under tax and accounting laws.
Security records such as CCTV footage or access logs are kept only as long as necessary for security, incident investigation, and legal compliance.
Complaints and correspondence are retained for as long as needed to address the matter and maintain accurate records.

When personal data is no longer needed, we will securely delete it, destroy it, or anonymise it so that it can no longer identify you.

7. Security Measures

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. These measures may include access controls, secure storage, staff confidentiality obligations, monitoring systems, and regular review of data handling practices. No system can be guaranteed to be completely secure, but we work to maintain strong protections and reduce risks to an acceptable level.

8. Your Rights

Subject to applicable law, you may have several rights regarding your personal data. These include:

Right of access – to request confirmation of whether we process your data and to receive a copy of it.
Right to rectification – to ask us to correct inaccurate or incomplete information.
Right to erasure – to request deletion of your data in certain circumstances.
Right to restriction – to ask us to limit processing in some cases.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to data portability – to receive certain information in a structured, commonly used, machine-readable format where applicable.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

You also have the right to raise a concern with the relevant data protection authority if you believe your rights have been infringed. We encourage you to contact us first so that we can address any issues promptly and fairly.

9. Children’s Data

Kingston Storage services are intended for adults and business users. We do not knowingly collect personal data directly from children. If we become aware that we have collected such data without appropriate legal basis, we will take steps to delete it or otherwise process it in accordance with the law.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, business practices, or operational needs. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to stay informed about how personal data is handled.

11. Summary of Our Commitment

Kingston Storage is committed to respecting privacy and handling personal data responsibly. We collect only what we need, use it for clear and lawful purposes, keep it only for as long as necessary, and protect it through appropriate safeguards. We also aim to be transparent about our use of processors and to support your rights under data protection law.

This Privacy Policy applies to all Kingston Storage customers in the area.